Series comparison

-[Qemu-devel] [PULL 00/39] target-arm queue
+[Qemu-devel] [PULL 00/29] target-arm queue
-Second pull request of the week; mostly RTH's support for some
+First arm pullreq of 4.2...
 new-in-v8.1/v8.3 instructions, and my v8M board model.
 thanks
 -- PMM
-The following changes since commit 427cbc7e4136a061628cb4315cc8182ea36d772f:
+The following changes since commit 27608c7c66bd923eb5e5faab80e795408cbe2b51:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2018-03-01 18:46:41 +0000)
+  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190814a' into staging (2019-08-16 12:00:18 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180302
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190816
-for you to fetch changes up to e66a67bf28e1b4fce2e3d72a2610dbd48d9d3078:
+for you to fetch changes up to 664b7e3b97d6376f3329986c465b3782458b0f8b:
-  target/arm: Enable ARM_FEATURE_V8_FCMA (2018-03-02 11:03:45 +0000)
+  target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word (2019-08-16 14:02:53 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * implement FCMA and RDM v8.1 and v8.3 instructions
+ * target/arm: generate a custom MIDR for -cpu max
- * enable Cortex-M33 v8M core, and provide new mps2-an505 board model
+ * hw/misc/zynq_slcr: refactor to use standard register definition
-   that uses it
+ * Set ENET_BD_BDU in I.MX FEC controller
- * decodetree: Propagate return value from translate subroutines
+ * target/arm: Fix routing of singlestep exceptions
- * xlnx-zynqmp: Implement the RTC device
+ * refactor a32/t32 decoder handling of PC
  * minor optimisations/cleanups of some a32/t32 codegen
  * target/arm/cpu64: Ensure kvm really supports aarch64=off
  * target/arm/cpu: Ensure we can use the pmu with kvm
  * target/arm: Minor cleanups preparatory to KVM SVE support
 ----------------------------------------------------------------
-Alistair Francis (3):
+Aaron Hill (1):
-      xlnx-zynqmp-rtc: Initial commit
+      Set ENET_BD_BDU in I.MX FEC controller
       xlnx-zynqmp-rtc: Add basic time support
       xlnx-zynqmp: Connect the RTC device
-Peter Maydell (19):
+Alex Bennée (1):
-      loader: Add new load_ramdisk_as()
+      target/arm: generate a custom MIDR for -cpu max
       hw/arm/boot: Honour CPU's address space for image loads
       hw/arm/armv7m: Honour CPU's address space for image loads
       target/arm: Define an IDAU interface
       armv7m: Forward idau property to CPU object
       target/arm: Define init-svtor property for the reset secure VTOR value
       armv7m: Forward init-svtor property to CPU object
       target/arm: Add Cortex-M33
       hw/misc/unimp: Move struct to header file
       include/hw/or-irq.h: Add missing include guard
       qdev: Add new qdev_init_gpio_in_named_with_opaque()
       hw/core/split-irq: Device that splits IRQ lines
       hw/misc/mps2-fpgaio: FPGA control block for MPS2 AN505
       hw/misc/tz-ppc: Model TrustZone peripheral protection controller
       hw/misc/iotkit-secctl: Arm IoT Kit security controller initial skeleton
       hw/misc/iotkit-secctl: Add handling for PPCs
       hw/misc/iotkit-secctl: Add remaining simple registers
       hw/arm/iotkit: Model Arm IOT Kit
       mps2-an505: New board model: MPS2 with AN505 Cortex-M33 FPGA image
-Richard Henderson (17):
+Andrew Jones (6):
-      decodetree: Propagate return value from translate subroutines
+      target/arm/cpu64: Ensure kvm really supports aarch64=off
-      target/arm: Add ARM_FEATURE_V8_RDM
+      target/arm/cpu: Ensure we can use the pmu with kvm
-      target/arm: Refactor disas_simd_indexed decode
+      target/arm/helper: zcr: Add build bug next to value range assumption
-      target/arm: Refactor disas_simd_indexed size checks
+      target/arm/cpu: Use div-round-up to determine predicate register array size
-      target/arm: Decode aa64 armv8.1 scalar three same extra
+      target/arm/kvm64: Fix error returns
-      target/arm: Decode aa64 armv8.1 three same extra
+      target/arm/kvm64: Move the get/put of fpsimd registers out
       target/arm: Decode aa64 armv8.1 scalar/vector x indexed element
       target/arm: Decode aa32 armv8.1 three same
       target/arm: Decode aa32 armv8.1 two reg and a scalar
       target/arm: Enable ARM_FEATURE_V8_RDM
       target/arm: Add ARM_FEATURE_V8_FCMA
       target/arm: Decode aa64 armv8.3 fcadd
       target/arm: Decode aa64 armv8.3 fcmla
       target/arm: Decode aa32 armv8.3 3-same
       target/arm: Decode aa32 armv8.3 2-reg-index
       target/arm: Decode t32 simd 3reg and 2reg_scalar extension
       target/arm: Enable ARM_FEATURE_V8_FCMA
- hw/arm/Makefile.objs               |   2 +
+Damien Hedde (1):
- hw/core/Makefile.objs              |   1 +
+      hw/misc/zynq_slcr: use standard register definition
  hw/misc/Makefile.objs              |   4 +
  hw/timer/Makefile.objs             |   1 +
  target/arm/Makefile.objs           |   2 +-
  include/hw/arm/armv7m.h            |   5 +
  include/hw/arm/iotkit.h            | 109 ++++++
  include/hw/arm/xlnx-zynqmp.h       |   2 +
  include/hw/core/split-irq.h        |  57 +++
  include/hw/irq.h                   |   4 +-
  include/hw/loader.h                |  12 +-
  include/hw/misc/iotkit-secctl.h    | 103 ++++++
  include/hw/misc/mps2-fpgaio.h      |  43 +++
  include/hw/misc/tz-ppc.h           | 101 ++++++
  include/hw/misc/unimp.h            |  10 +
  include/hw/or-irq.h                |   5 +
  include/hw/qdev-core.h             |  30 +-
  include/hw/timer/xlnx-zynqmp-rtc.h |  86 +++++
  target/arm/cpu.h                   |   8 +
  target/arm/helper.h                |  31 ++
  target/arm/idau.h                  |  61 ++++
  hw/arm/armv7m.c                    |  35 +-
  hw/arm/boot.c                      | 119 ++++---
  hw/arm/iotkit.c                    | 598 +++++++++++++++++++++++++++++++
  hw/arm/mps2-tz.c                   | 503 ++++++++++++++++++++++++++
  hw/arm/xlnx-zynqmp.c               |  14 +
  hw/core/loader.c                   |   8 +-
  hw/core/qdev.c                     |   8 +-
  hw/core/split-irq.c                |  89 +++++
  hw/misc/iotkit-secctl.c            | 704 +++++++++++++++++++++++++++++++++++++
  hw/misc/mps2-fpgaio.c              | 176 ++++++++++
  hw/misc/tz-ppc.c                   | 302 ++++++++++++++++
  hw/misc/unimp.c                    |  10 -
  hw/timer/xlnx-zynqmp-rtc.c         | 272 ++++++++++++++
  linux-user/elfload.c               |   2 +
  target/arm/cpu.c                   |  66 +++-
  target/arm/cpu64.c                 |   2 +
  target/arm/helper.c                |  28 +-
  target/arm/translate-a64.c         | 514 +++++++++++++++++++++------
  target/arm/translate.c             | 275 +++++++++++++--
  target/arm/vec_helper.c            | 429 ++++++++++++++++++++++
  default-configs/arm-softmmu.mak    |   5 +
  hw/misc/trace-events               |  24 ++
  hw/timer/trace-events              |   3 +
  scripts/decodetree.py              |   5 +-
 files changed, 4668 insertions(+), 200 deletions(-)
  create mode 100644 include/hw/arm/iotkit.h
  create mode 100644 include/hw/core/split-irq.h
  create mode 100644 include/hw/misc/iotkit-secctl.h
  create mode 100644 include/hw/misc/mps2-fpgaio.h
  create mode 100644 include/hw/misc/tz-ppc.h
  create mode 100644 include/hw/timer/xlnx-zynqmp-rtc.h
  create mode 100644 target/arm/idau.h
  create mode 100644 hw/arm/iotkit.c
  create mode 100644 hw/arm/mps2-tz.c
  create mode 100644 hw/core/split-irq.c
  create mode 100644 hw/misc/iotkit-secctl.c
  create mode 100644 hw/misc/mps2-fpgaio.c
  create mode 100644 hw/misc/tz-ppc.c
  create mode 100644 hw/timer/xlnx-zynqmp-rtc.c
  create mode 100644 target/arm/vec_helper.c
+Peter Maydell (2):
+      target/arm: Factor out 'generate singlestep exception' function
+      target/arm: Fix routing of singlestep exceptions
+Richard Henderson (18):
+      target/arm: Pass in pc to thumb_insn_is_16bit
+      target/arm: Introduce pc_curr
+      target/arm: Introduce read_pc
+      target/arm: Introduce add_reg_for_lit
+      target/arm: Remove redundant s->pc & ~1
+      target/arm: Replace s->pc with s->base.pc_next
+      target/arm: Replace offset with pc in gen_exception_insn
+      target/arm: Replace offset with pc in gen_exception_internal_insn
+      target/arm: Remove offset argument to gen_exception_bkpt_insn
+      target/arm: Use unallocated_encoding for aarch32
+      target/arm: Remove helper_double_saturate
+      target/arm: Use tcg_gen_extract_i32 for shifter_out_im
+      target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB
+      target/arm: Remove redundant shift tests
+      target/arm: Use ror32 instead of open-coding the operation
+      target/arm: Use tcg_gen_rotri_i32 for gen_swap_half
+      target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR
+      target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word
+ target/arm/cpu.h               |  13 +-
+ target/arm/helper.h            |   1 -
+ target/arm/kvm_arm.h           |  28 ++
+ target/arm/translate-a64.h     |   4 +-
+ target/arm/translate.h         |  39 ++-
+ hw/misc/zynq_slcr.c            | 450 ++++++++++++++++----------------
+ hw/net/imx_fec.c               |   4 +
+ target/arm/cpu.c               |  30 ++-
+ target/arm/cpu64.c             |  31 ++-
+ target/arm/helper.c            |   7 +
+ target/arm/kvm.c               |   7 +
+ target/arm/kvm64.c             | 161 +++++++-----
+ target/arm/op_helper.c         |  15 --
+ target/arm/translate-a64.c     | 130 ++++------
+ target/arm/translate-vfp.inc.c |  45 +---
+ target/arm/translate.c         | 572 +++++++++++++++++------------------------
+files changed, 771 insertions(+), 766 deletions(-)

-[Qemu-devel] [PULL 33/39] target/arm: Add ARM_FEATURE_V8_FCMA
+[Qemu-devel] [PULL 01/29] target/arm: generate a custom MIDR for -cpu max
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-Not enabled anywhere yet.
+While most features are now detected by probing the ID_* registers
 kernels can (and do) use MIDR_EL1 for working out of they have to
 apply errata. This can trip up warnings in the kernel as it tries to
 work out if it should apply workarounds to features that don't
 actually exist in the reported CPU type.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Avoid this problem by synthesising our own MIDR value.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-11-richard.henderson@linaro.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190726113950.7499-1-alex.bennee@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h     | 1 +
+ target/arm/cpu.h   |  6 ++++++
- linux-user/elfload.c | 1 +
+ target/arm/cpu64.c | 19 +++++++++++++++++++
-files changed, 2 insertions(+)
+files changed, 25 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@ FIELD(V7M_FPCCR, ASPEN, 31, 1)
-     ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
+ /*
-     ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
+  * System register ID fields.
-     ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
+  */
-+    ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions.  */
++FIELD(MIDR_EL1, REVISION, 0, 4)
- };
++FIELD(MIDR_EL1, PARTNUM, 4, 12)
++FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
- static inline int arm_feature(CPUARMState *env, int feature)
++FIELD(MIDR_EL1, VARIANT, 20, 4)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
++FIELD(MIDR_EL1, IMPLEMENTER, 24, 8)
 +
  FIELD(ID_ISAR0, SWAP, 0, 4)
  FIELD(ID_ISAR0, BITCOUNT, 4, 4)
  FIELD(ID_ISAR0, BITFIELD, 8, 4)
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
+--- a/target/arm/cpu64.c
-+++ b/linux-user/elfload.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     GET_FEATURE(ARM_FEATURE_V8_FP16,
+         uint32_t u;
-                 ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+         aarch64_a57_initfn(obj);
-     GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
-+    GET_FEATURE(ARM_FEATURE_V8_FCMA, ARM_HWCAP_A64_FCMA);
++        /*
- #undef GET_FEATURE
++         * Reset MIDR so the guest doesn't mistake our 'max' CPU type for a real
++         * one and try to apply errata workarounds or use impdef features we
-     return hwcaps;
++         * don't provide.
 +         * An IMPLEMENTER field of 0 means "reserved for software use";
 +         * ARCHITECTURE must be 0xf indicating "v7 or later, check ID registers
 +         * to see which features are present";
 +         * the VARIANT, PARTNUM and REVISION fields are all implementation
 +         * defined and we choose to define PARTNUM just in case guest
 +         * code needs to distinguish this QEMU CPU from other software
 +         * implementations, though this shouldn't be needed.
 +         */
 +        t = FIELD_DP64(0, MIDR_EL1, IMPLEMENTER, 0);
 +        t = FIELD_DP64(t, MIDR_EL1, ARCHITECTURE, 0xf);
 +        t = FIELD_DP64(t, MIDR_EL1, PARTNUM, 'Q');
 +        t = FIELD_DP64(t, MIDR_EL1, VARIANT, 0);
 +        t = FIELD_DP64(t, MIDR_EL1, REVISION, 0);
 +        cpu->midr = t;
 +
          t = cpu->isar.id_aa64isar0;
          t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */
          t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 03/39] xlnx-zynqmp: Connect the RTC device
+[Qemu-devel] [PULL 02/29] hw/misc/zynq_slcr: use standard register definition
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Damien Hedde <damien.hedde@greensocs.com>
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Replace the zynq_slcr registers enum and macros using the
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+hw/registerfields.h macros.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20190729145654.14644-30-damien.hedde@greensocs.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-zynqmp.h |  2 ++
+ hw/misc/zynq_slcr.c | 450 ++++++++++++++++++++++----------------------
- hw/arm/xlnx-zynqmp.c         | 14 ++++++++++++++
+file changed, 225 insertions(+), 225 deletions(-)
 files changed, 16 insertions(+)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
+--- a/hw/misc/zynq_slcr.c
-+++ b/include/hw/arm/xlnx-zynqmp.h
++++ b/hw/misc/zynq_slcr.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/dma/xlnx_dpdma.h"
+ #include "sysemu/sysemu.h"
- #include "hw/display/xlnx_dp.h"
+ #include "qemu/log.h"
- #include "hw/intc/xlnx-zynqmp-ipi.h"
+ #include "qemu/module.h"
-+#include "hw/timer/xlnx-zynqmp-rtc.h"
++#include "hw/registerfields.h"
- #define TYPE_XLNX_ZYNQMP "xlnx,zynqmp"
+ #ifndef ZYNQ_SLCR_ERR_DEBUG
- #define XLNX_ZYNQMP(obj) OBJECT_CHECK(XlnxZynqMPState, (obj), \
+ #define ZYNQ_SLCR_ERR_DEBUG 0
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
      XlnxDPState dp;
      XlnxDPDMAState dpdma;
      XlnxZynqMPIPI ipi;
 +    XlnxZynqMPRTC rtc;
      char *boot_cpu;
      ARMCPU *boot_cpu_ptr;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
 @@ -XXX,XX +XXX,XX @@
- #define IPI_ADDR            0xFF300000
+ #define XILINX_LOCK_KEY 0x767b
- #define IPI_IRQ             64
+ #define XILINX_UNLOCK_KEY 0xdf0d
-+#define RTC_ADDR            0xffa60000
+-#define R_PSS_RST_CTRL_SOFT_RST 0x1
-+#define RTC_IRQ             26
++REG32(SCL, 0x000)
-+
++REG32(LOCK, 0x004)
- #define SDHCI_CAPABILITIES  0x280737ec6481 /* Datasheet: UG1085 (v1.7) */
++REG32(UNLOCK, 0x008)
++REG32(LOCKSTA, 0x00c)
- static const uint64_t gem_addr[XLNX_ZYNQMP_NUM_GEMS] = {
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
+-enum {
+-    SCL             = 0x000 / 4,
-     object_initialize(&s->ipi, sizeof(s->ipi), TYPE_XLNX_ZYNQMP_IPI);
+-    LOCK,
-     qdev_set_parent_bus(DEVICE(&s->ipi), sysbus_get_default());
+-    UNLOCK,
-+
+-    LOCKSTA,
-+    object_initialize(&s->rtc, sizeof(s->rtc), TYPE_XLNX_ZYNQMP_RTC);
++REG32(ARM_PLL_CTRL, 0x100)
-+    qdev_set_parent_bus(DEVICE(&s->rtc), sysbus_get_default());
++REG32(DDR_PLL_CTRL, 0x104)
 +REG32(IO_PLL_CTRL, 0x108)
 +REG32(PLL_STATUS, 0x10c)
 +REG32(ARM_PLL_CFG, 0x110)
 +REG32(DDR_PLL_CFG, 0x114)
 +REG32(IO_PLL_CFG, 0x118)
 -    ARM_PLL_CTRL    = 0x100 / 4,
 -    DDR_PLL_CTRL,
 -    IO_PLL_CTRL,
 -    PLL_STATUS,
 -    ARM_PLL_CFG,
 -    DDR_PLL_CFG,
 -    IO_PLL_CFG,
 -
 -    ARM_CLK_CTRL    = 0x120 / 4,
 -    DDR_CLK_CTRL,
 -    DCI_CLK_CTRL,
 -    APER_CLK_CTRL,
 -    USB0_CLK_CTRL,
 -    USB1_CLK_CTRL,
 -    GEM0_RCLK_CTRL,
 -    GEM1_RCLK_CTRL,
 -    GEM0_CLK_CTRL,
 -    GEM1_CLK_CTRL,
 -    SMC_CLK_CTRL,
 -    LQSPI_CLK_CTRL,
 -    SDIO_CLK_CTRL,
 -    UART_CLK_CTRL,
 -    SPI_CLK_CTRL,
 -    CAN_CLK_CTRL,
 -    CAN_MIOCLK_CTRL,
 -    DBG_CLK_CTRL,
 -    PCAP_CLK_CTRL,
 -    TOPSW_CLK_CTRL,
 +REG32(ARM_CLK_CTRL, 0x120)
 +REG32(DDR_CLK_CTRL, 0x124)
 +REG32(DCI_CLK_CTRL, 0x128)
 +REG32(APER_CLK_CTRL, 0x12c)
 +REG32(USB0_CLK_CTRL, 0x130)
 +REG32(USB1_CLK_CTRL, 0x134)
 +REG32(GEM0_RCLK_CTRL, 0x138)
 +REG32(GEM1_RCLK_CTRL, 0x13c)
 +REG32(GEM0_CLK_CTRL, 0x140)
 +REG32(GEM1_CLK_CTRL, 0x144)
 +REG32(SMC_CLK_CTRL, 0x148)
 +REG32(LQSPI_CLK_CTRL, 0x14c)
 +REG32(SDIO_CLK_CTRL, 0x150)
 +REG32(UART_CLK_CTRL, 0x154)
 +REG32(SPI_CLK_CTRL, 0x158)
 +REG32(CAN_CLK_CTRL, 0x15c)
 +REG32(CAN_MIOCLK_CTRL, 0x160)
 +REG32(DBG_CLK_CTRL, 0x164)
 +REG32(PCAP_CLK_CTRL, 0x168)
 +REG32(TOPSW_CLK_CTRL, 0x16c)
  #define FPGA_CTRL_REGS(n, start) \
 -    FPGA ## n ## _CLK_CTRL = (start) / 4, \
 -    FPGA ## n ## _THR_CTRL, \
 -    FPGA ## n ## _THR_CNT, \
 -    FPGA ## n ## _THR_STA,
 -    FPGA_CTRL_REGS(0, 0x170)
 -    FPGA_CTRL_REGS(1, 0x180)
 -    FPGA_CTRL_REGS(2, 0x190)
 -    FPGA_CTRL_REGS(3, 0x1a0)
 +    REG32(FPGA ## n ## _CLK_CTRL, (start)) \
 +    REG32(FPGA ## n ## _THR_CTRL, (start) + 0x4)\
 +    REG32(FPGA ## n ## _THR_CNT,  (start) + 0x8)\
 +    REG32(FPGA ## n ## _THR_STA,  (start) + 0xc)
 +FPGA_CTRL_REGS(0, 0x170)
 +FPGA_CTRL_REGS(1, 0x180)
 +FPGA_CTRL_REGS(2, 0x190)
 +FPGA_CTRL_REGS(3, 0x1a0)
 -    BANDGAP_TRIP    = 0x1b8 / 4,
 -    PLL_PREDIVISOR  = 0x1c0 / 4,
 -    CLK_621_TRUE,
 +REG32(BANDGAP_TRIP, 0x1b8)
 +REG32(PLL_PREDIVISOR, 0x1c0)
 +REG32(CLK_621_TRUE, 0x1c4)
 -    PSS_RST_CTRL    = 0x200 / 4,
 -    DDR_RST_CTRL,
 -    TOPSW_RESET_CTRL,
 -    DMAC_RST_CTRL,
 -    USB_RST_CTRL,
 -    GEM_RST_CTRL,
 -    SDIO_RST_CTRL,
 -    SPI_RST_CTRL,
 -    CAN_RST_CTRL,
 -    I2C_RST_CTRL,
 -    UART_RST_CTRL,
 -    GPIO_RST_CTRL,
 -    LQSPI_RST_CTRL,
 -    SMC_RST_CTRL,
 -    OCM_RST_CTRL,
 -    FPGA_RST_CTRL   = 0x240 / 4,
 -    A9_CPU_RST_CTRL,
 +REG32(PSS_RST_CTRL, 0x200)
 +    FIELD(PSS_RST_CTRL, SOFT_RST, 0, 1)
 +REG32(DDR_RST_CTRL, 0x204)
 +REG32(TOPSW_RESET_CTRL, 0x208)
 +REG32(DMAC_RST_CTRL, 0x20c)
 +REG32(USB_RST_CTRL, 0x210)
 +REG32(GEM_RST_CTRL, 0x214)
 +REG32(SDIO_RST_CTRL, 0x218)
 +REG32(SPI_RST_CTRL, 0x21c)
 +REG32(CAN_RST_CTRL, 0x220)
 +REG32(I2C_RST_CTRL, 0x224)
 +REG32(UART_RST_CTRL, 0x228)
 +REG32(GPIO_RST_CTRL, 0x22c)
 +REG32(LQSPI_RST_CTRL, 0x230)
 +REG32(SMC_RST_CTRL, 0x234)
 +REG32(OCM_RST_CTRL, 0x238)
 +REG32(FPGA_RST_CTRL, 0x240)
 +REG32(A9_CPU_RST_CTRL, 0x244)
 -    RS_AWDT_CTRL    = 0x24c / 4,
 -    RST_REASON,
 +REG32(RS_AWDT_CTRL, 0x24c)
 +REG32(RST_REASON, 0x250)
 -    REBOOT_STATUS   = 0x258 / 4,
 -    BOOT_MODE,
 +REG32(REBOOT_STATUS, 0x258)
 +REG32(BOOT_MODE, 0x25c)
 -    APU_CTRL        = 0x300 / 4,
 -    WDT_CLK_SEL,
 +REG32(APU_CTRL, 0x300)
 +REG32(WDT_CLK_SEL, 0x304)
 -    TZ_DMA_NS       = 0x440 / 4,
 -    TZ_DMA_IRQ_NS,
 -    TZ_DMA_PERIPH_NS,
 +REG32(TZ_DMA_NS, 0x440)
 +REG32(TZ_DMA_IRQ_NS, 0x444)
 +REG32(TZ_DMA_PERIPH_NS, 0x448)
 -    PSS_IDCODE      = 0x530 / 4,
 +REG32(PSS_IDCODE, 0x530)
 -    DDR_URGENT      = 0x600 / 4,
 -    DDR_CAL_START   = 0x60c / 4,
 -    DDR_REF_START   = 0x614 / 4,
 -    DDR_CMD_STA,
 -    DDR_URGENT_SEL,
 -    DDR_DFI_STATUS,
 +REG32(DDR_URGENT, 0x600)
 +REG32(DDR_CAL_START, 0x60c)
 +REG32(DDR_REF_START, 0x614)
 +REG32(DDR_CMD_STA, 0x618)
 +REG32(DDR_URGENT_SEL, 0x61c)
 +REG32(DDR_DFI_STATUS, 0x620)
 -    MIO             = 0x700 / 4,
 +REG32(MIO, 0x700)
  #define MIO_LENGTH 54
 -    MIO_LOOPBACK    = 0x804 / 4,
 -    MIO_MST_TRI0,
 -    MIO_MST_TRI1,
 +REG32(MIO_LOOPBACK, 0x804)
 +REG32(MIO_MST_TRI0, 0x808)
 +REG32(MIO_MST_TRI1, 0x80c)
 -    SD0_WP_CD_SEL   = 0x830 / 4,
 -    SD1_WP_CD_SEL,
 +REG32(SD0_WP_CD_SEL, 0x830)
 +REG32(SD1_WP_CD_SEL, 0x834)
 -    LVL_SHFTR_EN    = 0x900 / 4,
 -    OCM_CFG         = 0x910 / 4,
 +REG32(LVL_SHFTR_EN, 0x900)
 +REG32(OCM_CFG, 0x910)
 -    CPU_RAM         = 0xa00 / 4,
 +REG32(CPU_RAM, 0xa00)
 -    IOU             = 0xa30 / 4,
 +REG32(IOU, 0xa30)
 -    DMAC_RAM        = 0xa50 / 4,
 +REG32(DMAC_RAM, 0xa50)
 -    AFI0            = 0xa60 / 4,
 -    AFI1 = AFI0 + 3,
 -    AFI2 = AFI1 + 3,
 -    AFI3 = AFI2 + 3,
 +REG32(AFI0, 0xa60)
 +REG32(AFI1, 0xa6c)
 +REG32(AFI2, 0xa78)
 +REG32(AFI3, 0xa84)
  #define AFI_LENGTH 3
 -    OCM             = 0xa90 / 4,
 +REG32(OCM, 0xa90)
 -    DEVCI_RAM       = 0xaa0 / 4,
 +REG32(DEVCI_RAM, 0xaa0)
 -    CSG_RAM         = 0xab0 / 4,
 +REG32(CSG_RAM, 0xab0)
 -    GPIOB_CTRL      = 0xb00 / 4,
 -    GPIOB_CFG_CMOS18,
 -    GPIOB_CFG_CMOS25,
 -    GPIOB_CFG_CMOS33,
 -    GPIOB_CFG_HSTL  = 0xb14 / 4,
 -    GPIOB_DRVR_BIAS_CTRL,
 +REG32(GPIOB_CTRL, 0xb00)
 +REG32(GPIOB_CFG_CMOS18, 0xb04)
 +REG32(GPIOB_CFG_CMOS25, 0xb08)
 +REG32(GPIOB_CFG_CMOS33, 0xb0c)
 +REG32(GPIOB_CFG_HSTL, 0xb14)
 +REG32(GPIOB_DRVR_BIAS_CTRL, 0xb18)
 -    DDRIOB          = 0xb40 / 4,
 +REG32(DDRIOB, 0xb40)
  #define DDRIOB_LENGTH 14
 -};
  #define ZYNQ_SLCR_MMIO_SIZE     0x1000
  #define ZYNQ_SLCR_NUM_REGS      (ZYNQ_SLCR_MMIO_SIZE / 4)
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset(DeviceState *d)
      DB_PRINT("RESET\n");
 -    s->regs[LOCKSTA] = 1;
 +    s->regs[R_LOCKSTA] = 1;
      /* 0x100 - 0x11C */
 -    s->regs[ARM_PLL_CTRL]   = 0x0001A008;
 -    s->regs[DDR_PLL_CTRL]   = 0x0001A008;
 -    s->regs[IO_PLL_CTRL]    = 0x0001A008;
 -    s->regs[PLL_STATUS]     = 0x0000003F;
 -    s->regs[ARM_PLL_CFG]    = 0x00014000;
 -    s->regs[DDR_PLL_CFG]    = 0x00014000;
 -    s->regs[IO_PLL_CFG]     = 0x00014000;
 +    s->regs[R_ARM_PLL_CTRL]   = 0x0001A008;
 +    s->regs[R_DDR_PLL_CTRL]   = 0x0001A008;
 +    s->regs[R_IO_PLL_CTRL]    = 0x0001A008;
 +    s->regs[R_PLL_STATUS]     = 0x0000003F;
 +    s->regs[R_ARM_PLL_CFG]    = 0x00014000;
 +    s->regs[R_DDR_PLL_CFG]    = 0x00014000;
 +    s->regs[R_IO_PLL_CFG]     = 0x00014000;
      /* 0x120 - 0x16C */
 -    s->regs[ARM_CLK_CTRL]   = 0x1F000400;
 -    s->regs[DDR_CLK_CTRL]   = 0x18400003;
 -    s->regs[DCI_CLK_CTRL]   = 0x01E03201;
 -    s->regs[APER_CLK_CTRL]  = 0x01FFCCCD;
 -    s->regs[USB0_CLK_CTRL]  = s->regs[USB1_CLK_CTRL]    = 0x00101941;
 -    s->regs[GEM0_RCLK_CTRL] = s->regs[GEM1_RCLK_CTRL]   = 0x00000001;
 -    s->regs[GEM0_CLK_CTRL]  = s->regs[GEM1_CLK_CTRL]    = 0x00003C01;
 -    s->regs[SMC_CLK_CTRL]   = 0x00003C01;
 -    s->regs[LQSPI_CLK_CTRL] = 0x00002821;
 -    s->regs[SDIO_CLK_CTRL]  = 0x00001E03;
 -    s->regs[UART_CLK_CTRL]  = 0x00003F03;
 -    s->regs[SPI_CLK_CTRL]   = 0x00003F03;
 -    s->regs[CAN_CLK_CTRL]   = 0x00501903;
 -    s->regs[DBG_CLK_CTRL]   = 0x00000F03;
 -    s->regs[PCAP_CLK_CTRL]  = 0x00000F01;
 +    s->regs[R_ARM_CLK_CTRL]   = 0x1F000400;
 +    s->regs[R_DDR_CLK_CTRL]   = 0x18400003;
 +    s->regs[R_DCI_CLK_CTRL]   = 0x01E03201;
 +    s->regs[R_APER_CLK_CTRL]  = 0x01FFCCCD;
 +    s->regs[R_USB0_CLK_CTRL]  = s->regs[R_USB1_CLK_CTRL]  = 0x00101941;
 +    s->regs[R_GEM0_RCLK_CTRL] = s->regs[R_GEM1_RCLK_CTRL] = 0x00000001;
 +    s->regs[R_GEM0_CLK_CTRL]  = s->regs[R_GEM1_CLK_CTRL]  = 0x00003C01;
 +    s->regs[R_SMC_CLK_CTRL]   = 0x00003C01;
 +    s->regs[R_LQSPI_CLK_CTRL] = 0x00002821;
 +    s->regs[R_SDIO_CLK_CTRL]  = 0x00001E03;
 +    s->regs[R_UART_CLK_CTRL]  = 0x00003F03;
 +    s->regs[R_SPI_CLK_CTRL]   = 0x00003F03;
 +    s->regs[R_CAN_CLK_CTRL]   = 0x00501903;
 +    s->regs[R_DBG_CLK_CTRL]   = 0x00000F03;
 +    s->regs[R_PCAP_CLK_CTRL]  = 0x00000F01;
      /* 0x170 - 0x1AC */
 -    s->regs[FPGA0_CLK_CTRL] = s->regs[FPGA1_CLK_CTRL] = s->regs[FPGA2_CLK_CTRL]
 -                            = s->regs[FPGA3_CLK_CTRL] = 0x00101800;
 -    s->regs[FPGA0_THR_STA] = s->regs[FPGA1_THR_STA] = s->regs[FPGA2_THR_STA]
 -                           = s->regs[FPGA3_THR_STA] = 0x00010000;
 +    s->regs[R_FPGA0_CLK_CTRL] = s->regs[R_FPGA1_CLK_CTRL]
 +                              = s->regs[R_FPGA2_CLK_CTRL]
 +                              = s->regs[R_FPGA3_CLK_CTRL] = 0x00101800;
 +    s->regs[R_FPGA0_THR_STA] = s->regs[R_FPGA1_THR_STA]
 +                             = s->regs[R_FPGA2_THR_STA]
 +                             = s->regs[R_FPGA3_THR_STA] = 0x00010000;
      /* 0x1B0 - 0x1D8 */
 -    s->regs[BANDGAP_TRIP]   = 0x0000001F;
 -    s->regs[PLL_PREDIVISOR] = 0x00000001;
 -    s->regs[CLK_621_TRUE]   = 0x00000001;
 +    s->regs[R_BANDGAP_TRIP]   = 0x0000001F;
 +    s->regs[R_PLL_PREDIVISOR] = 0x00000001;
 +    s->regs[R_CLK_621_TRUE]   = 0x00000001;
      /* 0x200 - 0x25C */
 -    s->regs[FPGA_RST_CTRL]  = 0x01F33F0F;
 -    s->regs[RST_REASON]     = 0x00000040;
 +    s->regs[R_FPGA_RST_CTRL]  = 0x01F33F0F;
 +    s->regs[R_RST_REASON]     = 0x00000040;
 -    s->regs[BOOT_MODE]      = 0x00000001;
 +    s->regs[R_BOOT_MODE]      = 0x00000001;
      /* 0x700 - 0x7D4 */
      for (i = 0; i < 54; i++) {
 -        s->regs[MIO + i] = 0x00001601;
 +        s->regs[R_MIO + i] = 0x00001601;
      }
      for (i = 2; i <= 8; i++) {
 -        s->regs[MIO + i] = 0x00000601;
 +        s->regs[R_MIO + i] = 0x00000601;
      }
 -    s->regs[MIO_MST_TRI0] = s->regs[MIO_MST_TRI1] = 0xFFFFFFFF;
 +    s->regs[R_MIO_MST_TRI0] = s->regs[R_MIO_MST_TRI1] = 0xFFFFFFFF;
 -    s->regs[CPU_RAM + 0] = s->regs[CPU_RAM + 1] = s->regs[CPU_RAM + 3]
 -                         = s->regs[CPU_RAM + 4] = s->regs[CPU_RAM + 7]
 -                         = 0x00010101;
 -    s->regs[CPU_RAM + 2] = s->regs[CPU_RAM + 5] = 0x01010101;
 -    s->regs[CPU_RAM + 6] = 0x00000001;
 +    s->regs[R_CPU_RAM + 0] = s->regs[R_CPU_RAM + 1] = s->regs[R_CPU_RAM + 3]
 +                           = s->regs[R_CPU_RAM + 4] = s->regs[R_CPU_RAM + 7]
 +                           = 0x00010101;
 +    s->regs[R_CPU_RAM + 2] = s->regs[R_CPU_RAM + 5] = 0x01010101;
 +    s->regs[R_CPU_RAM + 6] = 0x00000001;
 -    s->regs[IOU + 0] = s->regs[IOU + 1] = s->regs[IOU + 2] = s->regs[IOU + 3]
 -                     = 0x09090909;
 -    s->regs[IOU + 4] = s->regs[IOU + 5] = 0x00090909;
 -    s->regs[IOU + 6] = 0x00000909;
 +    s->regs[R_IOU + 0] = s->regs[R_IOU + 1] = s->regs[R_IOU + 2]
 +                       = s->regs[R_IOU + 3] = 0x09090909;
 +    s->regs[R_IOU + 4] = s->regs[R_IOU + 5] = 0x00090909;
 +    s->regs[R_IOU + 6] = 0x00000909;
 -    s->regs[DMAC_RAM] = 0x00000009;
 +    s->regs[R_DMAC_RAM] = 0x00000009;
 -    s->regs[AFI0 + 0] = s->regs[AFI0 + 1] = 0x09090909;
 -    s->regs[AFI1 + 0] = s->regs[AFI1 + 1] = 0x09090909;
 -    s->regs[AFI2 + 0] = s->regs[AFI2 + 1] = 0x09090909;
 -    s->regs[AFI3 + 0] = s->regs[AFI3 + 1] = 0x09090909;
 -    s->regs[AFI0 + 2] = s->regs[AFI1 + 2] = s->regs[AFI2 + 2]
 -                      = s->regs[AFI3 + 2] = 0x00000909;
 +    s->regs[R_AFI0 + 0] = s->regs[R_AFI0 + 1] = 0x09090909;
 +    s->regs[R_AFI1 + 0] = s->regs[R_AFI1 + 1] = 0x09090909;
 +    s->regs[R_AFI2 + 0] = s->regs[R_AFI2 + 1] = 0x09090909;
 +    s->regs[R_AFI3 + 0] = s->regs[R_AFI3 + 1] = 0x09090909;
 +    s->regs[R_AFI0 + 2] = s->regs[R_AFI1 + 2] = s->regs[R_AFI2 + 2]
 +                        = s->regs[R_AFI3 + 2] = 0x00000909;
 -    s->regs[OCM + 0]    = 0x01010101;
 -    s->regs[OCM + 1]    = s->regs[OCM + 2] = 0x09090909;
 +    s->regs[R_OCM + 0] = 0x01010101;
 +    s->regs[R_OCM + 1] = s->regs[R_OCM + 2] = 0x09090909;
 -    s->regs[DEVCI_RAM]  = 0x00000909;
 -    s->regs[CSG_RAM]    = 0x00000001;
 +    s->regs[R_DEVCI_RAM] = 0x00000909;
 +    s->regs[R_CSG_RAM]   = 0x00000001;
 -    s->regs[DDRIOB + 0] = s->regs[DDRIOB + 1] = s->regs[DDRIOB + 2]
 -                        = s->regs[DDRIOB + 3] = 0x00000e00;
 -    s->regs[DDRIOB + 4] = s->regs[DDRIOB + 5] = s->regs[DDRIOB + 6]
 -                        = 0x00000e00;
 -    s->regs[DDRIOB + 12] = 0x00000021;
 +    s->regs[R_DDRIOB + 0] = s->regs[R_DDRIOB + 1] = s->regs[R_DDRIOB + 2]
 +                          = s->regs[R_DDRIOB + 3] = 0x00000e00;
 +    s->regs[R_DDRIOB + 4] = s->regs[R_DDRIOB + 5] = s->regs[R_DDRIOB + 6]
 +                          = 0x00000e00;
 +    s->regs[R_DDRIOB + 12] = 0x00000021;
  }
- static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+ static bool zynq_slcr_check_offset(hwaddr offset, bool rnw)
  {
      switch (offset) {
 -    case LOCK:
 -    case UNLOCK:
 -    case DDR_CAL_START:
 -    case DDR_REF_START:
 +    case R_LOCK:
 +    case R_UNLOCK:
 +    case R_DDR_CAL_START:
 +    case R_DDR_REF_START:
          return !rnw; /* Write only */
 -    case LOCKSTA:
 -    case FPGA0_THR_STA:
 -    case FPGA1_THR_STA:
 -    case FPGA2_THR_STA:
 -    case FPGA3_THR_STA:
 -    case BOOT_MODE:
 -    case PSS_IDCODE:
 -    case DDR_CMD_STA:
 -    case DDR_DFI_STATUS:
 -    case PLL_STATUS:
 +    case R_LOCKSTA:
 +    case R_FPGA0_THR_STA:
 +    case R_FPGA1_THR_STA:
 +    case R_FPGA2_THR_STA:
 +    case R_FPGA3_THR_STA:
 +    case R_BOOT_MODE:
 +    case R_PSS_IDCODE:
 +    case R_DDR_CMD_STA:
 +    case R_DDR_DFI_STATUS:
 +    case R_PLL_STATUS:
          return rnw;/* read only */
 -    case SCL:
 -    case ARM_PLL_CTRL ... IO_PLL_CTRL:
 -    case ARM_PLL_CFG ... IO_PLL_CFG:
 -    case ARM_CLK_CTRL ... TOPSW_CLK_CTRL:
 -    case FPGA0_CLK_CTRL ... FPGA0_THR_CNT:
 -    case FPGA1_CLK_CTRL ... FPGA1_THR_CNT:
 -    case FPGA2_CLK_CTRL ... FPGA2_THR_CNT:
 -    case FPGA3_CLK_CTRL ... FPGA3_THR_CNT:
 -    case BANDGAP_TRIP:
 -    case PLL_PREDIVISOR:
 -    case CLK_621_TRUE:
 -    case PSS_RST_CTRL ... A9_CPU_RST_CTRL:
 -    case RS_AWDT_CTRL:
 -    case RST_REASON:
 -    case REBOOT_STATUS:
 -    case APU_CTRL:
 -    case WDT_CLK_SEL:
 -    case TZ_DMA_NS ... TZ_DMA_PERIPH_NS:
 -    case DDR_URGENT:
 -    case DDR_URGENT_SEL:
 -    case MIO ... MIO + MIO_LENGTH - 1:
 -    case MIO_LOOPBACK ... MIO_MST_TRI1:
 -    case SD0_WP_CD_SEL:
 -    case SD1_WP_CD_SEL:
 -    case LVL_SHFTR_EN:
 -    case OCM_CFG:
 -    case CPU_RAM:
 -    case IOU:
 -    case DMAC_RAM:
 -    case AFI0 ... AFI3 + AFI_LENGTH - 1:
 -    case OCM:
 -    case DEVCI_RAM:
 -    case CSG_RAM:
 -    case GPIOB_CTRL ... GPIOB_CFG_CMOS33:
 -    case GPIOB_CFG_HSTL:
 -    case GPIOB_DRVR_BIAS_CTRL:
 -    case DDRIOB ... DDRIOB + DDRIOB_LENGTH - 1:
 +    case R_SCL:
 +    case R_ARM_PLL_CTRL ... R_IO_PLL_CTRL:
 +    case R_ARM_PLL_CFG ... R_IO_PLL_CFG:
 +    case R_ARM_CLK_CTRL ... R_TOPSW_CLK_CTRL:
 +    case R_FPGA0_CLK_CTRL ... R_FPGA0_THR_CNT:
 +    case R_FPGA1_CLK_CTRL ... R_FPGA1_THR_CNT:
 +    case R_FPGA2_CLK_CTRL ... R_FPGA2_THR_CNT:
 +    case R_FPGA3_CLK_CTRL ... R_FPGA3_THR_CNT:
 +    case R_BANDGAP_TRIP:
 +    case R_PLL_PREDIVISOR:
 +    case R_CLK_621_TRUE:
 +    case R_PSS_RST_CTRL ... R_A9_CPU_RST_CTRL:
 +    case R_RS_AWDT_CTRL:
 +    case R_RST_REASON:
 +    case R_REBOOT_STATUS:
 +    case R_APU_CTRL:
 +    case R_WDT_CLK_SEL:
 +    case R_TZ_DMA_NS ... R_TZ_DMA_PERIPH_NS:
 +    case R_DDR_URGENT:
 +    case R_DDR_URGENT_SEL:
 +    case R_MIO ... R_MIO + MIO_LENGTH - 1:
 +    case R_MIO_LOOPBACK ... R_MIO_MST_TRI1:
 +    case R_SD0_WP_CD_SEL:
 +    case R_SD1_WP_CD_SEL:
 +    case R_LVL_SHFTR_EN:
 +    case R_OCM_CFG:
 +    case R_CPU_RAM:
 +    case R_IOU:
 +    case R_DMAC_RAM:
 +    case R_AFI0 ... R_AFI3 + AFI_LENGTH - 1:
 +    case R_OCM:
 +    case R_DEVCI_RAM:
 +    case R_CSG_RAM:
 +    case R_GPIOB_CTRL ... R_GPIOB_CFG_CMOS33:
 +    case R_GPIOB_CFG_HSTL:
 +    case R_GPIOB_DRVR_BIAS_CTRL:
 +    case R_DDRIOB ... R_DDRIOB + DDRIOB_LENGTH - 1:
          return true;
      default:
          return false;
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
      }
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ipi), 0, IPI_ADDR);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ipi), 0, gic_spi[IPI_IRQ]);
+     switch (offset) {
-+
+-    case SCL:
-+    object_property_set_bool(OBJECT(&s->rtc), true, "realized", &err);
+-        s->regs[SCL] = val & 0x1;
-+    if (err) {
++    case R_SCL:
-+        error_propagate(errp, err);
++        s->regs[R_SCL] = val & 0x1;
-+        return;
+         return;
-+    }
+-    case LOCK:
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, RTC_ADDR);
++    case R_LOCK:
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0, gic_spi[RTC_IRQ]);
+         if ((val & 0xFFFF) == XILINX_LOCK_KEY) {
- }
+             DB_PRINT("XILINX LOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
+                 (unsigned)val & 0xFFFF);
- static Property xlnx_zynqmp_props[] = {
+-            s->regs[LOCKSTA] = 1;
 +            s->regs[R_LOCKSTA] = 1;
          } else {
              DB_PRINT("WRONG XILINX LOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
                  (int)offset, (unsigned)val & 0xFFFF);
          }
          return;
 -    case UNLOCK:
 +    case R_UNLOCK:
          if ((val & 0xFFFF) == XILINX_UNLOCK_KEY) {
              DB_PRINT("XILINX UNLOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
                  (unsigned)val & 0xFFFF);
 -            s->regs[LOCKSTA] = 0;
 +            s->regs[R_LOCKSTA] = 0;
          } else {
              DB_PRINT("WRONG XILINX UNLOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
                  (int)offset, (unsigned)val & 0xFFFF);
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
          return;
      }
 -    if (s->regs[LOCKSTA]) {
 +    if (s->regs[R_LOCKSTA]) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "SCLR registers are locked. Unlock them first\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
      s->regs[offset] = val;
      switch (offset) {
 -    case PSS_RST_CTRL:
 -        if (val & R_PSS_RST_CTRL_SOFT_RST) {
 +    case R_PSS_RST_CTRL:
 +        if (FIELD_EX32(val, PSS_RST_CTRL, SOFT_RST)) {
              qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
          }
          break;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 23/39] mps2-an505: New board model: MPS2 with AN505 Cortex-M33 FPGA image
+[Qemu-devel] [PULL 03/29] Set ENET_BD_BDU in I.MX FEC controller
-Define a new board model for the MPS2 with an AN505 FPGA image
+From: Aaron Hill <aa1ronham@gmail.com>
 containing a Cortex-M33. Since the FPGA images for TrustZone
 cores (AN505, and the similar AN519 for Cortex-M23) have a
 significantly different layout of devices to the non-TrustZone
 images, we use a new source file rather than shoehorning them
 into the existing mps2.c.
+This commit properly sets the ENET_BD_BDU flag once the emulated FEC controller
+has finished processing the last descriptor. This is done for both transmit
+and receive descriptors.
+This allows the QNX 7.0.0 BSP for the Sabrelite board (which can be
+found at http://blackberry.qnx.com/en/developers/bsp) to properly
+control the FEC. Without this patch, the BSP ethernet driver will never
+re-use FEC descriptors, as the unset ENET_BD_BDU flag will cause
+it to believe that the descriptors are still in use by the NIC.
+Note that Linux does not appear to use this field at all, and is
+unaffected by this patch.
+Without this patch, QNX will think that the NIC is still processing its
+transaction descriptors, and won't send any more data over the network.
+For reference:
+On page 1192 of the I.MX 6DQ reference manual revision (Rev. 5, 06/2018),
+which can be found at https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-6-processors/i.mx-6quad-processors-high-performance-3d-graphics-hd-video-arm-cortex-a9-core:i.MX6Q?&tab=Documentation_Tab&linkline=Application-Note
+the 'BDU' field is described as follows for the 'Enhanced transmit
+buffer descriptor':
+'Last buffer descriptor update done. Indicates that the last BD data has been updated by
+uDMA. This field is written by the user (=0) and uDMA (=1).'
+The same description is used for the receive buffer descriptor.
+Signed-off-by: Aaron Hill <aa1ronham@gmail.com>
+Message-id: 20190805142417.10433-1-aaron.hill@alertinnovation.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-20-peter.maydell@linaro.org
 ---
- hw/arm/Makefile.objs |   1 +
+ hw/net/imx_fec.c | 4 ++++
- hw/arm/mps2-tz.c     | 503 +++++++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 4 insertions(+)
 files changed, 504 insertions(+)
  create mode 100644 hw/arm/mps2-tz.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/hw/net/imx_fec.c
-+++ b/hw/arm/Makefile.objs
++++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
+@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
- obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
+             if (bd.option & ENET_BD_TX_INT) {
- obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
+                 s->regs[ENET_EIR] |= int_txf;
- obj-$(CONFIG_MPS2) += mps2.o
+             }
-+obj-$(CONFIG_MPS2) += mps2-tz.o
++            /* Indicate that we've updated the last buffer descriptor. */
- obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
++            bd.last_buffer = ENET_BD_BDU;
- obj-$(CONFIG_IOTKIT) += iotkit.o
+         }
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+         if (bd.option & ENET_BD_TX_INT) {
-new file mode 100644
+             s->regs[ENET_EIR] |= int_txb;
-index XXXXXXX..XXXXXXX
+@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
---- /dev/null
+             /* Last buffer in frame.  */
-+++ b/hw/arm/mps2-tz.c
+             bd.flags |= flags | ENET_BD_L;
-@@ -XXX,XX +XXX,XX @@
+             FEC_PRINTF("rx frame flags %04x\n", bd.flags);
-+/*
++            /* Indicate that we've updated the last buffer descriptor. */
-+ * ARM V2M MPS2 board emulation, trustzone aware FPGA images
++            bd.last_buffer = ENET_BD_BDU;
-+ *
+             if (bd.option & ENET_BD_RX_INT) {
-+ * Copyright (c) 2017 Linaro Limited
+                 s->regs[ENET_EIR] |= ENET_INT_RXF;
-+ * Written by Peter Maydell
+             }
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
 + * FPGA but is otherwise the same as the 2). Since the CPU itself
 + * and most of the devices are in the FPGA, the details of the board
 + * as seen by the guest depend significantly on the FPGA image.
 + * This source file covers the following FPGA images, for TrustZone cores:
 + *  "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
 + *
 + * Links to the TRM for the board itself and to the various Application
 + * Notes which document the FPGA images can be found here:
 + * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
 + *
 + * Board TRM:
 + * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
 + * Application Note AN505:
 + * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
 + *
 + * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
 + * (ARM ECM0601256) for the details of some of the device layout:
 + *   http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "qemu/error-report.h"
 +#include "hw/arm/arm.h"
 +#include "hw/arm/armv7m.h"
 +#include "hw/or-irq.h"
 +#include "hw/boards.h"
 +#include "exec/address-spaces.h"
 +#include "sysemu/sysemu.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/char/cmsdk-apb-uart.h"
 +#include "hw/timer/cmsdk-apb-timer.h"
 +#include "hw/misc/mps2-scc.h"
 +#include "hw/misc/mps2-fpgaio.h"
 +#include "hw/arm/iotkit.h"
 +#include "hw/devices.h"
 +#include "net/net.h"
 +#include "hw/core/split-irq.h"
 +
 +typedef enum MPS2TZFPGAType {
 +    FPGA_AN505,
 +} MPS2TZFPGAType;
 +
 +typedef struct {
 +    MachineClass parent;
 +    MPS2TZFPGAType fpga_type;
 +    uint32_t scc_id;
 +} MPS2TZMachineClass;
 +
 +typedef struct {
 +    MachineState parent;
 +
 +    IoTKit iotkit;
 +    MemoryRegion psram;
 +    MemoryRegion ssram1;
 +    MemoryRegion ssram1_m;
 +    MemoryRegion ssram23;
 +    MPS2SCC scc;
 +    MPS2FPGAIO fpgaio;
 +    TZPPC ppc[5];
 +    UnimplementedDeviceState ssram_mpc[3];
 +    UnimplementedDeviceState spi[5];
 +    UnimplementedDeviceState i2c[4];
 +    UnimplementedDeviceState i2s_audio;
 +    UnimplementedDeviceState gpio[5];
 +    UnimplementedDeviceState dma[4];
 +    UnimplementedDeviceState gfx;
 +    CMSDKAPBUART uart[5];
 +    SplitIRQ sec_resp_splitter;
 +    qemu_or_irq uart_irq_orgate;
 +} MPS2TZMachineState;
 +
 +#define TYPE_MPS2TZ_MACHINE "mps2tz"
 +#define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
 +
 +#define MPS2TZ_MACHINE(obj) \
 +    OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
 +#define MPS2TZ_MACHINE_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
 +#define MPS2TZ_MACHINE_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
 +
 +/* Main SYSCLK frequency in Hz */
 +#define SYSCLK_FRQ 20000000
 +
 +/* Initialize the auxiliary RAM region @mr and map it into
 + * the memory map at @base.
 + */
 +static void make_ram(MemoryRegion *mr, const char *name,
 +                     hwaddr base, hwaddr size)
 +{
 +    memory_region_init_ram(mr, NULL, name, size, &error_fatal);
 +    memory_region_add_subregion(get_system_memory(), base, mr);
 +}
 +
 +/* Create an alias of an entire original MemoryRegion @orig
 + * located at @base in the memory map.
 + */
 +static void make_ram_alias(MemoryRegion *mr, const char *name,
 +                           MemoryRegion *orig, hwaddr base)
 +{
 +    memory_region_init_alias(mr, NULL, name, orig, 0,
 +                             memory_region_size(orig));
 +    memory_region_add_subregion(get_system_memory(), base, mr);
 +}
 +
 +static void init_sysbus_child(Object *parent, const char *childname,
 +                              void *child, size_t childsize,
 +                              const char *childtype)
 +{
 +    object_initialize(child, childsize, childtype);
 +    object_property_add_child(parent, childname, OBJECT(child), &error_abort);
 +    qdev_set_parent_bus(DEVICE(child), sysbus_get_default());
 +
 +}
 +
 +/* Most of the devices in the AN505 FPGA image sit behind
 + * Peripheral Protection Controllers. These data structures
 + * define the layout of which devices sit behind which PPCs.
 + * The devfn for each port is a function which creates, configures
 + * and initializes the device, returning the MemoryRegion which
 + * needs to be plugged into the downstream end of the PPC port.
 + */
 +typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
 +                                const char *name, hwaddr size);
 +
 +typedef struct PPCPortInfo {
 +    const char *name;
 +    MakeDevFn *devfn;
 +    void *opaque;
 +    hwaddr addr;
 +    hwaddr size;
 +} PPCPortInfo;
 +
 +typedef struct PPCInfo {
 +    const char *name;
 +    PPCPortInfo ports[TZ_NUM_PORTS];
 +} PPCInfo;
 +
 +static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
 +                                       void *opaque,
 +                                       const char *name, hwaddr size)
 +{
 +    /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
 +     * and return a pointer to its MemoryRegion.
 +     */
 +    UnimplementedDeviceState *uds = opaque;
 +
 +    init_sysbus_child(OBJECT(mms), name, uds,
 +                      sizeof(UnimplementedDeviceState),
 +                      TYPE_UNIMPLEMENTED_DEVICE);
 +    qdev_prop_set_string(DEVICE(uds), "name", name);
 +    qdev_prop_set_uint64(DEVICE(uds), "size", size);
 +    object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
 +    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 +}
 +
 +static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
 +                               const char *name, hwaddr size)
 +{
 +    CMSDKAPBUART *uart = opaque;
 +    int i = uart - &mms->uart[0];
 +    Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
 +    int rxirqno = i * 2;
 +    int txirqno = i * 2 + 1;
 +    int combirqno = i + 10;
 +    SysBusDevice *s;
 +    DeviceState *iotkitdev = DEVICE(&mms->iotkit);
 +    DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
 +
 +    init_sysbus_child(OBJECT(mms), name, uart,
 +                      sizeof(mms->uart[0]), TYPE_CMSDK_APB_UART);
 +    qdev_prop_set_chr(DEVICE(uart), "chardev", uartchr);
 +    qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
 +    object_property_set_bool(OBJECT(uart), true, "realized", &error_fatal);
 +    s = SYS_BUS_DEVICE(uart);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in_named(iotkitdev,
 +                                                    "EXP_IRQ", txirqno));
 +    sysbus_connect_irq(s, 1, qdev_get_gpio_in_named(iotkitdev,
 +                                                    "EXP_IRQ", rxirqno));
 +    sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
 +    sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
 +    sysbus_connect_irq(s, 4, qdev_get_gpio_in_named(iotkitdev,
 +                                                    "EXP_IRQ", combirqno));
 +    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
 +}
 +
 +static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 +                              const char *name, hwaddr size)
 +{
 +    MPS2SCC *scc = opaque;
 +    DeviceState *sccdev;
 +    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 +
 +    object_initialize(scc, sizeof(mms->scc), TYPE_MPS2_SCC);
 +    sccdev = DEVICE(scc);
 +    qdev_set_parent_bus(sccdev, sysbus_get_default());
 +    qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
 +    qdev_prop_set_uint32(sccdev, "scc-aid", 0x02000008);
 +    qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
 +    object_property_set_bool(OBJECT(scc), true, "realized", &error_fatal);
 +    return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
 +}
 +
 +static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
 +                                 const char *name, hwaddr size)
 +{
 +    MPS2FPGAIO *fpgaio = opaque;
 +
 +    object_initialize(fpgaio, sizeof(mms->fpgaio), TYPE_MPS2_FPGAIO);
 +    qdev_set_parent_bus(DEVICE(fpgaio), sysbus_get_default());
 +    object_property_set_bool(OBJECT(fpgaio), true, "realized", &error_fatal);
 +    return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
 +}
 +
 +static void mps2tz_common_init(MachineState *machine)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 +    MachineClass *mc = MACHINE_GET_CLASS(machine);
 +    MemoryRegion *system_memory = get_system_memory();
 +    DeviceState *iotkitdev;
 +    DeviceState *dev_splitter;
 +    int i;
 +
 +    if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
 +        error_report("This board can only be used with CPU %s",
 +                     mc->default_cpu_type);
 +        exit(1);
 +    }
 +
 +    init_sysbus_child(OBJECT(machine), "iotkit", &mms->iotkit,
 +                      sizeof(mms->iotkit), TYPE_IOTKIT);
 +    iotkitdev = DEVICE(&mms->iotkit);
 +    object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
 +                             "memory", &error_abort);
 +    qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", 92);
 +    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
 +    object_property_set_bool(OBJECT(&mms->iotkit), true, "realized",
 +                             &error_fatal);
 +
 +    /* The sec_resp_cfg output from the IoTKit must be split into multiple
 +     * lines, one for each of the PPCs we create here.
 +     */
 +    object_initialize(&mms->sec_resp_splitter, sizeof(mms->sec_resp_splitter),
 +                      TYPE_SPLIT_IRQ);
 +    object_property_add_child(OBJECT(machine), "sec-resp-splitter",
 +                              OBJECT(&mms->sec_resp_splitter), &error_abort);
 +    object_property_set_int(OBJECT(&mms->sec_resp_splitter), 5,
 +                            "num-lines", &error_fatal);
 +    object_property_set_bool(OBJECT(&mms->sec_resp_splitter), true,
 +                             "realized", &error_fatal);
 +    dev_splitter = DEVICE(&mms->sec_resp_splitter);
 +    qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
 +                                qdev_get_gpio_in(dev_splitter, 0));
 +
 +    /* The IoTKit sets up much of the memory layout, including
 +     * the aliases between secure and non-secure regions in the
 +     * address space. The FPGA itself contains:
 +     *
 +     * 0x00000000..0x003fffff  SSRAM1
 +     * 0x00400000..0x007fffff  alias of SSRAM1
 +     * 0x28000000..0x283fffff  4MB SSRAM2 + SSRAM3
 +     * 0x40100000..0x4fffffff  AHB Master Expansion 1 interface devices
 +     * 0x80000000..0x80ffffff  16MB PSRAM
 +     */
 +
 +    /* The FPGA images have an odd combination of different RAMs,
 +     * because in hardware they are different implementations and
 +     * connected to different buses, giving varying performance/size
 +     * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
 +     * call the 16MB our "system memory", as it's the largest lump.
 +     */
 +    memory_region_allocate_system_memory(&mms->psram,
 +                                         NULL, "mps.ram", 0x01000000);
 +    memory_region_add_subregion(system_memory, 0x80000000, &mms->psram);
 +
 +    /* The SSRAM memories should all be behind Memory Protection Controllers,
 +     * but we don't implement that yet.
 +     */
 +    make_ram(&mms->ssram1, "mps.ssram1", 0x00000000, 0x00400000);
 +    make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", &mms->ssram1, 0x00400000);
 +
 +    make_ram(&mms->ssram23, "mps.ssram23", 0x28000000, 0x00400000);
 +
 +    /* The overflow IRQs for all UARTs are ORed together.
 +     * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
 +     * Create the OR gate for this.
 +     */
 +    object_initialize(&mms->uart_irq_orgate, sizeof(mms->uart_irq_orgate),
 +                      TYPE_OR_IRQ);
 +    object_property_add_child(OBJECT(mms), "uart-irq-orgate",
 +                              OBJECT(&mms->uart_irq_orgate), &error_abort);
 +    object_property_set_int(OBJECT(&mms->uart_irq_orgate), 10, "num-lines",
 +                            &error_fatal);
 +    object_property_set_bool(OBJECT(&mms->uart_irq_orgate), true,
 +                             "realized", &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
 +                          qdev_get_gpio_in_named(iotkitdev, "EXP_IRQ", 15));
 +
 +    /* Most of the devices in the FPGA are behind Peripheral Protection
 +     * Controllers. The required order for initializing things is:
 +     *  + initialize the PPC
 +     *  + initialize, configure and realize downstream devices
 +     *  + connect downstream device MemoryRegions to the PPC
 +     *  + realize the PPC
 +     *  + map the PPC's MemoryRegions to the places in the address map
 +     *    where the downstream devices should appear
 +     *  + wire up the PPC's control lines to the IoTKit object
 +     */
 +
 +    const PPCInfo ppcs[] = { {
 +            .name = "apb_ppcexp0",
 +            .ports = {
 +                { "ssram-mpc0", make_unimp_dev, &mms->ssram_mpc[0],
 +                  0x58007000, 0x1000 },
 +                { "ssram-mpc1", make_unimp_dev, &mms->ssram_mpc[1],
 +                  0x58008000, 0x1000 },
 +                { "ssram-mpc2", make_unimp_dev, &mms->ssram_mpc[2],
 +                  0x58009000, 0x1000 },
 +            },
 +        }, {
 +            .name = "apb_ppcexp1",
 +            .ports = {
 +                { "spi0", make_unimp_dev, &mms->spi[0], 0x40205000, 0x1000 },
 +                { "spi1", make_unimp_dev, &mms->spi[1], 0x40206000, 0x1000 },
 +                { "spi2", make_unimp_dev, &mms->spi[2], 0x40209000, 0x1000 },
 +                { "spi3", make_unimp_dev, &mms->spi[3], 0x4020a000, 0x1000 },
 +                { "spi4", make_unimp_dev, &mms->spi[4], 0x4020b000, 0x1000 },
 +                { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
 +                { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
 +                { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
 +                { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
 +                { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
 +                { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40207000, 0x1000 },
 +                { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40208000, 0x1000 },
 +                { "i2c2", make_unimp_dev, &mms->i2c[2], 0x4020c000, 0x1000 },
 +                { "i2c3", make_unimp_dev, &mms->i2c[3], 0x4020d000, 0x1000 },
 +            },
 +        }, {
 +            .name = "apb_ppcexp2",
 +            .ports = {
 +                { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
 +                { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
 +                  0x40301000, 0x1000 },
 +                { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
 +            },
 +        }, {
 +            .name = "ahb_ppcexp0",
 +            .ports = {
 +                { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
 +                { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
 +                { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
 +                { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
 +                { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
 +                { "gpio4", make_unimp_dev, &mms->gpio[4], 0x40104000, 0x1000 },
 +            },
 +        }, {
 +            .name = "ahb_ppcexp1",
 +            .ports = {
 +                { "dma0", make_unimp_dev, &mms->dma[0], 0x40110000, 0x1000 },
 +                { "dma1", make_unimp_dev, &mms->dma[1], 0x40111000, 0x1000 },
 +                { "dma2", make_unimp_dev, &mms->dma[2], 0x40112000, 0x1000 },
 +                { "dma3", make_unimp_dev, &mms->dma[3], 0x40113000, 0x1000 },
 +            },
 +        },
 +    };
 +
 +    for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
 +        const PPCInfo *ppcinfo = &ppcs[i];
 +        TZPPC *ppc = &mms->ppc[i];
 +        DeviceState *ppcdev;
 +        int port;
 +        char *gpioname;
 +
 +        init_sysbus_child(OBJECT(machine), ppcinfo->name, ppc,
 +                          sizeof(TZPPC), TYPE_TZ_PPC);
 +        ppcdev = DEVICE(ppc);
 +
 +        for (port = 0; port < TZ_NUM_PORTS; port++) {
 +            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 +            MemoryRegion *mr;
 +            char *portname;
 +
 +            if (!pinfo->devfn) {
 +                continue;
 +            }
 +
 +            mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 +            portname = g_strdup_printf("port[%d]", port);
 +            object_property_set_link(OBJECT(ppc), OBJECT(mr),
 +                                     portname, &error_fatal);
 +            g_free(portname);
 +        }
 +
 +        object_property_set_bool(OBJECT(ppc), true, "realized", &error_fatal);
 +
 +        for (port = 0; port < TZ_NUM_PORTS; port++) {
 +            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 +
 +            if (!pinfo->devfn) {
 +                continue;
 +            }
 +            sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
 +
 +            gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
 +            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
 +                                        qdev_get_gpio_in_named(ppcdev,
 +                                                               "cfg_nonsec",
 +                                                               port));
 +            g_free(gpioname);
 +            gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
 +            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
 +                                        qdev_get_gpio_in_named(ppcdev,
 +                                                               "cfg_ap", port));
 +            g_free(gpioname);
 +        }
 +
 +        gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
 +        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
 +                                    qdev_get_gpio_in_named(ppcdev,
 +                                                           "irq_enable", 0));
 +        g_free(gpioname);
 +        gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
 +        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
 +                                    qdev_get_gpio_in_named(ppcdev,
 +                                                           "irq_clear", 0));
 +        g_free(gpioname);
 +        gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
 +        qdev_connect_gpio_out_named(ppcdev, "irq", 0,
 +                                    qdev_get_gpio_in_named(iotkitdev,
 +                                                           gpioname, 0));
 +        g_free(gpioname);
 +
 +        qdev_connect_gpio_out(dev_splitter, i,
 +                              qdev_get_gpio_in_named(ppcdev,
 +                                                     "cfg_sec_resp", 0));
 +    }
 +
 +    /* In hardware this is a LAN9220; the LAN9118 is software compatible
 +     * except that it doesn't support the checksum-offload feature.
 +     * The ethernet controller is not behind a PPC.
 +     */
 +    lan9118_init(&nd_table[0], 0x42000000,
 +                 qdev_get_gpio_in_named(iotkitdev, "EXP_IRQ", 16));
 +
 +    create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
 +
 +    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
 +}
 +
 +static void mps2tz_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
 +    mc->init = mps2tz_common_init;
 +    mc->max_cpus = 1;
 +}
 +
 +static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
 +
 +    mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
 +    mmc->fpga_type = FPGA_AN505;
 +    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
 +    mmc->scc_id = 0x41040000 | (505 << 4);
 +}
 +
 +static const TypeInfo mps2tz_info = {
 +    .name = TYPE_MPS2TZ_MACHINE,
 +    .parent = TYPE_MACHINE,
 +    .abstract = true,
 +    .instance_size = sizeof(MPS2TZMachineState),
 +    .class_size = sizeof(MPS2TZMachineClass),
 +    .class_init = mps2tz_class_init,
 +};
 +
 +static const TypeInfo mps2tz_an505_info = {
 +    .name = TYPE_MPS2TZ_AN505_MACHINE,
 +    .parent = TYPE_MPS2TZ_MACHINE,
 +    .class_init = mps2tz_an505_class_init,
 +};
 +
 +static void mps2tz_machine_init(void)
 +{
 +    type_register_static(&mps2tz_info);
 +    type_register_static(&mps2tz_an505_info);
 +}
 +
 +type_init(mps2tz_machine_init);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 20/39] hw/misc/iotkit-secctl: Add handling for PPCs
+[Qemu-devel] [PULL 04/29] target/arm: Factor out 'generate singlestep exception' function
-The IoTKit Security Controller includes various registers
+Factor out code to 'generate a singlestep exception', which is
-that expose to software the controls for the Peripheral
+currently repeated in four places.
-Protection Controllers in the system. Implement these.
 To do this we need to also pull the identical copies of the
 gen-exception() function out of translate-a64.c and translate.c
 into translate.h.
 (There is a bug in the code: we're taking the exception to the wrong
 target EL.  This will be simpler to fix if there's only one place to
 do it.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180220180325.29818-17-peter.maydell@linaro.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190805130952.4415-2-peter.maydell@linaro.org
 ---
- include/hw/misc/iotkit-secctl.h |  64 +++++++++-
+ target/arm/translate.h     | 23 +++++++++++++++++++++++
- hw/misc/iotkit-secctl.c         | 270 +++++++++++++++++++++++++++++++++++++---
+ target/arm/translate-a64.c | 19 ++-----------------
-files changed, 315 insertions(+), 19 deletions(-)
+ target/arm/translate.c     | 20 ++------------------
 files changed, 27 insertions(+), 35 deletions(-)
-diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/iotkit-secctl.h
+--- a/target/arm/translate.h
-+++ b/include/hw/misc/iotkit-secctl.h
++++ b/target/arm/translate.h
 @@ -XXX,XX +XXX,XX @@
-  * QEMU interface:
+ #define TARGET_ARM_TRANSLATE_H
-  *  + sysbus MMIO region 0 is the "secure privilege control block" registers
-  *  + sysbus MMIO region 1 is the "non-secure privilege control block" registers
+ #include "exec/translator.h"
-+ *  + named GPIO output "sec_resp_cfg" indicating whether blocked accesses
++#include "internals.h"
-+ *    should RAZ/WI or bus error
-+ * Controlling the 2 APB PPCs in the IoTKit:
-+ *  + named GPIO outputs apb_ppc0_nonsec[0..2] and apb_ppc1_nonsec
+ /* internal defines */
-+ *  + named GPIO outputs apb_ppc0_ap[0..2] and apb_ppc1_ap
+@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
-+ *  + named GPIO outputs apb_ppc{0,1}_irq_enable
+     }
-+ *  + named GPIO outputs apb_ppc{0,1}_irq_clear
+ }
-+ *  + named GPIO inputs apb_ppc{0,1}_irq_status
-+ * Controlling each of the 4 expansion APB PPCs which a system using the IoTKit
++static inline void gen_exception(int excp, uint32_t syndrome,
-+ * might provide:
++                                 uint32_t target_el)
-+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
++{
-+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
++    TCGv_i32 tcg_excp = tcg_const_i32(excp);
-+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
++    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
-+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
++    TCGv_i32 tcg_el = tcg_const_i32(target_el);
 + *  + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
 + * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
 + * might provide:
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
 + *  + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
   */
  #ifndef IOTKIT_SECCTL_H
@@ -XXX,XX +XXX,XX @@
  #define TYPE_IOTKIT_SECCTL "iotkit-secctl"
  #define IOTKIT_SECCTL(obj) OBJECT_CHECK(IoTKitSecCtl, (obj), TYPE_IOTKIT_SECCTL)
 -typedef struct IoTKitSecCtl {
 +#define IOTS_APB_PPC0_NUM_PORTS 3
 +#define IOTS_APB_PPC1_NUM_PORTS 1
 +#define IOTS_PPC_NUM_PORTS 16
 +#define IOTS_NUM_APB_PPC 2
 +#define IOTS_NUM_APB_EXP_PPC 4
 +#define IOTS_NUM_AHB_EXP_PPC 4
 +
-+typedef struct IoTKitSecCtl IoTKitSecCtl;
++    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
 +                                       tcg_syn, tcg_el);
 +
-+/* State and IRQ lines relating to a PPC. For the
++    tcg_temp_free_i32(tcg_el);
-+ * PPCs in the IoTKit not all the IRQ lines are used.
++    tcg_temp_free_i32(tcg_syn);
-+ */
++    tcg_temp_free_i32(tcg_excp);
 +typedef struct IoTKitSecCtlPPC {
 +    qemu_irq nonsec[IOTS_PPC_NUM_PORTS];
 +    qemu_irq ap[IOTS_PPC_NUM_PORTS];
 +    qemu_irq irq_enable;
 +    qemu_irq irq_clear;
 +
 +    uint32_t ns;
 +    uint32_t sp;
 +    uint32_t nsp;
 +
 +    /* Number of ports actually present */
 +    int numports;
 +    /* Offset of this PPC's interrupt bits in SECPPCINTSTAT */
 +    int irq_bit_offset;
 +    IoTKitSecCtl *parent;
 +} IoTKitSecCtlPPC;
 +
 +struct IoTKitSecCtl {
      /*< private >*/
      SysBusDevice parent_obj;
      /*< public >*/
 +    qemu_irq sec_resp_cfg;
      MemoryRegion s_regs;
      MemoryRegion ns_regs;
 -} IoTKitSecCtl;
 +
 +    uint32_t secppcintstat;
 +    uint32_t secppcinten;
 +    uint32_t secrespcfg;
 +
 +    IoTKitSecCtlPPC apb[IOTS_NUM_APB_PPC];
 +    IoTKitSecCtlPPC apbexp[IOTS_NUM_APB_EXP_PPC];
 +    IoTKitSecCtlPPC ahbexp[IOTS_NUM_APB_EXP_PPC];
 +};
  #endif
 diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/iotkit-secctl.c
 +++ b/hw/misc/iotkit-secctl.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t iotkit_secctl_ns_idregs[] = {
 x0d, 0xf0, 0x05, 0xb1,
  };
 +/* The register sets for the various PPCs (AHB internal, APB internal,
 + * AHB expansion, APB expansion) are all set up so that they are
 + * in 16-aligned blocks so offsets 0xN0, 0xN4, 0xN8, 0xNC are PPCs
 + * 0, 1, 2, 3 of that type, so we can convert a register address offset
 + * into an an index into a PPC array easily.
 + */
 +static inline int offset_to_ppc_idx(uint32_t offset)
 +{
 +    return extract32(offset, 2, 2);
 +}
 +
-+typedef void PerPPCFunction(IoTKitSecCtlPPC *ppc);
++/* Generate an architectural singlestep exception */
-+
++static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 +static void foreach_ppc(IoTKitSecCtl *s, PerPPCFunction *fn)
 +{
-+    int i;
++    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
-+
++                  default_exception_el(s));
 +    for (i = 0; i < IOTS_NUM_APB_PPC; i++) {
 +        fn(&s->apb[i]);
 +    }
 +    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
 +        fn(&s->apbexp[i]);
 +    }
 +    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
 +        fn(&s->ahbexp[i]);
 +    }
 +}
 +
- static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
+ /*
-                                         uint64_t *pdata,
+  * Given a VFP floating point constant encoded into an 8 bit immediate in an
-                                         unsigned size, MemTxAttrs attrs)
+  * instruction, expand it to the actual constant value of the specified
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
      tcg_temp_free_i32(tcg_excp);
  }
 -static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
 -{
 -    TCGv_i32 tcg_excp = tcg_const_i32(excp);
 -    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
 -    TCGv_i32 tcg_el = tcg_const_i32(target_el);
 -
 -    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
 -                                       tcg_syn, tcg_el);
 -    tcg_temp_free_i32(tcg_el);
 -    tcg_temp_free_i32(tcg_syn);
 -    tcg_temp_free_i32(tcg_excp);
 -}
 -
  static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
  {
-     uint64_t r;
+     gen_a64_set_pc_im(s->pc - offset);
-     uint32_t offset = addr & ~0x3;
+@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
-+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
+      * of the exception, and our syndrome information is always correct.
+      */
-     switch (offset) {
+     gen_ss_advance(s);
-     case A_AHBNSPPC0:
+-    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
-@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
+-                  default_exception_el(s));
-         r = 0;
++    gen_swstep_exception(s, 1, s->is_ldex);
-         break;
+     s->base.is_jmp = DISAS_NORETURN;
      case A_SECRESPCFG:
 -    case A_NSCCFG:
 -    case A_SECMPCINTSTATUS:
 +        r = s->secrespcfg;
 +        break;
      case A_SECPPCINTSTAT:
 +        r = s->secppcintstat;
 +        break;
      case A_SECPPCINTEN:
 -    case A_SECMSCINTSTAT:
 -    case A_SECMSCINTEN:
 -    case A_BRGINTSTAT:
 -    case A_BRGINTEN:
 +        r = s->secppcinten;
 +        break;
      case A_AHBNSPPCEXP0:
      case A_AHBNSPPCEXP1:
      case A_AHBNSPPCEXP2:
      case A_AHBNSPPCEXP3:
 +        r = s->ahbexp[offset_to_ppc_idx(offset)].ns;
 +        break;
      case A_APBNSPPC0:
      case A_APBNSPPC1:
 +        r = s->apb[offset_to_ppc_idx(offset)].ns;
 +        break;
      case A_APBNSPPCEXP0:
      case A_APBNSPPCEXP1:
      case A_APBNSPPCEXP2:
      case A_APBNSPPCEXP3:
 +        r = s->apbexp[offset_to_ppc_idx(offset)].ns;
 +        break;
      case A_AHBSPPPCEXP0:
      case A_AHBSPPPCEXP1:
      case A_AHBSPPPCEXP2:
      case A_AHBSPPPCEXP3:
 +        r = s->apbexp[offset_to_ppc_idx(offset)].sp;
 +        break;
      case A_APBSPPPC0:
      case A_APBSPPPC1:
 +        r = s->apb[offset_to_ppc_idx(offset)].sp;
 +        break;
      case A_APBSPPPCEXP0:
      case A_APBSPPPCEXP1:
      case A_APBSPPPCEXP2:
      case A_APBSPPPCEXP3:
 +        r = s->apbexp[offset_to_ppc_idx(offset)].sp;
 +        break;
 +    case A_NSCCFG:
 +    case A_SECMPCINTSTATUS:
 +    case A_SECMSCINTSTAT:
 +    case A_SECMSCINTEN:
 +    case A_BRGINTSTAT:
 +    case A_BRGINTEN:
      case A_NSMSCEXP:
          qemu_log_mask(LOG_UNIMP,
                        "IoTKit SecCtl S block read: "
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
      return MEMTX_OK;
  }
-+static void iotkit_secctl_update_ppc_ap(IoTKitSecCtlPPC *ppc)
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-+{
+          * bits should be zero.
-+    int i;
+          */
-+
+         assert(dc->base.num_insns == 1);
-+    for (i = 0; i < ppc->numports; i++) {
+-        gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
-+        bool v;
+-                      default_exception_el(dc));
-+
++        gen_swstep_exception(dc, 0, 0);
-+        if (extract32(ppc->ns, i, 1)) {
+         dc->base.is_jmp = DISAS_NORETURN;
-+            v = extract32(ppc->nsp, i, 1);
+     } else {
-+        } else {
+         disas_a64_insn(env, dc);
-+            v = extract32(ppc->sp, i, 1);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-+        }
+index XXXXXXX..XXXXXXX 100644
-+        qemu_set_irq(ppc->ap[i], v);
+--- a/target/arm/translate.c
-+    }
++++ b/target/arm/translate.c
-+}
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
-+
+     tcg_temp_free_i32(tcg_excp);
-+static void iotkit_secctl_ppc_ns_write(IoTKitSecCtlPPC *ppc, uint32_t value)
+ }
-+{
-+    int i;
+-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
-+
+-{
-+    ppc->ns = value & MAKE_64BIT_MASK(0, ppc->numports);
+-    TCGv_i32 tcg_excp = tcg_const_i32(excp);
-+    for (i = 0; i < ppc->numports; i++) {
+-    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
-+        qemu_set_irq(ppc->nonsec[i], extract32(ppc->ns, i, 1));
+-    TCGv_i32 tcg_el = tcg_const_i32(target_el);
-+    }
+-
-+    iotkit_secctl_update_ppc_ap(ppc);
+-    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
-+}
+-                                       tcg_syn, tcg_el);
-+
+-
-+static void iotkit_secctl_ppc_sp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
+-    tcg_temp_free_i32(tcg_el);
-+{
+-    tcg_temp_free_i32(tcg_syn);
-+    ppc->sp = value & MAKE_64BIT_MASK(0, ppc->numports);
+-    tcg_temp_free_i32(tcg_excp);
-+    iotkit_secctl_update_ppc_ap(ppc);
+-}
-+}
+-
-+
+ static void gen_step_complete_exception(DisasContext *s)
 +static void iotkit_secctl_ppc_nsp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
 +{
 +    ppc->nsp = value & MAKE_64BIT_MASK(0, ppc->numports);
 +    iotkit_secctl_update_ppc_ap(ppc);
 +}
 +
 +static void iotkit_secctl_ppc_update_irq_clear(IoTKitSecCtlPPC *ppc)
 +{
 +    uint32_t value = ppc->parent->secppcintstat;
 +
 +    qemu_set_irq(ppc->irq_clear, extract32(value, ppc->irq_bit_offset, 1));
 +}
 +
 +static void iotkit_secctl_ppc_update_irq_enable(IoTKitSecCtlPPC *ppc)
 +{
 +    uint32_t value = ppc->parent->secppcinten;
 +
 +    qemu_set_irq(ppc->irq_enable, extract32(value, ppc->irq_bit_offset, 1));
 +}
 +
  static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
                                           uint64_t value,
                                           unsigned size, MemTxAttrs attrs)
  {
-+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
+     /* We just completed step of an insn. Move from Active-not-pending
-     uint32_t offset = addr;
+@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
-+    IoTKitSecCtlPPC *ppc;
+      * of the exception, and our syndrome information is always correct.
+      */
-     trace_iotkit_secctl_s_write(offset, value, size);
+     gen_ss_advance(s);
+-    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
-@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
+-                  default_exception_el(s));
++    gen_swstep_exception(s, 1, s->is_ldex);
-     switch (offset) {
+     s->base.is_jmp = DISAS_NORETURN;
      case A_SECRESPCFG:
 -    case A_NSCCFG:
 +        value &= 1;
 +        s->secrespcfg = value;
 +        qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
 +        break;
      case A_SECPPCINTCLR:
 +        value &= 0x00f000f3;
 +        foreach_ppc(s, iotkit_secctl_ppc_update_irq_clear);
 +        break;
      case A_SECPPCINTEN:
 -    case A_SECMSCINTCLR:
 -    case A_SECMSCINTEN:
 -    case A_BRGINTCLR:
 -    case A_BRGINTEN:
 +        s->secppcinten = value & 0x00f000f3;
 +        foreach_ppc(s, iotkit_secctl_ppc_update_irq_enable);
 +        break;
      case A_AHBNSPPCEXP0:
      case A_AHBNSPPCEXP1:
      case A_AHBNSPPCEXP2:
      case A_AHBNSPPCEXP3:
 +        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_ns_write(ppc, value);
 +        break;
      case A_APBNSPPC0:
      case A_APBNSPPC1:
 +        ppc = &s->apb[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_ns_write(ppc, value);
 +        break;
      case A_APBNSPPCEXP0:
      case A_APBNSPPCEXP1:
      case A_APBNSPPCEXP2:
      case A_APBNSPPCEXP3:
 +        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_ns_write(ppc, value);
 +        break;
      case A_AHBSPPPCEXP0:
      case A_AHBSPPPCEXP1:
      case A_AHBSPPPCEXP2:
      case A_AHBSPPPCEXP3:
 +        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_sp_write(ppc, value);
 +        break;
      case A_APBSPPPC0:
      case A_APBSPPPC1:
 +        ppc = &s->apb[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_sp_write(ppc, value);
 +        break;
      case A_APBSPPPCEXP0:
      case A_APBSPPPCEXP1:
      case A_APBSPPPCEXP2:
      case A_APBSPPPCEXP3:
 +        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_sp_write(ppc, value);
 +        break;
 +    case A_NSCCFG:
 +    case A_SECMSCINTCLR:
 +    case A_SECMSCINTEN:
 +    case A_BRGINTCLR:
 +    case A_BRGINTEN:
          qemu_log_mask(LOG_UNIMP,
                        "IoTKit SecCtl S block write: "
                        "unimplemented offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
                                           uint64_t *pdata,
                                           unsigned size, MemTxAttrs attrs)
  {
 +    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
      uint64_t r;
      uint32_t offset = addr & ~0x3;
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
      case A_AHBNSPPPCEXP1:
      case A_AHBNSPPPCEXP2:
      case A_AHBNSPPPCEXP3:
 +        r = s->ahbexp[offset_to_ppc_idx(offset)].nsp;
 +        break;
      case A_APBNSPPPC0:
      case A_APBNSPPPC1:
 +        r = s->apb[offset_to_ppc_idx(offset)].nsp;
 +        break;
      case A_APBNSPPPCEXP0:
      case A_APBNSPPPCEXP1:
      case A_APBNSPPPCEXP2:
      case A_APBNSPPPCEXP3:
 -        qemu_log_mask(LOG_UNIMP,
 -                      "IoTKit SecCtl NS block read: "
 -                      "unimplemented offset 0x%x\n", offset);
 +        r = s->apbexp[offset_to_ppc_idx(offset)].nsp;
          break;
      case A_PID4:
      case A_PID5:
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
                                            uint64_t value,
                                            unsigned size, MemTxAttrs attrs)
  {
 +    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
      uint32_t offset = addr;
 +    IoTKitSecCtlPPC *ppc;
      trace_iotkit_secctl_ns_write(offset, value, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
      case A_AHBNSPPPCEXP1:
      case A_AHBNSPPPCEXP2:
      case A_AHBNSPPPCEXP3:
 +        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_nsp_write(ppc, value);
 +        break;
      case A_APBNSPPPC0:
      case A_APBNSPPPC1:
 +        ppc = &s->apb[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_nsp_write(ppc, value);
 +        break;
      case A_APBNSPPPCEXP0:
      case A_APBNSPPPCEXP1:
      case A_APBNSPPPCEXP2:
      case A_APBNSPPPCEXP3:
 -        qemu_log_mask(LOG_UNIMP,
 -                      "IoTKit SecCtl NS block write: "
 -                      "unimplemented offset 0x%x\n", offset);
 +        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
 +        iotkit_secctl_ppc_nsp_write(ppc, value);
          break;
      case A_AHBNSPPPC0:
      case A_PID4:
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps iotkit_secctl_ns_ops = {
      .impl.max_access_size = 4,
  };
 +static void iotkit_secctl_reset_ppc(IoTKitSecCtlPPC *ppc)
 +{
 +    ppc->ns = 0;
 +    ppc->sp = 0;
 +    ppc->nsp = 0;
 +}
 +
  static void iotkit_secctl_reset(DeviceState *dev)
  {
 +    IoTKitSecCtl *s = IOTKIT_SECCTL(dev);
 +    s->secppcintstat = 0;
 +    s->secppcinten = 0;
 +    s->secrespcfg = 0;
 +
 +    foreach_ppc(s, iotkit_secctl_reset_ppc);
 +}
 +
 +static void iotkit_secctl_ppc_irqstatus(void *opaque, int n, int level)
 +{
 +    IoTKitSecCtlPPC *ppc = opaque;
 +    IoTKitSecCtl *s = IOTKIT_SECCTL(ppc->parent);
 +    int irqbit = ppc->irq_bit_offset + n;
 +
 +    s->secppcintstat = deposit32(s->secppcintstat, irqbit, 1, level);
 +}
 +
 +static void iotkit_secctl_init_ppc(IoTKitSecCtl *s,
 +                                   IoTKitSecCtlPPC *ppc,
 +                                   const char *name,
 +                                   int numports,
 +                                   int irq_bit_offset)
 +{
 +    char *gpioname;
 +    DeviceState *dev = DEVICE(s);
 +
 +    ppc->numports = numports;
 +    ppc->irq_bit_offset = irq_bit_offset;
 +    ppc->parent = s;
 +
 +    gpioname = g_strdup_printf("%s_nonsec", name);
 +    qdev_init_gpio_out_named(dev, ppc->nonsec, gpioname, numports);
 +    g_free(gpioname);
 +    gpioname = g_strdup_printf("%s_ap", name);
 +    qdev_init_gpio_out_named(dev, ppc->ap, gpioname, numports);
 +    g_free(gpioname);
 +    gpioname = g_strdup_printf("%s_irq_enable", name);
 +    qdev_init_gpio_out_named(dev, &ppc->irq_enable, gpioname, 1);
 +    g_free(gpioname);
 +    gpioname = g_strdup_printf("%s_irq_clear", name);
 +    qdev_init_gpio_out_named(dev, &ppc->irq_clear, gpioname, 1);
 +    g_free(gpioname);
 +    gpioname = g_strdup_printf("%s_irq_status", name);
 +    qdev_init_gpio_in_named_with_opaque(dev, iotkit_secctl_ppc_irqstatus,
 +                                        ppc, gpioname, 1);
 +    g_free(gpioname);
  }
- static void iotkit_secctl_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
- {
+          * bits should be zero.
-     IoTKitSecCtl *s = IOTKIT_SECCTL(obj);
+          */
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+         assert(dc->base.num_insns == 1);
-+    DeviceState *dev = DEVICE(obj);
+-        gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
-+    int i;
+-                      default_exception_el(dc));
-+
++        gen_swstep_exception(dc, 0, 0);
-+    iotkit_secctl_init_ppc(s, &s->apb[0], "apb_ppc0",
+         dc->base.is_jmp = DISAS_NORETURN;
-+                           IOTS_APB_PPC0_NUM_PORTS, 0);
+         return true;
 +    iotkit_secctl_init_ppc(s, &s->apb[1], "apb_ppc1",
 +                           IOTS_APB_PPC1_NUM_PORTS, 1);
 +
 +    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
 +        IoTKitSecCtlPPC *ppc = &s->apbexp[i];
 +        char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
 +        iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 4 + i);
 +        g_free(ppcname);
 +    }
 +    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
 +        IoTKitSecCtlPPC *ppc = &s->ahbexp[i];
 +        char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
 +        iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 20 + i);
 +        g_free(ppcname);
 +    }
 +
 +    qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
      memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
                            s, "iotkit-secctl-s-regs", 0x1000);
@@ -XXX,XX +XXX,XX @@ static void iotkit_secctl_init(Object *obj)
      sysbus_init_mmio(sbd, &s->ns_regs);
  }
 +static const VMStateDescription iotkit_secctl_ppc_vmstate = {
 +    .name = "iotkit-secctl-ppc",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(ns, IoTKitSecCtlPPC),
 +        VMSTATE_UINT32(sp, IoTKitSecCtlPPC),
 +        VMSTATE_UINT32(nsp, IoTKitSecCtlPPC),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription iotkit_secctl_vmstate = {
      .name = "iotkit-secctl",
      .version_id = 1,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(secppcintstat, IoTKitSecCtl),
 +        VMSTATE_UINT32(secppcinten, IoTKitSecCtl),
 +        VMSTATE_UINT32(secrespcfg, IoTKitSecCtl),
 +        VMSTATE_STRUCT_ARRAY(apb, IoTKitSecCtl, IOTS_NUM_APB_PPC, 1,
 +                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
 +        VMSTATE_STRUCT_ARRAY(apbexp, IoTKitSecCtl, IOTS_NUM_APB_EXP_PPC, 1,
 +                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
 +        VMSTATE_STRUCT_ARRAY(ahbexp, IoTKitSecCtl, IOTS_NUM_AHB_EXP_PPC, 1,
 +                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
          VMSTATE_END_OF_LIST()
      }
- };
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 08/39] target/arm: Define an IDAU interface
+[Qemu-devel] [PULL 05/29] target/arm: Fix routing of singlestep exceptions
-In v8M, the Implementation Defined Attribution Unit (IDAU) is
+When generating an architectural single-step exception we were
-a small piece of hardware typically implemented in the SoC
+routing it to the "default exception level", which is to say
-which provides board or SoC specific security attribution
+the same exception level we execute at except that EL0 exceptions
-information for each address that the CPU performs MPU/SAU
+go to EL1. This is incorrect because the debug exception level
-checks on. For QEMU, we model this with a QOM interface which
+can be configured by the guest for situations such as single
-is implemented by the board or SoC object and connected to
+stepping of EL0 and EL1 code by EL2.
 the CPU using a link property.
-This commit defines the new interface class, adds the link
+We have to track the target debug exception level in the TB
-property to the CPU object, and makes the SAU checking
+flags, because it is dependent on CPU state like HCR_EL2.TGE
-code call the IDAU interface if one is present.
+and MDCR_EL2.TDE. (That we were previously calling the
 arm_debug_target_el() function to determine dc->ss_same_el
 is itself a bug, though one that would only have manifested
 as incorrect syndrome information.) Since we are out of TB
 flag bits unless we want to expand into the cs_base field,
 we share some bits with the M-profile only HANDLER and
 STACKCHECK bits, since only A-profile has this singlestep.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1838913
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180220180325.29818-5-peter.maydell@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190805130952.4415-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    |  3 +++
+ target/arm/cpu.h           |  5 +++++
- target/arm/idau.h   | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.h     | 15 +++++++++++----
- target/arm/cpu.c    | 15 +++++++++++++
+ target/arm/helper.c        |  6 ++++++
- target/arm/helper.c | 28 +++++++++++++++++++++---
+ target/arm/translate-a64.c |  2 +-
-files changed, 104 insertions(+), 3 deletions(-)
+ target/arm/translate.c     |  4 +++-
- create mode 100644 target/arm/idau.h
+files changed, 26 insertions(+), 6 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)
-     /* MemoryRegion to use for secure physical accesses */
+ /* Target EL if we take a floating-point-disabled exception */
-     MemoryRegion *secure_memory;
+ FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2)
+ FIELD(TBFLAG_ANY, BE_DATA, 23, 1)
-+    /* For v8M, pointer to the IDAU interface provided by board/SoC */
++/*
-+    Object *idau;
++ * For A-profile only, target EL for debug exceptions.
 + * Note that this overlaps with the M-profile-only HANDLER and STACKCHECK bits.
 + */
 +FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2)
  /* Bit usage when in AArch32 state: */
  FIELD(TBFLAG_A32, THUMB, 0, 1)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      uint32_t svc_imm;
      int aarch64;
      int current_el;
 +    /* Debug target exception level for single-step exceptions */
 +    int debug_target_el;
      GHashTable *cp_regs;
      uint64_t features; /* CPU features bits */
      /* Because unallocated encodings generate different exception syndrome
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
       * ie A64 LDX*, LDAX*, A32/T32 LDREX*, LDAEX*.
       */
      bool is_ldex;
 -    /* True if a single-step exception will be taken to the current EL */
 -    bool ss_same_el;
      /* True if v8.3-PAuth is active.  */
      bool pauth_active;
      /* True with v8.5-BTI and SCTLR_ELx.BT* set.  */
@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
  /* Generate an architectural singlestep exception */
  static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
  {
 -    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
 -                  default_exception_el(s));
 +    bool same_el = (s->debug_target_el == s->current_el);
 +
-     /* 'compatible' string for this CPU for Linux device trees */
++    /*
-     const char *dtb_compatible;
++     * If singlestep is targeting a lower EL than the current one,
++     * then s->ss_active must be false and we can never get here.
-diff --git a/target/arm/idau.h b/target/arm/idau.h
++     */
-new file mode 100644
++    assert(s->debug_target_el >= s->current_el);
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/idau.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU ARM CPU -- interface for the Arm v8M IDAU
 + *
 + * Copyright (c) 2018 Linaro Ltd
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License
 + * as published by the Free Software Foundation; either version 2
 + * of the License, or (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program; if not, see
 + * <http://www.gnu.org/licenses/gpl-2.0.html>
 + *
 + * In the v8M architecture, the IDAU is a small piece of hardware
 + * typically implemented in the SoC which provides board or SoC
 + * specific security attribution information for each address that
 + * the CPU performs MPU/SAU checks on. For QEMU, we model this with a
 + * QOM interface which is implemented by the board or SoC object and
 + * connected to the CPU using a link property.
 + */
 +
-+#ifndef TARGET_ARM_IDAU_H
++    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
 +#define TARGET_ARM_IDAU_H
 +
 +#include "qom/object.h"
 +
 +#define TYPE_IDAU_INTERFACE "idau-interface"
 +#define IDAU_INTERFACE(obj) \
 +    INTERFACE_CHECK(IDAUInterface, (obj), TYPE_IDAU_INTERFACE)
 +#define IDAU_INTERFACE_CLASS(class) \
 +    OBJECT_CLASS_CHECK(IDAUInterfaceClass, (class), TYPE_IDAU_INTERFACE)
 +#define IDAU_INTERFACE_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(IDAUInterfaceClass, (obj), TYPE_IDAU_INTERFACE)
 +
 +typedef struct IDAUInterface {
 +    Object parent;
 +} IDAUInterface;
 +
 +#define IREGION_NOTVALID -1
 +
 +typedef struct IDAUInterfaceClass {
 +    InterfaceClass parent;
 +
 +    /* Check the specified address and return the IDAU security information
 +     * for it by filling in iregion, exempt, ns and nsc:
 +     *  iregion: IDAU region number, or IREGION_NOTVALID if not valid
 +     *  exempt: true if address is exempt from security attribution
 +     *  ns: true if the address is NonSecure
 +     *  nsc: true if the address is NonSecure-callable
 +     */
 +    void (*check)(IDAUInterface *ii, uint32_t address, int *iregion,
 +                  bool *exempt, bool *ns, bool *nsc);
 +} IDAUInterfaceClass;
 +
 +#endif
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "target/arm/idau.h"
  #include "qemu/error-report.h"
  #include "qapi/error.h"
  #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
          }
      }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {
 +        object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_UNREF_ON_RELEASE,
 +                                 &error_abort);
 +    }
 +
      qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
                               &error_abort);
  }
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_cpu_type_info = {
-     .class_init = arm_cpu_class_init,
+ /*
  };
 +static const TypeInfo idau_interface_type_info = {
 +    .name = TYPE_IDAU_INTERFACE,
 +    .parent = TYPE_INTERFACE,
 +    .class_size = sizeof(IDAUInterfaceClass),
 +};
 +
  static void arm_cpu_register_types(void)
  {
      const ARMCPUInfo *info = arm_cpus;
      type_register_static(&arm_cpu_type_info);
 +    type_register_static(&idau_interface_type_info);
      while (info->name) {
          cpu_register(info);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
- #include "qemu/osdep.h"
+         }
-+#include "target/arm/idau.h"
+     }
- #include "trace.h"
- #include "cpu.h"
++    if (!arm_feature(env, ARM_FEATURE_M)) {
- #include "internals.h"
++        int target_el = arm_debug_target_el(env);
@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,
       */
      ARMCPU *cpu = arm_env_get_cpu(env);
      int r;
 +    bool idau_exempt = false, idau_ns = true, idau_nsc = true;
 +    int idau_region = IREGION_NOTVALID;
 -    /* TODO: implement IDAU */
 +    if (cpu->idau) {
 +        IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
 +        IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
 +
-+        iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
++        flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);
 +                   &idau_nsc);
 +    }
      if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
          /* 0xf0000000..0xffffffff is always S for insn fetches */
          return;
      }
 -    if (v8m_is_sau_exempt(env, address, access_type)) {
 +    if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
          sattrs->ns = !regime_is_secure(env, mmu_idx);
          return;
      }
 +    if (idau_region != IREGION_NOTVALID) {
 +        sattrs->irvalid = true;
 +        sattrs->iregion = idau_region;
 +    }
 +
-     switch (env->sau.ctrl & 3) {
+     *pflags = flags;
-     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
+     *cs_base = 0;
          break;
@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,
              }
          }
 -        /* TODO when we support the IDAU then it may override the result here */
 +        /* The IDAU will override the SAU lookup results if it specifies
 +         * higher security than the SAU does.
 +         */
 +        if (!idau_ns) {
 +            if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
 +                sattrs->ns = false;
 +                sattrs->nsc = idau_nsc;
 +            }
 +        }
          break;
      }
  }
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
+     dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
+     dc->is_ldex = false;
+-    dc->ss_same_el = (arm_debug_target_el(env) == dc->current_el);
++    dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
+     /* Bound the number of insns to execute to those left on the page.  */
+     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+     dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
+     dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
+     dc->is_ldex = false;
+-    dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */
++    if (!arm_feature(env, ARM_FEATURE_M)) {
++        dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
++    }
+     dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 32/39] target/arm: Enable ARM_FEATURE_V8_RDM
+[Qemu-devel] [PULL 06/29] target/arm: Pass in pc to thumb_insn_is_16bit
 From: Richard Henderson <richard.henderson@linaro.org>
-Enable it for the "any" CPU used by *-linux-user.
+This function is used in two different contexts, and it will be
 clearer if the function is given the address to which it applies.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180228193125.20577-10-richard.henderson@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c   | 1 +
+ target/arm/translate.c | 14 +++++++-------
- target/arm/cpu64.c | 1 +
+file changed, 7 insertions(+), 7 deletions(-)
 files changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/translate.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_any_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     set_feature(&cpu->env, ARM_FEATURE_V8_SHA256);
+     }
      set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
      set_feature(&cpu->env, ARM_FEATURE_CRC);
 +    set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
      cpu->midr = 0xffffffff;
  }
- #endif
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+-static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
-index XXXXXXX..XXXXXXX 100644
++static bool thumb_insn_is_16bit(DisasContext *s, uint32_t pc, uint32_t insn)
---- a/target/arm/cpu64.c
+ {
-+++ b/target/arm/cpu64.c
+-    /* Return true if this is a 16 bit instruction. We must be precise
-@@ -XXX,XX +XXX,XX @@ static void aarch64_any_initfn(Object *obj)
+-     * about this (matching the decode).  We assume that s->pc still
-     set_feature(&cpu->env, ARM_FEATURE_V8_SM4);
+-     * points to the first 16 bits of the insn.
-     set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
++    /*
-     set_feature(&cpu->env, ARM_FEATURE_CRC);
++     * Return true if this is a 16 bit instruction. We must be precise
-+    set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
++     * about this (matching the decode).
-     set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
+      */
-     cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
+     if ((insn >> 11) < 0x1d) {
-     cpu->dcz_blocksize = 7; /*  512 bytes */
+         /* Definitely a 16-bit instruction */
@@ -XXX,XX +XXX,XX @@ static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
          return false;
      }
 -    if ((insn >> 11) == 0x1e && s->pc - s->page_start < TARGET_PAGE_SIZE - 3) {
 +    if ((insn >> 11) == 0x1e && pc - s->page_start < TARGET_PAGE_SIZE - 3) {
          /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
           * is not on the next page; we merge this into a 32-bit
           * insn.
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
       */
      uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 -    return !thumb_insn_is_16bit(s, insn);
 +    return !thumb_insn_is_16bit(s, s->pc, insn);
  }
  static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      }
      insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
 -    is_16bit = thumb_insn_is_16bit(dc, insn);
 +    is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
      dc->pc += 2;
      if (!is_16bit) {
          uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 29/39] target/arm: Decode aa64 armv8.1 scalar/vector x indexed element
+[Qemu-devel] [PULL 07/29] target/arm: Introduce pc_curr
 From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Add a new field to retain the address of the instruction currently
 being translated.  The 32-bit uses are all within subroutines used
 by a32 and t32.  This will become less obvious when t16 support is
 merged with a32+t32, and having a clear definition will help.
 Convert aarch64 as well for consistency.  Note that there is one
 instance of a pre-assert fprintf that used the wrong value for the
 address of the current instruction.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-7-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 29 +++++++++++++++++++++++++++++
+ target/arm/translate-a64.h |  2 +-
-file changed, 29 insertions(+)
+ target/arm/translate.h     |  2 ++
+ target/arm/translate-a64.c | 21 +++++++++++----------
  target/arm/translate.c     | 14 ++++++++------
 files changed, 22 insertions(+), 17 deletions(-)
 diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.h
 +++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s);
          qemu_log_mask(LOG_UNIMP,                                         \
                        "%s:%d: unsupported instruction encoding 0x%08x "  \
                        "at pc=%016" PRIx64 "\n",                          \
 -                      __FILE__, __LINE__, insn, s->pc - 4);              \
 +                      __FILE__, __LINE__, insn, s->pc_curr);             \
          unallocated_encoding(s);                                         \
      } while (0)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      const ARMISARegisters *isar;
      target_ulong pc;
 +    /* The address of the current instruction being translated. */
 +    target_ulong pc_curr;
      target_ulong page_start;
      uint32_t insn;
      /* Nonzero if this instruction has been conditionally skipped.  */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static inline AArch64DecodeFn *lookup_disas_fn(const AArch64DecodeTable *table,
-     case 0x19: /* FMULX */
+  */
-         is_fp = true;
+ static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
-         break;
+ {
-+    case 0x1d: /* SQRDMLAH */
+-    uint64_t addr = s->pc + sextract32(insn, 0, 26) * 4 - 4;
-+    case 0x1f: /* SQRDMLSH */
++    uint64_t addr = s->pc_curr + sextract32(insn, 0, 26) * 4;
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
-+            unallocated_encoding(s);
+     if (insn & (1U << 31)) {
-+            return;
+         /* BL Branch with link */
-+        }
+@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
-+        break;
+     sf = extract32(insn, 31, 1);
-     default:
+     op = extract32(insn, 24, 1); /* 0: CBZ; 1: CBNZ */
      rt = extract32(insn, 0, 5);
 -    addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
 +    addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
      tcg_cmp = read_cpu_reg(s, rt, sf);
      label_match = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
      bit_pos = (extract32(insn, 31, 1) << 5) | extract32(insn, 19, 5);
      op = extract32(insn, 24, 1); /* 0: TBZ; 1: TBNZ */
 -    addr = s->pc + sextract32(insn, 5, 14) * 4 - 4;
 +    addr = s->pc_curr + sextract32(insn, 5, 14) * 4;
      rt = extract32(insn, 0, 5);
      tcg_cmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
          unallocated_encoding(s);
          return;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+     }
-                                                 tcg_op, tcg_idx);
+-    addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
-                 }
++    addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
      cond = extract32(insn, 0, 4);
      reset_btype(s);
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
          TCGv_i32 tcg_syn, tcg_isread;
          uint32_t syndrome;
 -        gen_a64_set_pc_im(s->pc - 4);
 +        gen_a64_set_pc_im(s->pc_curr);
          tmpptr = tcg_const_ptr(ri);
          syndrome = syn_aa64_sysregtrap(op0, op1, op2, crn, crm, rt, isread);
          tcg_syn = tcg_const_i32(syndrome);
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
              /* The pre HVC helper handles cases when HVC gets trapped
               * as an undefined insn by runtime configuration.
               */
 -            gen_a64_set_pc_im(s->pc - 4);
 +            gen_a64_set_pc_im(s->pc_curr);
              gen_helper_pre_hvc(cpu_env);
              gen_ss_advance(s);
              gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
                  unallocated_encoding(s);
                  break;
-+            case 0x1d: /* SQRDMLAH */
+             }
-+                read_vec_element_i32(s, tcg_res, rd, pass,
+-            gen_a64_set_pc_im(s->pc - 4);
-+                                     is_scalar ? size : MO_32);
++            gen_a64_set_pc_im(s->pc_curr);
-+                if (size == 1) {
+             tmp = tcg_const_i32(syn_aa64_smc(imm16));
-+                    gen_helper_neon_qrdmlah_s16(tcg_res, cpu_env,
+             gen_helper_pre_smc(cpu_env, tmp);
-+                                                tcg_op, tcg_idx, tcg_res);
+             tcg_temp_free_i32(tmp);
-+                } else {
+@@ -XXX,XX +XXX,XX @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
-+                    gen_helper_neon_qrdmlah_s32(tcg_res, cpu_env,
-+                                                tcg_op, tcg_idx, tcg_res);
+     tcg_rt = cpu_reg(s, rt);
-+                }
-+                break;
+-    clean_addr = tcg_const_i64((s->pc - 4) + imm);
-+            case 0x1f: /* SQRDMLSH */
++    clean_addr = tcg_const_i64(s->pc_curr + imm);
-+                read_vec_element_i32(s, tcg_res, rd, pass,
+     if (is_vector) {
-+                                     is_scalar ? size : MO_32);
+         do_fp_ld(s, rt, clean_addr, size);
-+                if (size == 1) {
+     } else {
-+                    gen_helper_neon_qrdmlsh_s16(tcg_res, cpu_env,
+@@ -XXX,XX +XXX,XX @@ static void disas_pc_rel_adr(DisasContext *s, uint32_t insn)
-+                                                tcg_op, tcg_idx, tcg_res);
+     offset = sextract64(insn, 5, 19);
-+                } else {
+     offset = offset << 2 | extract32(insn, 29, 2);
-+                    gen_helper_neon_qrdmlsh_s32(tcg_res, cpu_env,
+     rd = extract32(insn, 0, 5);
-+                                                tcg_op, tcg_idx, tcg_res);
+-    base = s->pc - 4;
-+                }
++    base = s->pc_curr;
-+                break;
      if (page) {
          /* ADRP (page based) */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                  break;
              default:
+                 fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+-                        __func__, insn, fpopcode, s->pc);
++                        __func__, insn, fpopcode, s->pc_curr);
                  g_assert_not_reached();
              }
+@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
+ {
+     uint32_t insn;
++    s->pc_curr = s->pc;
+     insn = arm_ldl_code(env, s->pc, s->sctlr_b);
+     s->insn = insn;
+     s->pc += 4;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
+      * as an undefined insn by runtime configuration (ie before
+      * the insn really executes).
+      */
+-    gen_set_pc_im(s, s->pc - 4);
++    gen_set_pc_im(s, s->pc_curr);
+     gen_helper_pre_hvc(cpu_env);
+     /* Otherwise we will treat this as a real exception which
+      * happens after execution of the insn. (The distinction matters
+@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
+      */
+     TCGv_i32 tmp;
+-    gen_set_pc_im(s, s->pc - 4);
++    gen_set_pc_im(s, s->pc_curr);
+     tmp = tcg_const_i32(syn_aa32_smc());
+     gen_helper_pre_smc(cpu_env, tmp);
+     tcg_temp_free_i32(tmp);
+@@ -XXX,XX +XXX,XX @@ static void gen_msr_banked(DisasContext *s, int r, int sysm, int rn)
+     /* Sync state because msr_banked() can raise exceptions */
+     gen_set_condexec(s);
+-    gen_set_pc_im(s, s->pc - 4);
++    gen_set_pc_im(s, s->pc_curr);
+     tcg_reg = load_reg(s, rn);
+     tcg_tgtmode = tcg_const_i32(tgtmode);
+     tcg_regno = tcg_const_i32(regno);
+@@ -XXX,XX +XXX,XX @@ static void gen_mrs_banked(DisasContext *s, int r, int sysm, int rn)
+     /* Sync state because mrs_banked() can raise exceptions */
+     gen_set_condexec(s);
+-    gen_set_pc_im(s, s->pc - 4);
++    gen_set_pc_im(s, s->pc_curr);
+     tcg_reg = tcg_temp_new_i32();
+     tcg_tgtmode = tcg_const_i32(tgtmode);
+     tcg_regno = tcg_const_i32(regno);
+@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
+             }
+             gen_set_condexec(s);
+-            gen_set_pc_im(s, s->pc - 4);
++            gen_set_pc_im(s, s->pc_curr);
+             tmpptr = tcg_const_ptr(ri);
+             tcg_syn = tcg_const_i32(syndrome);
+             tcg_isread = tcg_const_i32(isread);
+@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
+     tmp = tcg_const_i32(mode);
+     /* get_r13_banked() will raise an exception if called from System mode */
+     gen_set_condexec(s);
+-    gen_set_pc_im(s, s->pc - 4);
++    gen_set_pc_im(s, s->pc_curr);
+     gen_helper_get_r13_banked(addr, cpu_env, tmp);
+     tcg_temp_free_i32(tmp);
+     switch (amode) {
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+         return;
+     }
++    dc->pc_curr = dc->pc;
+     insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
+     dc->insn = insn;
+     dc->pc += 4;
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+         return;
+     }
++    dc->pc_curr = dc->pc;
+     insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
+     is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
+     dc->pc += 2;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 30/39] target/arm: Decode aa32 armv8.1 three same
+[Qemu-devel] [PULL 08/29] target/arm: Introduce read_pc
 From: Richard Henderson <richard.henderson@linaro.org>
+We currently have 3 different ways of computing the architectural
+value of "PC" as seen in the ARM ARM.
+The value of s->pc has been incremented past the current insn,
+but that is all.  Thus for a32, PC = s->pc + 4; for t32, PC = s->pc;
+for t16, PC = s->pc + 2.  These differing computations make it
+impossible at present to unify the various code paths.
+With the newly introduced s->pc_curr, we can compute the correct
+value for all cases, using the formula given in the ARM ARM.
+This changes the behaviour for load_reg() and load_reg_var()
+when called with reg==15 from a 32-bit Thumb instruction:
+previously they would have returned the incorrect value
+of pc_curr + 6, and now they will return the architecturally
+correct value of PC, which is pc_curr + 4. This will not
+affect well-behaved guest software, because all of the places
+we call these functions from T32 code are instructions where
+using r15 is UNPREDICTABLE. Using the architectural PC value
+here is more consistent with the T16 and A32 behaviour.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180228193125.20577-8-richard.henderson@linaro.org
+Message-id: 20190807045335.1361-4-richard.henderson@linaro.org
 [PMM: added commit message note about UNPREDICTABLE T32 cases]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 86 +++++++++++++++++++++++++++++++++++++++-----------
+ target/arm/translate.c | 59 ++++++++++++++++--------------------------
-file changed, 67 insertions(+), 19 deletions(-)
+file changed, 23 insertions(+), 36 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline void store_cpu_offset(TCGv_i32 var, int offset)
- #include "disas/disas.h"
+ #define store_cpu_field(var, name) \
- #include "exec/exec-all.h"
+     store_cpu_offset(var, offsetof(CPUARMState, name))
- #include "tcg-op.h"
-+#include "tcg-op-gvec.h"
++/* The architectural value of PC.  */
- #include "qemu/log.h"
++static uint32_t read_pc(DisasContext *s)
  #include "qemu/bitops.h"
  #include "arm_ldst.h"
@@ -XXX,XX +XXX,XX @@ static void gen_neon_narrow_op(int op, int u, int size,
  #define NEON_3R_VPMAX 20
  #define NEON_3R_VPMIN 21
  #define NEON_3R_VQDMULH_VQRDMULH 22
 -#define NEON_3R_VPADD 23
 +#define NEON_3R_VPADD_VQRDMLAH 23
  #define NEON_3R_SHA 24 /* SHA1C,SHA1P,SHA1M,SHA1SU0,SHA256H{2},SHA256SU1 */
 -#define NEON_3R_VFM 25 /* VFMA, VFMS : float fused multiply-add */
 +#define NEON_3R_VFM_VQRDMLSH 25 /* VFMA, VFMS, VQRDMLSH */
  #define NEON_3R_FLOAT_ARITH 26 /* float VADD, VSUB, VPADD, VABD */
  #define NEON_3R_FLOAT_MULTIPLY 27 /* float VMLA, VMLS, VMUL */
  #define NEON_3R_FLOAT_CMP 28 /* float VCEQ, VCGE, VCGT */
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
      [NEON_3R_VPMAX] = 0x7,
      [NEON_3R_VPMIN] = 0x7,
      [NEON_3R_VQDMULH_VQRDMULH] = 0x6,
 -    [NEON_3R_VPADD] = 0x7,
 +    [NEON_3R_VPADD_VQRDMLAH] = 0x7,
      [NEON_3R_SHA] = 0xf, /* size field encodes op type */
 -    [NEON_3R_VFM] = 0x5, /* size bit 1 encodes op */
 +    [NEON_3R_VFM_VQRDMLSH] = 0x7, /* For VFM, size bit 1 encodes op */
      [NEON_3R_FLOAT_ARITH] = 0x5, /* size bit 1 encodes op */
      [NEON_3R_FLOAT_MULTIPLY] = 0x5, /* size bit 1 encodes op */
      [NEON_3R_FLOAT_CMP] = 0x5, /* size bit 1 encodes op */
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_2rm_sizes[] = {
      [NEON_2RM_VCVT_UF] = 0x4,
  };
 +
 +/* Expand v8.1 simd helper.  */
 +static int do_v81_helper(DisasContext *s, gen_helper_gvec_3_ptr *fn,
 +                         int q, int rd, int rn, int rm)
 +{
-+    if (arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
++    return s->pc_curr + (s->thumb ? 4 : 8);
 +        int opr_sz = (1 + q) * 8;
 +        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
 +                           vfp_reg_offset(1, rn),
 +                           vfp_reg_offset(1, rm), cpu_env,
 +                           opr_sz, opr_sz, 0, fn);
 +        return 0;
 +    }
 +    return 1;
 +}
 +
- /* Translate a NEON data processing instruction.  Return nonzero if the
+ /* Set a variable to the value of a CPU register.  */
-    instruction is invalid.
+ static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
-    We process data in a mixture of 32-bit and 64-bit chunks.
+ {
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+     if (reg == 15) {
-         if (q && ((rd | rn | rm) & 1)) {
+-        uint32_t addr;
-             return 1;
+-        /* normally, since we updated PC, we need only to add one insn */
-         }
+-        if (s->thumb)
--        /*
+-            addr = (long)s->pc + 2;
--         * The SHA-1/SHA-256 3-register instructions require special treatment
+-        else
--         * here, as their size field is overloaded as an op type selector, and
+-            addr = (long)s->pc + 4;
--         * they all consume their input in a single pass.
+-        tcg_gen_movi_i32(var, addr);
--         */
++        tcg_gen_movi_i32(var, read_pc(s));
--        if (op == NEON_3R_SHA) {
+     } else {
-+        switch (op) {
+         tcg_gen_mov_i32(var, cpu_R[reg]);
-+        case NEON_3R_SHA:
+     }
-+            /* The SHA-1/SHA-256 3-register instructions require special
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+             * treatment here, as their size field is overloaded as an
+             /* branch link and change to thumb (blx <offset>) */
-+             * op type selector, and they all consume their input in a
+             int32_t offset;
-+             * single pass.
-+             */
+-            val = (uint32_t)s->pc;
-             if (!q) {
+             tmp = tcg_temp_new_i32();
-                 return 1;
+-            tcg_gen_movi_i32(tmp, val);
-             }
++            tcg_gen_movi_i32(tmp, s->pc);
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+             store_reg(s, 14, tmp);
-             tcg_temp_free_ptr(ptr2);
+             /* Sign-extend the 24-bit offset */
-             tcg_temp_free_ptr(ptr3);
+             offset = (((int32_t)insn) << 8) >> 8;
-             return 0;
++            val = read_pc(s);
-+
+             /* offset * 4 + bit24 * 2 + (thumb bit) */
-+        case NEON_3R_VPADD_VQRDMLAH:
+             val += (offset << 2) | ((insn >> 23) & 2) | 1;
-+            if (!u) {
+-            /* pipeline offset */
-+                break;  /* VPADD */
+-            val += 4;
-+            }
+             /* protected by ARCH(5); above, near the start of uncond block */
-+            /* VQRDMLAH */
+             gen_bx_im(s, val);
-+            switch (size) {
+             return;
-+            case 1:
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+                return do_v81_helper(s, gen_helper_gvec_qrdmlah_s16,
+                         } else {
-+                                     q, rd, rn, rm);
+                             /* store */
-+            case 2:
+                             if (i == 15) {
-+                return do_v81_helper(s, gen_helper_gvec_qrdmlah_s32,
+-                                /* special case: r15 = PC + 8 */
-+                                     q, rd, rn, rm);
+-                                val = (long)s->pc + 4;
-+            }
+                                 tmp = tcg_temp_new_i32();
-+            return 1;
+-                                tcg_gen_movi_i32(tmp, val);
-+
++                                tcg_gen_movi_i32(tmp, read_pc(s));
-+        case NEON_3R_VFM_VQRDMLSH:
+                             } else if (user) {
-+            if (!u) {
+                                 tmp = tcg_temp_new_i32();
-+                /* VFM, VFMS */
+                                 tmp2 = tcg_const_i32(i);
-+                if (size == 1) {
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+                    return 1;
+                 int32_t offset;
-+                }
-+                break;
+                 /* branch (and link) */
-+            }
+-                val = (int32_t)s->pc;
-+            /* VQRDMLSH */
+                 if (insn & (1 << 24)) {
-+            switch (size) {
+                     tmp = tcg_temp_new_i32();
-+            case 1:
+-                    tcg_gen_movi_i32(tmp, val);
-+                return do_v81_helper(s, gen_helper_gvec_qrdmlsh_s16,
++                    tcg_gen_movi_i32(tmp, s->pc);
-+                                     q, rd, rn, rm);
+                     store_reg(s, 14, tmp);
-+            case 2:
+                 }
-+                return do_v81_helper(s, gen_helper_gvec_qrdmlsh_s32,
+                 offset = sextract32(insn << 2, 0, 26);
-+                                     q, rd, rn, rm);
+-                val += offset + 4;
-+            }
+-                gen_jmp(s, val);
-+            return 1;
++                gen_jmp(s, read_pc(s) + offset);
          }
          if (size == 3 && op != NEON_3R_LOGIC) {
              /* 64-bit element instructions. */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                  rm = rtmp;
              }
              break;
--        case NEON_3R_VPADD:
+         case 0xc:
--            if (u) {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
--                return 1;
+                 tcg_temp_free_i32(addr);
--            }
+             } else if ((insn & (7 << 5)) == 0) {
--            /* Fall through */
+                 /* Table Branch.  */
-+        case NEON_3R_VPADD_VQRDMLAH:
+-                if (rn == 15) {
-         case NEON_3R_VPMAX:
+-                    addr = tcg_temp_new_i32();
-         case NEON_3R_VPMIN:
+-                    tcg_gen_movi_i32(addr, s->pc);
-             pairwise = 1;
+-                } else {
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+-                    addr = load_reg(s, rn);
-                 return 1;
+-                }
 +                addr = load_reg(s, rn);
                  tmp = load_reg(s, rm);
                  tcg_gen_add_i32(addr, addr, tmp);
                  if (insn & (1 << 4)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                  }
                  tcg_temp_free_i32(addr);
                  tcg_gen_shli_i32(tmp, tmp, 1);
 -                tcg_gen_addi_i32(tmp, tmp, s->pc);
 +                tcg_gen_addi_i32(tmp, tmp, read_pc(s));
                  store_reg(s, 15, tmp);
              } else {
                  bool is_lasr = false;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                      tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
                  }
 -                offset += s->pc;
 +                offset += read_pc(s);
                  if (insn & (1 << 12)) {
                      /* b/bl */
                      gen_jmp(s, offset);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                  offset |= (insn & (1 << 11)) << 8;
                  /* jump to the offset */
 -                gen_jmp(s, s->pc + offset);
 +                gen_jmp(s, read_pc(s) + offset);
              }
+         } else {
+             /*
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
+         if (insn & (1 << 11)) {
+             rd = (insn >> 8) & 7;
+             /* load pc-relative.  Bit 1 of PC is ignored.  */
+-            val = s->pc + 2 + ((insn & 0xff) * 4);
++            val = read_pc(s) + ((insn & 0xff) * 4);
+             val &= ~(uint32_t)2;
+             addr = tcg_temp_new_i32();
+             tcg_gen_movi_i32(addr, val);
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
+         } else {
+             /* PC. bit 1 is ignored.  */
+             tmp = tcg_temp_new_i32();
+-            tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
++            tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
+         }
+         val = (insn & 0xff) * 4;
+         tcg_gen_addi_i32(tmp, tmp, val);
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
+                 tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
+             tcg_temp_free_i32(tmp);
+             offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
+-            val = (uint32_t)s->pc + 2;
+-            val += offset;
+-            gen_jmp(s, val);
++            gen_jmp(s, read_pc(s) + offset);
              break;
--        case NEON_3R_VFM:
--            if (!arm_dc_feature(s, ARM_FEATURE_VFP4) || u) {
+         case 15: /* IT, nop-hint.  */
-+        case NEON_3R_VFM_VQRDMLSH:
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-+            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
+         arm_skip_unless(s, cond);
-                 return 1;
-             }
+         /* jump to the offset */
 -        val = (uint32_t)s->pc + 2;
 +        val = read_pc(s);
          offset = ((int32_t)insn << 24) >> 24;
          val += offset << 1;
          gen_jmp(s, val);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
              break;
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+         }
-                 }
+         /* unconditional branch */
-             }
+-        val = (uint32_t)s->pc;
-             break;
++        val = read_pc(s);
--        case NEON_3R_VPADD:
+         offset = ((int32_t)insn << 21) >> 21;
-+        case NEON_3R_VPADD_VQRDMLAH:
+-        val += (offset << 1) + 2;
-             switch (size) {
++        val += offset << 1;
-             case 0: gen_helper_neon_padd_u8(tmp, tmp, tmp2); break;
+         gen_jmp(s, val);
-             case 1: gen_helper_neon_padd_u16(tmp, tmp, tmp2); break;
+         break;
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-               }
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-             }
+             /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
-             break;
+             uint32_t uoffset = ((int32_t)insn << 21) >> 9;
--        case NEON_3R_VFM:
-+        case NEON_3R_VFM_VQRDMLSH:
+-            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
-         {
++            tcg_gen_movi_i32(cpu_R[14], read_pc(s) + uoffset);
-             /* VFMA, VFMS: fused multiply-add */
+         }
-             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+         break;
      }
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 06/39] hw/arm/boot: Honour CPU's address space for image loads
+[Qemu-devel] [PULL 09/29] target/arm: Introduce add_reg_for_lit
-Instead of loading kernels, device trees, and the like to
+From: Richard Henderson <richard.henderson@linaro.org>
-the system address space, use the CPU's address space. This
-is important if we're trying to load the file to memory or
+Provide a common routine for the places that require ALIGN(PC, 4)
-via an alias memory region that is provided by an SoC
+as the base address as opposed to plain PC.  The two are always
-object and thus not mapped into the system address space.
+the same for A32, but the difference is meaningful for thumb mode.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-3-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 119 +++++++++++++++++++++++++++++++++++++---------------------
+ target/arm/translate-vfp.inc.c |  38 ++------
-file changed, 76 insertions(+), 43 deletions(-)
+ target/arm/translate.c         | 166 +++++++++++++++------------------
+files changed, 82 insertions(+), 122 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/hw/arm/boot.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
- #define ARM64_TEXT_OFFSET_OFFSET    8
+         offset = -offset;
- #define ARM64_MAGIC_OFFSET          56
+     }
-+static AddressSpace *arm_boot_address_space(ARMCPU *cpu,
+-    if (s->thumb && a->rn == 15) {
-+                                            const struct arm_boot_info *info)
+-        /* This is actually UNPREDICTABLE */
 -        addr = tcg_temp_new_i32();
 -        tcg_gen_movi_i32(addr, s->pc & ~2);
 -    } else {
 -        addr = load_reg(s, a->rn);
 -    }
 -    tcg_gen_addi_i32(addr, addr, offset);
 +    /* For thumb, use of PC is UNPREDICTABLE.  */
 +    addr = add_reg_for_lit(s, a->rn, offset);
      tmp = tcg_temp_new_i32();
      if (a->l) {
          gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
          offset = -offset;
      }
 -    if (s->thumb && a->rn == 15) {
 -        /* This is actually UNPREDICTABLE */
 -        addr = tcg_temp_new_i32();
 -        tcg_gen_movi_i32(addr, s->pc & ~2);
 -    } else {
 -        addr = load_reg(s, a->rn);
 -    }
 -    tcg_gen_addi_i32(addr, addr, offset);
 +    /* For thumb, use of PC is UNPREDICTABLE.  */
 +    addr = add_reg_for_lit(s, a->rn, offset);
      tmp = tcg_temp_new_i64();
      if (a->l) {
          gen_aa32_ld64(s, tmp, addr, get_mem_index(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, arg_VLDM_VSTM_sp *a)
          return true;
      }
 -    if (s->thumb && a->rn == 15) {
 -        /* This is actually UNPREDICTABLE */
 -        addr = tcg_temp_new_i32();
 -        tcg_gen_movi_i32(addr, s->pc & ~2);
 -    } else {
 -        addr = load_reg(s, a->rn);
 -    }
 +    /* For thumb, use of PC is UNPREDICTABLE.  */
 +    addr = add_reg_for_lit(s, a->rn, 0);
      if (a->p) {
          /* pre-decrement */
          tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, arg_VLDM_VSTM_dp *a)
          return true;
      }
 -    if (s->thumb && a->rn == 15) {
 -        /* This is actually UNPREDICTABLE */
 -        addr = tcg_temp_new_i32();
 -        tcg_gen_movi_i32(addr, s->pc & ~2);
 -    } else {
 -        addr = load_reg(s, a->rn);
 -    }
 +    /* For thumb, use of PC is UNPREDICTABLE.  */
 +    addr = add_reg_for_lit(s, a->rn, 0);
      if (a->p) {
          /* pre-decrement */
          tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
      return tmp;
  }
 +/*
 + * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
 + * This is used for load/store for which use of PC implies (literal),
 + * or ADD that implies ADR.
 + */
 +static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
 +{
-+    /* Return the address space to use for bootloader reads and writes.
++    TCGv_i32 tmp = tcg_temp_new_i32();
 +     * We prefer the secure address space if the CPU has it and we're
 +     * going to boot the guest into it.
 +     */
 +    int asidx;
 +    CPUState *cs = CPU(cpu);
 +
-+    if (arm_feature(&cpu->env, ARM_FEATURE_EL3) && info->secure_boot) {
++    if (reg == 15) {
-+        asidx = ARMASIdx_S;
++        tcg_gen_movi_i32(tmp, (read_pc(s) & ~3) + ofs);
 +    } else {
-+        asidx = ARMASIdx_NS;
++        tcg_gen_addi_i32(tmp, cpu_R[reg], ofs);
 +    }
-+
++    return tmp;
 +    return cpu_get_address_space(cs, asidx);
 +}
 +
- typedef enum {
+ /* Set a CPU register.  The source must be a temporary and will be
-     FIXUP_NONE = 0,     /* do nothing */
+    marked as dead.  */
-     FIXUP_TERMINATOR,   /* end of insns */
+ static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
-@@ -XXX,XX +XXX,XX @@ static const ARMInsnFixup smpboot[] = {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
- };
+                  */
+                 bool wback = extract32(insn, 21, 1);
- static void write_bootloader(const char *name, hwaddr addr,
--                             const ARMInsnFixup *insns, uint32_t *fixupcontext)
+-                if (rn == 15) {
-+                             const ARMInsnFixup *insns, uint32_t *fixupcontext,
+-                    if (insn & (1 << 21)) {
-+                             AddressSpace *as)
+-                        /* UNPREDICTABLE */
- {
+-                        goto illegal_op;
-     /* Fix up the specified bootloader fragment and write it into
+-                    }
-      * guest memory using rom_add_blob_fixed(). fixupcontext is
+-                    addr = tcg_temp_new_i32();
-@@ -XXX,XX +XXX,XX @@ static void write_bootloader(const char *name, hwaddr addr,
+-                    tcg_gen_movi_i32(addr, s->pc & ~3);
-         code[i] = tswap32(insn);
+-                } else {
-     }
+-                    addr = load_reg(s, rn);
++                if (rn == 15 && (insn & (1 << 21))) {
--    rom_add_blob_fixed(name, code, len * sizeof(uint32_t), addr);
++                    /* UNPREDICTABLE */
-+    rom_add_blob_fixed_as(name, code, len * sizeof(uint32_t), addr, as);
++                    goto illegal_op;
+                 }
      g_free(code);
  }
@@ -XXX,XX +XXX,XX @@ static void default_write_secondary(ARMCPU *cpu,
                                      const struct arm_boot_info *info)
  {
      uint32_t fixupcontext[FIXUP_MAX];
 +    AddressSpace *as = arm_boot_address_space(cpu, info);
      fixupcontext[FIXUP_GIC_CPU_IF] = info->gic_cpu_if_addr;
      fixupcontext[FIXUP_BOOTREG] = info->smp_bootreg_addr;
@@ -XXX,XX +XXX,XX @@ static void default_write_secondary(ARMCPU *cpu,
      }
      write_bootloader("smpboot", info->smp_loader_start,
 -                     smpboot, fixupcontext);
 +                     smpboot, fixupcontext, as);
  }
  void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                              const struct arm_boot_info *info,
                                              hwaddr mvbar_addr)
  {
 +    AddressSpace *as = arm_boot_address_space(cpu, info);
      int n;
      uint32_t mvbar_blob[] = {
          /* mvbar_addr: secure monitor vectors
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
      for (n = 0; n < ARRAY_SIZE(mvbar_blob); n++) {
          mvbar_blob[n] = tswap32(mvbar_blob[n]);
      }
 -    rom_add_blob_fixed("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
 -                       mvbar_addr);
 +    rom_add_blob_fixed_as("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
 +                          mvbar_addr, as);
      for (n = 0; n < ARRAY_SIZE(board_setup_blob); n++) {
          board_setup_blob[n] = tswap32(board_setup_blob[n]);
      }
 -    rom_add_blob_fixed("board-setup", board_setup_blob,
 -                       sizeof(board_setup_blob), info->board_setup_addr);
 +    rom_add_blob_fixed_as("board-setup", board_setup_blob,
 +                          sizeof(board_setup_blob), info->board_setup_addr, as);
  }
  static void default_reset_secondary(ARMCPU *cpu,
                                      const struct arm_boot_info *info)
  {
 +    AddressSpace *as = arm_boot_address_space(cpu, info);
      CPUState *cs = CPU(cpu);
 -    address_space_stl_notdirty(&address_space_memory, info->smp_bootreg_addr,
 +    address_space_stl_notdirty(as, info->smp_bootreg_addr,
 , MEMTXATTRS_UNSPECIFIED, NULL);
      cpu_set_pc(cs, info->smp_loader_start);
  }
@@ -XXX,XX +XXX,XX @@ static inline bool have_dtb(const struct arm_boot_info *info)
  }
  #define WRITE_WORD(p, value) do { \
 -    address_space_stl_notdirty(&address_space_memory, p, value, \
 +    address_space_stl_notdirty(as, p, value, \
                                 MEMTXATTRS_UNSPECIFIED, NULL);  \
      p += 4;                       \
  } while (0)
 -static void set_kernel_args(const struct arm_boot_info *info)
 +static void set_kernel_args(const struct arm_boot_info *info, AddressSpace *as)
  {
      int initrd_size = info->initrd_size;
      hwaddr base = info->loader_start;
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
          int cmdline_size;
          cmdline_size = strlen(info->kernel_cmdline);
 -        cpu_physical_memory_write(p + 8, info->kernel_cmdline,
 -                                  cmdline_size + 1);
 +        address_space_write(as, p + 8, MEMTXATTRS_UNSPECIFIED,
 +                            (const uint8_t *)info->kernel_cmdline,
 +                            cmdline_size + 1);
          cmdline_size = (cmdline_size >> 2) + 1;
          WRITE_WORD(p, cmdline_size + 2);
          WRITE_WORD(p, 0x54410009);
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
          atag_board_len = (info->atag_board(info, atag_board_buf) + 3) & ~3;
          WRITE_WORD(p, (atag_board_len + 8) >> 2);
          WRITE_WORD(p, 0x414f4d50);
 -        cpu_physical_memory_write(p, atag_board_buf, atag_board_len);
 +        address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
 +                            atag_board_buf, atag_board_len);
          p += atag_board_len;
      }
      /* ATAG_END */
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
      WRITE_WORD(p, 0);
  }
 -static void set_kernel_args_old(const struct arm_boot_info *info)
 +static void set_kernel_args_old(const struct arm_boot_info *info,
 +                                AddressSpace *as)
  {
      hwaddr p;
      const char *s;
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args_old(const struct arm_boot_info *info)
      }
      s = info->kernel_cmdline;
      if (s) {
 -        cpu_physical_memory_write(p, s, strlen(s) + 1);
 +        address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
 +                            (const uint8_t *)s, strlen(s) + 1);
      } else {
          WRITE_WORD(p, 0);
      }
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
   * @addr:       the address to load the image at
   * @binfo:      struct describing the boot environment
   * @addr_limit: upper limit of the available memory area at @addr
 + * @as:         address space to load image to
   *
   * Load a device tree supplied by the machine or by the user  with the
   * '-dtb' command line option, and put it at offset @addr in target
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
   * Note: Must not be called unless have_dtb(binfo) is true.
   */
  static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 -                    hwaddr addr_limit)
 +                    hwaddr addr_limit, AddressSpace *as)
  {
      void *fdt = NULL;
      int size, rc;
@@ -XXX,XX +XXX,XX @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
      /* Put the DTB into the memory map as a ROM image: this will ensure
       * the DTB is copied again upon reset, even if addr points into RAM.
       */
 -    rom_add_blob_fixed("dtb", fdt, size, addr);
 +    rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
      g_free(fdt);
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
              }
              if (cs == first_cpu) {
 +                AddressSpace *as = arm_boot_address_space(cpu, info);
 +
-                 cpu_set_pc(cs, info->loader_start);
++                addr = add_reg_for_lit(s, rn, 0);
+                 offset = (insn & 0xff) * 4;
-                 if (!have_dtb(info)) {
+                 if ((insn & (1 << 23)) == 0) {
-                     if (old_param) {
+                     offset = -offset;
--                        set_kernel_args_old(info);
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+                        set_kernel_args_old(info, as);
+                         store_reg(s, rd, tmp);
                      } else {
--                        set_kernel_args(info);
+                         /* Add/sub 12-bit immediate.  */
-+                        set_kernel_args(info, as);
+-                        if (rn == 15) {
 -                            offset = s->pc & ~(uint32_t)3;
 -                            if (insn & (1 << 23))
 -                                offset -= imm;
 -                            else
 -                                offset += imm;
 -                            tmp = tcg_temp_new_i32();
 -                            tcg_gen_movi_i32(tmp, offset);
 -                            store_reg(s, rd, tmp);
 +                        if (insn & (1 << 23)) {
 +                            imm = -imm;
 +                        }
 +                        tmp = add_reg_for_lit(s, rn, imm);
 +                        if (rn == 13 && rd == 13) {
 +                            /* ADD SP, SP, imm or SUB SP, SP, imm */
 +                            store_sp_checked(s, tmp);
                          } else {
 -                            tmp = load_reg(s, rn);
 -                            if (insn & (1 << 23))
 -                                tcg_gen_subi_i32(tmp, tmp, imm);
 -                            else
 -                                tcg_gen_addi_i32(tmp, tmp, imm);
 -                            if (rn == 13 && rd == 13) {
 -                                /* ADD SP, SP, imm or SUB SP, SP, imm */
 -                                store_sp_checked(s, tmp);
 -                            } else {
 -                                store_reg(s, rd, tmp);
 -                            }
 +                            store_reg(s, rd, tmp);
                          }
                      }
                  }
-             } else {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
@@ -XXX,XX +XXX,XX @@ static int do_arm_linux_init(Object *obj, void *opaque)
  static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
                               uint64_t *lowaddr, uint64_t *highaddr,
 -                             int elf_machine)
 +                             int elf_machine, AddressSpace *as)
  {
      bool elf_is64;
      union {
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
          }
      }
 -    ret = load_elf(info->kernel_filename, NULL, NULL,
 -                   pentry, lowaddr, highaddr, big_endian, elf_machine,
 -                   1, data_swab);
 +    ret = load_elf_as(info->kernel_filename, NULL, NULL,
 +                      pentry, lowaddr, highaddr, big_endian, elf_machine,
 +                      1, data_swab, as);
      if (ret <= 0) {
          /* The header loaded but the image didn't */
          exit(1);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
  }
  static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
 -                                   hwaddr *entry)
 +                                   hwaddr *entry, AddressSpace *as)
  {
      hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
      uint8_t *buffer;
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
      }
      *entry = mem_base + kernel_load_offset;
 -    rom_add_blob_fixed(filename, buffer, size, *entry);
 +    rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
      g_free(buffer);
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
      ARMCPU *cpu = n->cpu;
      struct arm_boot_info *info =
          container_of(n, struct arm_boot_info, load_kernel_notifier);
 +    AddressSpace *as = arm_boot_address_space(cpu, info);
      /* The board code is not supposed to set secure_board_setup unless
       * running its code in secure mode is actually possible, and KVM
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
               * the kernel is supposed to be loaded by the bootloader), copy the
               * DTB to the base of RAM for the bootloader to pick up.
               */
 -            if (load_dtb(info->loader_start, info, 0) < 0) {
 +            if (load_dtb(info->loader_start, info, 0, as) < 0) {
                  exit(1);
              }
          }
-@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
+         memidx = get_mem_index(s);
+-        if (rn == 15) {
-     /* Assume that raw images are linux kernels, and ELF images are not.  */
+-            addr = tcg_temp_new_i32();
-     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
+-            /* PC relative.  */
--                               &elf_high_addr, elf_machine);
+-            /* s->pc has already been incremented by 4.  */
-+                               &elf_high_addr, elf_machine, as);
+-            imm = s->pc & 0xfffffffc;
-     if (kernel_size > 0 && have_dtb(info)) {
+-            if (insn & (1 << 23))
-         /* If there is still some room left at the base of RAM, try and put
+-                imm += insn & 0xfff;
-          * the DTB there like we do for images loaded with -bios or -pflash.
+-            else
-@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
+-                imm -= insn & 0xfff;
-             if (elf_low_addr < info->loader_start) {
+-            tcg_gen_movi_i32(addr, imm);
-                 elf_low_addr = 0;
++        imm = insn & 0xfff;
-             }
++        if (insn & (1 << 23)) {
--            if (load_dtb(info->loader_start, info, elf_low_addr) < 0) {
++            /* PC relative or Positive offset.  */
-+            if (load_dtb(info->loader_start, info, elf_low_addr, as) < 0) {
++            addr = add_reg_for_lit(s, rn, imm);
-                 exit(1);
++        } else if (rn == 15) {
 +            /* PC relative with negative offset.  */
 +            addr = add_reg_for_lit(s, rn, -imm);
          } else {
              addr = load_reg(s, rn);
 -            if (insn & (1 << 23)) {
 -                /* Positive offset.  */
 -                imm = insn & 0xfff;
 -                tcg_gen_addi_i32(addr, addr, imm);
 -            } else {
 -                imm = insn & 0xff;
 -                switch ((insn >> 8) & 0xf) {
 -                case 0x0: /* Shifted Register.  */
 -                    shift = (insn >> 4) & 0xf;
 -                    if (shift > 3) {
 -                        tcg_temp_free_i32(addr);
 -                        goto illegal_op;
 -                    }
 -                    tmp = load_reg(s, rm);
 -                    if (shift)
 -                        tcg_gen_shli_i32(tmp, tmp, shift);
 -                    tcg_gen_add_i32(addr, addr, tmp);
 -                    tcg_temp_free_i32(tmp);
 -                    break;
 -                case 0xc: /* Negative offset.  */
 -                    tcg_gen_addi_i32(addr, addr, -imm);
 -                    break;
 -                case 0xe: /* User privilege.  */
 -                    tcg_gen_addi_i32(addr, addr, imm);
 -                    memidx = get_a32_user_mem_index(s);
 -                    break;
 -                case 0x9: /* Post-decrement.  */
 -                    imm = -imm;
 -                    /* Fall through.  */
 -                case 0xb: /* Post-increment.  */
 -                    postinc = 1;
 -                    writeback = 1;
 -                    break;
 -                case 0xd: /* Pre-decrement.  */
 -                    imm = -imm;
 -                    /* Fall through.  */
 -                case 0xf: /* Pre-increment.  */
 -                    writeback = 1;
 -                    break;
 -                default:
 +            imm = insn & 0xff;
 +            switch ((insn >> 8) & 0xf) {
 +            case 0x0: /* Shifted Register.  */
 +                shift = (insn >> 4) & 0xf;
 +                if (shift > 3) {
                      tcg_temp_free_i32(addr);
                      goto illegal_op;
                  }
 +                tmp = load_reg(s, rm);
 +                if (shift) {
 +                    tcg_gen_shli_i32(tmp, tmp, shift);
 +                }
 +                tcg_gen_add_i32(addr, addr, tmp);
 +                tcg_temp_free_i32(tmp);
 +                break;
 +            case 0xc: /* Negative offset.  */
 +                tcg_gen_addi_i32(addr, addr, -imm);
 +                break;
 +            case 0xe: /* User privilege.  */
 +                tcg_gen_addi_i32(addr, addr, imm);
 +                memidx = get_a32_user_mem_index(s);
 +                break;
 +            case 0x9: /* Post-decrement.  */
 +                imm = -imm;
 +                /* Fall through.  */
 +            case 0xb: /* Post-increment.  */
 +                postinc = 1;
 +                writeback = 1;
 +                break;
 +            case 0xd: /* Pre-decrement.  */
 +                imm = -imm;
 +                /* Fall through.  */
 +            case 0xf: /* Pre-increment.  */
 +                writeback = 1;
 +                break;
 +            default:
 +                tcg_temp_free_i32(addr);
 +                goto illegal_op;
              }
          }
-     }
-     entry = elf_entry;
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-     if (kernel_size < 0) {
+         if (insn & (1 << 11)) {
--        kernel_size = load_uimage(info->kernel_filename, &entry, NULL,
+             rd = (insn >> 8) & 7;
--                                  &is_linux, NULL, NULL);
+             /* load pc-relative.  Bit 1 of PC is ignored.  */
-+        kernel_size = load_uimage_as(info->kernel_filename, &entry, NULL,
+-            val = read_pc(s) + ((insn & 0xff) * 4);
-+                                     &is_linux, NULL, NULL, as);
+-            val &= ~(uint32_t)2;
-     }
+-            addr = tcg_temp_new_i32();
-     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
+-            tcg_gen_movi_i32(addr, val);
-         kernel_size = load_aarch64_image(info->kernel_filename,
++            addr = add_reg_for_lit(s, 15, (insn & 0xff) * 4);
--                                         info->loader_start, &entry);
+             tmp = tcg_temp_new_i32();
-+                                         info->loader_start, &entry, as);
+             gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
-         is_linux = 1;
+                                rd | ISSIs16Bit);
-     } else if (kernel_size < 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-         /* 32-bit ARM */
+          *  - Add PC/SP (immediate)
-         entry = info->loader_start + KERNEL_LOAD_ADDR;
+          */
--        kernel_size = load_image_targphys(info->kernel_filename, entry,
+         rd = (insn >> 8) & 7;
--                                          info->ram_size - KERNEL_LOAD_ADDR);
+-        if (insn & (1 << 11)) {
-+        kernel_size = load_image_targphys_as(info->kernel_filename, entry,
+-            /* SP */
-+                                             info->ram_size - KERNEL_LOAD_ADDR,
+-            tmp = load_reg(s, 13);
-+                                             as);
+-        } else {
-         is_linux = 1;
+-            /* PC. bit 1 is ignored.  */
-     }
+-            tmp = tcg_temp_new_i32();
-     if (kernel_size < 0) {
+-            tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
-@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
+-        }
-         uint32_t fixupcontext[FIXUP_MAX];
+         val = (insn & 0xff) * 4;
+-        tcg_gen_addi_i32(tmp, tmp, val);
-         if (info->initrd_filename) {
++        tmp = add_reg_for_lit(s, insn & (1 << 11) ? 13 : 15, val);
--            initrd_size = load_ramdisk(info->initrd_filename,
+         store_reg(s, rd, tmp);
--                                       info->initrd_start,
+         break;
--                                       info->ram_size -
 -                                       info->initrd_start);
 +            initrd_size = load_ramdisk_as(info->initrd_filename,
 +                                          info->initrd_start,
 +                                          info->ram_size - info->initrd_start,
 +                                          as);
              if (initrd_size < 0) {
 -                initrd_size = load_image_targphys(info->initrd_filename,
 -                                                  info->initrd_start,
 -                                                  info->ram_size -
 -                                                  info->initrd_start);
 +                initrd_size = load_image_targphys_as(info->initrd_filename,
 +                                                     info->initrd_start,
 +                                                     info->ram_size -
 +                                                     info->initrd_start,
 +                                                     as);
              }
              if (initrd_size < 0) {
                  error_report("could not load initrd '%s'",
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
              /* Place the DTB after the initrd in memory with alignment. */
              dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size, align);
 -            if (load_dtb(dtb_start, info, 0) < 0) {
 +            if (load_dtb(dtb_start, info, 0, as) < 0) {
                  exit(1);
              }
              fixupcontext[FIXUP_ARGPTR] = dtb_start;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
          fixupcontext[FIXUP_ENTRYPOINT] = entry;
          write_bootloader("bootloader", info->loader_start,
 -                         primary_loader, fixupcontext);
 +                         primary_loader, fixupcontext, as);
          if (info->nb_cpus > 1) {
              info->write_secondary_boot(cpu, info);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 39/39] target/arm: Enable ARM_FEATURE_V8_FCMA
+[Qemu-devel] [PULL 10/29] target/arm: Remove redundant s->pc & ~1
 From: Richard Henderson <richard.henderson@linaro.org>
-Enable it for the "any" CPU used by *-linux-user.
+The thumb bit has already been removed from s->pc, and is always even.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180228193125.20577-17-richard.henderson@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c   | 1 +
+ target/arm/translate.c | 10 +++++-----
- target/arm/cpu64.c | 1 +
+file changed, 5 insertions(+), 5 deletions(-)
 files changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/translate.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_any_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
-     set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
-     set_feature(&cpu->env, ARM_FEATURE_CRC);
+ static inline void gen_lookup_tb(DisasContext *s)
-     set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
+ {
-+    set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);
+-    tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
-     cpu->midr = 0xffffffff;
++    tcg_gen_movi_i32(cpu_R[15], s->pc);
      s->base.is_jmp = DISAS_EXIT;
  }
- #endif
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-index XXXXXXX..XXXXXXX 100644
+                  * self-modifying code correctly and also to take
---- a/target/arm/cpu64.c
+                  * any pending interrupts immediately.
-+++ b/target/arm/cpu64.c
+                  */
-@@ -XXX,XX +XXX,XX @@ static void aarch64_any_initfn(Object *obj)
+-                gen_goto_tb(s, 0, s->pc & ~1);
-     set_feature(&cpu->env, ARM_FEATURE_CRC);
++                gen_goto_tb(s, 0, s->pc);
-     set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
+                 return;
-     set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
+             case 7: /* sb */
-+    set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);
+                 if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
-     cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     cpu->dcz_blocksize = 7; /*  512 bytes */
+                  * for TCG; MB and end the TB instead.
- }
+                  */
                  tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
 -                gen_goto_tb(s, 0, s->pc & ~1);
 +                gen_goto_tb(s, 0, s->pc);
                  return;
              default:
                  goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                               * and also to take any pending interrupts
                               * immediately.
                               */
 -                            gen_goto_tb(s, 0, s->pc & ~1);
 +                            gen_goto_tb(s, 0, s->pc);
                              break;
                          case 7: /* sb */
                              if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                               * for TCG; MB and end the TB instead.
                               */
                              tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
 -                            gen_goto_tb(s, 0, s->pc & ~1);
 +                            gen_goto_tb(s, 0, s->pc);
                              break;
                          default:
                              goto illegal_op;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 35/39] target/arm: Decode aa64 armv8.3 fcmla
+[Qemu-devel] [PULL 11/29] target/arm: Replace s->pc with s->base.pc_next
 From: Richard Henderson <richard.henderson@linaro.org>
+We must update s->base.pc_next when we return from the translate_insn
+hook to the main translator loop.  By incrementing s->base.pc_next
+immediately after reading the insn word, "pc_next" contains the address
+of the next instruction throughout translation.
+All remaining uses of s->pc are referencing the address of the next insn,
+so this is now a simple global replacement.  Remove the "s->pc" field.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-13-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: renamed e1/e2/e3/e4 to use the same naming as the version
- of the pseudocode in the Arm ARM]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  11 ++++
+ target/arm/translate.h     |   1 -
- target/arm/translate-a64.c |  94 +++++++++++++++++++++++++---
+ target/arm/translate-a64.c |  51 +++++++++---------
- target/arm/vec_helper.c    | 149 +++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.c     | 103 ++++++++++++++++++-------------------
-files changed, 246 insertions(+), 8 deletions(-)
+files changed, 72 insertions(+), 83 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/translate.h
-+++ b/target/arm/helper.h
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
- DEF_HELPER_FLAGS_5(gvec_fcaddd, TCG_CALL_NO_RWG,
+     DisasContextBase base;
-                    void, ptr, ptr, ptr, ptr, i32)
+     const ARMISARegisters *isar;
-+DEF_HELPER_FLAGS_5(gvec_fcmlah, TCG_CALL_NO_RWG,
+-    target_ulong pc;
-+                   void, ptr, ptr, ptr, ptr, i32)
+     /* The address of the current instruction being translated. */
-+DEF_HELPER_FLAGS_5(gvec_fcmlah_idx, TCG_CALL_NO_RWG,
+     target_ulong pc_curr;
-+                   void, ptr, ptr, ptr, ptr, i32)
+     target_ulong page_start;
 +DEF_HELPER_FLAGS_5(gvec_fcmlas, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_fcmlas_idx, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_fcmlad, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +
  #ifdef TARGET_AARCH64
  #include "helper-a64.h"
  #endif
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
-         }
-         feature = ARM_FEATURE_V8_RDM;
+ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
-         break;
+ {
-+    case 0x8: /* FCMLA, #0 */
+-    gen_a64_set_pc_im(s->pc - offset);
-+    case 0x9: /* FCMLA, #90 */
++    gen_a64_set_pc_im(s->base.pc_next - offset);
-+    case 0xa: /* FCMLA, #180 */
+     gen_exception_internal(excp);
-+    case 0xb: /* FCMLA, #270 */
+     s->base.is_jmp = DISAS_NORETURN;
-     case 0xc: /* FCADD, #90 */
+ }
-     case 0xe: /* FCADD, #270 */
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
-         if (size == 0
+ static void gen_exception_insn(DisasContext *s, int offset, int excp,
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
+                                uint32_t syndrome, uint32_t target_el)
-         }
+ {
 -    gen_a64_set_pc_im(s->pc - offset);
 +    gen_a64_set_pc_im(s->base.pc_next - offset);
      gen_exception(excp, syndrome, target_el);
      s->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset,
  {
      TCGv_i32 tcg_syn;
 -    gen_a64_set_pc_im(s->pc - offset);
 +    gen_a64_set_pc_im(s->base.pc_next - offset);
      tcg_syn = tcg_const_i32(syndrome);
      gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
      tcg_temp_free_i32(tcg_syn);
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
      if (insn & (1U << 31)) {
          /* BL Branch with link */
 -        tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
 +        tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
      }
      /* B Branch / BL Branch with link */
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
      tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
                          tcg_cmp, 0, label_match);
 -    gen_goto_tb(s, 0, s->pc);
 +    gen_goto_tb(s, 0, s->base.pc_next);
      gen_set_label(label_match);
      gen_goto_tb(s, 1, addr);
  }
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
      tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
                          tcg_cmp, 0, label_match);
      tcg_temp_free_i64(tcg_cmp);
 -    gen_goto_tb(s, 0, s->pc);
 +    gen_goto_tb(s, 0, s->base.pc_next);
      gen_set_label(label_match);
      gen_goto_tb(s, 1, addr);
  }
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
          /* genuinely conditional branches */
          TCGLabel *label_match = gen_new_label();
          arm_gen_test_cc(cond, label_match);
 -        gen_goto_tb(s, 0, s->pc);
 +        gen_goto_tb(s, 0, s->base.pc_next);
          gen_set_label(label_match);
          gen_goto_tb(s, 1, addr);
      } else {
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
           * any pending interrupts immediately.
           */
          reset_btype(s);
 -        gen_goto_tb(s, 0, s->pc);
 +        gen_goto_tb(s, 0, s->base.pc_next);
          return;
-+    case 0x8: /* FCMLA, #0 */
+     case 7: /* SB */
-+    case 0x9: /* FCMLA, #90 */
+@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
-+    case 0xa: /* FCMLA, #180 */
+          * MB and end the TB instead.
-+    case 0xb: /* FCMLA, #270 */
+          */
-+        rot = extract32(opcode, 0, 2);
+         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-+        switch (size) {
+-        gen_goto_tb(s, 0, s->pc);
-+        case 1:
++        gen_goto_tb(s, 0, s->base.pc_next);
-+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, true, rot,
+         return;
-+                              gen_helper_gvec_fcmlah);
-+            break;
+     default:
-+        case 2:
+@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
-+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, false, rot,
+         gen_a64_set_pc(s, dst);
-+                              gen_helper_gvec_fcmlas);
+         /* BLR also needs to load return address */
-+            break;
+         if (opc == 1) {
-+        case 3:
+-            tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
-+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, false, rot,
++            tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
 +                              gen_helper_gvec_fcmlad);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +        return;
 +
      case 0xc: /* FCADD, #90 */
      case 0xe: /* FCADD, #270 */
          rot = extract32(opcode, 1, 1);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
      int rn = extract32(insn, 5, 5);
      int rd = extract32(insn, 0, 5);
      bool is_long = false;
 -    bool is_fp = false;
 +    int is_fp = 0;
      bool is_fp16 = false;
      int index;
      TCGv_ptr fpst;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
      case 0x05: /* FMLS */
      case 0x09: /* FMUL */
      case 0x19: /* FMULX */
 -        is_fp = true;
 +        is_fp = 1;
          break;
      case 0x1d: /* SQRDMLAH */
      case 0x1f: /* SQRDMLSH */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              return;
          }
          break;
-+    case 0x11: /* FCMLA #0 */
-+    case 0x13: /* FCMLA #90 */
+@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
-+    case 0x15: /* FCMLA #180 */
+         gen_a64_set_pc(s, dst);
-+    case 0x17: /* FCMLA #270 */
+         /* BLRAA also needs to load return address */
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)) {
+         if (opc == 9) {
-+            unallocated_encoding(s);
+-            tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
-+            return;
++            tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
-+        }
+         }
-+        is_fp = 2;
+         break;
-+        break;
-     default:
+@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-         unallocated_encoding(s);
+ {
      uint32_t insn;
 -    s->pc_curr = s->pc;
 -    insn = arm_ldl_code(env, s->pc, s->sctlr_b);
 +    s->pc_curr = s->base.pc_next;
 +    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
      s->insn = insn;
 -    s->pc += 4;
 +    s->base.pc_next += 4;
      s->fp_access_checked = false;
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
      int bound, core_mmu_idx;
      dc->isar = &arm_cpu->isar;
 -    dc->pc = dc->base.pc_first;
      dc->condjmp = 0;
      dc->aarch64 = 1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  {
      DisasContext *dc = container_of(dcbase, DisasContext, base);
 -    tcg_gen_insn_start(dc->pc, 0, 0);
 +    tcg_gen_insn_start(dc->base.pc_next, 0, 0);
      dc->insn_start = tcg_last_op();
  }
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
      DisasContext *dc = container_of(dcbase, DisasContext, base);
      if (bp->flags & BP_CPU) {
 -        gen_a64_set_pc_im(dc->pc);
 +        gen_a64_set_pc_im(dc->base.pc_next);
          gen_helper_check_breakpoints(cpu_env);
          /* End the TB early; it likely won't be executed */
          dc->base.is_jmp = DISAS_TOO_MANY;
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
             to for it to be properly cleared -- thus we
             increment the PC here so that the logic setting
             tb->size below does the right thing.  */
 -        dc->pc += 4;
 +        dc->base.pc_next += 4;
          dc->base.is_jmp = DISAS_NORETURN;
      }
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          disas_a64_insn(env, dc);
      }
 -    dc->base.pc_next = dc->pc;
      translator_loop_temp_check(&dc->base);
  }
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
           */
          switch (dc->base.is_jmp) {
          default:
 -            gen_a64_set_pc_im(dc->pc);
 +            gen_a64_set_pc_im(dc->base.pc_next);
              /* fall through */
          case DISAS_EXIT:
          case DISAS_JUMP:
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          switch (dc->base.is_jmp) {
          case DISAS_NEXT:
          case DISAS_TOO_MANY:
 -            gen_goto_tb(dc, 1, dc->pc);
 +            gen_goto_tb(dc, 1, dc->base.pc_next);
              break;
          default:
          case DISAS_UPDATE:
 -            gen_a64_set_pc_im(dc->pc);
 +            gen_a64_set_pc_im(dc->base.pc_next);
              /* fall through */
          case DISAS_EXIT:
              tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          case DISAS_SWI:
              break;
          case DISAS_WFE:
 -            gen_a64_set_pc_im(dc->pc);
 +            gen_a64_set_pc_im(dc->base.pc_next);
              gen_helper_wfe(cpu_env);
              break;
          case DISAS_YIELD:
 -            gen_a64_set_pc_im(dc->pc);
 +            gen_a64_set_pc_im(dc->base.pc_next);
              gen_helper_yield(cpu_env);
              break;
          case DISAS_WFI:
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
               */
              TCGv_i32 tmp = tcg_const_i32(4);
 -            gen_a64_set_pc_im(dc->pc);
 +            gen_a64_set_pc_im(dc->base.pc_next);
              gen_helper_wfi(cpu_env, tmp);
              tcg_temp_free_i32(tmp);
              /* The helper doesn't necessarily throw an exception, but we
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          }
          }
      }
 -
 -    /* Functions above can change dc->pc, so re-align db->pc_next */
 -    dc->base.pc_next = dc->pc;
  }
  static void aarch64_tr_disas_log(const DisasContextBase *dcbase,
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_blxns(DisasContext *s, int rm)
       * We do however need to set the PC, because the blxns helper reads it.
       * The blxns helper may throw an exception.
       */
 -    gen_set_pc_im(s, s->pc);
 +    gen_set_pc_im(s, s->base.pc_next);
      gen_helper_v7m_blxns(cpu_env, var);
      tcg_temp_free_i32(var);
      s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
       * for single stepping.)
       */
      s->svc_imm = imm16;
 -    gen_set_pc_im(s, s->pc);
 +    gen_set_pc_im(s, s->base.pc_next);
      s->base.is_jmp = DISAS_HVC;
  }
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
      tmp = tcg_const_i32(syn_aa32_smc());
      gen_helper_pre_smc(cpu_env, tmp);
      tcg_temp_free_i32(tmp);
 -    gen_set_pc_im(s, s->pc);
 +    gen_set_pc_im(s, s->base.pc_next);
      s->base.is_jmp = DISAS_SMC;
  }
  static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
  {
      gen_set_condexec(s);
 -    gen_set_pc_im(s, s->pc - offset);
 +    gen_set_pc_im(s, s->base.pc_next - offset);
      gen_exception_internal(excp);
      s->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, int offset, int excp,
                                 int syn, uint32_t target_el)
  {
      gen_set_condexec(s);
 -    gen_set_pc_im(s, s->pc - offset);
 +    gen_set_pc_im(s, s->base.pc_next - offset);
      gen_exception(excp, syn, target_el);
      s->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
      TCGv_i32 tcg_syn;
      gen_set_condexec(s);
 -    gen_set_pc_im(s, s->pc - offset);
 +    gen_set_pc_im(s, s->base.pc_next - offset);
      tcg_syn = tcg_const_i32(syn);
      gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
      tcg_temp_free_i32(tcg_syn);
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
  /* Force a TB lookup after an instruction that changes the CPU state.  */
  static inline void gen_lookup_tb(DisasContext *s)
  {
 -    tcg_gen_movi_i32(cpu_R[15], s->pc);
 +    tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
      s->base.is_jmp = DISAS_EXIT;
  }
@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
  {
  #ifndef CONFIG_USER_ONLY
      return (s->base.tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
 -           ((s->pc - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
 +           ((s->base.pc_next - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
  #else
      return true;
  #endif
@@ -XXX,XX +XXX,XX @@ static void gen_nop_hint(DisasContext *s, int val)
           */
      case 1: /* yield */
          if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
 -            gen_set_pc_im(s, s->pc);
 +            gen_set_pc_im(s, s->base.pc_next);
              s->base.is_jmp = DISAS_YIELD;
          }
          break;
      case 3: /* wfi */
 -        gen_set_pc_im(s, s->pc);
 +        gen_set_pc_im(s, s->base.pc_next);
          s->base.is_jmp = DISAS_WFI;
          break;
      case 2: /* wfe */
          if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
 -            gen_set_pc_im(s, s->pc);
 +            gen_set_pc_im(s, s->base.pc_next);
              s->base.is_jmp = DISAS_WFE;
          }
          break;
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
              if (isread) {
                  return 1;
              }
 -            gen_set_pc_im(s, s->pc);
 +            gen_set_pc_im(s, s->base.pc_next);
              s->base.is_jmp = DISAS_WFI;
              return 0;
          default:
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                   * self-modifying code correctly and also to take
                   * any pending interrupts immediately.
                   */
 -                gen_goto_tb(s, 0, s->pc);
 +                gen_goto_tb(s, 0, s->base.pc_next);
                  return;
              case 7: /* sb */
                  if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                   * for TCG; MB and end the TB instead.
                   */
                  tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
 -                gen_goto_tb(s, 0, s->pc);
 +                gen_goto_tb(s, 0, s->base.pc_next);
                  return;
              default:
                  goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
              int32_t offset;
              tmp = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp, s->pc);
 +            tcg_gen_movi_i32(tmp, s->base.pc_next);
              store_reg(s, 14, tmp);
              /* Sign-extend the 24-bit offset */
              offset = (((int32_t)insn) << 8) >> 8;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
              /* branch link/exchange thumb (blx) */
              tmp = load_reg(s, rm);
              tmp2 = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp2, s->pc);
 +            tcg_gen_movi_i32(tmp2, s->base.pc_next);
              store_reg(s, 14, tmp2);
              gen_bx(s, tmp);
              break;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  /* branch (and link) */
                  if (insn & (1 << 24)) {
                      tmp = tcg_temp_new_i32();
 -                    tcg_gen_movi_i32(tmp, s->pc);
 +                    tcg_gen_movi_i32(tmp, s->base.pc_next);
                      store_reg(s, 14, tmp);
                  }
                  offset = sextract32(insn << 2, 0, 26);
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
              break;
          case 0xf:
              /* swi */
 -            gen_set_pc_im(s, s->pc);
 +            gen_set_pc_im(s, s->base.pc_next);
              s->svc_imm = extract32(insn, 0, 24);
              s->base.is_jmp = DISAS_SWI;
              break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                  if (insn & (1 << 14)) {
                      /* Branch and link.  */
 -                    tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
 +                    tcg_gen_movi_i32(cpu_R[14], s->base.pc_next | 1);
                  }
                  offset += read_pc(s);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                               * and also to take any pending interrupts
                               * immediately.
                               */
 -                            gen_goto_tb(s, 0, s->pc);
 +                            gen_goto_tb(s, 0, s->base.pc_next);
                              break;
                          case 7: /* sb */
                              if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                               * for TCG; MB and end the TB instead.
                               */
                              tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
 -                            gen_goto_tb(s, 0, s->pc);
 +                            gen_goto_tb(s, 0, s->base.pc_next);
                              break;
                          default:
                              goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
                  /* BLX/BX */
                  tmp = load_reg(s, rm);
                  if (link) {
 -                    val = (uint32_t)s->pc | 1;
 +                    val = (uint32_t)s->base.pc_next | 1;
                      tmp2 = tcg_temp_new_i32();
                      tcg_gen_movi_i32(tmp2, val);
                      store_reg(s, 14, tmp2);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
          if (cond == 0xf) {
              /* swi */
 -            gen_set_pc_im(s, s->pc);
 +            gen_set_pc_im(s, s->base.pc_next);
              s->svc_imm = extract32(insn, 0, 8);
              s->base.is_jmp = DISAS_SWI;
              break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
              tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
              tmp2 = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp2, s->pc | 1);
 +            tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
              store_reg(s, 14, tmp2);
              gen_bx(s, tmp);
              break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
              tcg_gen_addi_i32(tmp, tmp, offset);
              tmp2 = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp2, s->pc | 1);
 +            tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
              store_reg(s, 14, tmp2);
              gen_bx(s, tmp);
          } else {
@@ -XXX,XX +XXX,XX @@ undef:
  static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
  {
 -    /* Return true if the insn at dc->pc might cross a page boundary.
 +    /* Return true if the insn at dc->base.pc_next might cross a page boundary.
       * (False positives are OK, false negatives are not.)
       * We know this is a Thumb insn, and our caller ensures we are
 -     * only called if dc->pc is less than 4 bytes from the page
 +     * only called if dc->base.pc_next is less than 4 bytes from the page
       * boundary, so we cross the page if the first 16 bits indicate
       * that this is a 32 bit insn.
       */
 -    uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 +    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
 -    return !thumb_insn_is_16bit(s, s->pc, insn);
 +    return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
  }
  static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      uint32_t condexec, core_mmu_idx;
      dc->isar = &cpu->isar;
 -    dc->pc = dc->base.pc_first;
      dc->condjmp = 0;
      dc->aarch64 = 0;
@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  {
      DisasContext *dc = container_of(dcbase, DisasContext, base);
 -    tcg_gen_insn_start(dc->pc,
 +    tcg_gen_insn_start(dc->base.pc_next,
                         (dc->condexec_cond << 4) | (dc->condexec_mask >> 1),
 );
      dc->insn_start = tcg_last_op();
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
      if (bp->flags & BP_CPU) {
          gen_set_condexec(dc);
 -        gen_set_pc_im(dc, dc->pc);
 +        gen_set_pc_im(dc, dc->base.pc_next);
          gen_helper_check_breakpoints(cpu_env);
          /* End the TB early; it's likely not going to be executed */
          dc->base.is_jmp = DISAS_TOO_MANY;
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
             tb->size below does the right thing.  */
          /* TODO: Advance PC by correct instruction length to
           * avoid disassembler error messages */
 -        dc->pc += 2;
 +        dc->base.pc_next += 2;
          dc->base.is_jmp = DISAS_NORETURN;
      }
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
  {
  #ifdef CONFIG_USER_ONLY
      /* Intercept jump to the magic kernel page.  */
 -    if (dc->pc >= 0xffff0000) {
 +    if (dc->base.pc_next >= 0xffff0000) {
          /* We always get here via a jump, so know we are not in a
             conditional execution block.  */
          gen_exception_internal(EXCP_KERNEL_TRAP);
@@ -XXX,XX +XXX,XX @@ static void arm_post_translate_insn(DisasContext *dc)
          gen_set_label(dc->condlabel);
          dc->condjmp = 0;
      }
 -    dc->base.pc_next = dc->pc;
      translator_loop_temp_check(&dc->base);
  }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          return;
      }
--    if (is_fp) {
+-    dc->pc_curr = dc->pc;
-+    switch (is_fp) {
+-    insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
-+    case 1: /* normal fp */
++    dc->pc_curr = dc->base.pc_next;
-         /* convert insn encoded size to TCGMemOp size */
++    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
-         switch (size) {
+     dc->insn = insn;
-         case 0: /* half-precision */
+-    dc->pc += 4;
--            if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++    dc->base.pc_next += 4;
--                unallocated_encoding(s);
+     disas_arm_insn(dc, insn);
--                return;
--            }
+     arm_post_translate_insn(dc);
-             size = MO_16;
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-+            is_fp16 = true;
+         return;
-             break;
+     }
-         case MO_32: /* single precision */
-         case MO_64: /* double precision */
+-    dc->pc_curr = dc->pc;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+-    insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-             unallocated_encoding(s);
+-    is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
-             return;
+-    dc->pc += 2;
 +    dc->pc_curr = dc->base.pc_next;
 +    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
 +    is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
 +    dc->base.pc_next += 2;
      if (!is_16bit) {
 -        uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
 +        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
          insn = insn << 16 | insn2;
 -        dc->pc += 2;
 +        dc->base.pc_next += 2;
      }
      dc->insn = insn;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
       * but isn't very efficient).
       */
      if (dc->base.is_jmp == DISAS_NEXT
 -        && (dc->pc - dc->page_start >= TARGET_PAGE_SIZE
 -            || (dc->pc - dc->page_start >= TARGET_PAGE_SIZE - 3
 +        && (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE
 +            || (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE - 3
                  && insn_crosses_page(env, dc)))) {
          dc->base.is_jmp = DISAS_TOO_MANY;
      }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          case DISAS_NEXT:
          case DISAS_TOO_MANY:
          case DISAS_UPDATE:
 -            gen_set_pc_im(dc, dc->pc);
 +            gen_set_pc_im(dc, dc->base.pc_next);
              /* fall through */
          default:
              /* FIXME: Single stepping a WFI insn will not halt the CPU. */
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          switch(dc->base.is_jmp) {
          case DISAS_NEXT:
          case DISAS_TOO_MANY:
 -            gen_goto_tb(dc, 1, dc->pc);
 +            gen_goto_tb(dc, 1, dc->base.pc_next);
              break;
          case DISAS_JUMP:
              gen_goto_ptr();
              break;
          case DISAS_UPDATE:
 -            gen_set_pc_im(dc, dc->pc);
 +            gen_set_pc_im(dc, dc->base.pc_next);
              /* fall through */
          default:
              /* indicate that the hash table must be used to find the next TB */
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          gen_set_label(dc->condlabel);
          gen_set_condexec(dc);
          if (unlikely(is_singlestepping(dc))) {
 -            gen_set_pc_im(dc, dc->pc);
 +            gen_set_pc_im(dc, dc->base.pc_next);
              gen_singlestep_exception(dc);
          } else {
 -            gen_goto_tb(dc, 1, dc->pc);
 +            gen_goto_tb(dc, 1, dc->base.pc_next);
          }
--    } else {
+     }
-+        break;
+-
-+
+-    /* Functions above can change dc->pc, so re-align db->pc_next */
-+    case 2: /* complex fp */
+-    dc->base.pc_next = dc->pc;
-+        /* Each indexable element is a complex pair.  */
+ }
-+        size <<= 1;
-+        switch (size) {
+ static void arm_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
 +        case MO_32:
 +            if (h && !is_q) {
 +                unallocated_encoding(s);
 +                return;
 +            }
 +            is_fp16 = true;
 +            break;
 +        case MO_64:
 +            break;
 +        default:
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        break;
 +
 +    default: /* integer */
          switch (size) {
          case MO_8:
          case MO_64:
              unallocated_encoding(s);
              return;
          }
 +        break;
 +    }
 +    if (is_fp16 && !arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +        unallocated_encoding(s);
 +        return;
      }
      /* Given TCGMemOp size, adjust register and indexing.  */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
          fpst = NULL;
      }
 +    switch (16 * u + opcode) {
 +    case 0x11: /* FCMLA #0 */
 +    case 0x13: /* FCMLA #90 */
 +    case 0x15: /* FCMLA #180 */
 +    case 0x17: /* FCMLA #270 */
 +        tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
 +                           vec_full_reg_offset(s, rn),
 +                           vec_reg_offset(s, rm, index, size), fpst,
 +                           is_q ? 16 : 8, vec_full_reg_size(s),
 +                           extract32(insn, 13, 2), /* rot */
 +                           size == MO_64
 +                           ? gen_helper_gvec_fcmlas_idx
 +                           : gen_helper_gvec_fcmlah_idx);
 +        tcg_temp_free_ptr(fpst);
 +        return;
 +    }
 +
      if (size == 3) {
          TCGv_i64 tcg_idx = tcg_temp_new_i64();
          int pass;
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vec_helper.c
 +++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddd)(void *vd, void *vn, void *vm,
      }
      clear_tail(d, opr_sz, simd_maxsz(desc));
  }
 +
 +void HELPER(gvec_fcmlah)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float16 *d = vd;
 +    float16 *n = vn;
 +    float16 *m = vm;
 +    float_status *fpst = vfpst;
 +    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    uint32_t neg_real = flip ^ neg_imag;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 15;
 +    neg_imag <<= 15;
 +
 +    for (i = 0; i < opr_sz / 2; i += 2) {
 +        float16 e2 = n[H2(i + flip)];
 +        float16 e1 = m[H2(i + flip)] ^ neg_real;
 +        float16 e4 = e2;
 +        float16 e3 = m[H2(i + 1 - flip)] ^ neg_imag;
 +
 +        d[H2(i)] = float16_muladd(e2, e1, d[H2(i)], 0, fpst);
 +        d[H2(i + 1)] = float16_muladd(e4, e3, d[H2(i + 1)], 0, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcmlah_idx)(void *vd, void *vn, void *vm,
 +                             void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float16 *d = vd;
 +    float16 *n = vn;
 +    float16 *m = vm;
 +    float_status *fpst = vfpst;
 +    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    uint32_t neg_real = flip ^ neg_imag;
 +    uintptr_t i;
 +    float16 e1 = m[H2(flip)];
 +    float16 e3 = m[H2(1 - flip)];
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 15;
 +    neg_imag <<= 15;
 +    e1 ^= neg_real;
 +    e3 ^= neg_imag;
 +
 +    for (i = 0; i < opr_sz / 2; i += 2) {
 +        float16 e2 = n[H2(i + flip)];
 +        float16 e4 = e2;
 +
 +        d[H2(i)] = float16_muladd(e2, e1, d[H2(i)], 0, fpst);
 +        d[H2(i + 1)] = float16_muladd(e4, e3, d[H2(i + 1)], 0, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcmlas)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float32 *d = vd;
 +    float32 *n = vn;
 +    float32 *m = vm;
 +    float_status *fpst = vfpst;
 +    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    uint32_t neg_real = flip ^ neg_imag;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 31;
 +    neg_imag <<= 31;
 +
 +    for (i = 0; i < opr_sz / 4; i += 2) {
 +        float32 e2 = n[H4(i + flip)];
 +        float32 e1 = m[H4(i + flip)] ^ neg_real;
 +        float32 e4 = e2;
 +        float32 e3 = m[H4(i + 1 - flip)] ^ neg_imag;
 +
 +        d[H4(i)] = float32_muladd(e2, e1, d[H4(i)], 0, fpst);
 +        d[H4(i + 1)] = float32_muladd(e4, e3, d[H4(i + 1)], 0, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcmlas_idx)(void *vd, void *vn, void *vm,
 +                             void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float32 *d = vd;
 +    float32 *n = vn;
 +    float32 *m = vm;
 +    float_status *fpst = vfpst;
 +    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    uint32_t neg_real = flip ^ neg_imag;
 +    uintptr_t i;
 +    float32 e1 = m[H4(flip)];
 +    float32 e3 = m[H4(1 - flip)];
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 31;
 +    neg_imag <<= 31;
 +    e1 ^= neg_real;
 +    e3 ^= neg_imag;
 +
 +    for (i = 0; i < opr_sz / 4; i += 2) {
 +        float32 e2 = n[H4(i + flip)];
 +        float32 e4 = e2;
 +
 +        d[H4(i)] = float32_muladd(e2, e1, d[H4(i)], 0, fpst);
 +        d[H4(i + 1)] = float32_muladd(e4, e3, d[H4(i + 1)], 0, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcmlad)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float64 *d = vd;
 +    float64 *n = vn;
 +    float64 *m = vm;
 +    float_status *fpst = vfpst;
 +    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint64_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    uint64_t neg_real = flip ^ neg_imag;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 63;
 +    neg_imag <<= 63;
 +
 +    for (i = 0; i < opr_sz / 8; i += 2) {
 +        float64 e2 = n[i + flip];
 +        float64 e1 = m[i + flip] ^ neg_real;
 +        float64 e4 = e2;
 +        float64 e3 = m[i + 1 - flip] ^ neg_imag;
 +
 +        d[i] = float64_muladd(e2, e1, d[i], 0, fpst);
 +        d[i + 1] = float64_muladd(e4, e3, d[i + 1], 0, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 26/39] target/arm: Refactor disas_simd_indexed size checks
+[Qemu-devel] [PULL 12/29] target/arm: Replace offset with pc in gen_exception_insn
 From: Richard Henderson <richard.henderson@linaro.org>
-The integer size check was already outside of the opcode switch;
+The offset is variable depending on the instruction set, whereas
-move the floating-point size check outside as well.  Unify the
+we have stored values for the current pc and the next pc.  Passing
-size vs index adjustment between fp and integer paths.
+in the actual value is clearer in intent.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180228193125.20577-4-richard.henderson@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 65 +++++++++++++++++++++++-----------------------
+ target/arm/translate-a64.c     | 25 ++++++++++++++-----------
-file changed, 32 insertions(+), 33 deletions(-)
+ target/arm/translate-vfp.inc.c |  6 +++---
  target/arm/translate.c         | 31 ++++++++++++++++---------------
 files changed, 33 insertions(+), 29 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
-     case 0x05: /* FMLS */
+     s->base.is_jmp = DISAS_NORETURN;
-     case 0x09: /* FMUL */
+ }
-     case 0x19: /* FMULX */
--        if (size == 1) {
+-static void gen_exception_insn(DisasContext *s, int offset, int excp,
--            unallocated_encoding(s);
++static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
--            return;
+                                uint32_t syndrome, uint32_t target_el)
--        }
+ {
-         is_fp = true;
+-    gen_a64_set_pc_im(s->base.pc_next - offset);
-         break;
++    gen_a64_set_pc_im(pc);
-     default:
+     gen_exception(excp, syndrome, target_el);
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+     s->base.is_jmp = DISAS_NORETURN;
-     if (is_fp) {
+ }
-         /* convert insn encoded size to TCGMemOp size */
+@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
-         switch (size) {
+ void unallocated_encoding(DisasContext *s)
--        case 2: /* single precision */
+ {
--            size = MO_32;
+     /* Unallocated and reserved encodings are uncategorized */
--            index = h << 1 | l;
+-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
--            rm |= (m << 4);
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
--            break;
+                        default_exception_el(s));
--        case 3: /* double precision */
+ }
--            size = MO_64;
--            if (l || !is_q) {
+@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
-+        case 0: /* half-precision */
+         return true;
-+            if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+     }
-                 unallocated_encoding(s);
 -    gen_exception_insn(s, 4, EXCP_UDEF, syn_fp_access_trap(1, 0xe, false),
 -                       s->fp_excp_el);
 +    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                       syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
      return false;
  }
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
  bool sve_access_check(DisasContext *s)
  {
      if (s->sve_excp_el) {
 -        gen_exception_insn(s, 4, EXCP_UDEF, syn_sve_access_trap(),
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_sve_access_trap(),
                             s->sve_excp_el);
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
          switch (op2_ll) {
          case 1:                                                     /* SVC */
              gen_ss_advance(s);
 -            gen_exception_insn(s, 0, EXCP_SWI, syn_aa64_svc(imm16),
 -                               default_exception_el(s));
 +            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
 +                               syn_aa64_svc(imm16), default_exception_el(s));
              break;
          case 2:                                                     /* HVC */
              if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
              gen_a64_set_pc_im(s->pc_curr);
              gen_helper_pre_hvc(cpu_env);
              gen_ss_advance(s);
 -            gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
 +            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
 +                               syn_aa64_hvc(imm16), 2);
              break;
          case 3:                                                     /* SMC */
              if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
              gen_helper_pre_smc(cpu_env, tmp);
              tcg_temp_free_i32(tmp);
              gen_ss_advance(s);
 -            gen_exception_insn(s, 0, EXCP_SMC, syn_aa64_smc(imm16), 3);
 +            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
 +                               syn_aa64_smc(imm16), 3);
              break;
          default:
              unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
              if (s->btype != 0
                  && s->guarded_page
                  && !btype_destination_ok(insn, s->bt, s->btype)) {
 -                gen_exception_insn(s, 4, EXCP_UDEF, syn_btitrap(s->btype),
 +                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                                   syn_btitrap(s->btype),
                                     default_exception_el(s));
                  return;
              }
--            index = h;
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
--            rm |= (m << 4);
+index XXXXXXX..XXXXXXX 100644
--            break;
+--- a/target/arm/translate-vfp.inc.c
--        case 0: /* half precision */
++++ b/target/arm/translate-vfp.inc.c
-             size = MO_16;
+@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
--            index = h << 2 | l << 1 | m;
+ {
--            is_fp16 = true;
+     if (s->fp_excp_el) {
--            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+         if (arm_dc_feature(s, ARM_FEATURE_M)) {
--                break;
+-            gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
--            }
++            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
--            /* fallthru */
+                                s->fp_excp_el);
--        default: /* unallocated */
+         } else {
--            unallocated_encoding(s);
+-            gen_exception_insn(s, 4, EXCP_UDEF,
--            return;
++            gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
--        }
+                                syn_fp_access_trap(1, 0xe, false),
--    } else {
+                                s->fp_excp_el);
--        switch (size) {
+         }
--        case 1:
+@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
--            index = h << 2 | l << 1 | m;
-             break;
+     if (!s->vfp_enabled && !ignore_vfp_enabled) {
--        case 2:
+         assert(!arm_dc_feature(s, ARM_FEATURE_M));
--            index = h << 1 | l;
+-        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
--            rm |= (m << 4);
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+        case MO_32: /* single precision */
+                            default_exception_el(s));
-+        case MO_64: /* double precision */
+         return false;
      }
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
      s->base.is_jmp = DISAS_NORETURN;
  }
 -static void gen_exception_insn(DisasContext *s, int offset, int excp,
 +static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
                                 int syn, uint32_t target_el)
  {
      gen_set_condexec(s);
 -    gen_set_pc_im(s, s->base.pc_next - offset);
 +    gen_set_pc_im(s, pc);
      gen_exception(excp, syn, target_el);
      s->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
          return;
      }
 -    gen_exception_insn(s, s->thumb ? 2 : 4, EXCP_UDEF, syn_uncategorized(),
 +    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                         default_exception_el(s));
  }
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
  undef:
      /* If we get here then some access check did not pass */
 -    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), exc_target);
 +    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                       syn_uncategorized(), exc_target);
      return false;
  }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
       * for attempts to execute invalid vfp/neon encodings with FP disabled.
       */
      if (s->fp_excp_el) {
 -        gen_exception_insn(s, 4, EXCP_UDEF,
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
       * for attempts to execute invalid vfp/neon encodings with FP disabled.
       */
      if (s->fp_excp_el) {
 -        gen_exception_insn(s, 4, EXCP_UDEF,
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
      }
      if (s->fp_excp_el) {
 -        gen_exception_insn(s, 4, EXCP_UDEF,
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
          off_rm = vfp_reg_offset(0, rm);
      }
      if (s->fp_excp_el) {
 -        gen_exception_insn(s, 4, EXCP_UDEF,
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
       * For the UNPREDICTABLE cases we choose to UNDEF.
       */
      if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
 -        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3);
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
      }
      if (undef) {
 -        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                             default_exception_el(s));
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
       * UsageFault exception.
       */
      if (arm_dc_feature(s, ARM_FEATURE_M)) {
 -        gen_exception_insn(s, 4, EXCP_INVSTATE, syn_uncategorized(),
 +        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
                             default_exception_el(s));
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
              break;
          default:
-             unallocated_encoding(s);
+         illegal_op:
-             return;
+-            gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
 +            gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                                 default_exception_el(s));
              break;
          }
-+    } else {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+        switch (size) {
+             }
-+        case MO_8:
-+        case MO_64:
+             /* All other insns: NOCP */
-+            unallocated_encoding(s);
+-            gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
-+            return;
++            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
-+        }
+                                default_exception_el(s));
-+    }
+             break;
-+
+         }
-+    /* Given TCGMemOp size, adjust register and indexing.  */
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+    switch (size) {
+     }
-+    case MO_16:
+     return;
-+        index = h << 2 | l << 1 | m;
+ illegal_op:
-+        break;
+-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
-+    case MO_32:
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+        index = h << 1 | l;
+                        default_exception_el(s));
-+        rm |= m << 4;
+ }
-+        break;
-+    case MO_64:
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-+        if (l || !is_q) {
+     return;
-+            unallocated_encoding(s);
+ illegal_op:
-+            return;
+ undef:
-+        }
+-    gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
-+        index = h;
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+        rm |= m << 4;
+                        default_exception_el(s));
-+        break;
+ }
-+    default:
 +        g_assert_not_reached();
      }
      if (!fp_access_check(s)) {
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 25/39] target/arm: Refactor disas_simd_indexed decode
+[Qemu-devel] [PULL 13/29] target/arm: Replace offset with pc in gen_exception_internal_insn
 From: Richard Henderson <richard.henderson@linaro.org>
-Include the U bit in the switches rather than testing separately.
+The offset is variable depending on the instruction set.
 Passing in the actual value is clearer in intent.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180228193125.20577-3-richard.henderson@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 129 +++++++++++++++++++++------------------------
+ target/arm/translate-a64.c | 8 ++++----
-file changed, 61 insertions(+), 68 deletions(-)
+ target/arm/translate.c     | 8 ++++----
 files changed, 8 insertions(+), 8 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
-     int index;
+     tcg_temp_free_i32(tcg_excp);
-     TCGv_ptr fpst;
+ }
--    switch (opcode) {
+-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
--    case 0x0: /* MLA */
++static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
--    case 0x4: /* MLS */
+ {
--        if (!u || is_scalar) {
+-    gen_a64_set_pc_im(s->base.pc_next - offset);
-+    switch (16 * u + opcode) {
++    gen_a64_set_pc_im(pc);
-+    case 0x08: /* MUL */
+     gen_exception_internal(excp);
-+    case 0x10: /* MLA */
+     s->base.is_jmp = DISAS_NORETURN;
-+    case 0x14: /* MLS */
+ }
-+        if (is_scalar) {
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
              unallocated_encoding(s);
              return;
          }
          break;
 -    case 0x2: /* SMLAL, SMLAL2, UMLAL, UMLAL2 */
 -    case 0x6: /* SMLSL, SMLSL2, UMLSL, UMLSL2 */
 -    case 0xa: /* SMULL, SMULL2, UMULL, UMULL2 */
 +    case 0x02: /* SMLAL, SMLAL2 */
 +    case 0x12: /* UMLAL, UMLAL2 */
 +    case 0x06: /* SMLSL, SMLSL2 */
 +    case 0x16: /* UMLSL, UMLSL2 */
 +    case 0x0a: /* SMULL, SMULL2 */
 +    case 0x1a: /* UMULL, UMULL2 */
          if (is_scalar) {
              unallocated_encoding(s);
              return;
          }
          is_long = true;
          break;
 -    case 0x3: /* SQDMLAL, SQDMLAL2 */
 -    case 0x7: /* SQDMLSL, SQDMLSL2 */
 -    case 0xb: /* SQDMULL, SQDMULL2 */
 +    case 0x03: /* SQDMLAL, SQDMLAL2 */
 +    case 0x07: /* SQDMLSL, SQDMLSL2 */
 +    case 0x0b: /* SQDMULL, SQDMULL2 */
          is_long = true;
 -        /* fall through */
 -    case 0xc: /* SQDMULH */
 -    case 0xd: /* SQRDMULH */
 -        if (u) {
 -            unallocated_encoding(s);
 -            return;
 -        }
          break;
 -    case 0x8: /* MUL */
 -        if (u || is_scalar) {
 -            unallocated_encoding(s);
 -            return;
 -        }
 +    case 0x0c: /* SQDMULH */
 +    case 0x0d: /* SQRDMULH */
          break;
 -    case 0x1: /* FMLA */
 -    case 0x5: /* FMLS */
 -        if (u) {
 -            unallocated_encoding(s);
 -            return;
 -        }
 -        /* fall through */
 -    case 0x9: /* FMUL, FMULX */
 +    case 0x01: /* FMLA */
 +    case 0x05: /* FMLS */
 +    case 0x09: /* FMUL */
 +    case 0x19: /* FMULX */
          if (size == 1) {
              unallocated_encoding(s);
              return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              read_vec_element(s, tcg_op, rn, pass, MO_64);
 -            switch (opcode) {
 -            case 0x5: /* FMLS */
 +            switch (16 * u + opcode) {
 +            case 0x05: /* FMLS */
                  /* As usual for ARM, separate negation for fused multiply-add */
                  gen_helper_vfp_negd(tcg_op, tcg_op);
                  /* fall through */
 -            case 0x1: /* FMLA */
 +            case 0x01: /* FMLA */
                  read_vec_element(s, tcg_res, rd, pass, MO_64);
                  gen_helper_vfp_muladdd(tcg_res, tcg_op, tcg_idx, tcg_res, fpst);
                  break;
 -            case 0x9: /* FMUL, FMULX */
 -                if (u) {
 -                    gen_helper_vfp_mulxd(tcg_res, tcg_op, tcg_idx, fpst);
 -                } else {
 -                    gen_helper_vfp_muld(tcg_res, tcg_op, tcg_idx, fpst);
 -                }
 +            case 0x09: /* FMUL */
 +                gen_helper_vfp_muld(tcg_res, tcg_op, tcg_idx, fpst);
 +                break;
 +            case 0x19: /* FMULX */
 +                gen_helper_vfp_mulxd(tcg_res, tcg_op, tcg_idx, fpst);
                  break;
              default:
                  g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              read_vec_element_i32(s, tcg_op, rn, pass, is_scalar ? size : MO_32);
 -            switch (opcode) {
 -            case 0x0: /* MLA */
 -            case 0x4: /* MLS */
 -            case 0x8: /* MUL */
 +            switch (16 * u + opcode) {
 +            case 0x08: /* MUL */
 +            case 0x10: /* MLA */
 +            case 0x14: /* MLS */
              {
                  static NeonGenTwoOpFn * const fns[2][2] = {
                      { gen_helper_neon_add_u16, gen_helper_neon_sub_u16 },
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                  genfn(tcg_res, tcg_op, tcg_res);
                  break;
              }
--            case 0x5: /* FMLS */
+ #endif
--            case 0x1: /* FMLA */
+-            gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
-+            case 0x05: /* FMLS */
++            gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
-+            case 0x01: /* FMLA */
+         } else {
-                 read_vec_element_i32(s, tcg_res, rd, pass,
+             unsupported_encoding(s, insn);
-                                      is_scalar ? size : MO_32);
+         }
-                 switch (size) {
+@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
+         /* End the TB early; it likely won't be executed */
-                     g_assert_not_reached();
+         dc->base.is_jmp = DISAS_TOO_MANY;
-                 }
+     } else {
-                 break;
+-        gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
--            case 0x9: /* FMUL, FMULX */
++        gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
-+            case 0x09: /* FMUL */
+         /* The address covered by the breakpoint must be
-                 switch (size) {
+            included in [tb->pc, tb->pc + tb->size) in order
-                 case 1:
+            to for it to be properly cleared -- thus we
--                    if (u) {
+diff --git a/target/arm/translate.c b/target/arm/translate.c
--                        if (is_scalar) {
+index XXXXXXX..XXXXXXX 100644
--                            gen_helper_advsimd_mulxh(tcg_res, tcg_op,
+--- a/target/arm/translate.c
--                                                     tcg_idx, fpst);
++++ b/target/arm/translate.c
--                        } else {
+@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
--                            gen_helper_advsimd_mulx2h(tcg_res, tcg_op,
+     s->base.is_jmp = DISAS_SMC;
--                                                      tcg_idx, fpst);
+ }
--                        }
-+                    if (is_scalar) {
+-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
-+                        gen_helper_advsimd_mulh(tcg_res, tcg_op,
++static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
-+                                                tcg_idx, fpst);
+ {
-                     } else {
+     gen_set_condexec(s);
--                        if (is_scalar) {
+-    gen_set_pc_im(s, s->base.pc_next - offset);
--                            gen_helper_advsimd_mulh(tcg_res, tcg_op,
++    gen_set_pc_im(s, pc);
--                                                    tcg_idx, fpst);
+     gen_exception_internal(excp);
--                        } else {
+     s->base.is_jmp = DISAS_NORETURN;
--                            gen_helper_advsimd_mul2h(tcg_res, tcg_op,
+ }
--                                                     tcg_idx, fpst);
+@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
--                        }
+         s->current_el != 0 &&
-+                        gen_helper_advsimd_mul2h(tcg_res, tcg_op,
+ #endif
-+                                                 tcg_idx, fpst);
+         (imm == (s->thumb ? 0x3c : 0xf000))) {
-                     }
+-        gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
-                     break;
++        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
-                 case 2:
+         return;
--                    if (u) {
+     }
--                        gen_helper_vfp_mulxs(tcg_res, tcg_op, tcg_idx, fpst);
--                    } else {
+@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
--                        gen_helper_vfp_muls(tcg_res, tcg_op, tcg_idx, fpst);
+         /* End the TB early; it's likely not going to be executed */
--                    }
+         dc->base.is_jmp = DISAS_TOO_MANY;
-+                    gen_helper_vfp_muls(tcg_res, tcg_op, tcg_idx, fpst);
+     } else {
-                     break;
+-        gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
-                 default:
++        gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
-                     g_assert_not_reached();
+         /* The address covered by the breakpoint must be
-                 }
+            included in [tb->pc, tb->pc + tb->size) in order
-                 break;
+            to for it to be properly cleared -- thus we
 -            case 0xc: /* SQDMULH */
 +            case 0x19: /* FMULX */
 +                switch (size) {
 +                case 1:
 +                    if (is_scalar) {
 +                        gen_helper_advsimd_mulxh(tcg_res, tcg_op,
 +                                                 tcg_idx, fpst);
 +                    } else {
 +                        gen_helper_advsimd_mulx2h(tcg_res, tcg_op,
 +                                                  tcg_idx, fpst);
 +                    }
 +                    break;
 +                case 2:
 +                    gen_helper_vfp_mulxs(tcg_res, tcg_op, tcg_idx, fpst);
 +                    break;
 +                default:
 +                    g_assert_not_reached();
 +                }
 +                break;
 +            case 0x0c: /* SQDMULH */
                  if (size == 1) {
                      gen_helper_neon_qdmulh_s16(tcg_res, cpu_env,
                                                 tcg_op, tcg_idx);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                                                 tcg_op, tcg_idx);
                  }
                  break;
 -            case 0xd: /* SQRDMULH */
 +            case 0x0d: /* SQRDMULH */
                  if (size == 1) {
                      gen_helper_neon_qrdmulh_s16(tcg_res, cpu_env,
                                                  tcg_op, tcg_idx);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 27/39] target/arm: Decode aa64 armv8.1 scalar three same extra
+[Qemu-devel] [PULL 14/29] target/arm: Remove offset argument to gen_exception_bkpt_insn
 From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Unlike the other more generic gen_exception{,_internal}_insn
 interfaces, breakpoints always refer to the current instruction.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-5-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/Makefile.objs   |   2 +-
+ target/arm/translate-a64.c | 7 +++----
- target/arm/helper.h        |   4 ++
+ target/arm/translate.c     | 8 ++++----
- target/arm/translate-a64.c |  84 ++++++++++++++++++++++++++++++++++
+files changed, 7 insertions(+), 8 deletions(-)
  target/arm/vec_helper.c    | 109 +++++++++++++++++++++++++++++++++++++++++++++
 files changed, 198 insertions(+), 1 deletion(-)
  create mode 100644 target/arm/vec_helper.c
-diff --git a/target/arm/Makefile.objs b/target/arm/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/Makefile.objs
-+++ b/target/arm/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(call land,$(CONFIG_KVM),$(call lnot,$(TARGET_AARCH64))) += kvm32.o
- obj-$(call land,$(CONFIG_KVM),$(TARGET_AARCH64)) += kvm64.o
- obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
- obj-y += translate.o op_helper.o helper.o cpu.o
--obj-y += neon_helper.o iwmmxt_helper.o
-+obj-y += neon_helper.o iwmmxt_helper.o vec_helper.o
- obj-y += gdbstub.o
- obj-$(TARGET_AARCH64) += cpu64.o translate-a64.o helper-a64.o gdbstub64.o
- obj-y += crypto_helper.o
-diff --git a/target/arm/helper.h b/target/arm/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
-+++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(neon_rbit_u8, TCG_CALL_NO_RWG_SE, i32, i32)
- DEF_HELPER_3(neon_qdmulh_s16, i32, env, i32, i32)
- DEF_HELPER_3(neon_qrdmulh_s16, i32, env, i32, i32)
-+DEF_HELPER_4(neon_qrdmlah_s16, i32, env, i32, i32, i32)
-+DEF_HELPER_4(neon_qrdmlsh_s16, i32, env, i32, i32, i32)
- DEF_HELPER_3(neon_qdmulh_s32, i32, env, i32, i32)
- DEF_HELPER_3(neon_qrdmulh_s32, i32, env, i32, i32)
-+DEF_HELPER_4(neon_qrdmlah_s32, i32, env, s32, s32, s32)
-+DEF_HELPER_4(neon_qrdmlsh_s32, i32, env, s32, s32, s32)
- DEF_HELPER_1(neon_narrow_u8, i32, i64)
- DEF_HELPER_1(neon_narrow_u16, i32, i64)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-     tcg_temp_free_ptr(fpst);
+     s->base.is_jmp = DISAS_NORETURN;
  }
-+/* AdvSIMD scalar three same extra
+-static void gen_exception_bkpt_insn(DisasContext *s, int offset,
-+ *  31 30  29 28       24 23  22  21 20  16  15 14    11  10 9  5 4  0
+-                                    uint32_t syndrome)
-+ * +-----+---+-----------+------+---+------+---+--------+---+----+----+
++static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
-+ * | 0 1 | U | 1 1 1 1 0 | size | 0 |  Rm  | 1 | opcode | 1 | Rn | Rd |
+ {
-+ * +-----+---+-----------+------+---+------+---+--------+---+----+----+
+     TCGv_i32 tcg_syn;
-+ */
-+static void disas_simd_scalar_three_reg_same_extra(DisasContext *s,
+-    gen_a64_set_pc_im(s->base.pc_next - offset);
-+                                                   uint32_t insn)
++    gen_a64_set_pc_im(s->pc_curr);
-+{
+     tcg_syn = tcg_const_i32(syndrome);
-+    int rd = extract32(insn, 0, 5);
+     gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
-+    int rn = extract32(insn, 5, 5);
+     tcg_temp_free_i32(tcg_syn);
-+    int opcode = extract32(insn, 11, 4);
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
-+    int rm = extract32(insn, 16, 5);
+             break;
-+    int size = extract32(insn, 22, 2);
+         }
-+    bool u = extract32(insn, 29, 1);
+         /* BRK */
-+    TCGv_i32 ele1, ele2, ele3;
+-        gen_exception_bkpt_insn(s, 4, syn_aa64_bkpt(imm16));
-+    TCGv_i64 res;
++        gen_exception_bkpt_insn(s, syn_aa64_bkpt(imm16));
-+    int feature;
+         break;
-+
+     case 2:
-+    switch (u * 16 + opcode) {
+         if (op2_ll != 0) {
-+    case 0x10: /* SQRDMLAH (vector) */
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-+    case 0x11: /* SQRDMLSH (vector) */
+index XXXXXXX..XXXXXXX 100644
-+        if (size != 1 && size != 2) {
+--- a/target/arm/translate.c
-+            unallocated_encoding(s);
++++ b/target/arm/translate.c
-+            return;
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
-+        }
+     s->base.is_jmp = DISAS_NORETURN;
-+        feature = ARM_FEATURE_V8_RDM;
+ }
-+        break;
-+    default:
+-static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
-+        unallocated_encoding(s);
++static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
-+        return;
+ {
-+    }
+     TCGv_i32 tcg_syn;
-+    if (!arm_dc_feature(s, feature)) {
-+        unallocated_encoding(s);
+     gen_set_condexec(s);
-+        return;
+-    gen_set_pc_im(s, s->base.pc_next - offset);
-+    }
++    gen_set_pc_im(s, s->pc_curr);
-+    if (!fp_access_check(s)) {
+     tcg_syn = tcg_const_i32(syn);
-+        return;
+     gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
-+    }
+     tcg_temp_free_i32(tcg_syn);
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+    /* Do a single operation on the lowest element in the vector.
+             case 1:
-+     * We use the standard Neon helpers and rely on 0 OP 0 == 0
+                 /* bkpt */
-+     * with no side effects for all these operations.
+                 ARCH(5);
-+     * OPTME: special-purpose helpers would avoid doing some
+-                gen_exception_bkpt_insn(s, 4, syn_aa32_bkpt(imm16, false));
-+     * unnecessary work in the helper for the 16 bit cases.
++                gen_exception_bkpt_insn(s, syn_aa32_bkpt(imm16, false));
-+     */
+                 break;
-+    ele1 = tcg_temp_new_i32();
+             case 2:
-+    ele2 = tcg_temp_new_i32();
+                 /* Hypervisor call (v7) */
-+    ele3 = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-+
+         {
-+    read_vec_element_i32(s, ele1, rn, 0, size);
+             int imm8 = extract32(insn, 0, 8);
-+    read_vec_element_i32(s, ele2, rm, 0, size);
+             ARCH(5);
-+    read_vec_element_i32(s, ele3, rd, 0, size);
+-            gen_exception_bkpt_insn(s, 2, syn_aa32_bkpt(imm8, true));
-+
++            gen_exception_bkpt_insn(s, syn_aa32_bkpt(imm8, true));
-+    switch (opcode) {
+             break;
-+    case 0x0: /* SQRDMLAH */
+         }
-+        if (size == 1) {
 +            gen_helper_neon_qrdmlah_s16(ele3, cpu_env, ele1, ele2, ele3);
 +        } else {
 +            gen_helper_neon_qrdmlah_s32(ele3, cpu_env, ele1, ele2, ele3);
 +        }
 +        break;
 +    case 0x1: /* SQRDMLSH */
 +        if (size == 1) {
 +            gen_helper_neon_qrdmlsh_s16(ele3, cpu_env, ele1, ele2, ele3);
 +        } else {
 +            gen_helper_neon_qrdmlsh_s32(ele3, cpu_env, ele1, ele2, ele3);
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    tcg_temp_free_i32(ele1);
 +    tcg_temp_free_i32(ele2);
 +
 +    res = tcg_temp_new_i64();
 +    tcg_gen_extu_i32_i64(res, ele3);
 +    tcg_temp_free_i32(ele3);
 +
 +    write_fp_dreg(s, rd, res);
 +    tcg_temp_free_i64(res);
 +}
 +
  static void handle_2misc_64(DisasContext *s, int opcode, bool u,
                              TCGv_i64 tcg_rd, TCGv_i64 tcg_rn,
                              TCGv_i32 tcg_rmode, TCGv_ptr tcg_fpstatus)
@@ -XXX,XX +XXX,XX @@ static const AArch64DecodeTable data_proc_simd[] = {
      { 0x0e000800, 0xbf208c00, disas_simd_zip_trn },
      { 0x2e000000, 0xbf208400, disas_simd_ext },
      { 0x5e200400, 0xdf200400, disas_simd_scalar_three_reg_same },
 +    { 0x5e008400, 0xdf208400, disas_simd_scalar_three_reg_same_extra },
      { 0x5e200000, 0xdf200c00, disas_simd_scalar_three_reg_diff },
      { 0x5e200800, 0xdf3e0c00, disas_simd_scalar_two_reg_misc },
      { 0x5e300800, 0xdf3e0c00, disas_simd_scalar_pairwise },
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM AdvSIMD / SVE Vector Operations
 + *
 + * Copyright (c) 2018 Linaro
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "exec/exec-all.h"
 +#include "exec/helper-proto.h"
 +#include "tcg/tcg-gvec-desc.h"
 +
 +
 +#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
 +
 +/* Signed saturating rounding doubling multiply-accumulate high half, 16-bit */
 +static uint16_t inl_qrdmlah_s16(CPUARMState *env, int16_t src1,
 +                                int16_t src2, int16_t src3)
 +{
 +    /* Simplify:
 +     * = ((a3 << 16) + ((e1 * e2) << 1) + (1 << 15)) >> 16
 +     * = ((a3 << 15) + (e1 * e2) + (1 << 14)) >> 15
 +     */
 +    int32_t ret = (int32_t)src1 * src2;
 +    ret = ((int32_t)src3 << 15) + ret + (1 << 14);
 +    ret >>= 15;
 +    if (ret != (int16_t)ret) {
 +        SET_QC();
 +        ret = (ret < 0 ? -0x8000 : 0x7fff);
 +    }
 +    return ret;
 +}
 +
 +uint32_t HELPER(neon_qrdmlah_s16)(CPUARMState *env, uint32_t src1,
 +                                  uint32_t src2, uint32_t src3)
 +{
 +    uint16_t e1 = inl_qrdmlah_s16(env, src1, src2, src3);
 +    uint16_t e2 = inl_qrdmlah_s16(env, src1 >> 16, src2 >> 16, src3 >> 16);
 +    return deposit32(e1, 16, 16, e2);
 +}
 +
 +/* Signed saturating rounding doubling multiply-subtract high half, 16-bit */
 +static uint16_t inl_qrdmlsh_s16(CPUARMState *env, int16_t src1,
 +                                int16_t src2, int16_t src3)
 +{
 +    /* Similarly, using subtraction:
 +     * = ((a3 << 16) - ((e1 * e2) << 1) + (1 << 15)) >> 16
 +     * = ((a3 << 15) - (e1 * e2) + (1 << 14)) >> 15
 +     */
 +    int32_t ret = (int32_t)src1 * src2;
 +    ret = ((int32_t)src3 << 15) - ret + (1 << 14);
 +    ret >>= 15;
 +    if (ret != (int16_t)ret) {
 +        SET_QC();
 +        ret = (ret < 0 ? -0x8000 : 0x7fff);
 +    }
 +    return ret;
 +}
 +
 +uint32_t HELPER(neon_qrdmlsh_s16)(CPUARMState *env, uint32_t src1,
 +                                  uint32_t src2, uint32_t src3)
 +{
 +    uint16_t e1 = inl_qrdmlsh_s16(env, src1, src2, src3);
 +    uint16_t e2 = inl_qrdmlsh_s16(env, src1 >> 16, src2 >> 16, src3 >> 16);
 +    return deposit32(e1, 16, 16, e2);
 +}
 +
 +/* Signed saturating rounding doubling multiply-accumulate high half, 32-bit */
 +uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
 +                                  int32_t src2, int32_t src3)
 +{
 +    /* Simplify similarly to int_qrdmlah_s16 above.  */
 +    int64_t ret = (int64_t)src1 * src2;
 +    ret = ((int64_t)src3 << 31) + ret + (1 << 30);
 +    ret >>= 31;
 +    if (ret != (int32_t)ret) {
 +        SET_QC();
 +        ret = (ret < 0 ? INT32_MIN : INT32_MAX);
 +    }
 +    return ret;
 +}
 +
 +/* Signed saturating rounding doubling multiply-subtract high half, 32-bit */
 +uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
 +                                  int32_t src2, int32_t src3)
 +{
 +    /* Simplify similarly to int_qrdmlsh_s16 above.  */
 +    int64_t ret = (int64_t)src1 * src2;
 +    ret = ((int64_t)src3 << 31) - ret + (1 << 30);
 +    ret >>= 31;
 +    if (ret != (int32_t)ret) {
 +        SET_QC();
 +        ret = (ret < 0 ? INT32_MIN : INT32_MAX);
 +    }
 +    return ret;
 +}
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 28/39] target/arm: Decode aa64 armv8.1 three same extra
+[Qemu-devel] [PULL 15/29] target/arm: Use unallocated_encoding for aarch32
 From: Richard Henderson <richard.henderson@linaro.org>
+Promote this function from aarch64 to fully general use.
+Use it to unify the code sequences for generating illegal
+opcode exceptions.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180228193125.20577-6-richard.henderson@linaro.org
+Message-id: 20190807045335.1361-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  9 +++++
+ target/arm/translate-a64.h     |  2 --
- target/arm/translate-a64.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.h         |  2 ++
- target/arm/vec_helper.c    | 74 +++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c     |  7 -------
-files changed, 166 insertions(+)
+ target/arm/translate-vfp.inc.c |  3 +--
  target/arm/translate.c         | 22 ++++++++++++----------
 files changed, 15 insertions(+), 21 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/translate-a64.h
-+++ b/target/arm/helper.h
++++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(dc_zva, void, env, i64)
+@@ -XXX,XX +XXX,XX @@
- DEF_HELPER_FLAGS_2(neon_pmull_64_lo, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ #ifndef TARGET_ARM_TRANSLATE_A64_H
- DEF_HELPER_FLAGS_2(neon_pmull_64_hi, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ #define TARGET_ARM_TRANSLATE_A64_H
-+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s16, TCG_CALL_NO_RWG,
+-void unallocated_encoding(DisasContext *s);
-+                   void, ptr, ptr, ptr, ptr, i32)
+-
-+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s16, TCG_CALL_NO_RWG,
+ #define unsupported_encoding(s, insn)                                    \
-+                   void, ptr, ptr, ptr, ptr, i32)
+     do {                                                                 \
-+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s32, TCG_CALL_NO_RWG,
+         qemu_log_mask(LOG_UNIMP,                                         \
-+                   void, ptr, ptr, ptr, ptr, i32)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
-+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s32, TCG_CALL_NO_RWG,
+index XXXXXXX..XXXXXXX 100644
-+                   void, ptr, ptr, ptr, ptr, i32)
+--- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasCompare {
      bool value_global;
  } DisasCompare;
 +void unallocated_encoding(DisasContext *s);
 +
- #ifdef TARGET_AARCH64
+ /* Share the TCG temporaries common between 32 and 64 bit modes.  */
- #include "helper-a64.h"
+ extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
- #endif
+ extern TCGv_i64 cpu_exclusive_addr;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3(DisasContext *s, bool is_q, int rd,
+@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
-                    vec_full_reg_size(s), gvec_op);
+     }
  }
-+/* Expand a 3-operand + env pointer operation using
+-void unallocated_encoding(DisasContext *s)
-+ * an out-of-line helper.
+-{
-+ */
+-    /* Unallocated and reserved encodings are uncategorized */
-+static void gen_gvec_op3_env(DisasContext *s, bool is_q, int rd,
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+                             int rn, int rm, gen_helper_gvec_3_ptr *fn)
+-                       default_exception_el(s));
 -}
 -
  static void init_tmp_a64_array(DisasContext *s)
  {
  #ifdef CONFIG_DEBUG_TCG
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
      if (!s->vfp_enabled && !ignore_vfp_enabled) {
          assert(!arm_dc_feature(s, ARM_FEATURE_M));
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
 -                           default_exception_el(s));
 +        unallocated_encoding(s);
          return false;
      }
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
      s->base.is_jmp = DISAS_NORETURN;
  }
 +void unallocated_encoding(DisasContext *s)
 +{
-+    tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
++    /* Unallocated and reserved encodings are uncategorized */
-+                       vec_full_reg_offset(s, rn),
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+                       vec_full_reg_offset(s, rm), cpu_env,
++                       default_exception_el(s));
 +                       is_q ? 16 : 8, vec_full_reg_size(s), 0, fn);
 +}
 +
- /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
-  * than the 32 bit equivalent.
+ static inline void gen_lookup_tb(DisasContext *s)
-  */
+ {
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
-     clear_vec_high(s, is_q, rd);
+         return;
      }
 -    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
 -                       default_exception_el(s));
 +    unallocated_encoding(s);
  }
-+/* AdvSIMD three same extra
+ static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
-+ *  31   30  29 28       24 23  22  21 20  16  15 14    11  10 9  5 4  0
+@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
-+ * +---+---+---+-----------+------+---+------+---+--------+---+----+----+
+     }
-+ * | 0 | Q | U | 0 1 1 1 0 | size | 0 |  Rm  | 1 | opcode | 1 | Rn | Rd |
-+ * +---+---+---+-----------+------+---+------+---+--------+---+----+----+
+     if (undef) {
-+ */
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
+-                           default_exception_el(s));
-+{
++        unallocated_encoding(s);
-+    int rd = extract32(insn, 0, 5);
+         return;
-+    int rn = extract32(insn, 5, 5);
+     }
-+    int opcode = extract32(insn, 11, 4);
-+    int rm = extract32(insn, 16, 5);
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+    int size = extract32(insn, 22, 2);
+             break;
-+    bool u = extract32(insn, 29, 1);
+         default:
-+    bool is_q = extract32(insn, 30, 1);
+         illegal_op:
-+    int feature;
+-            gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+
+-                               default_exception_el(s));
 +    switch (u * 16 + opcode) {
 +    case 0x10: /* SQRDMLAH (vector) */
 +    case 0x11: /* SQRDMLSH (vector) */
 +        if (size != 1 && size != 2) {
 +            unallocated_encoding(s);
-+            return;
+             break;
-+        }
+         }
-+        feature = ARM_FEATURE_V8_RDM;
+     }
-+        break;
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+    default:
+     }
-+        unallocated_encoding(s);
+     return;
-+        return;
+ illegal_op:
-+    }
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+    if (!arm_dc_feature(s, feature)) {
+-                       default_exception_el(s));
-+        unallocated_encoding(s);
++    unallocated_encoding(s);
 +        return;
 +    }
 +    if (!fp_access_check(s)) {
 +        return;
 +    }
 +
 +    switch (opcode) {
 +    case 0x0: /* SQRDMLAH (vector) */
 +        switch (size) {
 +        case 1:
 +            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlah_s16);
 +            break;
 +        case 2:
 +            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlah_s32);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +        return;
 +
 +    case 0x1: /* SQRDMLSH (vector) */
 +        switch (size) {
 +        case 1:
 +            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlsh_s16);
 +            break;
 +        case 2:
 +            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlsh_s32);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +        return;
 +
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  static void handle_2misc_widening(DisasContext *s, int opcode, bool is_q,
                                    int size, int rn, int rd)
  {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_imm2(DisasContext *s, uint32_t insn)
  static const AArch64DecodeTable data_proc_simd[] = {
      /* pattern  ,  mask     ,  fn                        */
      { 0x0e200400, 0x9f200400, disas_simd_three_reg_same },
 +    { 0x0e008400, 0x9f208400, disas_simd_three_reg_same_extra },
      { 0x0e200000, 0x9f200c00, disas_simd_three_reg_diff },
      { 0x0e200800, 0x9f3e0c00, disas_simd_two_reg_misc },
      { 0x0e300800, 0x9f3e0c00, disas_simd_across_lanes },
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vec_helper.c
 +++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
  #define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
 +static void clear_tail(void *vd, uintptr_t opr_sz, uintptr_t max_sz)
 +{
 +    uint64_t *d = vd + opr_sz;
 +    uintptr_t i;
 +
 +    for (i = opr_sz; i < max_sz; i += 8) {
 +        *d++ = 0;
 +    }
 +}
 +
  /* Signed saturating rounding doubling multiply-accumulate high half, 16-bit */
  static uint16_t inl_qrdmlah_s16(CPUARMState *env, int16_t src1,
                                  int16_t src2, int16_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlah_s16)(CPUARMState *env, uint32_t src1,
      return deposit32(e1, 16, 16, e2);
  }
-+void HELPER(gvec_qrdmlah_s16)(void *vd, void *vn, void *vm,
+ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-+                              void *ve, uint32_t desc)
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-+{
+     return;
-+    uintptr_t opr_sz = simd_oprsz(desc);
+ illegal_op:
-+    int16_t *d = vd;
+ undef:
-+    int16_t *n = vn;
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+    int16_t *m = vm;
+-                       default_exception_el(s));
-+    CPUARMState *env = ve;
++    unallocated_encoding(s);
 +    uintptr_t i;
 +
 +    for (i = 0; i < opr_sz / 2; ++i) {
 +        d[i] = inl_qrdmlah_s16(env, n[i], m[i], d[i]);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
  /* Signed saturating rounding doubling multiply-subtract high half, 16-bit */
  static uint16_t inl_qrdmlsh_s16(CPUARMState *env, int16_t src1,
                                  int16_t src2, int16_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlsh_s16)(CPUARMState *env, uint32_t src1,
      return deposit32(e1, 16, 16, e2);
  }
-+void HELPER(gvec_qrdmlsh_s16)(void *vd, void *vn, void *vm,
+ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
 +                              void *ve, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    int16_t *d = vd;
 +    int16_t *n = vn;
 +    int16_t *m = vm;
 +    CPUARMState *env = ve;
 +    uintptr_t i;
 +
 +    for (i = 0; i < opr_sz / 2; ++i) {
 +        d[i] = inl_qrdmlsh_s16(env, n[i], m[i], d[i]);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
  /* Signed saturating rounding doubling multiply-accumulate high half, 32-bit */
  uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
                                    int32_t src2, int32_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
      return ret;
  }
 +void HELPER(gvec_qrdmlah_s32)(void *vd, void *vn, void *vm,
 +                              void *ve, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    int32_t *d = vd;
 +    int32_t *n = vn;
 +    int32_t *m = vm;
 +    CPUARMState *env = ve;
 +    uintptr_t i;
 +
 +    for (i = 0; i < opr_sz / 4; ++i) {
 +        d[i] = helper_neon_qrdmlah_s32(env, n[i], m[i], d[i]);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
  /* Signed saturating rounding doubling multiply-subtract high half, 32-bit */
  uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
                                    int32_t src2, int32_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
      }
      return ret;
  }
 +
 +void HELPER(gvec_qrdmlsh_s32)(void *vd, void *vn, void *vm,
 +                              void *ve, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    int32_t *d = vd;
 +    int32_t *n = vn;
 +    int32_t *m = vm;
 +    CPUARMState *env = ve;
 +    uintptr_t i;
 +
 +    for (i = 0; i < opr_sz / 4; ++i) {
 +        d[i] = helper_neon_qrdmlsh_s32(env, n[i], m[i], d[i]);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 34/39] target/arm: Decode aa64 armv8.3 fcadd
+[Qemu-devel] [PULL 16/29] target/arm: Remove helper_double_saturate
 From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Replace x = double_saturate(y) with x = add_saturate(y, y).
 There is no need for a separate more specialized helper.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-12-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190807045335.1361-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  7 ++++
+ target/arm/helper.h    |  1 -
- target/arm/translate-a64.c | 48 ++++++++++++++++++++++-
+ target/arm/op_helper.c | 15 ---------------
- target/arm/vec_helper.c    | 97 ++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.c |  4 ++--
-files changed, 151 insertions(+), 1 deletion(-)
+files changed, 2 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_qrdmlah_s32, TCG_CALL_NO_RWG,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(add_saturate, i32, env, i32, i32)
- DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s32, TCG_CALL_NO_RWG,
+ DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
-                    void, ptr, ptr, ptr, ptr, i32)
+ DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
+ DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
-+DEF_HELPER_FLAGS_5(gvec_fcaddh, TCG_CALL_NO_RWG,
+-DEF_HELPER_2(double_saturate, i32, env, s32)
-+                   void, ptr, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_2(sdiv, TCG_CALL_NO_RWG_SE, s32, s32, s32)
-+DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_2(udiv, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-+                   void, ptr, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_1(rbit, TCG_CALL_NO_RWG_SE, i32, i32)
-+DEF_HELPER_FLAGS_5(gvec_fcaddd, TCG_CALL_NO_RWG,
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 +                   void, ptr, ptr, ptr, ptr, i32)
 +
  #ifdef TARGET_AARCH64
  #include "helper-a64.h"
  #endif
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/op_helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_env(DisasContext *s, bool is_q, int rd,
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
-                        is_q ? 16 : 8, vec_full_reg_size(s), 0, fn);
+     return res;
  }
-+/* Expand a 3-operand + fpstatus pointer + simd data value operation using
+-uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
-+ * an out-of-line helper.
+-{
-+ */
+-    uint32_t res;
-+static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+-    if (val >= 0x40000000) {
-+                              int rm, bool is_fp16, int data,
+-        res = ~SIGNBIT;
-+                              gen_helper_gvec_3_ptr *fn)
+-        env->QF = 1;
-+{
+-    } else if (val <= (int32_t)0xc0000000) {
-+    TCGv_ptr fpst = get_fpstatus_ptr(is_fp16);
+-        res = SIGNBIT;
-+    tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+-        env->QF = 1;
-+                       vec_full_reg_offset(s, rn),
+-    } else {
-+                       vec_full_reg_offset(s, rm), fpst,
+-        res = val << 1;
-+                       is_q ? 16 : 8, vec_full_reg_size(s), data, fn);
+-    }
-+    tcg_temp_free_ptr(fpst);
+-    return res;
-+}
+-}
-+
+-
- /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
+ uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
-  * than the 32 bit equivalent.
+ {
-  */
+     uint32_t res = a + b;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
      int size = extract32(insn, 22, 2);
      bool u = extract32(insn, 29, 1);
      bool is_q = extract32(insn, 30, 1);
 -    int feature;
 +    int feature, rot;
      switch (u * 16 + opcode) {
      case 0x10: /* SQRDMLAH (vector) */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
          }
          feature = ARM_FEATURE_V8_RDM;
          break;
 +    case 0xc: /* FCADD, #90 */
 +    case 0xe: /* FCADD, #270 */
 +        if (size == 0
 +            || (size == 1 && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))
 +            || (size == 3 && !is_q)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        feature = ARM_FEATURE_V8_FCMA;
 +        break;
      default:
          unallocated_encoding(s);
          return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
          }
          return;
 +    case 0xc: /* FCADD, #90 */
 +    case 0xe: /* FCADD, #270 */
 +        rot = extract32(opcode, 1, 1);
 +        switch (size) {
 +        case 1:
 +            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, size == 1, rot,
 +                              gen_helper_gvec_fcaddh);
 +            break;
 +        case 2:
 +            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, size == 1, rot,
 +                              gen_helper_gvec_fcadds);
 +            break;
 +        case 3:
 +            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, size == 1, rot,
 +                              gen_helper_gvec_fcaddd);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +        return;
 +
      default:
          g_assert_not_reached();
      }
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/vec_helper.c
+--- a/target/arm/translate.c
-+++ b/target/arm/vec_helper.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
- #include "exec/exec-all.h"
+             tmp = load_reg(s, rm);
- #include "exec/helper-proto.h"
+             tmp2 = load_reg(s, rn);
- #include "tcg/tcg-gvec-desc.h"
+             if (op1 & 2)
-+#include "fpu/softfloat.h"
+-                gen_helper_double_saturate(tmp2, cpu_env, tmp2);
++                gen_helper_add_saturate(tmp2, cpu_env, tmp2, tmp2);
+             if (op1 & 1)
-+/* Note that vector data is stored in host-endian 64-bit chunks,
+                 gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
-+   so addressing units smaller than that needs a host-endian fixup.  */
+             else
-+#ifdef HOST_WORDS_BIGENDIAN
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+#define H1(x)  ((x) ^ 7)
+                 tmp = load_reg(s, rn);
-+#define H2(x)  ((x) ^ 3)
+                 tmp2 = load_reg(s, rm);
-+#define H4(x)  ((x) ^ 1)
+                 if (op & 1)
-+#else
+-                    gen_helper_double_saturate(tmp, cpu_env, tmp);
-+#define H1(x)  (x)
++                    gen_helper_add_saturate(tmp, cpu_env, tmp, tmp);
-+#define H2(x)  (x)
+                 if (op & 2)
-+#define H4(x)  (x)
+                     gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
-+#endif
+                 else
 +
  #define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
  static void clear_tail(void *vd, uintptr_t opr_sz, uintptr_t max_sz)
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_qrdmlsh_s32)(void *vd, void *vn, void *vm,
      }
      clear_tail(d, opr_sz, simd_maxsz(desc));
  }
 +
 +void HELPER(gvec_fcaddh)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float16 *d = vd;
 +    float16 *n = vn;
 +    float16 *m = vm;
 +    float_status *fpst = vfpst;
 +    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = neg_real ^ 1;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 15;
 +    neg_imag <<= 15;
 +
 +    for (i = 0; i < opr_sz / 2; i += 2) {
 +        float16 e0 = n[H2(i)];
 +        float16 e1 = m[H2(i + 1)] ^ neg_imag;
 +        float16 e2 = n[H2(i + 1)];
 +        float16 e3 = m[H2(i)] ^ neg_real;
 +
 +        d[H2(i)] = float16_add(e0, e1, fpst);
 +        d[H2(i + 1)] = float16_add(e2, e3, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcadds)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float32 *d = vd;
 +    float32 *n = vn;
 +    float32 *m = vm;
 +    float_status *fpst = vfpst;
 +    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint32_t neg_imag = neg_real ^ 1;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 31;
 +    neg_imag <<= 31;
 +
 +    for (i = 0; i < opr_sz / 4; i += 2) {
 +        float32 e0 = n[H4(i)];
 +        float32 e1 = m[H4(i + 1)] ^ neg_imag;
 +        float32 e2 = n[H4(i + 1)];
 +        float32 e3 = m[H4(i)] ^ neg_real;
 +
 +        d[H4(i)] = float32_add(e0, e1, fpst);
 +        d[H4(i + 1)] = float32_add(e2, e3, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_fcaddd)(void *vd, void *vn, void *vm,
 +                         void *vfpst, uint32_t desc)
 +{
 +    uintptr_t opr_sz = simd_oprsz(desc);
 +    float64 *d = vd;
 +    float64 *n = vn;
 +    float64 *m = vm;
 +    float_status *fpst = vfpst;
 +    uint64_t neg_real = extract64(desc, SIMD_DATA_SHIFT, 1);
 +    uint64_t neg_imag = neg_real ^ 1;
 +    uintptr_t i;
 +
 +    /* Shift boolean to the sign bit so we can xor to negate.  */
 +    neg_real <<= 63;
 +    neg_imag <<= 63;
 +
 +    for (i = 0; i < opr_sz / 8; i += 2) {
 +        float64 e0 = n[i];
 +        float64 e1 = m[i + 1] ^ neg_imag;
 +        float64 e2 = n[i + 1];
 +        float64 e3 = m[i] ^ neg_real;
 +
 +        d[i] = float64_add(e0, e1, fpst);
 +        d[i + 1] = float64_add(e2, e3, fpst);
 +    }
 +    clear_tail(d, opr_sz, simd_maxsz(desc));
 +}
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 22/39] hw/arm/iotkit: Model Arm IOT Kit
+[Qemu-devel] [PULL 17/29] target/arm/cpu64: Ensure kvm really supports aarch64=off
-Model the Arm IoT Kit documented in
+From: Andrew Jones <drjones@redhat.com>
 http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
-The Arm IoT Kit is a subsystem which includes a CPU and some devices,
+If -cpu <cpu>,aarch64=off is used then KVM must also be used, and it
-and is intended be extended by adding extra devices to form a
+and the host must support running the vcpu in 32-bit mode. Also, if
-complete system.  It is used in the MPS2 board's AN505 image for the
+-cpu <cpu>,aarch64=on is used, then it doesn't matter if kvm is
-Cortex-M33.
+enabled or not.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-19-peter.maydell@linaro.org
 ---
- hw/arm/Makefile.objs            |   1 +
+ target/arm/kvm_arm.h | 14 ++++++++++++++
- include/hw/arm/iotkit.h         | 109 ++++++++
+ target/arm/cpu64.c   | 12 ++++++------
- hw/arm/iotkit.c                 | 598 ++++++++++++++++++++++++++++++++++++++++
+ target/arm/kvm64.c   |  9 +++++++++
- default-configs/arm-softmmu.mak |   1 +
+files changed, 29 insertions(+), 6 deletions(-)
 files changed, 709 insertions(+)
  create mode 100644 include/hw/arm/iotkit.h
  create mode 100644 hw/arm/iotkit.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/target/arm/kvm_arm.h
-+++ b/hw/arm/Makefile.objs
++++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
- obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
+  */
- obj-$(CONFIG_MPS2) += mps2.o
+ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
- obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
-+obj-$(CONFIG_IOTKIT) += iotkit.o
++/**
-diff --git a/include/hw/arm/iotkit.h b/include/hw/arm/iotkit.h
++ * kvm_arm_aarch32_supported:
-new file mode 100644
++ * @cs: CPUState
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/iotkit.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM IoT Kit
 + *
-+ * Copyright (c) 2018 Linaro Limited
++ * Returns: true if the KVM VCPU can enable AArch32 mode
-+ * Written by Peter Maydell
++ * and false otherwise.
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
++bool kvm_arm_aarch32_supported(CPUState *cs);
 +
-+/* This is a model of the Arm IoT Kit which is documented in
+ /**
-+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
-+ * It contains:
+  * IPA address space supported by KVM
-+ *  a Cortex-M33
+@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
-+ *  the IDAU
+     cpu->host_cpu_probe_failed = true;
-+ *  some timers and watchdogs
+ }
-+ *  two peripheral protection controllers
-+ *  a memory protection controller
++static inline bool kvm_arm_aarch32_supported(CPUState *cs)
 + *  a security controller
 + *  a bus fabric which arranges that some parts of the address
 + *  space are secure and non-secure aliases of each other
 + *
 + * QEMU interface:
 + *  + QOM property "memory" is a MemoryRegion containing the devices provided
 + *    by the board model.
 + *  + QOM property "MAINCLK" is the frequency of the main system clock
 + *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts
 + *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts, which
 + *    are wired to the NVIC lines 32 .. n+32
 + * Controlling up to 4 AHB expansion PPBs which a system using the IoTKit
 + * might provide:
 + *  + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
 + *  + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
 + *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
 + *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
 + *  + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
 + * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
 + * might provide:
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
 + *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
 + *  + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
 + */
 +
 +#ifndef IOTKIT_H
 +#define IOTKIT_H
 +
 +#include "hw/sysbus.h"
 +#include "hw/arm/armv7m.h"
 +#include "hw/misc/iotkit-secctl.h"
 +#include "hw/misc/tz-ppc.h"
 +#include "hw/timer/cmsdk-apb-timer.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/or-irq.h"
 +#include "hw/core/split-irq.h"
 +
 +#define TYPE_IOTKIT "iotkit"
 +#define IOTKIT(obj) OBJECT_CHECK(IoTKit, (obj), TYPE_IOTKIT)
 +
 +/* We have an IRQ splitter and an OR gate input for each external PPC
 + * and the 2 internal PPCs
 + */
 +#define NUM_EXTERNAL_PPCS (IOTS_NUM_AHB_EXP_PPC + IOTS_NUM_APB_EXP_PPC)
 +#define NUM_PPCS (NUM_EXTERNAL_PPCS + 2)
 +
 +typedef struct IoTKit {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    ARMv7MState armv7m;
 +    IoTKitSecCtl secctl;
 +    TZPPC apb_ppc0;
 +    TZPPC apb_ppc1;
 +    CMSDKAPBTIMER timer0;
 +    CMSDKAPBTIMER timer1;
 +    qemu_or_irq ppc_irq_orgate;
 +    SplitIRQ sec_resp_splitter;
 +    SplitIRQ ppc_irq_splitter[NUM_PPCS];
 +
 +    UnimplementedDeviceState dualtimer;
 +    UnimplementedDeviceState s32ktimer;
 +
 +    MemoryRegion container;
 +    MemoryRegion alias1;
 +    MemoryRegion alias2;
 +    MemoryRegion alias3;
 +    MemoryRegion sram0;
 +
 +    qemu_irq *exp_irqs;
 +    qemu_irq ppc0_irq;
 +    qemu_irq ppc1_irq;
 +    qemu_irq sec_resp_cfg;
 +    qemu_irq sec_resp_cfg_in;
 +    qemu_irq nsc_cfg_in;
 +
 +    qemu_irq irq_status_in[NUM_EXTERNAL_PPCS];
 +
 +    uint32_t nsccfg;
 +
 +    /* Properties */
 +    MemoryRegion *board_memory;
 +    uint32_t exp_numirq;
 +    uint32_t mainclk_frq;
 +} IoTKit;
 +
 +#endif
 diff --git a/hw/arm/iotkit.c b/hw/arm/iotkit.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/iotkit.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Arm IoT Kit
 + *
 + * Copyright (c) 2018 Linaro Limited
 + * Written by Peter Maydell
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +#include "trace.h"
 +#include "hw/sysbus.h"
 +#include "hw/registerfields.h"
 +#include "hw/arm/iotkit.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/arm/arm.h"
 +
 +/* Create an alias region of @size bytes starting at @base
 + * which mirrors the memory starting at @orig.
 + */
 +static void make_alias(IoTKit *s, MemoryRegion *mr, const char *name,
 +                       hwaddr base, hwaddr size, hwaddr orig)
 +{
-+    memory_region_init_alias(mr, NULL, name, &s->container, orig, size);
++    return false;
 +    /* The alias is even lower priority than unimplemented_device regions */
 +    memory_region_add_subregion_overlap(&s->container, base, mr, -1500);
 +}
 +
-+static void init_sysbus_child(Object *parent, const char *childname,
+ static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
-+                              void *child, size_t childsize,
+ {
-+                              const char *childtype)
+     return -ENOENT;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_set_aarch64(Object *obj, bool value, Error **errp)
       * restriction allows us to avoid fixing up functionality that assumes a
       * uniform execution state like do_interrupt.
       */
 -    if (!kvm_enabled()) {
 -        error_setg(errp, "'aarch64' feature cannot be disabled "
 -                         "unless KVM is enabled");
 -        return;
 -    }
 -
      if (value == false) {
 +        if (!kvm_enabled() || !kvm_arm_aarch32_supported(CPU(cpu))) {
 +            error_setg(errp, "'aarch64' feature cannot be disabled "
 +                             "unless KVM is enabled and 32-bit EL1 "
 +                             "is supported");
 +            return;
 +        }
          unset_feature(&cpu->env, ARM_FEATURE_AARCH64);
      } else {
          set_feature(&cpu->env, ARM_FEATURE_AARCH64);
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/gdbstub.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/kvm_int.h"
  #include "kvm_arm.h"
 +#include "hw/boards.h"
  #include "internals.h"
  static bool have_guest_debug;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      return true;
  }
 +bool kvm_arm_aarch32_supported(CPUState *cpu)
 +{
-+    object_initialize(child, childsize, childtype);
++    KVMState *s = KVM_STATE(current_machine->accelerator);
-+    object_property_add_child(parent, childname, OBJECT(child), &error_abort);
++
-+    qdev_set_parent_bus(DEVICE(child), sysbus_get_default());
++    return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
 +}
 +
-+static void irq_status_forwarder(void *opaque, int n, int level)
+ #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
-+{
-+    qemu_irq destirq = opaque;
+ int kvm_arch_init_vcpu(CPUState *cs)
 +
 +    qemu_set_irq(destirq, level);
 +}
 +
 +static void nsccfg_handler(void *opaque, int n, int level)
 +{
 +    IoTKit *s = IOTKIT(opaque);
 +
 +    s->nsccfg = level;
 +}
 +
 +static void iotkit_forward_ppc(IoTKit *s, const char *ppcname, int ppcnum)
 +{
 +    /* Each of the 4 AHB and 4 APB PPCs that might be present in a
 +     * system using the IoTKit has a collection of control lines which
 +     * are provided by the security controller and which we want to
 +     * expose as control lines on the IoTKit device itself, so the
 +     * code using the IoTKit can wire them up to the PPCs.
 +     */
 +    SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum];
 +    DeviceState *iotkitdev = DEVICE(s);
 +    DeviceState *dev_secctl = DEVICE(&s->secctl);
 +    DeviceState *dev_splitter = DEVICE(splitter);
 +    char *name;
 +
 +    name = g_strdup_printf("%s_nonsec", ppcname);
 +    qdev_pass_gpios(dev_secctl, iotkitdev, name);
 +    g_free(name);
 +    name = g_strdup_printf("%s_ap", ppcname);
 +    qdev_pass_gpios(dev_secctl, iotkitdev, name);
 +    g_free(name);
 +    name = g_strdup_printf("%s_irq_enable", ppcname);
 +    qdev_pass_gpios(dev_secctl, iotkitdev, name);
 +    g_free(name);
 +    name = g_strdup_printf("%s_irq_clear", ppcname);
 +    qdev_pass_gpios(dev_secctl, iotkitdev, name);
 +    g_free(name);
 +
 +    /* irq_status is a little more tricky, because we need to
 +     * split it so we can send it both to the security controller
 +     * and to our OR gate for the NVIC interrupt line.
 +     * Connect up the splitter's outputs, and create a GPIO input
 +     * which will pass the line state to the input splitter.
 +     */
 +    name = g_strdup_printf("%s_irq_status", ppcname);
 +    qdev_connect_gpio_out(dev_splitter, 0,
 +                          qdev_get_gpio_in_named(dev_secctl,
 +                                                 name, 0));
 +    qdev_connect_gpio_out(dev_splitter, 1,
 +                          qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum));
 +    s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0);
 +    qdev_init_gpio_in_named_with_opaque(iotkitdev, irq_status_forwarder,
 +                                        s->irq_status_in[ppcnum], name, 1);
 +    g_free(name);
 +}
 +
 +static void iotkit_forward_sec_resp_cfg(IoTKit *s)
 +{
 +    /* Forward the 3rd output from the splitter device as a
 +     * named GPIO output of the iotkit object.
 +     */
 +    DeviceState *dev = DEVICE(s);
 +    DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter);
 +
 +    qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
 +    s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder,
 +                                           s->sec_resp_cfg, 1);
 +    qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
 +}
 +
 +static void iotkit_init(Object *obj)
 +{
 +    IoTKit *s = IOTKIT(obj);
 +    int i;
 +
 +    memory_region_init(&s->container, obj, "iotkit-container", UINT64_MAX);
 +
 +    init_sysbus_child(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
 +                      TYPE_ARMV7M);
 +    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
 +                         ARM_CPU_TYPE_NAME("cortex-m33"));
 +
 +    init_sysbus_child(obj, "secctl", &s->secctl, sizeof(s->secctl),
 +                      TYPE_IOTKIT_SECCTL);
 +    init_sysbus_child(obj, "apb-ppc0", &s->apb_ppc0, sizeof(s->apb_ppc0),
 +                      TYPE_TZ_PPC);
 +    init_sysbus_child(obj, "apb-ppc1", &s->apb_ppc1, sizeof(s->apb_ppc1),
 +                      TYPE_TZ_PPC);
 +    init_sysbus_child(obj, "timer0", &s->timer0, sizeof(s->timer0),
 +                      TYPE_CMSDK_APB_TIMER);
 +    init_sysbus_child(obj, "timer1", &s->timer1, sizeof(s->timer1),
 +                      TYPE_CMSDK_APB_TIMER);
 +    init_sysbus_child(obj, "dualtimer", &s->dualtimer, sizeof(s->dualtimer),
 +                      TYPE_UNIMPLEMENTED_DEVICE);
 +    object_initialize(&s->ppc_irq_orgate, sizeof(s->ppc_irq_orgate),
 +                      TYPE_OR_IRQ);
 +    object_property_add_child(obj, "ppc-irq-orgate",
 +                              OBJECT(&s->ppc_irq_orgate), &error_abort);
 +    object_initialize(&s->sec_resp_splitter, sizeof(s->sec_resp_splitter),
 +                      TYPE_SPLIT_IRQ);
 +    object_property_add_child(obj, "sec-resp-splitter",
 +                              OBJECT(&s->sec_resp_splitter), &error_abort);
 +    for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
 +        char *name = g_strdup_printf("ppc-irq-splitter-%d", i);
 +        SplitIRQ *splitter = &s->ppc_irq_splitter[i];
 +
 +        object_initialize(splitter, sizeof(*splitter), TYPE_SPLIT_IRQ);
 +        object_property_add_child(obj, name, OBJECT(splitter), &error_abort);
 +    }
 +    init_sysbus_child(obj, "s32ktimer", &s->s32ktimer, sizeof(s->s32ktimer),
 +                      TYPE_UNIMPLEMENTED_DEVICE);
 +}
 +
 +static void iotkit_exp_irq(void *opaque, int n, int level)
 +{
 +    IoTKit *s = IOTKIT(opaque);
 +
 +    qemu_set_irq(s->exp_irqs[n], level);
 +}
 +
 +static void iotkit_realize(DeviceState *dev, Error **errp)
 +{
 +    IoTKit *s = IOTKIT(dev);
 +    int i;
 +    MemoryRegion *mr;
 +    Error *err = NULL;
 +    SysBusDevice *sbd_apb_ppc0;
 +    SysBusDevice *sbd_secctl;
 +    DeviceState *dev_apb_ppc0;
 +    DeviceState *dev_apb_ppc1;
 +    DeviceState *dev_secctl;
 +    DeviceState *dev_splitter;
 +
 +    if (!s->board_memory) {
 +        error_setg(errp, "memory property was not set");
 +        return;
 +    }
 +
 +    if (!s->mainclk_frq) {
 +        error_setg(errp, "MAINCLK property was not set");
 +        return;
 +    }
 +
 +    /* Handling of which devices should be available only to secure
 +     * code is usually done differently for M profile than for A profile.
 +     * Instead of putting some devices only into the secure address space,
 +     * devices exist in both address spaces but with hard-wired security
 +     * permissions that will cause the CPU to fault for non-secure accesses.
 +     *
 +     * The IoTKit has an IDAU (Implementation Defined Access Unit),
 +     * which specifies hard-wired security permissions for different
 +     * areas of the physical address space. For the IoTKit IDAU, the
 +     * top 4 bits of the physical address are the IDAU region ID, and
 +     * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS
 +     * region, otherwise it is an S region.
 +     *
 +     * The various devices and RAMs are generally all mapped twice,
 +     * once into a region that the IDAU defines as secure and once
 +     * into a non-secure region. They sit behind either a Memory
 +     * Protection Controller (for RAM) or a Peripheral Protection
 +     * Controller (for devices), which allow a more fine grained
 +     * configuration of whether non-secure accesses are permitted.
 +     *
 +     * (The other place that guest software can configure security
 +     * permissions is in the architected SAU (Security Attribution
 +     * Unit), which is entirely inside the CPU. The IDAU can upgrade
 +     * the security attributes for a region to more restrictive than
 +     * the SAU specifies, but cannot downgrade them.)
 +     *
 +     * 0x10000000..0x1fffffff  alias of 0x00000000..0x0fffffff
 +     * 0x20000000..0x2007ffff  32KB FPGA block RAM
 +     * 0x30000000..0x3fffffff  alias of 0x20000000..0x2fffffff
 +     * 0x40000000..0x4000ffff  base peripheral region 1
 +     * 0x40010000..0x4001ffff  CPU peripherals (none for IoTKit)
 +     * 0x40020000..0x4002ffff  system control element peripherals
 +     * 0x40080000..0x400fffff  base peripheral region 2
 +     * 0x50000000..0x5fffffff  alias of 0x40000000..0x4fffffff
 +     */
 +
 +    memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -1);
 +
 +    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", s->exp_numirq + 32);
 +    /* In real hardware the initial Secure VTOR is set from the INITSVTOR0
 +     * register in the IoT Kit System Control Register block, and the
 +     * initial value of that is in turn specifiable by the FPGA that
 +     * instantiates the IoT Kit. In QEMU we don't implement this wrinkle,
 +     * and simply set the CPU's init-svtor to the IoT Kit default value.
 +     */
 +    qdev_prop_set_uint32(DEVICE(&s->armv7m), "init-svtor", 0x10000000);
 +    object_property_set_link(OBJECT(&s->armv7m), OBJECT(&s->container),
 +                             "memory", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_link(OBJECT(&s->armv7m), OBJECT(s), "idau", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    /* Connect our EXP_IRQ GPIOs to the NVIC's lines 32 and up. */
 +    s->exp_irqs = g_new(qemu_irq, s->exp_numirq);
 +    for (i = 0; i < s->exp_numirq; i++) {
 +        s->exp_irqs[i] = qdev_get_gpio_in(DEVICE(&s->armv7m), i + 32);
 +    }
 +    qdev_init_gpio_in_named(dev, iotkit_exp_irq, "EXP_IRQ", s->exp_numirq);
 +
 +    /* Set up the big aliases first */
 +    make_alias(s, &s->alias1, "alias 1", 0x10000000, 0x10000000, 0x00000000);
 +    make_alias(s, &s->alias2, "alias 2", 0x30000000, 0x10000000, 0x20000000);
 +    /* The 0x50000000..0x5fffffff region is not a pure alias: it has
 +     * a few extra devices that only appear there (generally the
 +     * control interfaces for the protection controllers).
 +     * We implement this by mapping those devices over the top of this
 +     * alias MR at a higher priority.
 +     */
 +    make_alias(s, &s->alias3, "alias 3", 0x50000000, 0x10000000, 0x40000000);
 +
 +    /* This RAM should be behind a Memory Protection Controller, but we
 +     * don't implement that yet.
 +     */
 +    memory_region_init_ram(&s->sram0, NULL, "iotkit.sram0", 0x00008000, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(&s->container, 0x20000000, &s->sram0);
 +
 +    /* Security controller */
 +    object_property_set_bool(OBJECT(&s->secctl), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sbd_secctl = SYS_BUS_DEVICE(&s->secctl);
 +    dev_secctl = DEVICE(&s->secctl);
 +    sysbus_mmio_map(sbd_secctl, 0, 0x50080000);
 +    sysbus_mmio_map(sbd_secctl, 1, 0x40080000);
 +
 +    s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1);
 +    qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in);
 +
 +    /* The sec_resp_cfg output from the security controller must be split into
 +     * multiple lines, one for each of the PPCs within the IoTKit and one
 +     * that will be an output from the IoTKit to the system.
 +     */
 +    object_property_set_int(OBJECT(&s->sec_resp_splitter), 3,
 +                            "num-lines", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_bool(OBJECT(&s->sec_resp_splitter), true,
 +                             "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    dev_splitter = DEVICE(&s->sec_resp_splitter);
 +    qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0,
 +                                qdev_get_gpio_in(dev_splitter, 0));
 +
 +    /* Devices behind APB PPC0:
 +     *   0x40000000: timer0
 +     *   0x40001000: timer1
 +     *   0x40002000: dual timer
 +     * We must configure and realize each downstream device and connect
 +     * it to the appropriate PPC port; then we can realize the PPC and
 +     * map its upstream ends to the right place in the container.
 +     */
 +    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
 +    object_property_set_bool(OBJECT(&s->timer0), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer0), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->armv7m), 3));
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer0), 0);
 +    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[0]", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
 +    object_property_set_bool(OBJECT(&s->timer1), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->armv7m), 3));
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0);
 +    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[1]", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    qdev_prop_set_string(DEVICE(&s->dualtimer), "name", "Dual timer");
 +    qdev_prop_set_uint64(DEVICE(&s->dualtimer), "size", 0x1000);
 +    object_property_set_bool(OBJECT(&s->dualtimer), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0);
 +    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[2]", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    object_property_set_bool(OBJECT(&s->apb_ppc0), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc0);
 +    dev_apb_ppc0 = DEVICE(&s->apb_ppc0);
 +
 +    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 0);
 +    memory_region_add_subregion(&s->container, 0x40000000, mr);
 +    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 1);
 +    memory_region_add_subregion(&s->container, 0x40001000, mr);
 +    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2);
 +    memory_region_add_subregion(&s->container, 0x40002000, mr);
 +    for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) {
 +        qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i,
 +                                    qdev_get_gpio_in_named(dev_apb_ppc0,
 +                                                           "cfg_nonsec", i));
 +        qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i,
 +                                    qdev_get_gpio_in_named(dev_apb_ppc0,
 +                                                           "cfg_ap", i));
 +    }
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc0,
 +                                                       "irq_enable", 0));
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc0,
 +                                                       "irq_clear", 0));
 +    qdev_connect_gpio_out(dev_splitter, 0,
 +                          qdev_get_gpio_in_named(dev_apb_ppc0,
 +                                                 "cfg_sec_resp", 0));
 +
 +    /* All the PPC irq lines (from the 2 internal PPCs and the 8 external
 +     * ones) are sent individually to the security controller, and also
 +     * ORed together to give a single combined PPC interrupt to the NVIC.
 +     */
 +    object_property_set_int(OBJECT(&s->ppc_irq_orgate),
 +                            NUM_PPCS, "num-lines", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_bool(OBJECT(&s->ppc_irq_orgate), true,
 +                             "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0,
 +                          qdev_get_gpio_in(DEVICE(&s->armv7m), 10));
 +
 +    /* 0x40010000 .. 0x4001ffff: private CPU region: unused in IoTKit */
 +
 +    /* 0x40020000 .. 0x4002ffff : IoTKit system control peripheral region */
 +    /* Devices behind APB PPC1:
 +     *   0x4002f000: S32K timer
 +     */
 +    qdev_prop_set_string(DEVICE(&s->s32ktimer), "name", "S32KTIMER");
 +    qdev_prop_set_uint64(DEVICE(&s->s32ktimer), "size", 0x1000);
 +    object_property_set_bool(OBJECT(&s->s32ktimer), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0);
 +    object_property_set_link(OBJECT(&s->apb_ppc1), OBJECT(mr), "port[0]", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    object_property_set_bool(OBJECT(&s->apb_ppc1), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc1), 0);
 +    memory_region_add_subregion(&s->container, 0x4002f000, mr);
 +
 +    dev_apb_ppc1 = DEVICE(&s->apb_ppc1);
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc1,
 +                                                       "cfg_nonsec", 0));
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc1,
 +                                                       "cfg_ap", 0));
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc1,
 +                                                       "irq_enable", 0));
 +    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0,
 +                                qdev_get_gpio_in_named(dev_apb_ppc1,
 +                                                       "irq_clear", 0));
 +    qdev_connect_gpio_out(dev_splitter, 1,
 +                          qdev_get_gpio_in_named(dev_apb_ppc1,
 +                                                 "cfg_sec_resp", 0));
 +
 +    /* Using create_unimplemented_device() maps the stub into the
 +     * system address space rather than into our container, but the
 +     * overall effect to the guest is the same.
 +     */
 +    create_unimplemented_device("SYSINFO", 0x40020000, 0x1000);
 +
 +    create_unimplemented_device("SYSCONTROL", 0x50021000, 0x1000);
 +    create_unimplemented_device("S32KWATCHDOG", 0x5002e000, 0x1000);
 +
 +    /* 0x40080000 .. 0x4008ffff : IoTKit second Base peripheral region */
 +
 +    create_unimplemented_device("NS watchdog", 0x40081000, 0x1000);
 +    create_unimplemented_device("S watchdog", 0x50081000, 0x1000);
 +
 +    create_unimplemented_device("SRAM0 MPC", 0x50083000, 0x1000);
 +
 +    for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
 +        Object *splitter = OBJECT(&s->ppc_irq_splitter[i]);
 +
 +        object_property_set_int(splitter, 2, "num-lines", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        object_property_set_bool(splitter, true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
 +
 +    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
 +        char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
 +
 +        iotkit_forward_ppc(s, ppcname, i);
 +        g_free(ppcname);
 +    }
 +
 +    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
 +        char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
 +
 +        iotkit_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC);
 +        g_free(ppcname);
 +    }
 +
 +    for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) {
 +        /* Wire up IRQ splitter for internal PPCs */
 +        DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]);
 +        char *gpioname = g_strdup_printf("apb_ppc%d_irq_status",
 +                                         i - NUM_EXTERNAL_PPCS);
 +        TZPPC *ppc = (i == NUM_EXTERNAL_PPCS) ? &s->apb_ppc0 : &s->apb_ppc1;
 +
 +        qdev_connect_gpio_out(devs, 0,
 +                              qdev_get_gpio_in_named(dev_secctl, gpioname, 0));
 +        qdev_connect_gpio_out(devs, 1,
 +                              qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i));
 +        qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0,
 +                                    qdev_get_gpio_in(devs, 0));
 +    }
 +
 +    iotkit_forward_sec_resp_cfg(s);
 +
 +    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
 +}
 +
 +static void iotkit_idau_check(IDAUInterface *ii, uint32_t address,
 +                              int *iregion, bool *exempt, bool *ns, bool *nsc)
 +{
 +    /* For IoTKit systems the IDAU responses are simple logical functions
 +     * of the address bits. The NSC attribute is guest-adjustable via the
 +     * NSCCFG register in the security controller.
 +     */
 +    IoTKit *s = IOTKIT(ii);
 +    int region = extract32(address, 28, 4);
 +
 +    *ns = !(region & 1);
 +    *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2));
 +    /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
 +    *exempt = (address & 0xeff00000) == 0xe0000000;
 +    *iregion = region;
 +}
 +
 +static const VMStateDescription iotkit_vmstate = {
 +    .name = "iotkit",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(nsccfg, IoTKit),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property iotkit_properties[] = {
 +    DEFINE_PROP_LINK("memory", IoTKit, board_memory, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("EXP_NUMIRQ", IoTKit, exp_numirq, 64),
 +    DEFINE_PROP_UINT32("MAINCLK", IoTKit, mainclk_frq, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static void iotkit_reset(DeviceState *dev)
 +{
 +    IoTKit *s = IOTKIT(dev);
 +
 +    s->nsccfg = 0;
 +}
 +
 +static void iotkit_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
 +
 +    dc->realize = iotkit_realize;
 +    dc->vmsd = &iotkit_vmstate;
 +    dc->props = iotkit_properties;
 +    dc->reset = iotkit_reset;
 +    iic->check = iotkit_idau_check;
 +}
 +
 +static const TypeInfo iotkit_info = {
 +    .name = TYPE_IOTKIT,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(IoTKit),
 +    .instance_init = iotkit_init,
 +    .class_init = iotkit_class_init,
 +    .interfaces = (InterfaceInfo[]) {
 +        { TYPE_IDAU_INTERFACE },
 +        { }
 +    }
 +};
 +
 +static void iotkit_register_types(void)
 +{
 +    type_register_static(&iotkit_info);
 +}
 +
 +type_init(iotkit_register_types);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_MPS2_FPGAIO=y
  CONFIG_MPS2_SCC=y
  CONFIG_TZ_PPC=y
 +CONFIG_IOTKIT=y
  CONFIG_IOTKIT_SECCTL=y
  CONFIG_VERSATILE_PCI=y
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 12/39] target/arm: Add Cortex-M33
+[Qemu-devel] [PULL 18/29] target/arm/cpu: Ensure we can use the pmu with kvm
-Add a Cortex-M33 definition. The M33 is an M profile CPU
+From: Andrew Jones <drjones@redhat.com>
 which implements the ARM v8M architecture, including the
 M profile Security Extension.
+We first convert the pmu property from a static property to one with
+its own accessors. Then we use the set accessor to check if the PMU is
+supported when using KVM. Indeed a 32-bit KVM host does not support
+the PMU, so this check will catch an attempt to use it at property-set
+time.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-9-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 31 +++++++++++++++++++++++++++++++
+ target/arm/kvm_arm.h | 14 ++++++++++++++
-file changed, 31 insertions(+)
+ target/arm/cpu.c     | 30 +++++++++++++++++++++++++-----
  target/arm/kvm.c     |  7 +++++++
 files changed, 46 insertions(+), 5 deletions(-)
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm_arm.h
++++ b/target/arm/kvm_arm.h
+@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
+  */
+ bool kvm_arm_aarch32_supported(CPUState *cs);
++/**
++ * bool kvm_arm_pmu_supported:
++ * @cs: CPUState
++ *
++ * Returns: true if the KVM VCPU can enable its PMU
++ * and false otherwise.
++ */
++bool kvm_arm_pmu_supported(CPUState *cs);
++
+ /**
+  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
+  * IPA address space supported by KVM
+@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_aarch32_supported(CPUState *cs)
+     return false;
+ }
++static inline bool kvm_arm_pmu_supported(CPUState *cs)
++{
++    return false;
++}
++
+ static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+ {
+     return -ENOENT;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_el3_property =
-     cpu->id_isar5 = 0x00000000;
+ static Property arm_cpu_cfgend_property =
- }
+             DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
-+static void cortex_m33_initfn(Object *obj)
+-/* use property name "pmu" to match other archs and virt tools */
 -static Property arm_cpu_has_pmu_property =
 -            DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 -
  static Property arm_cpu_has_vfp_property =
              DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
                                             pmsav7_dregion,
                                             qdev_prop_uint32, uint32_t);
 +static bool arm_get_pmu(Object *obj, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
-+    set_feature(&cpu->env, ARM_FEATURE_V8);
++    return cpu->has_pmu;
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd213; /* r0p3 */
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    cpu->id_pfr0 = 0x00000030;
 +    cpu->id_pfr1 = 0x00000210;
 +    cpu->id_dfr0 = 0x00200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->id_mmfr0 = 0x00101F40;
 +    cpu->id_mmfr1 = 0x00000000;
 +    cpu->id_mmfr2 = 0x01000000;
 +    cpu->id_mmfr3 = 0x00000000;
 +    cpu->id_isar0 = 0x01101110;
 +    cpu->id_isar1 = 0x02212000;
 +    cpu->id_isar2 = 0x20232232;
 +    cpu->id_isar3 = 0x01111131;
 +    cpu->id_isar4 = 0x01310132;
 +    cpu->id_isar5 = 0x00000000;
 +    cpu->clidr = 0x00000000;
 +    cpu->ctr = 0x8000c000;
 +}
 +
- static void arm_v7m_class_init(ObjectClass *oc, void *data)
++static void arm_set_pmu(Object *obj, bool value, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    if (value) {
 +        if (kvm_enabled() && !kvm_arm_pmu_supported(CPU(cpu))) {
 +            error_setg(errp, "'pmu' feature not supported by KVM on this host");
 +            return;
 +        }
 +        set_feature(&cpu->env, ARM_FEATURE_PMU);
 +    } else {
 +        unset_feature(&cpu->env, ARM_FEATURE_PMU);
 +    }
 +    cpu->has_pmu = value;
 +}
 +
  static void arm_get_init_svtor(Object *obj, Visitor *v, const char *name,
                                 void *opaque, Error **errp)
  {
-     CPUClass *cc = CPU_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_cpus[] = {
+     }
-                              .class_init = arm_v7m_class_init },
-     { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+     if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {
-                              .class_init = arm_v7m_class_init },
+-        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_pmu_property,
-+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
++        cpu->has_pmu = true;
-+                             .class_init = arm_v7m_class_init },
++        object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu,
-     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
+                                  &error_abort);
-     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
+     }
-     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
      env->features = arm_host_cpu_features.features;
  }
 +bool kvm_arm_pmu_supported(CPUState *cpu)
 +{
 +    KVMState *s = KVM_STATE(current_machine->accelerator);
 +
 +    return kvm_check_extension(s, KVM_CAP_ARM_PMU_V3);
 +}
 +
  int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
  {
      KVMState *s = KVM_STATE(ms->accelerator);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 19/39] hw/misc/iotkit-secctl: Arm IoT Kit security controller initial skeleton
+[Qemu-devel] [PULL 19/29] target/arm/helper: zcr: Add build bug next to value range assumption
-The Arm IoT Kit includes a "security controller" which is largely a
+From: Andrew Jones <drjones@redhat.com>
 collection of registers for controlling the PPCs and other bits of
 glue in the system.  This commit provides the initial skeleton of the
 device, implementing just the ID registers, and a couple of read-only
 read-as-zero registers.
+The current implementation of ZCR_ELx matches the architecture, only
+implementing the lower four bits, with the rest RAZ/WI. This puts
+a strict limit on ARM_MAX_VQ of 16. Make sure we don't let ARM_MAX_VQ
+grow without a corresponding update here.
+Suggested-by: Dave Martin <Dave.Martin@arm.com>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-16-peter.maydell@linaro.org
 ---
- hw/misc/Makefile.objs           |   1 +
+ target/arm/helper.c | 1 +
- include/hw/misc/iotkit-secctl.h |  39 ++++
+file changed, 1 insertion(+)
  hw/misc/iotkit-secctl.c         | 448 ++++++++++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   1 +
  hw/misc/trace-events            |   7 +
 files changed, 496 insertions(+)
  create mode 100644 include/hw/misc/iotkit-secctl.h
  create mode 100644 hw/misc/iotkit-secctl.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/helper.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2_FPGAIO) += mps2-fpgaio.o
+@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
+     int new_len;
- obj-$(CONFIG_TZ_PPC) += tz-ppc.o
+     /* Bits other than [3:0] are RAZ/WI.  */
-+obj-$(CONFIG_IOTKIT_SECCTL) += iotkit-secctl.o
++    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
+     raw_write(env, ri, value & 0xf);
- obj-$(CONFIG_PVPANIC) += pvpanic.o
- obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
+     /*
 diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/iotkit-secctl.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM IoT Kit security controller
 + *
 + * Copyright (c) 2018 Linaro Limited
 + * Written by Peter Maydell
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +/* This is a model of the security controller which is part of the
 + * Arm IoT Kit and documented in
 + * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
 + *
 + * QEMU interface:
 + *  + sysbus MMIO region 0 is the "secure privilege control block" registers
 + *  + sysbus MMIO region 1 is the "non-secure privilege control block" registers
 + */
 +
 +#ifndef IOTKIT_SECCTL_H
 +#define IOTKIT_SECCTL_H
 +
 +#include "hw/sysbus.h"
 +
 +#define TYPE_IOTKIT_SECCTL "iotkit-secctl"
 +#define IOTKIT_SECCTL(obj) OBJECT_CHECK(IoTKitSecCtl, (obj), TYPE_IOTKIT_SECCTL)
 +
 +typedef struct IoTKitSecCtl {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +
 +    MemoryRegion s_regs;
 +    MemoryRegion ns_regs;
 +} IoTKitSecCtl;
 +
 +#endif
 diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/iotkit-secctl.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Arm IoT Kit security controller
 + *
 + * Copyright (c) 2018 Linaro Limited
 + * Written by Peter Maydell
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +#include "trace.h"
 +#include "hw/sysbus.h"
 +#include "hw/registerfields.h"
 +#include "hw/misc/iotkit-secctl.h"
 +
 +/* Registers in the secure privilege control block */
 +REG32(SECRESPCFG, 0x10)
 +REG32(NSCCFG, 0x14)
 +REG32(SECMPCINTSTATUS, 0x1c)
 +REG32(SECPPCINTSTAT, 0x20)
 +REG32(SECPPCINTCLR, 0x24)
 +REG32(SECPPCINTEN, 0x28)
 +REG32(SECMSCINTSTAT, 0x30)
 +REG32(SECMSCINTCLR, 0x34)
 +REG32(SECMSCINTEN, 0x38)
 +REG32(BRGINTSTAT, 0x40)
 +REG32(BRGINTCLR, 0x44)
 +REG32(BRGINTEN, 0x48)
 +REG32(AHBNSPPC0, 0x50)
 +REG32(AHBNSPPCEXP0, 0x60)
 +REG32(AHBNSPPCEXP1, 0x64)
 +REG32(AHBNSPPCEXP2, 0x68)
 +REG32(AHBNSPPCEXP3, 0x6c)
 +REG32(APBNSPPC0, 0x70)
 +REG32(APBNSPPC1, 0x74)
 +REG32(APBNSPPCEXP0, 0x80)
 +REG32(APBNSPPCEXP1, 0x84)
 +REG32(APBNSPPCEXP2, 0x88)
 +REG32(APBNSPPCEXP3, 0x8c)
 +REG32(AHBSPPPC0, 0x90)
 +REG32(AHBSPPPCEXP0, 0xa0)
 +REG32(AHBSPPPCEXP1, 0xa4)
 +REG32(AHBSPPPCEXP2, 0xa8)
 +REG32(AHBSPPPCEXP3, 0xac)
 +REG32(APBSPPPC0, 0xb0)
 +REG32(APBSPPPC1, 0xb4)
 +REG32(APBSPPPCEXP0, 0xc0)
 +REG32(APBSPPPCEXP1, 0xc4)
 +REG32(APBSPPPCEXP2, 0xc8)
 +REG32(APBSPPPCEXP3, 0xcc)
 +REG32(NSMSCEXP, 0xd0)
 +REG32(PID4, 0xfd0)
 +REG32(PID5, 0xfd4)
 +REG32(PID6, 0xfd8)
 +REG32(PID7, 0xfdc)
 +REG32(PID0, 0xfe0)
 +REG32(PID1, 0xfe4)
 +REG32(PID2, 0xfe8)
 +REG32(PID3, 0xfec)
 +REG32(CID0, 0xff0)
 +REG32(CID1, 0xff4)
 +REG32(CID2, 0xff8)
 +REG32(CID3, 0xffc)
 +
 +/* Registers in the non-secure privilege control block */
 +REG32(AHBNSPPPC0, 0x90)
 +REG32(AHBNSPPPCEXP0, 0xa0)
 +REG32(AHBNSPPPCEXP1, 0xa4)
 +REG32(AHBNSPPPCEXP2, 0xa8)
 +REG32(AHBNSPPPCEXP3, 0xac)
 +REG32(APBNSPPPC0, 0xb0)
 +REG32(APBNSPPPC1, 0xb4)
 +REG32(APBNSPPPCEXP0, 0xc0)
 +REG32(APBNSPPPCEXP1, 0xc4)
 +REG32(APBNSPPPCEXP2, 0xc8)
 +REG32(APBNSPPPCEXP3, 0xcc)
 +/* PID and CID registers are also present in the NS block */
 +
 +static const uint8_t iotkit_secctl_s_idregs[] = {
 +    0x04, 0x00, 0x00, 0x00,
 +    0x52, 0xb8, 0x0b, 0x00,
 +    0x0d, 0xf0, 0x05, 0xb1,
 +};
 +
 +static const uint8_t iotkit_secctl_ns_idregs[] = {
 +    0x04, 0x00, 0x00, 0x00,
 +    0x53, 0xb8, 0x0b, 0x00,
 +    0x0d, 0xf0, 0x05, 0xb1,
 +};
 +
 +static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
 +                                        uint64_t *pdata,
 +                                        unsigned size, MemTxAttrs attrs)
 +{
 +    uint64_t r;
 +    uint32_t offset = addr & ~0x3;
 +
 +    switch (offset) {
 +    case A_AHBNSPPC0:
 +    case A_AHBSPPPC0:
 +        r = 0;
 +        break;
 +    case A_SECRESPCFG:
 +    case A_NSCCFG:
 +    case A_SECMPCINTSTATUS:
 +    case A_SECPPCINTSTAT:
 +    case A_SECPPCINTEN:
 +    case A_SECMSCINTSTAT:
 +    case A_SECMSCINTEN:
 +    case A_BRGINTSTAT:
 +    case A_BRGINTEN:
 +    case A_AHBNSPPCEXP0:
 +    case A_AHBNSPPCEXP1:
 +    case A_AHBNSPPCEXP2:
 +    case A_AHBNSPPCEXP3:
 +    case A_APBNSPPC0:
 +    case A_APBNSPPC1:
 +    case A_APBNSPPCEXP0:
 +    case A_APBNSPPCEXP1:
 +    case A_APBNSPPCEXP2:
 +    case A_APBNSPPCEXP3:
 +    case A_AHBSPPPCEXP0:
 +    case A_AHBSPPPCEXP1:
 +    case A_AHBSPPPCEXP2:
 +    case A_AHBSPPPCEXP3:
 +    case A_APBSPPPC0:
 +    case A_APBSPPPC1:
 +    case A_APBSPPPCEXP0:
 +    case A_APBSPPPCEXP1:
 +    case A_APBSPPPCEXP2:
 +    case A_APBSPPPCEXP3:
 +    case A_NSMSCEXP:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SecCtl S block read: "
 +                      "unimplemented offset 0x%x\n", offset);
 +        r = 0;
 +        break;
 +    case A_PID4:
 +    case A_PID5:
 +    case A_PID6:
 +    case A_PID7:
 +    case A_PID0:
 +    case A_PID1:
 +    case A_PID2:
 +    case A_PID3:
 +    case A_CID0:
 +    case A_CID1:
 +    case A_CID2:
 +    case A_CID3:
 +        r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4];
 +        break;
 +    case A_SECPPCINTCLR:
 +    case A_SECMSCINTCLR:
 +    case A_BRGINTCLR:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl S block read: write-only offset 0x%x\n",
 +                      offset);
 +        r = 0;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl S block read: bad offset 0x%x\n", offset);
 +        r = 0;
 +        break;
 +    }
 +
 +    if (size != 4) {
 +        /* None of our registers are access-sensitive, so just pull the right
 +         * byte out of the word read result.
 +         */
 +        r = extract32(r, (addr & 3) * 8, size * 8);
 +    }
 +
 +    trace_iotkit_secctl_s_read(offset, r, size);
 +    *pdata = r;
 +    return MEMTX_OK;
 +}
 +
 +static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
 +                                         uint64_t value,
 +                                         unsigned size, MemTxAttrs attrs)
 +{
 +    uint32_t offset = addr;
 +
 +    trace_iotkit_secctl_s_write(offset, value, size);
 +
 +    if (size != 4) {
 +        /* Byte and halfword writes are ignored */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl S block write: bad size, ignored\n");
 +        return MEMTX_OK;
 +    }
 +
 +    switch (offset) {
 +    case A_SECRESPCFG:
 +    case A_NSCCFG:
 +    case A_SECPPCINTCLR:
 +    case A_SECPPCINTEN:
 +    case A_SECMSCINTCLR:
 +    case A_SECMSCINTEN:
 +    case A_BRGINTCLR:
 +    case A_BRGINTEN:
 +    case A_AHBNSPPCEXP0:
 +    case A_AHBNSPPCEXP1:
 +    case A_AHBNSPPCEXP2:
 +    case A_AHBNSPPCEXP3:
 +    case A_APBNSPPC0:
 +    case A_APBNSPPC1:
 +    case A_APBNSPPCEXP0:
 +    case A_APBNSPPCEXP1:
 +    case A_APBNSPPCEXP2:
 +    case A_APBNSPPCEXP3:
 +    case A_AHBSPPPCEXP0:
 +    case A_AHBSPPPCEXP1:
 +    case A_AHBSPPPCEXP2:
 +    case A_AHBSPPPCEXP3:
 +    case A_APBSPPPC0:
 +    case A_APBSPPPC1:
 +    case A_APBSPPPCEXP0:
 +    case A_APBSPPPCEXP1:
 +    case A_APBSPPPCEXP2:
 +    case A_APBSPPPCEXP3:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SecCtl S block write: "
 +                      "unimplemented offset 0x%x\n", offset);
 +        break;
 +    case A_SECMPCINTSTATUS:
 +    case A_SECPPCINTSTAT:
 +    case A_SECMSCINTSTAT:
 +    case A_BRGINTSTAT:
 +    case A_AHBNSPPC0:
 +    case A_AHBSPPPC0:
 +    case A_NSMSCEXP:
 +    case A_PID4:
 +    case A_PID5:
 +    case A_PID6:
 +    case A_PID7:
 +    case A_PID0:
 +    case A_PID1:
 +    case A_PID2:
 +    case A_PID3:
 +    case A_CID0:
 +    case A_CID1:
 +    case A_CID2:
 +    case A_CID3:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IoTKit SecCtl S block write: "
 +                      "read-only offset 0x%x\n", offset);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl S block write: bad offset 0x%x\n",
 +                      offset);
 +        break;
 +    }
 +
 +    return MEMTX_OK;
 +}
 +
 +static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
 +                                         uint64_t *pdata,
 +                                         unsigned size, MemTxAttrs attrs)
 +{
 +    uint64_t r;
 +    uint32_t offset = addr & ~0x3;
 +
 +    switch (offset) {
 +    case A_AHBNSPPPC0:
 +        r = 0;
 +        break;
 +    case A_AHBNSPPPCEXP0:
 +    case A_AHBNSPPPCEXP1:
 +    case A_AHBNSPPPCEXP2:
 +    case A_AHBNSPPPCEXP3:
 +    case A_APBNSPPPC0:
 +    case A_APBNSPPPC1:
 +    case A_APBNSPPPCEXP0:
 +    case A_APBNSPPPCEXP1:
 +    case A_APBNSPPPCEXP2:
 +    case A_APBNSPPPCEXP3:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SecCtl NS block read: "
 +                      "unimplemented offset 0x%x\n", offset);
 +        break;
 +    case A_PID4:
 +    case A_PID5:
 +    case A_PID6:
 +    case A_PID7:
 +    case A_PID0:
 +    case A_PID1:
 +    case A_PID2:
 +    case A_PID3:
 +    case A_CID0:
 +    case A_CID1:
 +    case A_CID2:
 +    case A_CID3:
 +        r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4];
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl NS block write: bad offset 0x%x\n",
 +                      offset);
 +        r = 0;
 +        break;
 +    }
 +
 +    if (size != 4) {
 +        /* None of our registers are access-sensitive, so just pull the right
 +         * byte out of the word read result.
 +         */
 +        r = extract32(r, (addr & 3) * 8, size * 8);
 +    }
 +
 +    trace_iotkit_secctl_ns_read(offset, r, size);
 +    *pdata = r;
 +    return MEMTX_OK;
 +}
 +
 +static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
 +                                          uint64_t value,
 +                                          unsigned size, MemTxAttrs attrs)
 +{
 +    uint32_t offset = addr;
 +
 +    trace_iotkit_secctl_ns_write(offset, value, size);
 +
 +    if (size != 4) {
 +        /* Byte and halfword writes are ignored */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl NS block write: bad size, ignored\n");
 +        return MEMTX_OK;
 +    }
 +
 +    switch (offset) {
 +    case A_AHBNSPPPCEXP0:
 +    case A_AHBNSPPPCEXP1:
 +    case A_AHBNSPPPCEXP2:
 +    case A_AHBNSPPPCEXP3:
 +    case A_APBNSPPPC0:
 +    case A_APBNSPPPC1:
 +    case A_APBNSPPPCEXP0:
 +    case A_APBNSPPPCEXP1:
 +    case A_APBNSPPPCEXP2:
 +    case A_APBNSPPPCEXP3:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SecCtl NS block write: "
 +                      "unimplemented offset 0x%x\n", offset);
 +        break;
 +    case A_AHBNSPPPC0:
 +    case A_PID4:
 +    case A_PID5:
 +    case A_PID6:
 +    case A_PID7:
 +    case A_PID0:
 +    case A_PID1:
 +    case A_PID2:
 +    case A_PID3:
 +    case A_CID0:
 +    case A_CID1:
 +    case A_CID2:
 +    case A_CID3:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IoTKit SecCtl NS block write: "
 +                      "read-only offset 0x%x\n", offset);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "IotKit SecCtl NS block write: bad offset 0x%x\n",
 +                      offset);
 +        break;
 +    }
 +
 +    return MEMTX_OK;
 +}
 +
 +static const MemoryRegionOps iotkit_secctl_s_ops = {
 +    .read_with_attrs = iotkit_secctl_s_read,
 +    .write_with_attrs = iotkit_secctl_s_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 1,
 +    .valid.max_access_size = 4,
 +    .impl.min_access_size = 1,
 +    .impl.max_access_size = 4,
 +};
 +
 +static const MemoryRegionOps iotkit_secctl_ns_ops = {
 +    .read_with_attrs = iotkit_secctl_ns_read,
 +    .write_with_attrs = iotkit_secctl_ns_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 1,
 +    .valid.max_access_size = 4,
 +    .impl.min_access_size = 1,
 +    .impl.max_access_size = 4,
 +};
 +
 +static void iotkit_secctl_reset(DeviceState *dev)
 +{
 +
 +}
 +
 +static void iotkit_secctl_init(Object *obj)
 +{
 +    IoTKitSecCtl *s = IOTKIT_SECCTL(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +
 +    memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
 +                          s, "iotkit-secctl-s-regs", 0x1000);
 +    memory_region_init_io(&s->ns_regs, obj, &iotkit_secctl_ns_ops,
 +                          s, "iotkit-secctl-ns-regs", 0x1000);
 +    sysbus_init_mmio(sbd, &s->s_regs);
 +    sysbus_init_mmio(sbd, &s->ns_regs);
 +}
 +
 +static const VMStateDescription iotkit_secctl_vmstate = {
 +    .name = "iotkit-secctl",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void iotkit_secctl_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->vmsd = &iotkit_secctl_vmstate;
 +    dc->reset = iotkit_secctl_reset;
 +}
 +
 +static const TypeInfo iotkit_secctl_info = {
 +    .name = TYPE_IOTKIT_SECCTL,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(IoTKitSecCtl),
 +    .instance_init = iotkit_secctl_init,
 +    .class_init = iotkit_secctl_class_init,
 +};
 +
 +static void iotkit_secctl_register_types(void)
 +{
 +    type_register_static(&iotkit_secctl_info);
 +}
 +
 +type_init(iotkit_secctl_register_types);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_MPS2_FPGAIO=y
  CONFIG_MPS2_SCC=y
  CONFIG_TZ_PPC=y
 +CONFIG_IOTKIT_SECCTL=y
  CONFIG_VERSATILE_PCI=y
  CONFIG_VERSATILE_I2C=y
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ tz_ppc_irq_clear(int level) "TZ PPC: int_clear = %d"
  tz_ppc_update_irq(int level) "TZ PPC: setting irq line to %d"
  tz_ppc_read_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " read (secure %d user %d) blocked"
  tz_ppc_write_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " write (secure %d user %d) blocked"
 +
 +# hw/misc/iotkit-secctl.c
 +iotkit_secctl_s_read(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl S regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 +iotkit_secctl_s_write(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl S regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 +iotkit_secctl_ns_read(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl NS regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 +iotkit_secctl_ns_write(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl NS regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 +iotkit_secctl_reset(void) "IoTKit SecCtl: reset"
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 10/39] target/arm: Define init-svtor property for the reset secure VTOR value
+[Qemu-devel] [PULL 20/29] target/arm/cpu: Use div-round-up to determine predicate register array size
-The Cortex-M33 allows the system to specify the reset value of the
+From: Andrew Jones <drjones@redhat.com>
 secure Vector Table Offset Register (VTOR) by asserting config
 signals. In particular, guest images for the MPS2 AN505 board rely
 on the MPS2's initial VTOR being correct for that board.
 Implement a QEMU property so board and SoC code can set the reset
 value to the correct value.
+Unless we're guaranteed to always increase ARM_MAX_VQ by a multiple of
+four, then we should use DIV_ROUND_UP to ensure we get an appropriate
+array size.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-7-peter.maydell@linaro.org
 ---
- target/arm/cpu.h |  3 +++
+ target/arm/cpu.h | 2 +-
- target/arm/cpu.c | 18 ++++++++++++++----
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 17 insertions(+), 4 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMVectorReg {
-      */
+ #ifdef TARGET_AARCH64
-     uint32_t psci_conduit;
+ /* In AArch32 mode, predicate registers do not exist at all.  */
+ typedef struct ARMPredicateReg {
-+    /* For v8M, initial value of the Secure VTOR */
+-    uint64_t p[2 * ARM_MAX_VQ / 8] QEMU_ALIGNED(16);
-+    uint32_t init_svtor;
++    uint64_t p[DIV_ROUND_UP(2 * ARM_MAX_VQ, 8)] QEMU_ALIGNED(16);
-+
+ } ARMPredicateReg;
-     /* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or
-      * QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type.
+ /* In AArch32 mode, PAC keys do not exist at all.  */
       */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
          uint32_t initial_msp; /* Loaded from 0x0 */
          uint32_t initial_pc; /* Loaded from 0x4 */
          uint8_t *rom;
 +        uint32_t vecbase;
          if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
              env->v7m.secure = true;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
          /* Unlike A/R profile, M profile defines the reset LR value */
          env->regs[14] = 0xffffffff;
 -        /* Load the initial SP and PC from the vector table at address 0 */
 -        rom = rom_ptr(0);
 +        env->v7m.vecbase[M_REG_S] = cpu->init_svtor & 0xffffff80;
 +
 +        /* Load the initial SP and PC from offset 0 and 4 in the vector table */
 +        vecbase = env->v7m.vecbase[env->v7m.secure];
 +        rom = rom_ptr(vecbase);
          if (rom) {
              /* Address zero is covered by ROM which hasn't yet been
               * copied into physical memory.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
               * it got copied into memory. In the latter case, rom_ptr
               * will return a NULL pointer and we should use ldl_phys instead.
               */
 -            initial_msp = ldl_phys(s->as, 0);
 -            initial_pc = ldl_phys(s->as, 4);
 +            initial_msp = ldl_phys(s->as, vecbase);
 +            initial_pc = ldl_phys(s->as, vecbase + 4);
          }
          env->regs[13] = initial_msp & 0xFFFFFFFC;
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
                                             pmsav7_dregion,
                                             qdev_prop_uint32, uint32_t);
 +/* M profile: initial value of the Secure VTOR */
 +static Property arm_cpu_initsvtor_property =
 +            DEFINE_PROP_UINT32("init-svtor", ARMCPU, init_svtor, 0);
 +
  static void arm_cpu_post_init(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
                                   qdev_prop_allow_set_link_before_realize,
                                   OBJ_PROP_LINK_UNREF_ON_RELEASE,
                                   &error_abort);
 +        qdev_property_add_static(DEVICE(obj), &arm_cpu_initsvtor_property,
 +                                 &error_abort);
      }
      qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 21/39] hw/misc/iotkit-secctl: Add remaining simple registers
+[Qemu-devel] [PULL 21/29] target/arm/kvm64: Fix error returns
-Add remaining easy registers to iotkit-secctl:
+From: Andrew Jones <drjones@redhat.com>
  * NSCCFG just routes its two bits out to external GPIO lines
  * BRGINSTAT/BRGINTCLR/BRGINTEN can be dummies, because QEMU's
    bus fabric can never report errors
+A couple return -EINVAL's forgot their '-'s.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180220180325.29818-18-peter.maydell@linaro.org
 ---
- include/hw/misc/iotkit-secctl.h |  4 ++++
+ target/arm/kvm64.c | 4 ++--
- hw/misc/iotkit-secctl.c         | 32 ++++++++++++++++++++++++++------
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 30 insertions(+), 6 deletions(-)
-diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/iotkit-secctl.h
+--- a/target/arm/kvm64.c
-+++ b/include/hw/misc/iotkit-secctl.h
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-  *  + sysbus MMIO region 1 is the "non-secure privilege control block" registers
+     write_cpustate_to_list(cpu, true);
-  *  + named GPIO output "sec_resp_cfg" indicating whether blocked accesses
-  *    should RAZ/WI or bus error
+     if (!write_list_to_kvmstate(cpu, level)) {
-+ *  + named GPIO output "nsc_cfg" whose value tracks the NSCCFG register value
+-        return EINVAL;
-  * Controlling the 2 APB PPCs in the IoTKit:
++        return -EINVAL;
   *  + named GPIO outputs apb_ppc0_nonsec[0..2] and apb_ppc1_nonsec
   *  + named GPIO outputs apb_ppc0_ap[0..2] and apb_ppc1_ap
@@ -XXX,XX +XXX,XX @@ struct IoTKitSecCtl {
      /*< public >*/
      qemu_irq sec_resp_cfg;
 +    qemu_irq nsc_cfg_irq;
      MemoryRegion s_regs;
      MemoryRegion ns_regs;
@@ -XXX,XX +XXX,XX @@ struct IoTKitSecCtl {
      uint32_t secppcintstat;
      uint32_t secppcinten;
      uint32_t secrespcfg;
 +    uint32_t nsccfg;
 +    uint32_t brginten;
      IoTKitSecCtlPPC apb[IOTS_NUM_APB_PPC];
      IoTKitSecCtlPPC apbexp[IOTS_NUM_APB_EXP_PPC];
 diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/iotkit-secctl.c
 +++ b/hw/misc/iotkit-secctl.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
      case A_SECRESPCFG:
          r = s->secrespcfg;
          break;
 +    case A_NSCCFG:
 +        r = s->nsccfg;
 +        break;
      case A_SECPPCINTSTAT:
          r = s->secppcintstat;
          break;
      case A_SECPPCINTEN:
          r = s->secppcinten;
          break;
 +    case A_BRGINTSTAT:
 +        /* QEMU's bus fabric can never report errors as it doesn't buffer
 +         * writes, so we never report bridge interrupts.
 +         */
 +        r = 0;
 +        break;
 +    case A_BRGINTEN:
 +        r = s->brginten;
 +        break;
      case A_AHBNSPPCEXP0:
      case A_AHBNSPPCEXP1:
      case A_AHBNSPPCEXP2:
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
      case A_APBSPPPCEXP3:
          r = s->apbexp[offset_to_ppc_idx(offset)].sp;
          break;
 -    case A_NSCCFG:
      case A_SECMPCINTSTATUS:
      case A_SECMSCINTSTAT:
      case A_SECMSCINTEN:
 -    case A_BRGINTSTAT:
 -    case A_BRGINTEN:
      case A_NSMSCEXP:
          qemu_log_mask(LOG_UNIMP,
                        "IoTKit SecCtl S block read: "
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
      }
-     switch (offset) {
+     kvm_arm_sync_mpstate_to_kvm(cpu);
-+    case A_NSCCFG:
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
 +        s->nsccfg = value & 3;
 +        qemu_set_irq(s->nsc_cfg_irq, s->nsccfg);
 +        break;
      case A_SECRESPCFG:
          value &= 1;
          s->secrespcfg = value;
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
          s->secppcinten = value & 0x00f000f3;
          foreach_ppc(s, iotkit_secctl_ppc_update_irq_enable);
          break;
 +    case A_BRGINTCLR:
 +        break;
 +    case A_BRGINTEN:
 +        s->brginten = value & 0xffff0000;
 +        break;
      case A_AHBNSPPCEXP0:
      case A_AHBNSPPCEXP1:
      case A_AHBNSPPCEXP2:
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
          ppc = &s->apbexp[offset_to_ppc_idx(offset)];
          iotkit_secctl_ppc_sp_write(ppc, value);
          break;
 -    case A_NSCCFG:
      case A_SECMSCINTCLR:
      case A_SECMSCINTEN:
 -    case A_BRGINTCLR:
 -    case A_BRGINTEN:
          qemu_log_mask(LOG_UNIMP,
                        "IoTKit SecCtl S block write: "
                        "unimplemented offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static void iotkit_secctl_reset(DeviceState *dev)
      s->secppcintstat = 0;
      s->secppcinten = 0;
      s->secrespcfg = 0;
 +    s->nsccfg = 0;
 +    s->brginten = 0;
      foreach_ppc(s, iotkit_secctl_reset_ppc);
  }
@@ -XXX,XX +XXX,XX @@ static void iotkit_secctl_init(Object *obj)
      }
-     qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
+     if (!write_kvmstate_to_list(cpu)) {
-+    qdev_init_gpio_out_named(dev, &s->nsc_cfg_irq, "nsc_cfg", 1);
+-        return EINVAL;
++        return -EINVAL;
-     memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
+     }
-                           s, "iotkit-secctl-s-regs", 0x1000);
+     /* Note that it's OK to have registers which aren't in CPUState,
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_secctl_vmstate = {
+      * so we can ignore a failure return here.
          VMSTATE_UINT32(secppcintstat, IoTKitSecCtl),
          VMSTATE_UINT32(secppcinten, IoTKitSecCtl),
          VMSTATE_UINT32(secrespcfg, IoTKitSecCtl),
 +        VMSTATE_UINT32(nsccfg, IoTKitSecCtl),
 +        VMSTATE_UINT32(brginten, IoTKitSecCtl),
          VMSTATE_STRUCT_ARRAY(apb, IoTKitSecCtl, IOTS_NUM_APB_PPC, 1,
                               iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
          VMSTATE_STRUCT_ARRAY(apbexp, IoTKitSecCtl, IOTS_NUM_APB_EXP_PPC, 1,
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 01/39] xlnx-zynqmp-rtc: Initial commit
+[Qemu-devel] [PULL 22/29] target/arm/kvm64: Move the get/put of fpsimd registers out
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Andrew Jones <drjones@redhat.com>
-Initial commit of the ZynqMP RTC device.
+Move the getting/putting of the fpsimd registers out of
+kvm_arch_get/put_registers() into their own helper functions
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+to prepare for alternatively getting/putting SVE registers.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 No functional change.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/Makefile.objs             |   1 +
+ target/arm/kvm64.c | 148 +++++++++++++++++++++++++++------------------
- include/hw/timer/xlnx-zynqmp-rtc.h |  84 +++++++++++++++
+file changed, 88 insertions(+), 60 deletions(-)
- hw/timer/xlnx-zynqmp-rtc.c         | 214 +++++++++++++++++++++++++++++++++++++
-files changed, 299 insertions(+)
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
  create mode 100644 include/hw/timer/xlnx-zynqmp-rtc.h
  create mode 100644 hw/timer/xlnx-zynqmp-rtc.c
 diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/Makefile.objs
+--- a/target/arm/kvm64.c
-+++ b/hw/timer/Makefile.objs
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx_epit.o
+@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
- common-obj-$(CONFIG_IMX) += imx_gpt.o
+ #define AARCH64_SIMD_CTRL_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \
- common-obj-$(CONFIG_LM32) += lm32_timer.o
+                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
- common-obj-$(CONFIG_MILKYMIST) += milkymist-sysctl.o
-+common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp-rtc.o
++static int kvm_arch_put_fpsimd(CPUState *cs)
++{
- obj-$(CONFIG_ALTERA_TIMER) += altera_timer.o
++    ARMCPU *cpu = ARM_CPU(cs);
- obj-$(CONFIG_EXYNOS4) += exynos4210_mct.o
++    CPUARMState *env = &cpu->env;
-diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h
++    struct kvm_one_reg reg;
-new file mode 100644
++    uint32_t fpr;
-index XXXXXXX..XXXXXXX
++    int i, ret;
---- /dev/null
++
-+++ b/include/hw/timer/xlnx-zynqmp-rtc.h
++    for (i = 0; i < 32; i++) {
-@@ -XXX,XX +XXX,XX @@
++        uint64_t *q = aa64_vfp_qreg(env, i);
-+/*
++#ifdef HOST_WORDS_BIGENDIAN
-+ * QEMU model of the Xilinx ZynqMP Real Time Clock (RTC).
++        uint64_t fp_val[2] = { q[1], q[0] };
-+ *
++        reg.addr = (uintptr_t)fp_val;
-+ * Copyright (c) 2017 Xilinx Inc.
++#else
-+ *
++        reg.addr = (uintptr_t)q;
 + * Written-by: Alistair Francis <alistair.francis@xilinx.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "hw/register.h"
 +
 +#define TYPE_XLNX_ZYNQMP_RTC "xlnx-zynmp.rtc"
 +
 +#define XLNX_ZYNQMP_RTC(obj) \
 +     OBJECT_CHECK(XlnxZynqMPRTC, (obj), TYPE_XLNX_ZYNQMP_RTC)
 +
 +REG32(SET_TIME_WRITE, 0x0)
 +REG32(SET_TIME_READ, 0x4)
 +REG32(CALIB_WRITE, 0x8)
 +    FIELD(CALIB_WRITE, FRACTION_EN, 20, 1)
 +    FIELD(CALIB_WRITE, FRACTION_DATA, 16, 4)
 +    FIELD(CALIB_WRITE, MAX_TICK, 0, 16)
 +REG32(CALIB_READ, 0xc)
 +    FIELD(CALIB_READ, FRACTION_EN, 20, 1)
 +    FIELD(CALIB_READ, FRACTION_DATA, 16, 4)
 +    FIELD(CALIB_READ, MAX_TICK, 0, 16)
 +REG32(CURRENT_TIME, 0x10)
 +REG32(CURRENT_TICK, 0x14)
 +    FIELD(CURRENT_TICK, VALUE, 0, 16)
 +REG32(ALARM, 0x18)
 +REG32(RTC_INT_STATUS, 0x20)
 +    FIELD(RTC_INT_STATUS, ALARM, 1, 1)
 +    FIELD(RTC_INT_STATUS, SECONDS, 0, 1)
 +REG32(RTC_INT_MASK, 0x24)
 +    FIELD(RTC_INT_MASK, ALARM, 1, 1)
 +    FIELD(RTC_INT_MASK, SECONDS, 0, 1)
 +REG32(RTC_INT_EN, 0x28)
 +    FIELD(RTC_INT_EN, ALARM, 1, 1)
 +    FIELD(RTC_INT_EN, SECONDS, 0, 1)
 +REG32(RTC_INT_DIS, 0x2c)
 +    FIELD(RTC_INT_DIS, ALARM, 1, 1)
 +    FIELD(RTC_INT_DIS, SECONDS, 0, 1)
 +REG32(ADDR_ERROR, 0x30)
 +    FIELD(ADDR_ERROR, STATUS, 0, 1)
 +REG32(ADDR_ERROR_INT_MASK, 0x34)
 +    FIELD(ADDR_ERROR_INT_MASK, MASK, 0, 1)
 +REG32(ADDR_ERROR_INT_EN, 0x38)
 +    FIELD(ADDR_ERROR_INT_EN, MASK, 0, 1)
 +REG32(ADDR_ERROR_INT_DIS, 0x3c)
 +    FIELD(ADDR_ERROR_INT_DIS, MASK, 0, 1)
 +REG32(CONTROL, 0x40)
 +    FIELD(CONTROL, BATTERY_DISABLE, 31, 1)
 +    FIELD(CONTROL, OSC_CNTRL, 24, 4)
 +    FIELD(CONTROL, SLVERR_ENABLE, 0, 1)
 +REG32(SAFETY_CHK, 0x50)
 +
 +#define XLNX_ZYNQMP_RTC_R_MAX (R_SAFETY_CHK + 1)
 +
 +typedef struct XlnxZynqMPRTC {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +    qemu_irq irq_rtc_int;
 +    qemu_irq irq_addr_error_int;
 +
 +    uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];
 +    RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];
 +} XlnxZynqMPRTC;
 diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/timer/xlnx-zynqmp-rtc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/timer/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU model of the Xilinx ZynqMP Real Time Clock (RTC).
 + *
 + * Copyright (c) 2017 Xilinx Inc.
 + *
 + * Written-by: Alistair Francis <alistair.francis@xilinx.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/sysbus.h"
 +#include "hw/register.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "hw/timer/xlnx-zynqmp-rtc.h"
 +
 +#ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG
 +#define XLNX_ZYNQMP_RTC_ERR_DEBUG 0
 +#endif
-+
++        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-+static void rtc_int_update_irq(XlnxZynqMPRTC *s)
++        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+{
++        if (ret) {
-+    bool pending = s->regs[R_RTC_INT_STATUS] & ~s->regs[R_RTC_INT_MASK];
++            return ret;
-+    qemu_set_irq(s->irq_rtc_int, pending);
++        }
-+}
++    }
 +
-+static void addr_error_int_update_irq(XlnxZynqMPRTC *s)
++    reg.addr = (uintptr_t)(&fpr);
-+{
++    fpr = vfp_get_fpsr(env);
-+    bool pending = s->regs[R_ADDR_ERROR] & ~s->regs[R_ADDR_ERROR_INT_MASK];
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+    qemu_set_irq(s->irq_addr_error_int, pending);
++    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+}
++    if (ret) {
-+
++        return ret;
-+static void rtc_int_status_postw(RegisterInfo *reg, uint64_t val64)
++    }
-+{
++
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
++    reg.addr = (uintptr_t)(&fpr);
-+    rtc_int_update_irq(s);
++    fpr = vfp_get_fpcr(env);
-+}
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-+
++    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+static uint64_t rtc_int_en_prew(RegisterInfo *reg, uint64_t val64)
++    if (ret) {
-+{
++        return ret;
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
++    }
 +
 +    s->regs[R_RTC_INT_MASK] &= (uint32_t) ~val64;
 +    rtc_int_update_irq(s);
 +    return 0;
 +}
 +
-+static uint64_t rtc_int_dis_prew(RegisterInfo *reg, uint64_t val64)
+ int kvm_arch_put_registers(CPUState *cs, int level)
  {
      struct kvm_one_reg reg;
 -    uint32_t fpr;
      uint64_t val;
 -    int i;
 -    int ret;
 +    int i, ret;
      unsigned int el;
      ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          }
      }
 -    /* Advanced SIMD and FP registers. */
 -    for (i = 0; i < 32; i++) {
 -        uint64_t *q = aa64_vfp_qreg(env, i);
 -#ifdef HOST_WORDS_BIGENDIAN
 -        uint64_t fp_val[2] = { q[1], q[0] };
 -        reg.addr = (uintptr_t)fp_val;
 -#else
 -        reg.addr = (uintptr_t)q;
 -#endif
 -        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 -        if (ret) {
 -            return ret;
 -        }
 -    }
 -
 -    reg.addr = (uintptr_t)(&fpr);
 -    fpr = vfp_get_fpsr(env);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 -    if (ret) {
 -        return ret;
 -    }
 -
 -    fpr = vfp_get_fpcr(env);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_arch_put_fpsimd(cs);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      return ret;
  }
 +static int kvm_arch_get_fpsimd(CPUState *cs)
 +{
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
++    ARMCPU *cpu = ARM_CPU(cs);
-+
++    CPUARMState *env = &cpu->env;
-+    s->regs[R_RTC_INT_MASK] |= (uint32_t) val64;
++    struct kvm_one_reg reg;
-+    rtc_int_update_irq(s);
++    uint32_t fpr;
 +    int i, ret;
 +
 +    for (i = 0; i < 32; i++) {
 +        uint64_t *q = aa64_vfp_qreg(env, i);
 +        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 +        reg.addr = (uintptr_t)q;
 +        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        if (ret) {
 +            return ret;
 +        } else {
 +#ifdef HOST_WORDS_BIGENDIAN
 +            uint64_t t;
 +            t = q[0], q[0] = q[1], q[1] = t;
 +#endif
 +        }
 +    }
 +
 +    reg.addr = (uintptr_t)(&fpr);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    vfp_set_fpsr(env, fpr);
 +
 +    reg.addr = (uintptr_t)(&fpr);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    vfp_set_fpcr(env, fpr);
 +
 +    return 0;
 +}
 +
-+static void addr_error_postw(RegisterInfo *reg, uint64_t val64)
+ int kvm_arch_get_registers(CPUState *cs)
-+{
+ {
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+     struct kvm_one_reg reg;
-+    addr_error_int_update_irq(s);
+     uint64_t val;
-+}
+-    uint32_t fpr;
-+
+     unsigned int el;
-+static uint64_t addr_error_int_en_prew(RegisterInfo *reg, uint64_t val64)
+-    int i;
-+{
+-    int ret;
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
++    int i, ret;
-+
-+    s->regs[R_ADDR_ERROR_INT_MASK] &= (uint32_t) ~val64;
+     ARMCPU *cpu = ARM_CPU(cs);
-+    addr_error_int_update_irq(s);
+     CPUARMState *env = &cpu->env;
-+    return 0;
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
-+}
+         env->spsr = env->banked_spsr[i];
-+
+     }
-+static uint64_t addr_error_int_dis_prew(RegisterInfo *reg, uint64_t val64)
-+{
+-    /* Advanced SIMD and FP registers */
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+-    for (i = 0; i < 32; i++) {
-+
+-        uint64_t *q = aa64_vfp_qreg(env, i);
-+    s->regs[R_ADDR_ERROR_INT_MASK] |= (uint32_t) val64;
+-        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-+    addr_error_int_update_irq(s);
+-        reg.addr = (uintptr_t)q;
-+    return 0;
+-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+}
+-        if (ret) {
-+
+-            return ret;
-+static const RegisterAccessInfo rtc_regs_info[] = {
+-        } else {
-+    {   .name = "SET_TIME_WRITE",  .addr = A_SET_TIME_WRITE,
+-#ifdef HOST_WORDS_BIGENDIAN
-+    },{ .name = "SET_TIME_READ",  .addr = A_SET_TIME_READ,
+-            uint64_t t;
-+        .ro = 0xffffffff,
+-            t = q[0], q[0] = q[1], q[1] = t;
-+    },{ .name = "CALIB_WRITE",  .addr = A_CALIB_WRITE,
+-#endif
-+    },{ .name = "CALIB_READ",  .addr = A_CALIB_READ,
+-        }
-+        .ro = 0x1fffff,
+-    }
-+    },{ .name = "CURRENT_TIME",  .addr = A_CURRENT_TIME,
+-
-+        .ro = 0xffffffff,
+-    reg.addr = (uintptr_t)(&fpr);
-+    },{ .name = "CURRENT_TICK",  .addr = A_CURRENT_TICK,
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+        .ro = 0xffff,
+-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+    },{ .name = "ALARM",  .addr = A_ALARM,
++    ret = kvm_arch_get_fpsimd(cs);
-+    },{ .name = "RTC_INT_STATUS",  .addr = A_RTC_INT_STATUS,
+     if (ret) {
-+        .w1c = 0x3,
+         return ret;
-+        .post_write = rtc_int_status_postw,
+     }
-+    },{ .name = "RTC_INT_MASK",  .addr = A_RTC_INT_MASK,
+-    vfp_set_fpsr(env, fpr);
-+        .reset = 0x3,
+-
-+        .ro = 0x3,
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-+    },{ .name = "RTC_INT_EN",  .addr = A_RTC_INT_EN,
+-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+        .pre_write = rtc_int_en_prew,
+-    if (ret) {
-+    },{ .name = "RTC_INT_DIS",  .addr = A_RTC_INT_DIS,
+-        return ret;
-+        .pre_write = rtc_int_dis_prew,
+-    }
-+    },{ .name = "ADDR_ERROR",  .addr = A_ADDR_ERROR,
+-    vfp_set_fpcr(env, fpr);
-+        .w1c = 0x1,
-+        .post_write = addr_error_postw,
+     ret = kvm_get_vcpu_events(cpu);
-+    },{ .name = "ADDR_ERROR_INT_MASK",  .addr = A_ADDR_ERROR_INT_MASK,
+     if (ret) {
 +        .reset = 0x1,
 +        .ro = 0x1,
 +    },{ .name = "ADDR_ERROR_INT_EN",  .addr = A_ADDR_ERROR_INT_EN,
 +        .pre_write = addr_error_int_en_prew,
 +    },{ .name = "ADDR_ERROR_INT_DIS",  .addr = A_ADDR_ERROR_INT_DIS,
 +        .pre_write = addr_error_int_dis_prew,
 +    },{ .name = "CONTROL",  .addr = A_CONTROL,
 +        .reset = 0x1000000,
 +        .rsvd = 0x70fffffe,
 +    },{ .name = "SAFETY_CHK",  .addr = A_SAFETY_CHK,
 +    }
 +};
 +
 +static void rtc_reset(DeviceState *dev)
 +{
 +    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(dev);
 +    unsigned int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 +        register_reset(&s->regs_info[i]);
 +    }
 +
 +    rtc_int_update_irq(s);
 +    addr_error_int_update_irq(s);
 +}
 +
 +static const MemoryRegionOps rtc_ops = {
 +    .read = register_read_memory,
 +    .write = register_write_memory,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static void rtc_init(Object *obj)
 +{
 +    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    RegisterInfoArray *reg_array;
 +
 +    memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_RTC,
 +                       XLNX_ZYNQMP_RTC_R_MAX * 4);
 +    reg_array =
 +        register_init_block32(DEVICE(obj), rtc_regs_info,
 +                              ARRAY_SIZE(rtc_regs_info),
 +                              s->regs_info, s->regs,
 +                              &rtc_ops,
 +                              XLNX_ZYNQMP_RTC_ERR_DEBUG,
 +                              XLNX_ZYNQMP_RTC_R_MAX * 4);
 +    memory_region_add_subregion(&s->iomem,
 +                                0x0,
 +                                &reg_array->mem);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq_rtc_int);
 +    sysbus_init_irq(sbd, &s->irq_addr_error_int);
 +}
 +
 +static const VMStateDescription vmstate_rtc = {
 +    .name = TYPE_XLNX_ZYNQMP_RTC,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPRTC, XLNX_ZYNQMP_RTC_R_MAX),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static void rtc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = rtc_reset;
 +    dc->vmsd = &vmstate_rtc;
 +}
 +
 +static const TypeInfo rtc_info = {
 +    .name          = TYPE_XLNX_ZYNQMP_RTC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(XlnxZynqMPRTC),
 +    .class_init    = rtc_class_init,
 +    .instance_init = rtc_init,
 +};
 +
 +static void rtc_register_types(void)
 +{
 +    type_register_static(&rtc_info);
 +}
 +
 +type_init(rtc_register_types)
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 36/39] target/arm: Decode aa32 armv8.3 3-same
+[Qemu-devel] [PULL 23/29] target/arm: Use tcg_gen_extract_i32 for shifter_out_im
 From: Richard Henderson <richard.henderson@linaro.org>
+Extract is a compact combination of shift + and.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190808202616.13782-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180228193125.20577-14-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.c | 9 +--------
-file changed, 68 insertions(+)
+file changed, 1 insertion(+), 8 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
-     return 0;
  static void shifter_out_im(TCGv_i32 var, int shift)
  {
 -    if (shift == 0) {
 -        tcg_gen_andi_i32(cpu_CF, var, 1);
 -    } else {
 -        tcg_gen_shri_i32(cpu_CF, var, shift);
 -        if (shift != 31) {
 -            tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
 -        }
 -    }
 +    tcg_gen_extract_i32(cpu_CF, var, shift, 1);
  }
-+/* Advanced SIMD three registers of the same length extension.
+ /* Shift by immediate.  Includes special handling for shift == 0.  */
 + *  31           25    23  22    20   16   12  11   10   9    8        3     0
 + * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
 + * | 1 1 1 1 1 1 0 | op1 | D | op2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
 + * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
 + */
 +static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
 +{
 +    gen_helper_gvec_3_ptr *fn_gvec_ptr;
 +    int rd, rn, rm, rot, size, opr_sz;
 +    TCGv_ptr fpst;
 +    bool q;
 +
 +    q = extract32(insn, 6, 1);
 +    VFP_DREG_D(rd, insn);
 +    VFP_DREG_N(rn, insn);
 +    VFP_DREG_M(rm, insn);
 +    if ((rd | rn | rm) & q) {
 +        return 1;
 +    }
 +
 +    if ((insn & 0xfe200f10) == 0xfc200800) {
 +        /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
 +        size = extract32(insn, 20, 1);
 +        rot = extract32(insn, 23, 2);
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
 +            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
 +            return 1;
 +        }
 +        fn_gvec_ptr = size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
 +    } else if ((insn & 0xfea00f10) == 0xfc800800) {
 +        /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
 +        size = extract32(insn, 20, 1);
 +        rot = extract32(insn, 24, 1);
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
 +            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
 +            return 1;
 +        }
 +        fn_gvec_ptr = size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
 +    } else {
 +        return 1;
 +    }
 +
 +    if (s->fp_excp_el) {
 +        gen_exception_insn(s, 4, EXCP_UDEF,
 +                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
 +        return 0;
 +    }
 +    if (!s->vfp_enabled) {
 +        return 1;
 +    }
 +
 +    opr_sz = (1 + q) * 8;
 +    fpst = get_fpstatus_ptr(1);
 +    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
 +                       vfp_reg_offset(1, rn),
 +                       vfp_reg_offset(1, rm), fpst,
 +                       opr_sz, opr_sz, rot, fn_gvec_ptr);
 +    tcg_temp_free_ptr(fpst);
 +    return 0;
 +}
 +
  static int disas_coproc_insn(DisasContext *s, uint32_t insn)
  {
      int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                      }
                  }
              }
 +        } else if ((insn & 0x0e000a00) == 0x0c000800
 +                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
 +            if (disas_neon_insn_3same_ext(s, insn)) {
 +                goto illegal_op;
 +            }
 +            return;
          } else if ((insn & 0x0fe00000) == 0x0c400000) {
              /* Coprocessor double register transfer.  */
              ARCH(5TE);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 24/39] target/arm: Add ARM_FEATURE_V8_RDM
+[Qemu-devel] [PULL 24/29] target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB
 From: Richard Henderson <richard.henderson@linaro.org>
-Not enabled anywhere yet.
+Use deposit as the composit operation to merge the
 bits from the two inputs.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190808202616.13782-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h     | 1 +
+ target/arm/translate.c | 26 ++++++++++----------------
- linux-user/elfload.c | 1 +
+file changed, 10 insertions(+), 16 deletions(-)
 files changed, 2 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/translate.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
+                         shift = (insn >> 7) & 0x1f;
-     ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */
+                         if (insn & (1 << 6)) {
-     ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
+                             /* pkhtb */
-+    ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
+-                            if (shift == 0)
-     ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
++                            if (shift == 0) {
- };
+                                 shift = 31;
++                            }
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+                             tcg_gen_sari_i32(tmp2, tmp2, shift);
-index XXXXXXX..XXXXXXX 100644
+-                            tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
---- a/linux-user/elfload.c
+-                            tcg_gen_ext16u_i32(tmp2, tmp2);
-+++ b/linux-user/elfload.c
++                            tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
+                         } else {
-     GET_FEATURE(ARM_FEATURE_V8_SHA512, ARM_HWCAP_A64_SHA512);
+                             /* pkhbt */
-     GET_FEATURE(ARM_FEATURE_V8_FP16,
+-                            if (shift)
-                 ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+-                                tcg_gen_shli_i32(tmp2, tmp2, shift);
-+    GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
+-                            tcg_gen_ext16u_i32(tmp, tmp);
- #undef GET_FEATURE
+-                            tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
++                            tcg_gen_shli_i32(tmp2, tmp2, shift);
-     return hwcaps;
++                            tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
                          }
 -                        tcg_gen_or_i32(tmp, tmp, tmp2);
                          tcg_temp_free_i32(tmp2);
                          store_reg(s, rd, tmp);
                      } else if ((insn & 0x00200020) == 0x00200000) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
              shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
              if (insn & (1 << 5)) {
                  /* pkhtb */
 -                if (shift == 0)
 +                if (shift == 0) {
                      shift = 31;
 +                }
                  tcg_gen_sari_i32(tmp2, tmp2, shift);
 -                tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
 -                tcg_gen_ext16u_i32(tmp2, tmp2);
 +                tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
              } else {
                  /* pkhbt */
 -                if (shift)
 -                    tcg_gen_shli_i32(tmp2, tmp2, shift);
 -                tcg_gen_ext16u_i32(tmp, tmp);
 -                tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
 +                tcg_gen_shli_i32(tmp2, tmp2, shift);
 +                tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
              }
 -            tcg_gen_or_i32(tmp, tmp, tmp2);
              tcg_temp_free_i32(tmp2);
              store_reg(s, rd, tmp);
          } else {
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 31/39] target/arm: Decode aa32 armv8.1 two reg and a scalar
+[Qemu-devel] [PULL 25/29] target/arm: Remove redundant shift tests
 From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The immediate shift generator functions already test for,
 and eliminate, the case of a shift by zero.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-9-richard.henderson@linaro.org
+Message-id: 20190808202616.13782-4-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
+ target/arm/translate.c | 19 +++++++------------
-file changed, 42 insertions(+), 4 deletions(-)
+file changed, 7 insertions(+), 12 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static const char *regnames[] =
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+                         shift = (insn >> 10) & 3;
-       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
+                         /* ??? In many cases it's not necessary to do a
+                            rotate, a shift is sufficient.  */
-+/* Function prototypes for gen_ functions calling Neon helpers.  */
+-                        if (shift != 0)
-+typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+-                            tcg_gen_rotri_i32(tmp, tmp, shift * 8);
-+                                 TCGv_i32, TCGv_i32);
++                        tcg_gen_rotri_i32(tmp, tmp, shift * 8);
-+
+                         op1 = (insn >> 20) & 7;
- /* initialize TCG globals.  */
+                         switch (op1) {
- void arm_translate_init(void)
+                         case 0: gen_sxtb16(tmp);  break;
- {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+             shift = (insn >> 4) & 3;
              /* ??? In many cases it's not necessary to do a
                 rotate, a shift is sufficient.  */
 -            if (shift != 0)
 -                tcg_gen_rotri_i32(tmp, tmp, shift * 8);
 +            tcg_gen_rotri_i32(tmp, tmp, shift * 8);
              op = (insn >> 20) & 7;
              switch (op) {
              case 0: gen_sxth(tmp);   break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                      case 7:
                          goto illegal_op;
                      default: /* Saturate.  */
 -                        if (shift) {
 -                            if (op & 1)
 -                                tcg_gen_sari_i32(tmp, tmp, shift);
 -                            else
 -                                tcg_gen_shli_i32(tmp, tmp, shift);
 +                        if (op & 1) {
 +                            tcg_gen_sari_i32(tmp, tmp, shift);
 +                        } else {
 +                            tcg_gen_shli_i32(tmp, tmp, shift);
                          }
-                         neon_store_reg64(cpu_V0, rd + pass);
+                         tmp2 = tcg_const_i32(imm);
-                     }
+                         if (op & 4) {
--
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
--
+                     goto illegal_op;
                      break;
 -                default: /* 14 and 15 are RESERVED */
 -                    return 1;
 +                case 14: /* VQRDMLAH scalar */
 +                case 15: /* VQRDMLSH scalar */
 +                    {
 +                        NeonGenThreeOpEnvFn *fn;
 +
 +                        if (!arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
 +                            return 1;
 +                        }
 +                        if (u && ((rd | rn) & 1)) {
 +                            return 1;
 +                        }
 +                        if (op == 14) {
 +                            if (size == 1) {
 +                                fn = gen_helper_neon_qrdmlah_s16;
 +                            } else {
 +                                fn = gen_helper_neon_qrdmlah_s32;
 +                            }
 +                        } else {
 +                            if (size == 1) {
 +                                fn = gen_helper_neon_qrdmlsh_s16;
 +                            } else {
 +                                fn = gen_helper_neon_qrdmlsh_s32;
 +                            }
 +                        }
 +
 +                        tmp2 = neon_get_scalar(size, rm);
 +                        for (pass = 0; pass < (u ? 4 : 2); pass++) {
 +                            tmp = neon_load_reg(rn, pass);
 +                            tmp3 = neon_load_reg(rd, pass);
 +                            fn(tmp, cpu_env, tmp, tmp2, tmp3);
 +                            tcg_temp_free_i32(tmp3);
 +                            neon_store_reg(rd, pass, tmp);
 +                        }
 +                        tcg_temp_free_i32(tmp2);
 +                    }
 +                    break;
 +                default:
 +                    g_assert_not_reached();
                  }
-             }
+                 tmp = load_reg(s, rm);
-         } else { /* size == 3 */
+-                if (shift) {
 -                    tcg_gen_shli_i32(tmp, tmp, shift);
 -                }
 +                tcg_gen_shli_i32(tmp, tmp, shift);
                  tcg_gen_add_i32(addr, addr, tmp);
                  tcg_temp_free_i32(tmp);
                  break;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 38/39] target/arm: Decode t32 simd 3reg and 2reg_scalar extension
+[Qemu-devel] [PULL 26/29] target/arm: Use ror32 instead of open-coding the operation
 From: Richard Henderson <richard.henderson@linaro.org>
-Happily, the bits are in the same places compared to a32.
+The helper function is more documentary, and also already
 handles the case of rotate by zero.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-16-richard.henderson@linaro.org
+Message-id: 20190808202616.13782-5-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 14 +++++++++++++-
+ target/arm/translate.c | 7 ++-----
-file changed, 13 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 5 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-                                default_exception_el(s));
+                 /* CPSR = immediate */
-             break;
+                 val = insn & 0xff;
-         }
+                 shift = ((insn >> 8) & 0xf) * 2;
--        if (((insn >> 24) & 3) == 3) {
+-                if (shift)
-+        if ((insn & 0xfe000a00) == 0xfc000800
+-                    val = (val >> shift) | (val << (32 - shift));
-+            && arm_dc_feature(s, ARM_FEATURE_V8)) {
++                val = ror32(val, shift);
-+            /* The Thumb2 and ARM encodings are identical.  */
+                 i = ((insn & (1 << 22)) != 0);
-+            if (disas_neon_insn_3same_ext(s, insn)) {
+                 if (gen_set_psr_im(s, msr_mask(s, (insn >> 16) & 0xf, i),
-+                goto illegal_op;
+                                    i, val)) {
-+            }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-+        } else if ((insn & 0xff000a00) == 0xfe000800
+             /* immediate operand */
-+                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+             val = insn & 0xff;
-+            /* The Thumb2 and ARM encodings are identical.  */
+             shift = ((insn >> 8) & 0xf) * 2;
-+            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
+-            if (shift) {
-+                goto illegal_op;
+-                val = (val >> shift) | (val << (32 - shift));
-+            }
+-            }
-+        } else if (((insn >> 24) & 3) == 3) {
++            val = ror32(val, shift);
-             /* Translate into the equivalent ARM encoding.  */
+             tmp2 = tcg_temp_new_i32();
-             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
+             tcg_gen_movi_i32(tmp2, val);
-             if (disas_neon_data_insn(s, insn)) {
+             if (logic_cc && shift) {
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 37/39] target/arm: Decode aa32 armv8.3 2-reg-index
+[Qemu-devel] [PULL 27/29] target/arm: Use tcg_gen_rotri_i32 for gen_swap_half
 From: Richard Henderson <richard.henderson@linaro.org>
+Rotate is the more compact and obvious way to swap 16-bit
+elements of a 32-bit word.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180228193125.20577-15-richard.henderson@linaro.org
+Message-id: 20190808202616.13782-6-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.c | 6 +-----
-file changed, 61 insertions(+)
+file changed, 1 insertion(+), 5 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
-     return 0;
+ /* Swap low and high halfwords.  */
  static void gen_swap_half(TCGv_i32 var)
  {
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    tcg_gen_shri_i32(tmp, var, 16);
 -    tcg_gen_shli_i32(var, var, 16);
 -    tcg_gen_or_i32(var, var, tmp);
 -    tcg_temp_free_i32(tmp);
 +    tcg_gen_rotri_i32(var, var, 16);
  }
-+/* Advanced SIMD two registers and a scalar extension.
+ /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
 + *  31             24   23  22   20   16   12  11   10   9    8        3     0
 + * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
 + * | 1 1 1 1 1 1 1 0 | o1 | D | o2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
 + * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
 + *
 + */
 +
 +static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
 +{
 +    int rd, rn, rm, rot, size, opr_sz;
 +    TCGv_ptr fpst;
 +    bool q;
 +
 +    q = extract32(insn, 6, 1);
 +    VFP_DREG_D(rd, insn);
 +    VFP_DREG_N(rn, insn);
 +    VFP_DREG_M(rm, insn);
 +    if ((rd | rn) & q) {
 +        return 1;
 +    }
 +
 +    if ((insn & 0xff000f10) == 0xfe000800) {
 +        /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
 +        rot = extract32(insn, 20, 2);
 +        size = extract32(insn, 23, 1);
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
 +            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
 +            return 1;
 +        }
 +    } else {
 +        return 1;
 +    }
 +
 +    if (s->fp_excp_el) {
 +        gen_exception_insn(s, 4, EXCP_UDEF,
 +                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
 +        return 0;
 +    }
 +    if (!s->vfp_enabled) {
 +        return 1;
 +    }
 +
 +    opr_sz = (1 + q) * 8;
 +    fpst = get_fpstatus_ptr(1);
 +    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
 +                       vfp_reg_offset(1, rn),
 +                       vfp_reg_offset(1, rm), fpst,
 +                       opr_sz, opr_sz, rot,
 +                       size ? gen_helper_gvec_fcmlas_idx
 +                       : gen_helper_gvec_fcmlah_idx);
 +    tcg_temp_free_ptr(fpst);
 +    return 0;
 +}
 +
  static int disas_coproc_insn(DisasContext *s, uint32_t insn)
  {
      int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  goto illegal_op;
              }
              return;
 +        } else if ((insn & 0x0f000a00) == 0x0e000800
 +                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
 +            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
 +                goto illegal_op;
 +            }
 +            return;
          } else if ((insn & 0x0fe00000) == 0x0c400000) {
              /* Coprocessor double register transfer.  */
              ARCH(5TE);
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 02/39] xlnx-zynqmp-rtc: Add basic time support
+[Qemu-devel] [PULL 28/29] target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Allow the guest to determine the time set from the QEMU command line.
+All of the inputs to these instructions are 32-bits.  Rather than
 extend each input to 64-bits and then extract the high 32-bits of
 the output, use tcg_gen_muls2_i32 and other 32-bit generator functions.
-This includes adding a trace event to debug the new time.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190808202616.13782-7-richard.henderson@linaro.org
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/xlnx-zynqmp-rtc.h |  2 ++
+ target/arm/translate.c | 72 +++++++++++++++---------------------------
- hw/timer/xlnx-zynqmp-rtc.c         | 58 ++++++++++++++++++++++++++++++++++++++
+file changed, 26 insertions(+), 46 deletions(-)
  hw/timer/trace-events              |  3 ++
 files changed, 63 insertions(+)
-diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/xlnx-zynqmp-rtc.h
+--- a/target/arm/translate.c
-+++ b/include/hw/timer/xlnx-zynqmp-rtc.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPRTC {
+@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 var)
-     qemu_irq irq_rtc_int;
+     tcg_gen_ext16s_i32(var, var);
      qemu_irq irq_addr_error_int;
 +    uint32_t tick_offset;
 +
      uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];
      RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];
  } XlnxZynqMPRTC;
 diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/timer/xlnx-zynqmp-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/xlnx-zynqmp-rtc.c
 +++ b/hw/timer/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/register.h"
  #include "qemu/bitops.h"
  #include "qemu/log.h"
 +#include "hw/ptimer.h"
 +#include "qemu/cutils.h"
 +#include "sysemu/sysemu.h"
 +#include "trace.h"
  #include "hw/timer/xlnx-zynqmp-rtc.h"
  #ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG
@@ -XXX,XX +XXX,XX @@ static void addr_error_int_update_irq(XlnxZynqMPRTC *s)
      qemu_set_irq(s->irq_addr_error_int, pending);
  }
-+static uint32_t rtc_get_count(XlnxZynqMPRTC *s)
+-/* Return (b << 32) + a. Mark inputs as dead */
-+{
+-static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
-+    int64_t now = qemu_clock_get_ns(rtc_clock);
+-{
-+    return s->tick_offset + now / NANOSECONDS_PER_SECOND;
+-    TCGv_i64 tmp64 = tcg_temp_new_i64();
-+}
+-
-+
+-    tcg_gen_extu_i32_i64(tmp64, b);
-+static uint64_t current_time_postr(RegisterInfo *reg, uint64_t val64)
+-    tcg_temp_free_i32(b);
-+{
+-    tcg_gen_shli_i64(tmp64, tmp64, 32);
-+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+-    tcg_gen_add_i64(a, tmp64, a);
-+
+-
-+    return rtc_get_count(s);
+-    tcg_temp_free_i64(tmp64);
-+}
+-    return a;
-+
+-}
- static void rtc_int_status_postw(RegisterInfo *reg, uint64_t val64)
+-
 -/* Return (b << 32) - a. Mark inputs as dead. */
 -static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
 -{
 -    TCGv_i64 tmp64 = tcg_temp_new_i64();
 -
 -    tcg_gen_extu_i32_i64(tmp64, b);
 -    tcg_temp_free_i32(b);
 -    tcg_gen_shli_i64(tmp64, tmp64, 32);
 -    tcg_gen_sub_i64(a, tmp64, a);
 -
 -    tcg_temp_free_i64(tmp64);
 -    return a;
 -}
 -
  /* 32x32->64 multiply.  Marks inputs as dead.  */
  static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
  {
-     XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-@@ -XXX,XX +XXX,XX @@ static uint64_t addr_error_int_dis_prew(RegisterInfo *reg, uint64_t val64)
+                            (SMMUL, SMMLA, SMMLS) */
+                         tmp = load_reg(s, rm);
- static const RegisterAccessInfo rtc_regs_info[] = {
+                         tmp2 = load_reg(s, rs);
-     {   .name = "SET_TIME_WRITE",  .addr = A_SET_TIME_WRITE,
+-                        tmp64 = gen_muls_i64_i32(tmp, tmp2);
-+        .unimp = MAKE_64BIT_MASK(0, 32),
++                        tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
-     },{ .name = "SET_TIME_READ",  .addr = A_SET_TIME_READ,
-         .ro = 0xffffffff,
+                         if (rd != 15) {
-+        .post_read = current_time_postr,
+-                            tmp = load_reg(s, rd);
-     },{ .name = "CALIB_WRITE",  .addr = A_CALIB_WRITE,
++                            tmp3 = load_reg(s, rd);
-+        .unimp = MAKE_64BIT_MASK(0, 32),
+                             if (insn & (1 << 6)) {
-     },{ .name = "CALIB_READ",  .addr = A_CALIB_READ,
+-                                tmp64 = gen_subq_msw(tmp64, tmp);
-         .ro = 0x1fffff,
++                                tcg_gen_sub_i32(tmp, tmp, tmp3);
-     },{ .name = "CURRENT_TIME",  .addr = A_CURRENT_TIME,
+                             } else {
-         .ro = 0xffffffff,
+-                                tmp64 = gen_addq_msw(tmp64, tmp);
-+        .post_read = current_time_postr,
++                                tcg_gen_add_i32(tmp, tmp, tmp3);
-     },{ .name = "CURRENT_TICK",  .addr = A_CURRENT_TICK,
+                             }
-         .ro = 0xffff,
++                            tcg_temp_free_i32(tmp3);
-     },{ .name = "ALARM",  .addr = A_ALARM,
+                         }
-@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)
+                         if (insn & (1 << 5)) {
-     XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(obj);
+-                            tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
++                            /*
-     RegisterInfoArray *reg_array;
++                             * Adding 0x80000000 to the 64-bit quantity
-+    struct tm current_tm;
++                             * means that we have carry in to the high
++                             * word when the low word has the high bit set.
-     memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_RTC,
++                             */
-                        XLNX_ZYNQMP_RTC_R_MAX * 4);
++                            tcg_gen_shri_i32(tmp2, tmp2, 31);
-@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)
++                            tcg_gen_add_i32(tmp, tmp, tmp2);
-     sysbus_init_mmio(sbd, &s->iomem);
+                         }
-     sysbus_init_irq(sbd, &s->irq_rtc_int);
+-                        tcg_gen_shri_i64(tmp64, tmp64, 32);
-     sysbus_init_irq(sbd, &s->irq_addr_error_int);
+-                        tmp = tcg_temp_new_i32();
-+
+-                        tcg_gen_extrl_i64_i32(tmp, tmp64);
-+    qemu_get_timedate(&current_tm, 0);
+-                        tcg_temp_free_i64(tmp64);
-+    s->tick_offset = mktimegm(&current_tm) -
++                        tcg_temp_free_i32(tmp2);
-+        qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+                         store_reg(s, rn, tmp);
-+
+                         break;
-+    trace_xlnx_zynqmp_rtc_gettime(current_tm.tm_year, current_tm.tm_mon,
+                     case 0:
-+                                  current_tm.tm_mday, current_tm.tm_hour,
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-+                                  current_tm.tm_min, current_tm.tm_sec);
+                   }
-+}
+                 break;
-+
+             case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
-+static int rtc_pre_save(void *opaque)
+-                tmp64 = gen_muls_i64_i32(tmp, tmp2);
-+{
++                tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
-+    XlnxZynqMPRTC *s = opaque;
+                 if (rs != 15) {
-+    int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+-                    tmp = load_reg(s, rs);
-+
++                    tmp3 = load_reg(s, rs);
-+    /* Add the time at migration */
+                     if (insn & (1 << 20)) {
-+    s->tick_offset = s->tick_offset + now;
+-                        tmp64 = gen_addq_msw(tmp64, tmp);
-+
++                        tcg_gen_add_i32(tmp, tmp, tmp3);
-+    return 0;
+                     } else {
-+}
+-                        tmp64 = gen_subq_msw(tmp64, tmp);
-+
++                        tcg_gen_sub_i32(tmp, tmp, tmp3);
-+static int rtc_post_load(void *opaque, int version_id)
+                     }
-+{
++                    tcg_temp_free_i32(tmp3);
-+    XlnxZynqMPRTC *s = opaque;
+                 }
-+    int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+                 if (insn & (1 << 4)) {
-+
+-                    tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
-+    /* Subtract the time after migration. This combined with the pre_save
++                    /*
-+     * action results in us having subtracted the time that the guest was
++                     * Adding 0x80000000 to the 64-bit quantity
-+     * stopped to the offset.
++                     * means that we have carry in to the high
-+     */
++                     * word when the low word has the high bit set.
-+    s->tick_offset = s->tick_offset - now;
++                     */
-+
++                    tcg_gen_shri_i32(tmp2, tmp2, 31);
-+    return 0;
++                    tcg_gen_add_i32(tmp, tmp, tmp2);
- }
+                 }
+-                tcg_gen_shri_i64(tmp64, tmp64, 32);
- static const VMStateDescription vmstate_rtc = {
+-                tmp = tcg_temp_new_i32();
-     .name = TYPE_XLNX_ZYNQMP_RTC,
+-                tcg_gen_extrl_i64_i32(tmp, tmp64);
-     .version_id = 1,
+-                tcg_temp_free_i64(tmp64);
-     .minimum_version_id = 1,
++                tcg_temp_free_i32(tmp2);
-+    .pre_save = rtc_pre_save,
+                 break;
-+    .post_load = rtc_post_load,
+             case 7: /* Unsigned sum of absolute differences.  */
-     .fields = (VMStateField[]) {
+                 gen_helper_usad8(tmp, tmp, tmp2);
          VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPRTC, XLNX_ZYNQMP_RTC_R_MAX),
 +        VMSTATE_UINT32(tick_offset, XlnxZynqMPRTC),
          VMSTATE_END_OF_LIST(),
      }
  };
 diff --git a/hw/timer/trace-events b/hw/timer/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/trace-events
 +++ b/hw/timer/trace-events
@@ -XXX,XX +XXX,XX @@ systick_write(uint64_t addr, uint32_t value, unsigned size) "systick write addr
  cmsdk_apb_timer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
  cmsdk_apb_timer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
  cmsdk_apb_timer_reset(void) "CMSDK APB timer: reset"
 +
 +# hw/timer/xlnx-zynqmp-rtc.c
 +xlnx_zynqmp_rtc_gettime(int year, int month, int day, int hour, int min, int sec) "Get time from host: %d-%d-%d %2d:%02d:%02d"
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 04/39] decodetree: Propagate return value from translate subroutines
+[Qemu-devel] [PULL 29/29] target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word
 From: Richard Henderson <richard.henderson@linaro.org>
-Allow the translate subroutines to return false for invalid insns.
+Separate shift + extract low will result in one extra insn
+for hosts like RISC-V, MIPS, and Sparc.
 At present we can of course invoke an invalid insn exception from within
 the translate subroutine, but in the short term this consolidates code.
 In the long term it would allow the decodetree language to support
 overlapping patterns for ISA extensions.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180227232618.2908-1-richard.henderson@linaro.org
+Message-id: 20190808202616.13782-8-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- scripts/decodetree.py | 5 ++---
+ target/arm/translate.c | 18 ++++++------------
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 6 insertions(+), 12 deletions(-)
-diff --git a/scripts/decodetree.py b/scripts/decodetree.py
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/scripts/decodetree.py
+--- a/target/arm/translate.c
-+++ b/scripts/decodetree.py
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ class Pattern(General):
+@@ -XXX,XX +XXX,XX @@ static int disas_iwmmxt_insn(DisasContext *s, uint32_t insn)
-         global translate_prefix
+             if (insn & ARM_CP_RW_BIT) {                         /* TMRRC */
-         output('typedef ', self.base.base.struct_name(),
+                 iwmmxt_load_reg(cpu_V0, wrd);
-                ' arg_', self.name, ';\n')
+                 tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
--        output(translate_scope, 'void ', translate_prefix, '_', self.name,
+-                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-+        output(translate_scope, 'bool ', translate_prefix, '_', self.name,
+-                tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
-                '(DisasContext *ctx, arg_', self.name,
++                tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
-                ' *a, ', insntype, ' insn);\n')
+             } else {                                    /* TMCRR */
+                 tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
-@@ -XXX,XX +XXX,XX @@ class Pattern(General):
+                 iwmmxt_store_reg(cpu_V0, wrd);
-             output(ind, self.base.extract_name(), '(&u.f_', arg, ', insn);\n')
+@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
-         for n, f in self.fields.items():
+         if (insn & ARM_CP_RW_BIT) {                     /* MRA */
-             output(ind, 'u.f_', arg, '.', n, ' = ', f.str_extract(), ';\n')
+             iwmmxt_load_reg(cpu_V0, acc);
--        output(ind, translate_prefix, '_', self.name,
+             tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
-+        output(ind, 'return ', translate_prefix, '_', self.name,
+-            tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-                '(ctx, &u.f_', arg, ', insn);\n')
+-            tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
--        output(ind, 'return true;\n')
++            tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
- # end Pattern
+             tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
+         } else {                                        /* MAR */
              tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                  gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
                                  break;
                              case 2:
 -                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
 -                                tcg_gen_extrl_i64_i32(tmp, cpu_V0);
 +                                tcg_gen_extrh_i64_i32(tmp, cpu_V0);
                                  break;
                              default: abort();
                              }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                  break;
                              case 2:
                                  tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
 -                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
 -                                tcg_gen_extrl_i64_i32(tmp, cpu_V0);
 +                                tcg_gen_extrh_i64_i32(tmp, cpu_V0);
                                  break;
                              default: abort();
                              }
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
                  tmp = tcg_temp_new_i32();
                  tcg_gen_extrl_i64_i32(tmp, tmp64);
                  store_reg(s, rt, tmp);
 -                tcg_gen_shri_i64(tmp64, tmp64, 32);
                  tmp = tcg_temp_new_i32();
 -                tcg_gen_extrl_i64_i32(tmp, tmp64);
 +                tcg_gen_extrh_i64_i32(tmp, tmp64);
                  tcg_temp_free_i64(tmp64);
                  store_reg(s, rt2, tmp);
              } else {
@@ -XXX,XX +XXX,XX @@ static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
      tcg_gen_extrl_i64_i32(tmp, val);
      store_reg(s, rlow, tmp);
      tmp = tcg_temp_new_i32();
 -    tcg_gen_shri_i64(val, val, 32);
 -    tcg_gen_extrl_i64_i32(tmp, val);
 +    tcg_gen_extrh_i64_i32(tmp, val);
      store_reg(s, rhigh, tmp);
  }
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 05/39] loader: Add new load_ramdisk_as()
+Deleted patch
-Add a function load_ramdisk_as() which behaves like the existing
-load_ramdisk() but allows the caller to specify the AddressSpace
-to use. This matches the pattern we have already for various
-other loader functions.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-2-peter.maydell@linaro.org
----
- include/hw/loader.h | 12 +++++++++++-
- hw/core/loader.c    |  8 +++++++-
-files changed, 18 insertions(+), 2 deletions(-)
-diff --git a/include/hw/loader.h b/include/hw/loader.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/loader.h
-+++ b/include/hw/loader.h
-@@ -XXX,XX +XXX,XX @@ int load_uimage(const char *filename, hwaddr *ep,
-                 void *translate_opaque);
- /**
-- * load_ramdisk:
-+ * load_ramdisk_as:
-  * @filename: Path to the ramdisk image
-  * @addr: Memory address to load the ramdisk to
-  * @max_sz: Maximum allowed ramdisk size (for non-u-boot ramdisks)
-+ * @as: The AddressSpace to load the ELF to. The value of address_space_memory
-+ *      is used if nothing is supplied here.
-  *
-  * Load a ramdisk image with U-Boot header to the specified memory
-  * address.
-  *
-  * Returns the size of the loaded image on success, -1 otherwise.
-  */
-+int load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
-+                    AddressSpace *as);
-+
-+/**
-+ * load_ramdisk:
-+ * Same as load_ramdisk_as(), but doesn't allow the caller to specify
-+ * an AddressSpace.
-+ */
- int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz);
- ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src, size_t srclen);
-diff --git a/hw/core/loader.c b/hw/core/loader.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/loader.c
-+++ b/hw/core/loader.c
-@@ -XXX,XX +XXX,XX @@ int load_uimage_as(const char *filename, hwaddr *ep, hwaddr *loadaddr,
- /* Load a ramdisk.  */
- int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
-+{
-+    return load_ramdisk_as(filename, addr, max_sz, NULL);
-+}
-+
-+int load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
-+                    AddressSpace *as)
- {
-     return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK,
--                            NULL, NULL, NULL);
-+                            NULL, NULL, as);
- }
- /* Load a gzip-compressed kernel to a dynamically allocated buffer. */
---
-.16.2

-[Qemu-devel] [PULL 07/39] hw/arm/armv7m: Honour CPU's address space for image loads
+Deleted patch
-Instead of loading guest images to the system address space, use the
-CPU's address space.  This is important if we're trying to load the
-file to memory or via an alias memory region that is provided by an
-SoC object and thus not mapped into the system address space.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-4-peter.maydell@linaro.org
----
- hw/arm/armv7m.c | 17 ++++++++++++++---
-file changed, 14 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
-+++ b/hw/arm/armv7m.c
-@@ -XXX,XX +XXX,XX @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size)
-     uint64_t entry;
-     uint64_t lowaddr;
-     int big_endian;
-+    AddressSpace *as;
-+    int asidx;
-+    CPUState *cs = CPU(cpu);
- #ifdef TARGET_WORDS_BIGENDIAN
-     big_endian = 1;
-@@ -XXX,XX +XXX,XX @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size)
-         exit(1);
-     }
-+    if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
-+        asidx = ARMASIdx_S;
-+    } else {
-+        asidx = ARMASIdx_NS;
-+    }
-+    as = cpu_get_address_space(cs, asidx);
-+
-     if (kernel_filename) {
--        image_size = load_elf(kernel_filename, NULL, NULL, &entry, &lowaddr,
--                              NULL, big_endian, EM_ARM, 1, 0);
-+        image_size = load_elf_as(kernel_filename, NULL, NULL, &entry, &lowaddr,
-+                                 NULL, big_endian, EM_ARM, 1, 0, as);
-         if (image_size < 0) {
--            image_size = load_image_targphys(kernel_filename, 0, mem_size);
-+            image_size = load_image_targphys_as(kernel_filename, 0,
-+                                                mem_size, as);
-             lowaddr = 0;
-         }
-         if (image_size < 0) {
---
-.16.2

-[Qemu-devel] [PULL 09/39] armv7m: Forward idau property to CPU object
+Deleted patch
-Create an "idau" property on the armv7m container object which
-we can forward to the CPU object. Annoyingly, we can't use
-object_property_add_alias() because the CPU object we want to
-forward to doesn't exist until the armv7m container is realized.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-6-peter.maydell@linaro.org
----
- include/hw/arm/armv7m.h | 3 +++
- hw/arm/armv7m.c         | 9 +++++++++
-files changed, 12 insertions(+)
-diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/armv7m.h
-+++ b/include/hw/arm/armv7m.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "hw/intc/armv7m_nvic.h"
-+#include "target/arm/idau.h"
- #define TYPE_BITBAND "ARM,bitband-memory"
- #define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-  * + Property "memory": MemoryRegion defining the physical address space
-  *   that CPU accesses see. (The NVIC, bitbanding and other CPU-internal
-  *   devices will be automatically layered on top of this view.)
-+ * + Property "idau": IDAU interface (forwarded to CPU object)
-  */
- typedef struct ARMv7MState {
-     /*< private >*/
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
-     char *cpu_type;
-     /* MemoryRegion the board provides to us (with its devices, RAM, etc) */
-     MemoryRegion *board_memory;
-+    Object *idau;
- } ARMv7MState;
- #endif
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
-+++ b/hw/arm/armv7m.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/qtest.h"
- #include "qemu/error-report.h"
- #include "exec/address-spaces.h"
-+#include "target/arm/idau.h"
- /* Bitbanded IO.  Each word corresponds to a single bit.  */
-@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
-     object_property_set_link(OBJECT(s->cpu), OBJECT(&s->container), "memory",
-                              &error_abort);
-+    if (object_property_find(OBJECT(s->cpu), "idau", NULL)) {
-+        object_property_set_link(OBJECT(s->cpu), s->idau, "idau", &err);
-+        if (err != NULL) {
-+            error_propagate(errp, err);
-+            return;
-+        }
-+    }
-     object_property_set_bool(OBJECT(s->cpu), true, "realized", &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
-@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
-     DEFINE_PROP_STRING("cpu-type", ARMv7MState, cpu_type),
-     DEFINE_PROP_LINK("memory", ARMv7MState, board_memory, TYPE_MEMORY_REGION,
-                      MemoryRegion *),
-+    DEFINE_PROP_LINK("idau", ARMv7MState, idau, TYPE_IDAU_INTERFACE, Object *),
-     DEFINE_PROP_END_OF_LIST(),
- };
---
-.16.2

-[Qemu-devel] [PULL 11/39] armv7m: Forward init-svtor property to CPU object
+Deleted patch
-Create an "init-svtor" property on the armv7m container
-object which we can forward to the CPU object.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-8-peter.maydell@linaro.org
----
- include/hw/arm/armv7m.h | 2 ++
- hw/arm/armv7m.c         | 9 +++++++++
-files changed, 11 insertions(+)
-diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/armv7m.h
-+++ b/include/hw/arm/armv7m.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-  *   that CPU accesses see. (The NVIC, bitbanding and other CPU-internal
-  *   devices will be automatically layered on top of this view.)
-  * + Property "idau": IDAU interface (forwarded to CPU object)
-+ * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
-  */
- typedef struct ARMv7MState {
-     /*< private >*/
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
-     /* MemoryRegion the board provides to us (with its devices, RAM, etc) */
-     MemoryRegion *board_memory;
-     Object *idau;
-+    uint32_t init_svtor;
- } ARMv7MState;
- #endif
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
-+++ b/hw/arm/armv7m.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
-             return;
-         }
-     }
-+    if (object_property_find(OBJECT(s->cpu), "init-svtor", NULL)) {
-+        object_property_set_uint(OBJECT(s->cpu), s->init_svtor,
-+                                 "init-svtor", &err);
-+        if (err != NULL) {
-+            error_propagate(errp, err);
-+            return;
-+        }
-+    }
-     object_property_set_bool(OBJECT(s->cpu), true, "realized", &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
-@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
-     DEFINE_PROP_LINK("memory", ARMv7MState, board_memory, TYPE_MEMORY_REGION,
-                      MemoryRegion *),
-     DEFINE_PROP_LINK("idau", ARMv7MState, idau, TYPE_IDAU_INTERFACE, Object *),
-+    DEFINE_PROP_UINT32("init-svtor", ARMv7MState, init_svtor, 0),
-     DEFINE_PROP_END_OF_LIST(),
- };
---
-.16.2

-[Qemu-devel] [PULL 13/39] hw/misc/unimp: Move struct to header file
+Deleted patch
-Move the definition of the struct for the unimplemented-device
-from unimp.c to unimp.h, so that users can embed the struct
-in their own device structs if they prefer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-10-peter.maydell@linaro.org
----
- include/hw/misc/unimp.h | 10 ++++++++++
- hw/misc/unimp.c         | 10 ----------
-files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/unimp.h
-+++ b/include/hw/misc/unimp.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_UNIMPLEMENTED_DEVICE "unimplemented-device"
-+#define UNIMPLEMENTED_DEVICE(obj) \
-+    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
-+
-+typedef struct {
-+    SysBusDevice parent_obj;
-+    MemoryRegion iomem;
-+    char *name;
-+    uint64_t size;
-+} UnimplementedDeviceState;
-+
- /**
-  * create_unimplemented_device: create and map a dummy device
-  * @name: name of the device for debug logging
-diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/unimp.c
-+++ b/hw/misc/unimp.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "qapi/error.h"
--#define UNIMPLEMENTED_DEVICE(obj) \
--    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
--
--typedef struct {
--    SysBusDevice parent_obj;
--    MemoryRegion iomem;
--    char *name;
--    uint64_t size;
--} UnimplementedDeviceState;
--
- static uint64_t unimp_read(void *opaque, hwaddr offset, unsigned size)
- {
-     UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
---
-.16.2

-[Qemu-devel] [PULL 14/39] include/hw/or-irq.h: Add missing include guard
+Deleted patch
-The or-irq.h header file is missing the customary guard against
-multiple inclusion, which means compilation fails if it gets
-included twice. Fix the omission.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-11-peter.maydell@linaro.org
----
- include/hw/or-irq.h | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/or-irq.h
-+++ b/include/hw/or-irq.h
-@@ -XXX,XX +XXX,XX @@
-  * THE SOFTWARE.
-  */
-+#ifndef HW_OR_IRQ_H
-+#define HW_OR_IRQ_H
-+
- #include "hw/irq.h"
- #include "hw/sysbus.h"
- #include "qom/object.h"
-@@ -XXX,XX +XXX,XX @@ struct OrIRQState {
-     bool levels[MAX_OR_LINES];
-     uint16_t num_lines;
- };
-+
-+#endif
---
-.16.2

-[Qemu-devel] [PULL 15/39] qdev: Add new qdev_init_gpio_in_named_with_opaque()
+Deleted patch
-The function qdev_init_gpio_in_named() passes the DeviceState pointer
-as the opaque data pointor for the irq handler function.  Usually
-this is what you want, but in some cases it would be helpful to use
-some other data pointer.
-Add a new function qdev_init_gpio_in_named_with_opaque() which allows
-the caller to specify the data pointer they want.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-12-peter.maydell@linaro.org
----
- include/hw/qdev-core.h | 30 ++++++++++++++++++++++++++++--
- hw/core/qdev.c         |  8 +++++---
-files changed, 33 insertions(+), 5 deletions(-)
-diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-core.h
-+++ b/include/hw/qdev-core.h
-@@ -XXX,XX +XXX,XX @@ BusState *qdev_get_child_bus(DeviceState *dev, const char *name);
- /* GPIO inputs also double as IRQ sinks.  */
- void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n);
- void qdev_init_gpio_out(DeviceState *dev, qemu_irq *pins, int n);
--void qdev_init_gpio_in_named(DeviceState *dev, qemu_irq_handler handler,
--                             const char *name, int n);
- void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,
-                               const char *name, int n);
-+/**
-+ * qdev_init_gpio_in_named_with_opaque: create an array of input GPIO lines
-+ *   for the specified device
-+ *
-+ * @dev: Device to create input GPIOs for
-+ * @handler: Function to call when GPIO line value is set
-+ * @opaque: Opaque data pointer to pass to @handler
-+ * @name: Name of the GPIO input (must be unique for this device)
-+ * @n: Number of GPIO lines in this input set
-+ */
-+void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
-+                                         qemu_irq_handler handler,
-+                                         void *opaque,
-+                                         const char *name, int n);
-+
-+/**
-+ * qdev_init_gpio_in_named: create an array of input GPIO lines
-+ *   for the specified device
-+ *
-+ * Like qdev_init_gpio_in_named_with_opaque(), but the opaque pointer
-+ * passed to the handler is @dev (which is the most commonly desired behaviour).
-+ */
-+static inline void qdev_init_gpio_in_named(DeviceState *dev,
-+                                           qemu_irq_handler handler,
-+                                           const char *name, int n)
-+{
-+    qdev_init_gpio_in_named_with_opaque(dev, handler, dev, name, n);
-+}
- void qdev_pass_gpios(DeviceState *dev, DeviceState *container,
-                      const char *name);
-diff --git a/hw/core/qdev.c b/hw/core/qdev.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/qdev.c
-+++ b/hw/core/qdev.c
-@@ -XXX,XX +XXX,XX @@ static NamedGPIOList *qdev_get_named_gpio_list(DeviceState *dev,
-     return ngl;
- }
--void qdev_init_gpio_in_named(DeviceState *dev, qemu_irq_handler handler,
--                             const char *name, int n)
-+void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
-+                                         qemu_irq_handler handler,
-+                                         void *opaque,
-+                                         const char *name, int n)
- {
-     int i;
-     NamedGPIOList *gpio_list = qdev_get_named_gpio_list(dev, name);
-     assert(gpio_list->num_out == 0 || !name);
-     gpio_list->in = qemu_extend_irqs(gpio_list->in, gpio_list->num_in, handler,
--                                     dev, n);
-+                                     opaque, n);
-     if (!name) {
-         name = "unnamed-gpio-in";
---
-.16.2

-[Qemu-devel] [PULL 16/39] hw/core/split-irq: Device that splits IRQ lines
+Deleted patch
-In some board or SoC models it is necessary to split a qemu_irq line
-so that one input can feed multiple outputs.  We currently have
-qemu_irq_split() for this, but that has several deficiencies:
- * it can only handle splitting a line into two
- * it unavoidably leaks memory, so it can't be used
-   in a device that can be deleted
-Implement a qdev device that encapsulates splitting of IRQs, with a
-configurable number of outputs.  (This is in some ways the inverse of
-the TYPE_OR_IRQ device.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-13-peter.maydell@linaro.org
----
- hw/core/Makefile.objs       |  1 +
- include/hw/core/split-irq.h | 57 +++++++++++++++++++++++++++++
- include/hw/irq.h            |  4 +-
- hw/core/split-irq.c         | 89 +++++++++++++++++++++++++++++++++++++++++++++
-files changed, 150 insertions(+), 1 deletion(-)
- create mode 100644 include/hw/core/split-irq.h
- create mode 100644 hw/core/split-irq.c
-diff --git a/hw/core/Makefile.objs b/hw/core/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/Makefile.objs
-+++ b/hw/core/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_FITLOADER) += loader-fit.o
- common-obj-$(CONFIG_SOFTMMU) += qdev-properties-system.o
- common-obj-$(CONFIG_SOFTMMU) += register.o
- common-obj-$(CONFIG_SOFTMMU) += or-irq.o
-+common-obj-$(CONFIG_SOFTMMU) += split-irq.o
- common-obj-$(CONFIG_PLATFORM_BUS) += platform-bus.o
- obj-$(CONFIG_SOFTMMU) += generic-loader.o
-diff --git a/include/hw/core/split-irq.h b/include/hw/core/split-irq.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/core/split-irq.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * IRQ splitter device.
-+ *
-+ * Copyright (c) 2018 Linaro Limited.
-+ * Written by Peter Maydell
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+/* This is a simple device which has one GPIO input line and multiple
-+ * GPIO output lines. Any change on the input line is forwarded to all
-+ * of the outputs.
-+ *
-+ * QEMU interface:
-+ *  + one unnamed GPIO input: the input line
-+ *  + N unnamed GPIO outputs: the output lines
-+ *  + QOM property "num-lines": sets the number of output lines
-+ */
-+#ifndef HW_SPLIT_IRQ_H
-+#define HW_SPLIT_IRQ_H
-+
-+#include "hw/irq.h"
-+#include "hw/sysbus.h"
-+#include "qom/object.h"
-+
-+#define TYPE_SPLIT_IRQ "split-irq"
-+
-+#define MAX_SPLIT_LINES 16
-+
-+typedef struct SplitIRQ SplitIRQ;
-+
-+#define SPLIT_IRQ(obj) OBJECT_CHECK(SplitIRQ, (obj), TYPE_SPLIT_IRQ)
-+
-+struct SplitIRQ {
-+    DeviceState parent_obj;
-+
-+    qemu_irq out_irq[MAX_SPLIT_LINES];
-+    uint16_t num_lines;
-+};
-+
-+#endif
-diff --git a/include/hw/irq.h b/include/hw/irq.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/irq.h
-+++ b/include/hw/irq.h
-@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
- /* Returns a new IRQ with opposite polarity.  */
- qemu_irq qemu_irq_invert(qemu_irq irq);
--/* Returns a new IRQ which feeds into both the passed IRQs */
-+/* Returns a new IRQ which feeds into both the passed IRQs.
-+ * It's probably better to use the TYPE_SPLIT_IRQ device instead.
-+ */
- qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
- /* Returns a new IRQ set which connects 1:1 to another IRQ set, which
-diff --git a/hw/core/split-irq.c b/hw/core/split-irq.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/core/split-irq.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * IRQ splitter device.
-+ *
-+ * Copyright (c) 2018 Linaro Limited.
-+ * Written by Peter Maydell
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/core/split-irq.h"
-+#include "qapi/error.h"
-+
-+static void split_irq_handler(void *opaque, int n, int level)
-+{
-+    SplitIRQ *s = SPLIT_IRQ(opaque);
-+    int i;
-+
-+    for (i = 0; i < s->num_lines; i++) {
-+        qemu_set_irq(s->out_irq[i], level);
-+    }
-+}
-+
-+static void split_irq_init(Object *obj)
-+{
-+    qdev_init_gpio_in(DEVICE(obj), split_irq_handler, 1);
-+}
-+
-+static void split_irq_realize(DeviceState *dev, Error **errp)
-+{
-+    SplitIRQ *s = SPLIT_IRQ(dev);
-+
-+    if (s->num_lines < 1 || s->num_lines >= MAX_SPLIT_LINES) {
-+        error_setg(errp,
-+                   "IRQ splitter number of lines %d is not between 1 and %d",
-+                   s->num_lines, MAX_SPLIT_LINES);
-+        return;
-+    }
-+
-+    qdev_init_gpio_out(dev, s->out_irq, s->num_lines);
-+}
-+
-+static Property split_irq_properties[] = {
-+    DEFINE_PROP_UINT16("num-lines", SplitIRQ, num_lines, 1),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void split_irq_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    /* No state to reset or migrate */
-+    dc->props = split_irq_properties;
-+    dc->realize = split_irq_realize;
-+
-+    /* Reason: Needs to be wired up to work */
-+    dc->user_creatable = false;
-+}
-+
-+static const TypeInfo split_irq_type_info = {
-+   .name = TYPE_SPLIT_IRQ,
-+   .parent = TYPE_DEVICE,
-+   .instance_size = sizeof(SplitIRQ),
-+   .instance_init = split_irq_init,
-+   .class_init = split_irq_class_init,
-+};
-+
-+static void split_irq_register_types(void)
-+{
-+    type_register_static(&split_irq_type_info);
-+}
-+
-+type_init(split_irq_register_types)
---
-.16.2

-[Qemu-devel] [PULL 17/39] hw/misc/mps2-fpgaio: FPGA control block for MPS2 AN505
+Deleted patch
-The MPS2 AN505 FPGA image includes a "FPGA control block"
-which is a small set of registers handling LEDs, buttons
-and some counters.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-14-peter.maydell@linaro.org
----
- hw/misc/Makefile.objs           |   1 +
- include/hw/misc/mps2-fpgaio.h   |  43 ++++++++++
- hw/misc/mps2-fpgaio.c           | 176 ++++++++++++++++++++++++++++++++++++++++
- default-configs/arm-softmmu.mak |   1 +
- hw/misc/trace-events            |   6 ++
-files changed, 227 insertions(+)
- create mode 100644 include/hw/misc/mps2-fpgaio.h
- create mode 100644 hw/misc/mps2-fpgaio.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
- obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
- obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
- obj-$(CONFIG_MIPS_ITU) += mips_itu.o
-+obj-$(CONFIG_MPS2_FPGAIO) += mps2-fpgaio.o
- obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
- obj-$(CONFIG_PVPANIC) += pvpanic.o
-diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/misc/mps2-fpgaio.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * ARM MPS2 FPGAIO emulation
-+ *
-+ * Copyright (c) 2018 Linaro Limited
-+ * Written by Peter Maydell
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 or
-+ *  (at your option) any later version.
-+ */
-+
-+/* This is a model of the FPGAIO register block in the AN505
-+ * FPGA image for the MPS2 dev board; it is documented in the
-+ * application note:
-+ * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
-+ *
-+ * QEMU interface:
-+ *  + sysbus MMIO region 0: the register bank
-+ */
-+
-+#ifndef MPS2_FPGAIO_H
-+#define MPS2_FPGAIO_H
-+
-+#include "hw/sysbus.h"
-+
-+#define TYPE_MPS2_FPGAIO "mps2-fpgaio"
-+#define MPS2_FPGAIO(obj) OBJECT_CHECK(MPS2FPGAIO, (obj), TYPE_MPS2_FPGAIO)
-+
-+typedef struct {
-+    /*< private >*/
-+    SysBusDevice parent_obj;
-+
-+    /*< public >*/
-+    MemoryRegion iomem;
-+
-+    uint32_t led0;
-+    uint32_t prescale;
-+    uint32_t misc;
-+
-+    uint32_t prescale_clk;
-+} MPS2FPGAIO;
-+
-+#endif
-diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/mps2-fpgaio.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * ARM MPS2 AN505 FPGAIO emulation
-+ *
-+ * Copyright (c) 2018 Linaro Limited
-+ * Written by Peter Maydell
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 or
-+ *  (at your option) any later version.
-+ */
-+
-+/* This is a model of the "FPGA system control and I/O" block found
-+ * in the AN505 FPGA image for the MPS2 devboard.
-+ * It is documented in AN505:
-+ * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "qapi/error.h"
-+#include "trace.h"
-+#include "hw/sysbus.h"
-+#include "hw/registerfields.h"
-+#include "hw/misc/mps2-fpgaio.h"
-+
-+REG32(LED0, 0)
-+REG32(BUTTON, 8)
-+REG32(CLK1HZ, 0x10)
-+REG32(CLK100HZ, 0x14)
-+REG32(COUNTER, 0x18)
-+REG32(PRESCALE, 0x1c)
-+REG32(PSCNTR, 0x20)
-+REG32(MISC, 0x4c)
-+
-+static uint64_t mps2_fpgaio_read(void *opaque, hwaddr offset, unsigned size)
-+{
-+    MPS2FPGAIO *s = MPS2_FPGAIO(opaque);
-+    uint64_t r;
-+
-+    switch (offset) {
-+    case A_LED0:
-+        r = s->led0;
-+        break;
-+    case A_BUTTON:
-+        /* User-pressable board buttons. We don't model that, so just return
-+         * zeroes.
-+         */
-+        r = 0;
-+        break;
-+    case A_PRESCALE:
-+        r = s->prescale;
-+        break;
-+    case A_MISC:
-+        r = s->misc;
-+        break;
-+    case A_CLK1HZ:
-+    case A_CLK100HZ:
-+    case A_COUNTER:
-+    case A_PSCNTR:
-+        /* These are all upcounters of various frequencies. */
-+        qemu_log_mask(LOG_UNIMP, "MPS2 FPGAIO: counters unimplemented\n");
-+        r = 0;
-+        break;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "MPS2 FPGAIO read: bad offset %x\n", (int) offset);
-+        r = 0;
-+        break;
-+    }
-+
-+    trace_mps2_fpgaio_read(offset, r, size);
-+    return r;
-+}
-+
-+static void mps2_fpgaio_write(void *opaque, hwaddr offset, uint64_t value,
-+                              unsigned size)
-+{
-+    MPS2FPGAIO *s = MPS2_FPGAIO(opaque);
-+
-+    trace_mps2_fpgaio_write(offset, value, size);
-+
-+    switch (offset) {
-+    case A_LED0:
-+        /* LED bits [1:0] control board LEDs. We don't currently have
-+         * a mechanism for displaying this graphically, so use a trace event.
-+         */
-+        trace_mps2_fpgaio_leds(value & 0x02 ? '*' : '.',
-+                               value & 0x01 ? '*' : '.');
-+        s->led0 = value & 0x3;
-+        break;
-+    case A_PRESCALE:
-+        s->prescale = value;
-+        break;
-+    case A_MISC:
-+        /* These are control bits for some of the other devices on the
-+         * board (SPI, CLCD, etc). We don't implement that yet, so just
-+         * make the bits read as written.
-+         */
-+        qemu_log_mask(LOG_UNIMP,
-+                      "MPS2 FPGAIO: MISC control bits unimplemented\n");
-+        s->misc = value;
-+        break;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "MPS2 FPGAIO write: bad offset 0x%x\n", (int) offset);
-+        break;
-+    }
-+}
-+
-+static const MemoryRegionOps mps2_fpgaio_ops = {
-+    .read = mps2_fpgaio_read,
-+    .write = mps2_fpgaio_write,
-+    .endianness = DEVICE_LITTLE_ENDIAN,
-+};
-+
-+static void mps2_fpgaio_reset(DeviceState *dev)
-+{
-+    MPS2FPGAIO *s = MPS2_FPGAIO(dev);
-+
-+    trace_mps2_fpgaio_reset();
-+    s->led0 = 0;
-+    s->prescale = 0;
-+    s->misc = 0;
-+}
-+
-+static void mps2_fpgaio_init(Object *obj)
-+{
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+    MPS2FPGAIO *s = MPS2_FPGAIO(obj);
-+
-+    memory_region_init_io(&s->iomem, obj, &mps2_fpgaio_ops, s,
-+                          "mps2-fpgaio", 0x1000);
-+    sysbus_init_mmio(sbd, &s->iomem);
-+}
-+
-+static const VMStateDescription mps2_fpgaio_vmstate = {
-+    .name = "mps2-fpgaio",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(led0, MPS2FPGAIO),
-+        VMSTATE_UINT32(prescale, MPS2FPGAIO),
-+        VMSTATE_UINT32(misc, MPS2FPGAIO),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static Property mps2_fpgaio_properties[] = {
-+    /* Frequency of the prescale counter */
-+    DEFINE_PROP_UINT32("prescale-clk", MPS2FPGAIO, prescale_clk, 20000000),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void mps2_fpgaio_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->vmsd = &mps2_fpgaio_vmstate;
-+    dc->reset = mps2_fpgaio_reset;
-+    dc->props = mps2_fpgaio_properties;
-+}
-+
-+static const TypeInfo mps2_fpgaio_info = {
-+    .name = TYPE_MPS2_FPGAIO,
-+    .parent = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(MPS2FPGAIO),
-+    .instance_init = mps2_fpgaio_init,
-+    .class_init = mps2_fpgaio_class_init,
-+};
-+
-+static void mps2_fpgaio_register_types(void)
-+{
-+    type_register_static(&mps2_fpgaio_info);
-+}
-+
-+type_init(mps2_fpgaio_register_types);
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
-+++ b/default-configs/arm-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F205_SOC=y
- CONFIG_CMSDK_APB_TIMER=y
- CONFIG_CMSDK_APB_UART=y
-+CONFIG_MPS2_FPGAIO=y
- CONFIG_MPS2_SCC=y
- CONFIG_VERSATILE_PCI=y
-diff --git a/hw/misc/trace-events b/hw/misc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/trace-events
-+++ b/hw/misc/trace-events
-@@ -XXX,XX +XXX,XX @@ mps2_scc_leds(char led7, char led6, char led5, char led4, char led3, char led2,
- mps2_scc_cfg_write(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config write: function %d device %d data 0x%" PRIx32
- mps2_scc_cfg_read(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config read: function %d device %d data 0x%" PRIx32
-+# hw/misc/mps2_fpgaio.c
-+mps2_fpgaio_read(uint64_t offset, uint64_t data, unsigned size) "MPS2 FPGAIO read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-+mps2_fpgaio_write(uint64_t offset, uint64_t data, unsigned size) "MPS2 FPGAIO write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-+mps2_fpgaio_reset(void) "MPS2 FPGAIO: reset"
-+mps2_fpgaio_leds(char led1, char led0) "MPS2 FPGAIO LEDs: %c%c"
-+
- # hw/misc/msf2-sysreg.c
- msf2_sysreg_write(uint64_t offset, uint32_t val, uint32_t prev) "msf2-sysreg write: addr 0x%08" HWADDR_PRIx " data 0x%" PRIx32 " prev 0x%" PRIx32
- msf2_sysreg_read(uint64_t offset, uint32_t val) "msf2-sysreg read: addr 0x%08" HWADDR_PRIx " data 0x%08" PRIx32
---
-.16.2

-[Qemu-devel] [PULL 18/39] hw/misc/tz-ppc: Model TrustZone peripheral protection controller
+Deleted patch
-Add a model of the TrustZone peripheral protection controller (PPC),
-which is used to gate transactions to non-TZ-aware peripherals so
-that secure software can configure them to not be accessible to
-non-secure software.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180220180325.29818-15-peter.maydell@linaro.org
----
- hw/misc/Makefile.objs           |   2 +
- include/hw/misc/tz-ppc.h        | 101 ++++++++++++++
- hw/misc/tz-ppc.c                | 302 ++++++++++++++++++++++++++++++++++++++++
- default-configs/arm-softmmu.mak |   2 +
- hw/misc/trace-events            |  11 ++
-files changed, 418 insertions(+)
- create mode 100644 include/hw/misc/tz-ppc.h
- create mode 100644 hw/misc/tz-ppc.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MIPS_ITU) += mips_itu.o
- obj-$(CONFIG_MPS2_FPGAIO) += mps2-fpgaio.o
- obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
-+obj-$(CONFIG_TZ_PPC) += tz-ppc.o
-+
- obj-$(CONFIG_PVPANIC) += pvpanic.o
- obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
- obj-$(CONFIG_AUX) += auxbus.o
-diff --git a/include/hw/misc/tz-ppc.h b/include/hw/misc/tz-ppc.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/misc/tz-ppc.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * ARM TrustZone peripheral protection controller emulation
-+ *
-+ * Copyright (c) 2018 Linaro Limited
-+ * Written by Peter Maydell
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 or
-+ * (at your option) any later version.
-+ */
-+
-+/* This is a model of the TrustZone peripheral protection controller (PPC).
-+ * It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM
-+ * (DDI 0571G):
-+ * https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g
-+ *
-+ * The PPC sits in front of peripherals and allows secure software to
-+ * configure it to either pass through or reject transactions.
-+ * Rejected transactions may be configured to either be aborted, or to
-+ * behave as RAZ/WI. An interrupt can be signalled for a rejected transaction.
-+ *
-+ * The PPC has no register interface -- it is configured purely by a
-+ * collection of input signals from other hardware in the system. Typically
-+ * they are either hardwired or exposed in an ad-hoc register interface by
-+ * the SoC that uses the PPC.
-+ *
-+ * This QEMU model can be used to model either the AHB5 or APB4 TZ PPC,
-+ * since the only difference between them is that the AHB version has a
-+ * "default" port which has no security checks applied. In QEMU the default
-+ * port can be emulated simply by wiring its downstream devices directly
-+ * into the parent address space, since the PPC does not need to intercept
-+ * transactions there.
-+ *
-+ * In the hardware, selection of which downstream port to use is done by
-+ * the user's decode logic asserting one of the hsel[] signals. In QEMU,
-+ * we provide 16 MMIO regions, one per port, and the user maps these into
-+ * the desired addresses to implement the address decode.
-+ *
-+ * QEMU interface:
-+ * + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end
-+ *   of each of the 16 ports of the PPC
-+ * + Property "port[0..15]": MemoryRegion defining the downstream device(s)
-+ *   for each of the 16 ports of the PPC
-+ * + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be
-+ *   accessible to NonSecure transactions
-+ * + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be
-+ *   accessible to non-privileged transactions
-+ * + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should
-+ *   result in a transaction error, or 0 for the transaction to RAZ/WI
-+ * + Named GPIO input "irq_enable": set to 1 to enable interrupts
-+ * + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt
-+ * + Named GPIO output "irq": set for a transaction-failed interrupt
-+ * + Property "NONSEC_MASK": if a bit is set in this mask then accesses to
-+ *   the associated port do not have the TZ security check performed. (This
-+ *   corresponds to the hardware allowing this to be set as a Verilog
-+ *   parameter.)
-+ */
-+
-+#ifndef TZ_PPC_H
-+#define TZ_PPC_H
-+
-+#include "hw/sysbus.h"
-+
-+#define TYPE_TZ_PPC "tz-ppc"
-+#define TZ_PPC(obj) OBJECT_CHECK(TZPPC, (obj), TYPE_TZ_PPC)
-+
-+#define TZ_NUM_PORTS 16
-+
-+typedef struct TZPPC TZPPC;
-+
-+typedef struct TZPPCPort {
-+    TZPPC *ppc;
-+    MemoryRegion upstream;
-+    AddressSpace downstream_as;
-+    MemoryRegion *downstream;
-+} TZPPCPort;
-+
-+struct TZPPC {
-+    /*< private >*/
-+    SysBusDevice parent_obj;
-+
-+    /*< public >*/
-+
-+    /* State: these just track the values of our input signals */
-+    bool cfg_nonsec[TZ_NUM_PORTS];
-+    bool cfg_ap[TZ_NUM_PORTS];
-+    bool cfg_sec_resp;
-+    bool irq_enable;
-+    bool irq_clear;
-+    /* State: are we asserting irq ? */
-+    bool irq_status;
-+
-+    qemu_irq irq;
-+
-+    /* Properties */
-+    uint32_t nonsec_mask;
-+
-+    TZPPCPort port[TZ_NUM_PORTS];
-+};
-+
-+#endif
-diff --git a/hw/misc/tz-ppc.c b/hw/misc/tz-ppc.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/tz-ppc.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * ARM TrustZone peripheral protection controller emulation
-+ *
-+ * Copyright (c) 2018 Linaro Limited
-+ * Written by Peter Maydell
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 or
-+ * (at your option) any later version.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "qapi/error.h"
-+#include "trace.h"
-+#include "hw/sysbus.h"
-+#include "hw/registerfields.h"
-+#include "hw/misc/tz-ppc.h"
-+
-+static void tz_ppc_update_irq(TZPPC *s)
-+{
-+    bool level = s->irq_status && s->irq_enable;
-+
-+    trace_tz_ppc_update_irq(level);
-+    qemu_set_irq(s->irq, level);
-+}
-+
-+static void tz_ppc_cfg_nonsec(void *opaque, int n, int level)
-+{
-+    TZPPC *s = TZ_PPC(opaque);
-+
-+    assert(n < TZ_NUM_PORTS);
-+    trace_tz_ppc_cfg_nonsec(n, level);
-+    s->cfg_nonsec[n] = level;
-+}
-+
-+static void tz_ppc_cfg_ap(void *opaque, int n, int level)
-+{
-+    TZPPC *s = TZ_PPC(opaque);
-+
-+    assert(n < TZ_NUM_PORTS);
-+    trace_tz_ppc_cfg_ap(n, level);
-+    s->cfg_ap[n] = level;
-+}
-+
-+static void tz_ppc_cfg_sec_resp(void *opaque, int n, int level)
-+{
-+    TZPPC *s = TZ_PPC(opaque);
-+
-+    trace_tz_ppc_cfg_sec_resp(level);
-+    s->cfg_sec_resp = level;
-+}
-+
-+static void tz_ppc_irq_enable(void *opaque, int n, int level)
-+{
-+    TZPPC *s = TZ_PPC(opaque);
-+
-+    trace_tz_ppc_irq_enable(level);
-+    s->irq_enable = level;
-+    tz_ppc_update_irq(s);
-+}
-+
-+static void tz_ppc_irq_clear(void *opaque, int n, int level)
-+{
-+    TZPPC *s = TZ_PPC(opaque);
-+
-+    trace_tz_ppc_irq_clear(level);
-+
-+    s->irq_clear = level;
-+    if (level) {
-+        s->irq_status = false;
-+        tz_ppc_update_irq(s);
-+    }
-+}
-+
-+static bool tz_ppc_check(TZPPC *s, int n, MemTxAttrs attrs)
-+{
-+    /* Check whether to allow an access to port n; return true if
-+     * the check passes, and false if the transaction must be blocked.
-+     * If the latter, the caller must check cfg_sec_resp to determine
-+     * whether to abort or RAZ/WI the transaction.
-+     * The checks are:
-+     *  + nonsec_mask suppresses any check of the secure attribute
-+     *  + otherwise, block if cfg_nonsec is 1 and transaction is secure,
-+     *    or if cfg_nonsec is 0 and transaction is non-secure
-+     *  + block if transaction is usermode and cfg_ap is 0
-+     */
-+    if ((attrs.secure == s->cfg_nonsec[n] && !(s->nonsec_mask & (1 << n))) ||
-+        (attrs.user && !s->cfg_ap[n])) {
-+        /* Block the transaction. */
-+        if (!s->irq_clear) {
-+            /* Note that holding irq_clear high suppresses interrupts */
-+            s->irq_status = true;
-+            tz_ppc_update_irq(s);
-+        }
-+        return false;
-+    }
-+    return true;
-+}
-+
-+static MemTxResult tz_ppc_read(void *opaque, hwaddr addr, uint64_t *pdata,
-+                               unsigned size, MemTxAttrs attrs)
-+{
-+    TZPPCPort *p = opaque;
-+    TZPPC *s = p->ppc;
-+    int n = p - s->port;
-+    AddressSpace *as = &p->downstream_as;
-+    uint64_t data;
-+    MemTxResult res;
-+
-+    if (!tz_ppc_check(s, n, attrs)) {
-+        trace_tz_ppc_read_blocked(n, addr, attrs.secure, attrs.user);
-+        if (s->cfg_sec_resp) {
-+            return MEMTX_ERROR;
-+        } else {
-+            *pdata = 0;
-+            return MEMTX_OK;
-+        }
-+    }
-+
-+    switch (size) {
-+    case 1:
-+        data = address_space_ldub(as, addr, attrs, &res);
-+        break;
-+    case 2:
-+        data = address_space_lduw_le(as, addr, attrs, &res);
-+        break;
-+    case 4:
-+        data = address_space_ldl_le(as, addr, attrs, &res);
-+        break;
-+    case 8:
-+        data = address_space_ldq_le(as, addr, attrs, &res);
-+        break;
-+    default:
-+        g_assert_not_reached();
-+    }
-+    *pdata = data;
-+    return res;
-+}
-+
-+static MemTxResult tz_ppc_write(void *opaque, hwaddr addr, uint64_t val,
-+                                unsigned size, MemTxAttrs attrs)
-+{
-+    TZPPCPort *p = opaque;
-+    TZPPC *s = p->ppc;
-+    AddressSpace *as = &p->downstream_as;
-+    int n = p - s->port;
-+    MemTxResult res;
-+
-+    if (!tz_ppc_check(s, n, attrs)) {
-+        trace_tz_ppc_write_blocked(n, addr, attrs.secure, attrs.user);
-+        if (s->cfg_sec_resp) {
-+            return MEMTX_ERROR;
-+        } else {
-+            return MEMTX_OK;
-+        }
-+    }
-+
-+    switch (size) {
-+    case 1:
-+        address_space_stb(as, addr, val, attrs, &res);
-+        break;
-+    case 2:
-+        address_space_stw_le(as, addr, val, attrs, &res);
-+        break;
-+    case 4:
-+        address_space_stl_le(as, addr, val, attrs, &res);
-+        break;
-+    case 8:
-+        address_space_stq_le(as, addr, val, attrs, &res);
-+        break;
-+    default:
-+        g_assert_not_reached();
-+    }
-+    return res;
-+}
-+
-+static const MemoryRegionOps tz_ppc_ops = {
-+    .read_with_attrs = tz_ppc_read,
-+    .write_with_attrs = tz_ppc_write,
-+    .endianness = DEVICE_LITTLE_ENDIAN,
-+};
-+
-+static void tz_ppc_reset(DeviceState *dev)
-+{
-+    TZPPC *s = TZ_PPC(dev);
-+
-+    trace_tz_ppc_reset();
-+    s->cfg_sec_resp = false;
-+    memset(s->cfg_nonsec, 0, sizeof(s->cfg_nonsec));
-+    memset(s->cfg_ap, 0, sizeof(s->cfg_ap));
-+}
-+
-+static void tz_ppc_init(Object *obj)
-+{
-+    DeviceState *dev = DEVICE(obj);
-+    TZPPC *s = TZ_PPC(obj);
-+
-+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_nonsec, "cfg_nonsec", TZ_NUM_PORTS);
-+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_ap, "cfg_ap", TZ_NUM_PORTS);
-+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_sec_resp, "cfg_sec_resp", 1);
-+    qdev_init_gpio_in_named(dev, tz_ppc_irq_enable, "irq_enable", 1);
-+    qdev_init_gpio_in_named(dev, tz_ppc_irq_clear, "irq_clear", 1);
-+    qdev_init_gpio_out_named(dev, &s->irq, "irq", 1);
-+}
-+
-+static void tz_ppc_realize(DeviceState *dev, Error **errp)
-+{
-+    Object *obj = OBJECT(dev);
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-+    TZPPC *s = TZ_PPC(dev);
-+    int i;
-+
-+    /* We can't create the upstream end of the port until realize,
-+     * as we don't know the size of the MR used as the downstream until then.
-+     */
-+    for (i = 0; i < TZ_NUM_PORTS; i++) {
-+        TZPPCPort *port = &s->port[i];
-+        char *name;
-+        uint64_t size;
-+
-+        if (!port->downstream) {
-+            continue;
-+        }
-+
-+        name = g_strdup_printf("tz-ppc-port[%d]", i);
-+
-+        port->ppc = s;
-+        address_space_init(&port->downstream_as, port->downstream, name);
-+
-+        size = memory_region_size(port->downstream);
-+        memory_region_init_io(&port->upstream, obj, &tz_ppc_ops,
-+                              port, name, size);
-+        sysbus_init_mmio(sbd, &port->upstream);
-+        g_free(name);
-+    }
-+}
-+
-+static const VMStateDescription tz_ppc_vmstate = {
-+    .name = "tz-ppc",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_BOOL_ARRAY(cfg_nonsec, TZPPC, 16),
-+        VMSTATE_BOOL_ARRAY(cfg_ap, TZPPC, 16),
-+        VMSTATE_BOOL(cfg_sec_resp, TZPPC),
-+        VMSTATE_BOOL(irq_enable, TZPPC),
-+        VMSTATE_BOOL(irq_clear, TZPPC),
-+        VMSTATE_BOOL(irq_status, TZPPC),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+#define DEFINE_PORT(N)                                          \
-+    DEFINE_PROP_LINK("port[" #N "]", TZPPC, port[N].downstream, \
-+                     TYPE_MEMORY_REGION, MemoryRegion *)
-+
-+static Property tz_ppc_properties[] = {
-+    DEFINE_PROP_UINT32("NONSEC_MASK", TZPPC, nonsec_mask, 0),
-+    DEFINE_PORT(0),
-+    DEFINE_PORT(1),
-+    DEFINE_PORT(2),
-+    DEFINE_PORT(3),
-+    DEFINE_PORT(4),
-+    DEFINE_PORT(5),
-+    DEFINE_PORT(6),
-+    DEFINE_PORT(7),
-+    DEFINE_PORT(8),
-+    DEFINE_PORT(9),
-+    DEFINE_PORT(10),
-+    DEFINE_PORT(11),
-+    DEFINE_PORT(12),
-+    DEFINE_PORT(13),
-+    DEFINE_PORT(14),
-+    DEFINE_PORT(15),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void tz_ppc_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->realize = tz_ppc_realize;
-+    dc->vmsd = &tz_ppc_vmstate;
-+    dc->reset = tz_ppc_reset;
-+    dc->props = tz_ppc_properties;
-+}
-+
-+static const TypeInfo tz_ppc_info = {
-+    .name = TYPE_TZ_PPC,
-+    .parent = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(TZPPC),
-+    .instance_init = tz_ppc_init,
-+    .class_init = tz_ppc_class_init,
-+};
-+
-+static void tz_ppc_register_types(void)
-+{
-+    type_register_static(&tz_ppc_info);
-+}
-+
-+type_init(tz_ppc_register_types);
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
-+++ b/default-configs/arm-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ CONFIG_CMSDK_APB_UART=y
- CONFIG_MPS2_FPGAIO=y
- CONFIG_MPS2_SCC=y
-+CONFIG_TZ_PPC=y
-+
- CONFIG_VERSATILE_PCI=y
- CONFIG_VERSATILE_I2C=y
-diff --git a/hw/misc/trace-events b/hw/misc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/trace-events
-+++ b/hw/misc/trace-events
-@@ -XXX,XX +XXX,XX @@ mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d co
- mos6522_set_sr_int(void) "set sr_int"
- mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
- mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
-+
-+# hw/misc/tz-ppc.c
-+tz_ppc_reset(void) "TZ PPC: reset"
-+tz_ppc_cfg_nonsec(int n, int level) "TZ PPC: cfg_nonsec[%d] = %d"
-+tz_ppc_cfg_ap(int n, int level) "TZ PPC: cfg_ap[%d] = %d"
-+tz_ppc_cfg_sec_resp(int level) "TZ PPC: cfg_sec_resp = %d"
-+tz_ppc_irq_enable(int level) "TZ PPC: int_enable = %d"
-+tz_ppc_irq_clear(int level) "TZ PPC: int_clear = %d"
-+tz_ppc_update_irq(int level) "TZ PPC: setting irq line to %d"
-+tz_ppc_read_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " read (secure %d user %d) blocked"
-+tz_ppc_write_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " write (secure %d user %d) blocked"
---
-.16.2

Second pull request of the week; mostly RTH's support for some
new-in-v8.1/v8.3 instructions, and my v8M board model.

thanks
-- PMM

The following changes since commit 427cbc7e4136a061628cb4315cc8182ea36d772f:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2018-03-01 18:46:41 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180302

for you to fetch changes up to e66a67bf28e1b4fce2e3d72a2610dbd48d9d3078:

target/arm: Enable ARM_FEATURE_V8_FCMA (2018-03-02 11:03:45 +0000)

----------------------------------------------------------------
target-arm queue:
 * implement FCMA and RDM v8.1 and v8.3 instructions
 * enable Cortex-M33 v8M core, and provide new mps2-an505 board model
   that uses it
 * decodetree: Propagate return value from translate subroutines
 * xlnx-zynqmp: Implement the RTC device

----------------------------------------------------------------
Alistair Francis (3):
      xlnx-zynqmp-rtc: Initial commit
      xlnx-zynqmp-rtc: Add basic time support
      xlnx-zynqmp: Connect the RTC device

Peter Maydell (19):
      loader: Add new load_ramdisk_as()
      hw/arm/boot: Honour CPU's address space for image loads
      hw/arm/armv7m: Honour CPU's address space for image loads
      target/arm: Define an IDAU interface
      armv7m: Forward idau property to CPU object
      target/arm: Define init-svtor property for the reset secure VTOR value
      armv7m: Forward init-svtor property to CPU object
      target/arm: Add Cortex-M33
      hw/misc/unimp: Move struct to header file
      include/hw/or-irq.h: Add missing include guard
      qdev: Add new qdev_init_gpio_in_named_with_opaque()
      hw/core/split-irq: Device that splits IRQ lines
      hw/misc/mps2-fpgaio: FPGA control block for MPS2 AN505
      hw/misc/tz-ppc: Model TrustZone peripheral protection controller
      hw/misc/iotkit-secctl: Arm IoT Kit security controller initial skeleton
      hw/misc/iotkit-secctl: Add handling for PPCs
      hw/misc/iotkit-secctl: Add remaining simple registers
      hw/arm/iotkit: Model Arm IOT Kit
      mps2-an505: New board model: MPS2 with AN505 Cortex-M33 FPGA image

Richard Henderson (17):
      decodetree: Propagate return value from translate subroutines
      target/arm: Add ARM_FEATURE_V8_RDM
      target/arm: Refactor disas_simd_indexed decode
      target/arm: Refactor disas_simd_indexed size checks
      target/arm: Decode aa64 armv8.1 scalar three same extra
      target/arm: Decode aa64 armv8.1 three same extra
      target/arm: Decode aa64 armv8.1 scalar/vector x indexed element
      target/arm: Decode aa32 armv8.1 three same
      target/arm: Decode aa32 armv8.1 two reg and a scalar
      target/arm: Enable ARM_FEATURE_V8_RDM
      target/arm: Add ARM_FEATURE_V8_FCMA
      target/arm: Decode aa64 armv8.3 fcadd
      target/arm: Decode aa64 armv8.3 fcmla
      target/arm: Decode aa32 armv8.3 3-same
      target/arm: Decode aa32 armv8.3 2-reg-index
      target/arm: Decode t32 simd 3reg and 2reg_scalar extension
      target/arm: Enable ARM_FEATURE_V8_FCMA

hw/arm/Makefile.objs               |   2 +
 hw/core/Makefile.objs              |   1 +
 hw/misc/Makefile.objs              |   4 +
 hw/timer/Makefile.objs             |   1 +
 target/arm/Makefile.objs           |   2 +-
 include/hw/arm/armv7m.h            |   5 +
 include/hw/arm/iotkit.h            | 109 ++++++
 include/hw/arm/xlnx-zynqmp.h       |   2 +
 include/hw/core/split-irq.h        |  57 +++
 include/hw/irq.h                   |   4 +-
 include/hw/loader.h                |  12 +-
 include/hw/misc/iotkit-secctl.h    | 103 ++++++
 include/hw/misc/mps2-fpgaio.h      |  43 +++
 include/hw/misc/tz-ppc.h           | 101 ++++++
 include/hw/misc/unimp.h            |  10 +
 include/hw/or-irq.h                |   5 +
 include/hw/qdev-core.h             |  30 +-
 include/hw/timer/xlnx-zynqmp-rtc.h |  86 +++++
 target/arm/cpu.h                   |   8 +
 target/arm/helper.h                |  31 ++
 target/arm/idau.h                  |  61 ++++
 hw/arm/armv7m.c                    |  35 +-
 hw/arm/boot.c                      | 119 ++++---
 hw/arm/iotkit.c                    | 598 +++++++++++++++++++++++++++++++
 hw/arm/mps2-tz.c                   | 503 ++++++++++++++++++++++++++
 hw/arm/xlnx-zynqmp.c               |  14 +
 hw/core/loader.c                   |   8 +-
 hw/core/qdev.c                     |   8 +-
 hw/core/split-irq.c                |  89 +++++
 hw/misc/iotkit-secctl.c            | 704 +++++++++++++++++++++++++++++++++++++
 hw/misc/mps2-fpgaio.c              | 176 ++++++++++
 hw/misc/tz-ppc.c                   | 302 ++++++++++++++++
 hw/misc/unimp.c                    |  10 -
 hw/timer/xlnx-zynqmp-rtc.c         | 272 ++++++++++++++
 linux-user/elfload.c               |   2 +
 target/arm/cpu.c                   |  66 +++-
 target/arm/cpu64.c                 |   2 +
 target/arm/helper.c                |  28 +-
 target/arm/translate-a64.c         | 514 +++++++++++++++++++++------
 target/arm/translate.c             | 275 +++++++++++++--
 target/arm/vec_helper.c            | 429 ++++++++++++++++++++++
 default-configs/arm-softmmu.mak    |   5 +
 hw/misc/trace-events               |  24 ++
 hw/timer/trace-events              |   3 +
 scripts/decodetree.py              |   5 +-
 45 files changed, 4668 insertions(+), 200 deletions(-)
 create mode 100644 include/hw/arm/iotkit.h
 create mode 100644 include/hw/core/split-irq.h
 create mode 100644 include/hw/misc/iotkit-secctl.h
 create mode 100644 include/hw/misc/mps2-fpgaio.h
 create mode 100644 include/hw/misc/tz-ppc.h
 create mode 100644 include/hw/timer/xlnx-zynqmp-rtc.h
 create mode 100644 target/arm/idau.h
 create mode 100644 hw/arm/iotkit.c
 create mode 100644 hw/arm/mps2-tz.c
 create mode 100644 hw/core/split-irq.c
 create mode 100644 hw/misc/iotkit-secctl.c
 create mode 100644 hw/misc/mps2-fpgaio.c
 create mode 100644 hw/misc/tz-ppc.c
 create mode 100644 hw/timer/xlnx-zynqmp-rtc.c
 create mode 100644 target/arm/vec_helper.c

From: Alistair Francis <alistair.francis@xilinx.com>

Initial commit of the ZynqMP RTC device.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/Makefile.objs             |   1 +
 include/hw/timer/xlnx-zynqmp-rtc.h |  84 +++++++++++++++
 hw/timer/xlnx-zynqmp-rtc.c         | 214 +++++++++++++++++++++++++++++++++++++
 3 files changed, 299 insertions(+)
 create mode 100644 include/hw/timer/xlnx-zynqmp-rtc.h
 create mode 100644 hw/timer/xlnx-zynqmp-rtc.c

diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx_epit.o
 common-obj-$(CONFIG_IMX) += imx_gpt.o
 common-obj-$(CONFIG_LM32) += lm32_timer.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-sysctl.o
+common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp-rtc.o
 
 obj-$(CONFIG_ALTERA_TIMER) += altera_timer.o
 obj-$(CONFIG_EXYNOS4) += exynos4210_mct.o
diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/timer/xlnx-zynqmp-rtc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx ZynqMP Real Time Clock (RTC).
+ *
+ * Copyright (c) 2017 Xilinx Inc.
+ *
+ * Written-by: Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw/register.h"
+
+#define TYPE_XLNX_ZYNQMP_RTC "xlnx-zynmp.rtc"
+
+#define XLNX_ZYNQMP_RTC(obj) \
+     OBJECT_CHECK(XlnxZynqMPRTC, (obj), TYPE_XLNX_ZYNQMP_RTC)
+
+REG32(SET_TIME_WRITE, 0x0)
+REG32(SET_TIME_READ, 0x4)
+REG32(CALIB_WRITE, 0x8)
+    FIELD(CALIB_WRITE, FRACTION_EN, 20, 1)
+    FIELD(CALIB_WRITE, FRACTION_DATA, 16, 4)
+    FIELD(CALIB_WRITE, MAX_TICK, 0, 16)
+REG32(CALIB_READ, 0xc)
+    FIELD(CALIB_READ, FRACTION_EN, 20, 1)
+    FIELD(CALIB_READ, FRACTION_DATA, 16, 4)
+    FIELD(CALIB_READ, MAX_TICK, 0, 16)
+REG32(CURRENT_TIME, 0x10)
+REG32(CURRENT_TICK, 0x14)
+    FIELD(CURRENT_TICK, VALUE, 0, 16)
+REG32(ALARM, 0x18)
+REG32(RTC_INT_STATUS, 0x20)
+    FIELD(RTC_INT_STATUS, ALARM, 1, 1)
+    FIELD(RTC_INT_STATUS, SECONDS, 0, 1)
+REG32(RTC_INT_MASK, 0x24)
+    FIELD(RTC_INT_MASK, ALARM, 1, 1)
+    FIELD(RTC_INT_MASK, SECONDS, 0, 1)
+REG32(RTC_INT_EN, 0x28)
+    FIELD(RTC_INT_EN, ALARM, 1, 1)
+    FIELD(RTC_INT_EN, SECONDS, 0, 1)
+REG32(RTC_INT_DIS, 0x2c)
+    FIELD(RTC_INT_DIS, ALARM, 1, 1)
+    FIELD(RTC_INT_DIS, SECONDS, 0, 1)
+REG32(ADDR_ERROR, 0x30)
+    FIELD(ADDR_ERROR, STATUS, 0, 1)
+REG32(ADDR_ERROR_INT_MASK, 0x34)
+    FIELD(ADDR_ERROR_INT_MASK, MASK, 0, 1)
+REG32(ADDR_ERROR_INT_EN, 0x38)
+    FIELD(ADDR_ERROR_INT_EN, MASK, 0, 1)
+REG32(ADDR_ERROR_INT_DIS, 0x3c)
+    FIELD(ADDR_ERROR_INT_DIS, MASK, 0, 1)
+REG32(CONTROL, 0x40)
+    FIELD(CONTROL, BATTERY_DISABLE, 31, 1)
+    FIELD(CONTROL, OSC_CNTRL, 24, 4)
+    FIELD(CONTROL, SLVERR_ENABLE, 0, 1)
+REG32(SAFETY_CHK, 0x50)
+
+#define XLNX_ZYNQMP_RTC_R_MAX (R_SAFETY_CHK + 1)
+
+typedef struct XlnxZynqMPRTC {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    qemu_irq irq_rtc_int;
+    qemu_irq irq_addr_error_int;
+
+    uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];
+    RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];
+} XlnxZynqMPRTC;
diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/timer/xlnx-zynqmp-rtc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/timer/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx ZynqMP Real Time Clock (RTC).
+ *
+ * Copyright (c) 2017 Xilinx Inc.
+ *
+ * Written-by: Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "hw/timer/xlnx-zynqmp-rtc.h"
+
+#ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG
+#define XLNX_ZYNQMP_RTC_ERR_DEBUG 0
+#endif
+
+static void rtc_int_update_irq(XlnxZynqMPRTC *s)
+{
+    bool pending = s->regs[R_RTC_INT_STATUS] & ~s->regs[R_RTC_INT_MASK];
+    qemu_set_irq(s->irq_rtc_int, pending);
+}
+
+static void addr_error_int_update_irq(XlnxZynqMPRTC *s)
+{
+    bool pending = s->regs[R_ADDR_ERROR] & ~s->regs[R_ADDR_ERROR_INT_MASK];
+    qemu_set_irq(s->irq_addr_error_int, pending);
+}
+
+static void rtc_int_status_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+    rtc_int_update_irq(s);
+}
+
+static uint64_t rtc_int_en_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+
+    s->regs[R_RTC_INT_MASK] &= (uint32_t) ~val64;
+    rtc_int_update_irq(s);
+    return 0;
+}
+
+static uint64_t rtc_int_dis_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+
+    s->regs[R_RTC_INT_MASK] |= (uint32_t) val64;
+    rtc_int_update_irq(s);
+    return 0;
+}
+
+static void addr_error_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+    addr_error_int_update_irq(s);
+}
+
+static uint64_t addr_error_int_en_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+
+    s->regs[R_ADDR_ERROR_INT_MASK] &= (uint32_t) ~val64;
+    addr_error_int_update_irq(s);
+    return 0;
+}
+
+static uint64_t addr_error_int_dis_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+
+    s->regs[R_ADDR_ERROR_INT_MASK] |= (uint32_t) val64;
+    addr_error_int_update_irq(s);
+    return 0;
+}
+
+static const RegisterAccessInfo rtc_regs_info[] = {
+    {   .name = "SET_TIME_WRITE",  .addr = A_SET_TIME_WRITE,
+    },{ .name = "SET_TIME_READ",  .addr = A_SET_TIME_READ,
+        .ro = 0xffffffff,
+    },{ .name = "CALIB_WRITE",  .addr = A_CALIB_WRITE,
+    },{ .name = "CALIB_READ",  .addr = A_CALIB_READ,
+        .ro = 0x1fffff,
+    },{ .name = "CURRENT_TIME",  .addr = A_CURRENT_TIME,
+        .ro = 0xffffffff,
+    },{ .name = "CURRENT_TICK",  .addr = A_CURRENT_TICK,
+        .ro = 0xffff,
+    },{ .name = "ALARM",  .addr = A_ALARM,
+    },{ .name = "RTC_INT_STATUS",  .addr = A_RTC_INT_STATUS,
+        .w1c = 0x3,
+        .post_write = rtc_int_status_postw,
+    },{ .name = "RTC_INT_MASK",  .addr = A_RTC_INT_MASK,
+        .reset = 0x3,
+        .ro = 0x3,
+    },{ .name = "RTC_INT_EN",  .addr = A_RTC_INT_EN,
+        .pre_write = rtc_int_en_prew,
+    },{ .name = "RTC_INT_DIS",  .addr = A_RTC_INT_DIS,
+        .pre_write = rtc_int_dis_prew,
+    },{ .name = "ADDR_ERROR",  .addr = A_ADDR_ERROR,
+        .w1c = 0x1,
+        .post_write = addr_error_postw,
+    },{ .name = "ADDR_ERROR_INT_MASK",  .addr = A_ADDR_ERROR_INT_MASK,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "ADDR_ERROR_INT_EN",  .addr = A_ADDR_ERROR_INT_EN,
+        .pre_write = addr_error_int_en_prew,
+    },{ .name = "ADDR_ERROR_INT_DIS",  .addr = A_ADDR_ERROR_INT_DIS,
+        .pre_write = addr_error_int_dis_prew,
+    },{ .name = "CONTROL",  .addr = A_CONTROL,
+        .reset = 0x1000000,
+        .rsvd = 0x70fffffe,
+    },{ .name = "SAFETY_CHK",  .addr = A_SAFETY_CHK,
+    }
+};
+
+static void rtc_reset(DeviceState *dev)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(dev);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    rtc_int_update_irq(s);
+    addr_error_int_update_irq(s);
+}
+
+static const MemoryRegionOps rtc_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void rtc_init(Object *obj)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
+
+    memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_RTC,
+                       XLNX_ZYNQMP_RTC_R_MAX * 4);
+    reg_array =
+        register_init_block32(DEVICE(obj), rtc_regs_info,
+                              ARRAY_SIZE(rtc_regs_info),
+                              s->regs_info, s->regs,
+                              &rtc_ops,
+                              XLNX_ZYNQMP_RTC_ERR_DEBUG,
+                              XLNX_ZYNQMP_RTC_R_MAX * 4);
+    memory_region_add_subregion(&s->iomem,
+                                0x0,
+                                &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq_rtc_int);
+    sysbus_init_irq(sbd, &s->irq_addr_error_int);
+}
+
+static const VMStateDescription vmstate_rtc = {
+    .name = TYPE_XLNX_ZYNQMP_RTC,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPRTC, XLNX_ZYNQMP_RTC_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void rtc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = rtc_reset;
+    dc->vmsd = &vmstate_rtc;
+}
+
+static const TypeInfo rtc_info = {
+    .name          = TYPE_XLNX_ZYNQMP_RTC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxZynqMPRTC),
+    .class_init    = rtc_class_init,
+    .instance_init = rtc_init,
+};
+
+static void rtc_register_types(void)
+{
+    type_register_static(&rtc_info);
+}
+
+type_init(rtc_register_types)
-- 
2.16.2

From: Alistair Francis <alistair.francis@xilinx.com>

Allow the guest to determine the time set from the QEMU command line.

This includes adding a trace event to debug the new time.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/xlnx-zynqmp-rtc.h |  2 ++
 hw/timer/xlnx-zynqmp-rtc.c         | 58 ++++++++++++++++++++++++++++++++++++++
 hw/timer/trace-events              |  3 ++
 3 files changed, 63 insertions(+)

diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/xlnx-zynqmp-rtc.h
+++ b/include/hw/timer/xlnx-zynqmp-rtc.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPRTC {
     qemu_irq irq_rtc_int;
     qemu_irq irq_addr_error_int;
 
+    uint32_t tick_offset;
+
     uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];
     RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];
 } XlnxZynqMPRTC;
diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/timer/xlnx-zynqmp-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/xlnx-zynqmp-rtc.c
+++ b/hw/timer/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/register.h"
 #include "qemu/bitops.h"
 #include "qemu/log.h"
+#include "hw/ptimer.h"
+#include "qemu/cutils.h"
+#include "sysemu/sysemu.h"
+#include "trace.h"
 #include "hw/timer/xlnx-zynqmp-rtc.h"
 
 #ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG
@@ -XXX,XX +XXX,XX @@ static void addr_error_int_update_irq(XlnxZynqMPRTC *s)
     qemu_set_irq(s->irq_addr_error_int, pending);
 }
 
+static uint32_t rtc_get_count(XlnxZynqMPRTC *s)
+{
+    int64_t now = qemu_clock_get_ns(rtc_clock);
+    return s->tick_offset + now / NANOSECONDS_PER_SECOND;
+}
+
+static uint64_t current_time_postr(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
+
+    return rtc_get_count(s);
+}
+
 static void rtc_int_status_postw(RegisterInfo *reg, uint64_t val64)
 {
     XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);
@@ -XXX,XX +XXX,XX @@ static uint64_t addr_error_int_dis_prew(RegisterInfo *reg, uint64_t val64)
 
 static const RegisterAccessInfo rtc_regs_info[] = {
     {   .name = "SET_TIME_WRITE",  .addr = A_SET_TIME_WRITE,
+        .unimp = MAKE_64BIT_MASK(0, 32),
     },{ .name = "SET_TIME_READ",  .addr = A_SET_TIME_READ,
         .ro = 0xffffffff,
+        .post_read = current_time_postr,
     },{ .name = "CALIB_WRITE",  .addr = A_CALIB_WRITE,
+        .unimp = MAKE_64BIT_MASK(0, 32),
     },{ .name = "CALIB_READ",  .addr = A_CALIB_READ,
         .ro = 0x1fffff,
     },{ .name = "CURRENT_TIME",  .addr = A_CURRENT_TIME,
         .ro = 0xffffffff,
+        .post_read = current_time_postr,
     },{ .name = "CURRENT_TICK",  .addr = A_CURRENT_TICK,
         .ro = 0xffff,
     },{ .name = "ALARM",  .addr = A_ALARM,
@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)
     XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     RegisterInfoArray *reg_array;
+    struct tm current_tm;
 
     memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_RTC,
                        XLNX_ZYNQMP_RTC_R_MAX * 4);
@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq_rtc_int);
     sysbus_init_irq(sbd, &s->irq_addr_error_int);
+
+    qemu_get_timedate(&current_tm, 0);
+    s->tick_offset = mktimegm(&current_tm) -
+        qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+
+    trace_xlnx_zynqmp_rtc_gettime(current_tm.tm_year, current_tm.tm_mon,
+                                  current_tm.tm_mday, current_tm.tm_hour,
+                                  current_tm.tm_min, current_tm.tm_sec);
+}
+
+static int rtc_pre_save(void *opaque)
+{
+    XlnxZynqMPRTC *s = opaque;
+    int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+
+    /* Add the time at migration */
+    s->tick_offset = s->tick_offset + now;
+
+    return 0;
+}
+
+static int rtc_post_load(void *opaque, int version_id)
+{
+    XlnxZynqMPRTC *s = opaque;
+    int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+
+    /* Subtract the time after migration. This combined with the pre_save
+     * action results in us having subtracted the time that the guest was
+     * stopped to the offset.
+     */
+    s->tick_offset = s->tick_offset - now;
+
+    return 0;
 }
 
 static const VMStateDescription vmstate_rtc = {
     .name = TYPE_XLNX_ZYNQMP_RTC,
     .version_id = 1,
     .minimum_version_id = 1,
+    .pre_save = rtc_pre_save,
+    .post_load = rtc_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPRTC, XLNX_ZYNQMP_RTC_R_MAX),
+        VMSTATE_UINT32(tick_offset, XlnxZynqMPRTC),
         VMSTATE_END_OF_LIST(),
     }
 };
diff --git a/hw/timer/trace-events b/hw/timer/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/trace-events
+++ b/hw/timer/trace-events
@@ -XXX,XX +XXX,XX @@ systick_write(uint64_t addr, uint32_t value, unsigned size) "systick write addr
 cmsdk_apb_timer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 cmsdk_apb_timer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 cmsdk_apb_timer_reset(void) "CMSDK APB timer: reset"
+
+# hw/timer/xlnx-zynqmp-rtc.c
+xlnx_zynqmp_rtc_gettime(int year, int month, int day, int hour, int min, int sec) "Get time from host: %d-%d-%d %2d:%02d:%02d"
-- 
2.16.2

From: Alistair Francis <alistair.francis@xilinx.com>

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zynqmp.c         | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/dma/xlnx_dpdma.h"
 #include "hw/display/xlnx_dp.h"
 #include "hw/intc/xlnx-zynqmp-ipi.h"
+#include "hw/timer/xlnx-zynqmp-rtc.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx,zynqmp"
 #define XLNX_ZYNQMP(obj) OBJECT_CHECK(XlnxZynqMPState, (obj), \
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
     XlnxDPState dp;
     XlnxDPDMAState dpdma;
     XlnxZynqMPIPI ipi;
+    XlnxZynqMPRTC rtc;
 
     char *boot_cpu;
     ARMCPU *boot_cpu_ptr;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define IPI_ADDR            0xFF300000
 #define IPI_IRQ             64
 
+#define RTC_ADDR            0xffa60000
+#define RTC_IRQ             26
+
 #define SDHCI_CAPABILITIES  0x280737ec6481 /* Datasheet: UG1085 (v1.7) */
 
 static const uint64_t gem_addr[XLNX_ZYNQMP_NUM_GEMS] = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
 
     object_initialize(&s->ipi, sizeof(s->ipi), TYPE_XLNX_ZYNQMP_IPI);
     qdev_set_parent_bus(DEVICE(&s->ipi), sysbus_get_default());
+
+    object_initialize(&s->rtc, sizeof(s->rtc), TYPE_XLNX_ZYNQMP_RTC);
+    qdev_set_parent_bus(DEVICE(&s->rtc), sysbus_get_default());
 }
 
 static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ipi), 0, IPI_ADDR);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ipi), 0, gic_spi[IPI_IRQ]);
+
+    object_property_set_bool(OBJECT(&s->rtc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, RTC_ADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0, gic_spi[RTC_IRQ]);
 }
 
 static Property xlnx_zynqmp_props[] = {
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Allow the translate subroutines to return false for invalid insns.

At present we can of course invoke an invalid insn exception from within
the translate subroutine, but in the short term this consolidates code.
In the long term it would allow the decodetree language to support
overlapping patterns for ISA extensions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180227232618.2908-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 scripts/decodetree.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/scripts/decodetree.py b/scripts/decodetree.py
index XXXXXXX..XXXXXXX 100755
--- a/scripts/decodetree.py
+++ b/scripts/decodetree.py
@@ -XXX,XX +XXX,XX @@ class Pattern(General):
         global translate_prefix
         output('typedef ', self.base.base.struct_name(),
                ' arg_', self.name, ';\n')
-        output(translate_scope, 'void ', translate_prefix, '_', self.name,
+        output(translate_scope, 'bool ', translate_prefix, '_', self.name,
                '(DisasContext *ctx, arg_', self.name,
                ' *a, ', insntype, ' insn);\n')
 
@@ -XXX,XX +XXX,XX @@ class Pattern(General):
             output(ind, self.base.extract_name(), '(&u.f_', arg, ', insn);\n')
         for n, f in self.fields.items():
             output(ind, 'u.f_', arg, '.', n, ' = ', f.str_extract(), ';\n')
-        output(ind, translate_prefix, '_', self.name,
+        output(ind, 'return ', translate_prefix, '_', self.name,
                '(ctx, &u.f_', arg, ', insn);\n')
-        output(ind, 'return true;\n')
 # end Pattern
 
 
-- 
2.16.2

Add a function load_ramdisk_as() which behaves like the existing
load_ramdisk() but allows the caller to specify the AddressSpace
to use. This matches the pattern we have already for various
other loader functions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-2-peter.maydell@linaro.org
---
 include/hw/loader.h | 12 +++++++++++-
 hw/core/loader.c    |  8 +++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/include/hw/loader.h b/include/hw/loader.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -XXX,XX +XXX,XX @@ int load_uimage(const char *filename, hwaddr *ep,
                 void *translate_opaque);
 
 /**
- * load_ramdisk:
+ * load_ramdisk_as:
  * @filename: Path to the ramdisk image
  * @addr: Memory address to load the ramdisk to
  * @max_sz: Maximum allowed ramdisk size (for non-u-boot ramdisks)
+ * @as: The AddressSpace to load the ELF to. The value of address_space_memory
+ *      is used if nothing is supplied here.
  *
  * Load a ramdisk image with U-Boot header to the specified memory
  * address.
  *
  * Returns the size of the loaded image on success, -1 otherwise.
  */
+int load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
+                    AddressSpace *as);
+
+/**
+ * load_ramdisk:
+ * Same as load_ramdisk_as(), but doesn't allow the caller to specify
+ * an AddressSpace.
+ */
 int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz);
 
 ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src, size_t srclen);
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ int load_uimage_as(const char *filename, hwaddr *ep, hwaddr *loadaddr,
 
 /* Load a ramdisk.  */
 int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
+{
+    return load_ramdisk_as(filename, addr, max_sz, NULL);
+}
+
+int load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
+                    AddressSpace *as)
 {
     return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK,
-                            NULL, NULL, NULL);
+                            NULL, NULL, as);
 }
 
 /* Load a gzip-compressed kernel to a dynamically allocated buffer. */
-- 
2.16.2

Instead of loading kernels, device trees, and the like to
the system address space, use the CPU's address space. This
is important if we're trying to load the file to memory or
via an alias memory region that is provided by an SoC
object and thus not mapped into the system address space.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 119 +++++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 76 insertions(+), 43 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #define ARM64_TEXT_OFFSET_OFFSET    8
 #define ARM64_MAGIC_OFFSET          56
 
+static AddressSpace *arm_boot_address_space(ARMCPU *cpu,
+                                            const struct arm_boot_info *info)
+{
+    /* Return the address space to use for bootloader reads and writes.
+     * We prefer the secure address space if the CPU has it and we're
+     * going to boot the guest into it.
+     */
+    int asidx;
+    CPUState *cs = CPU(cpu);
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_EL3) && info->secure_boot) {
+        asidx = ARMASIdx_S;
+    } else {
+        asidx = ARMASIdx_NS;
+    }
+
+    return cpu_get_address_space(cs, asidx);
+}
+
 typedef enum {
     FIXUP_NONE = 0,     /* do nothing */
     FIXUP_TERMINATOR,   /* end of insns */
@@ -XXX,XX +XXX,XX @@ static const ARMInsnFixup smpboot[] = {
 };
 
 static void write_bootloader(const char *name, hwaddr addr,
-                             const ARMInsnFixup *insns, uint32_t *fixupcontext)
+                             const ARMInsnFixup *insns, uint32_t *fixupcontext,
+                             AddressSpace *as)
 {
     /* Fix up the specified bootloader fragment and write it into
      * guest memory using rom_add_blob_fixed(). fixupcontext is
@@ -XXX,XX +XXX,XX @@ static void write_bootloader(const char *name, hwaddr addr,
         code[i] = tswap32(insn);
     }
 
-    rom_add_blob_fixed(name, code, len * sizeof(uint32_t), addr);
+    rom_add_blob_fixed_as(name, code, len * sizeof(uint32_t), addr, as);
 
     g_free(code);
 }
@@ -XXX,XX +XXX,XX @@ static void default_write_secondary(ARMCPU *cpu,
                                     const struct arm_boot_info *info)
 {
     uint32_t fixupcontext[FIXUP_MAX];
+    AddressSpace *as = arm_boot_address_space(cpu, info);
 
     fixupcontext[FIXUP_GIC_CPU_IF] = info->gic_cpu_if_addr;
     fixupcontext[FIXUP_BOOTREG] = info->smp_bootreg_addr;
@@ -XXX,XX +XXX,XX @@ static void default_write_secondary(ARMCPU *cpu,
     }
 
     write_bootloader("smpboot", info->smp_loader_start,
-                     smpboot, fixupcontext);
+                     smpboot, fixupcontext, as);
 }
 
 void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr)
 {
+    AddressSpace *as = arm_boot_address_space(cpu, info);
     int n;
     uint32_t mvbar_blob[] = {
         /* mvbar_addr: secure monitor vectors
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
     for (n = 0; n < ARRAY_SIZE(mvbar_blob); n++) {
         mvbar_blob[n] = tswap32(mvbar_blob[n]);
     }
-    rom_add_blob_fixed("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
-                       mvbar_addr);
+    rom_add_blob_fixed_as("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
+                          mvbar_addr, as);
 
     for (n = 0; n < ARRAY_SIZE(board_setup_blob); n++) {
         board_setup_blob[n] = tswap32(board_setup_blob[n]);
     }
-    rom_add_blob_fixed("board-setup", board_setup_blob,
-                       sizeof(board_setup_blob), info->board_setup_addr);
+    rom_add_blob_fixed_as("board-setup", board_setup_blob,
+                          sizeof(board_setup_blob), info->board_setup_addr, as);
 }
 
 static void default_reset_secondary(ARMCPU *cpu,
                                     const struct arm_boot_info *info)
 {
+    AddressSpace *as = arm_boot_address_space(cpu, info);
     CPUState *cs = CPU(cpu);
 
-    address_space_stl_notdirty(&address_space_memory, info->smp_bootreg_addr,
+    address_space_stl_notdirty(as, info->smp_bootreg_addr,
                                0, MEMTXATTRS_UNSPECIFIED, NULL);
     cpu_set_pc(cs, info->smp_loader_start);
 }
@@ -XXX,XX +XXX,XX @@ static inline bool have_dtb(const struct arm_boot_info *info)
 }
 
 #define WRITE_WORD(p, value) do { \
-    address_space_stl_notdirty(&address_space_memory, p, value, \
+    address_space_stl_notdirty(as, p, value, \
                                MEMTXATTRS_UNSPECIFIED, NULL);  \
     p += 4;                       \
 } while (0)
 
-static void set_kernel_args(const struct arm_boot_info *info)
+static void set_kernel_args(const struct arm_boot_info *info, AddressSpace *as)
 {
     int initrd_size = info->initrd_size;
     hwaddr base = info->loader_start;
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
         int cmdline_size;
 
         cmdline_size = strlen(info->kernel_cmdline);
-        cpu_physical_memory_write(p + 8, info->kernel_cmdline,
-                                  cmdline_size + 1);
+        address_space_write(as, p + 8, MEMTXATTRS_UNSPECIFIED,
+                            (const uint8_t *)info->kernel_cmdline,
+                            cmdline_size + 1);
         cmdline_size = (cmdline_size >> 2) + 1;
         WRITE_WORD(p, cmdline_size + 2);
         WRITE_WORD(p, 0x54410009);
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
         atag_board_len = (info->atag_board(info, atag_board_buf) + 3) & ~3;
         WRITE_WORD(p, (atag_board_len + 8) >> 2);
         WRITE_WORD(p, 0x414f4d50);
-        cpu_physical_memory_write(p, atag_board_buf, atag_board_len);
+        address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
+                            atag_board_buf, atag_board_len);
         p += atag_board_len;
     }
     /* ATAG_END */
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args(const struct arm_boot_info *info)
     WRITE_WORD(p, 0);
 }
 
-static void set_kernel_args_old(const struct arm_boot_info *info)
+static void set_kernel_args_old(const struct arm_boot_info *info,
+                                AddressSpace *as)
 {
     hwaddr p;
     const char *s;
@@ -XXX,XX +XXX,XX @@ static void set_kernel_args_old(const struct arm_boot_info *info)
     }
     s = info->kernel_cmdline;
     if (s) {
-        cpu_physical_memory_write(p, s, strlen(s) + 1);
+        address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
+                            (const uint8_t *)s, strlen(s) + 1);
     } else {
         WRITE_WORD(p, 0);
     }
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
  * @addr:       the address to load the image at
  * @binfo:      struct describing the boot environment
  * @addr_limit: upper limit of the available memory area at @addr
+ * @as:         address space to load image to
  *
  * Load a device tree supplied by the machine or by the user  with the
  * '-dtb' command line option, and put it at offset @addr in target
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
  * Note: Must not be called unless have_dtb(binfo) is true.
  */
 static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
-                    hwaddr addr_limit)
+                    hwaddr addr_limit, AddressSpace *as)
 {
     void *fdt = NULL;
     int size, rc;
@@ -XXX,XX +XXX,XX @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
     /* Put the DTB into the memory map as a ROM image: this will ensure
      * the DTB is copied again upon reset, even if addr points into RAM.
      */
-    rom_add_blob_fixed("dtb", fdt, size, addr);
+    rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
 
     g_free(fdt);
 
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
             }
 
             if (cs == first_cpu) {
+                AddressSpace *as = arm_boot_address_space(cpu, info);
+
                 cpu_set_pc(cs, info->loader_start);
 
                 if (!have_dtb(info)) {
                     if (old_param) {
-                        set_kernel_args_old(info);
+                        set_kernel_args_old(info, as);
                     } else {
-                        set_kernel_args(info);
+                        set_kernel_args(info, as);
                     }
                 }
             } else {
@@ -XXX,XX +XXX,XX @@ static int do_arm_linux_init(Object *obj, void *opaque)
 
 static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
                              uint64_t *lowaddr, uint64_t *highaddr,
-                             int elf_machine)
+                             int elf_machine, AddressSpace *as)
 {
     bool elf_is64;
     union {
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
         }
     }
 
-    ret = load_elf(info->kernel_filename, NULL, NULL,
-                   pentry, lowaddr, highaddr, big_endian, elf_machine,
-                   1, data_swab);
+    ret = load_elf_as(info->kernel_filename, NULL, NULL,
+                      pentry, lowaddr, highaddr, big_endian, elf_machine,
+                      1, data_swab, as);
     if (ret <= 0) {
         /* The header loaded but the image didn't */
         exit(1);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
 }
 
 static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
-                                   hwaddr *entry)
+                                   hwaddr *entry, AddressSpace *as)
 {
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
     uint8_t *buffer;
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
     }
 
     *entry = mem_base + kernel_load_offset;
-    rom_add_blob_fixed(filename, buffer, size, *entry);
+    rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
 
     g_free(buffer);
 
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     ARMCPU *cpu = n->cpu;
     struct arm_boot_info *info =
         container_of(n, struct arm_boot_info, load_kernel_notifier);
+    AddressSpace *as = arm_boot_address_space(cpu, info);
 
     /* The board code is not supposed to set secure_board_setup unless
      * running its code in secure mode is actually possible, and KVM
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
              * the kernel is supposed to be loaded by the bootloader), copy the
              * DTB to the base of RAM for the bootloader to pick up.
              */
-            if (load_dtb(info->loader_start, info, 0) < 0) {
+            if (load_dtb(info->loader_start, info, 0, as) < 0) {
                 exit(1);
             }
         }
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
 
     /* Assume that raw images are linux kernels, and ELF images are not.  */
     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
-                               &elf_high_addr, elf_machine);
+                               &elf_high_addr, elf_machine, as);
     if (kernel_size > 0 && have_dtb(info)) {
         /* If there is still some room left at the base of RAM, try and put
          * the DTB there like we do for images loaded with -bios or -pflash.
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
             if (elf_low_addr < info->loader_start) {
                 elf_low_addr = 0;
             }
-            if (load_dtb(info->loader_start, info, elf_low_addr) < 0) {
+            if (load_dtb(info->loader_start, info, elf_low_addr, as) < 0) {
                 exit(1);
             }
         }
     }
     entry = elf_entry;
     if (kernel_size < 0) {
-        kernel_size = load_uimage(info->kernel_filename, &entry, NULL,
-                                  &is_linux, NULL, NULL);
+        kernel_size = load_uimage_as(info->kernel_filename, &entry, NULL,
+                                     &is_linux, NULL, NULL, as);
     }
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
         kernel_size = load_aarch64_image(info->kernel_filename,
-                                         info->loader_start, &entry);
+                                         info->loader_start, &entry, as);
         is_linux = 1;
     } else if (kernel_size < 0) {
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
-        kernel_size = load_image_targphys(info->kernel_filename, entry,
-                                          info->ram_size - KERNEL_LOAD_ADDR);
+        kernel_size = load_image_targphys_as(info->kernel_filename, entry,
+                                             info->ram_size - KERNEL_LOAD_ADDR,
+                                             as);
         is_linux = 1;
     }
     if (kernel_size < 0) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
         uint32_t fixupcontext[FIXUP_MAX];
 
         if (info->initrd_filename) {
-            initrd_size = load_ramdisk(info->initrd_filename,
-                                       info->initrd_start,
-                                       info->ram_size -
-                                       info->initrd_start);
+            initrd_size = load_ramdisk_as(info->initrd_filename,
+                                          info->initrd_start,
+                                          info->ram_size - info->initrd_start,
+                                          as);
             if (initrd_size < 0) {
-                initrd_size = load_image_targphys(info->initrd_filename,
-                                                  info->initrd_start,
-                                                  info->ram_size -
-                                                  info->initrd_start);
+                initrd_size = load_image_targphys_as(info->initrd_filename,
+                                                     info->initrd_start,
+                                                     info->ram_size -
+                                                     info->initrd_start,
+                                                     as);
             }
             if (initrd_size < 0) {
                 error_report("could not load initrd '%s'",
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
 
             /* Place the DTB after the initrd in memory with alignment. */
             dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size, align);
-            if (load_dtb(dtb_start, info, 0) < 0) {
+            if (load_dtb(dtb_start, info, 0, as) < 0) {
                 exit(1);
             }
             fixupcontext[FIXUP_ARGPTR] = dtb_start;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
         fixupcontext[FIXUP_ENTRYPOINT] = entry;
 
         write_bootloader("bootloader", info->loader_start,
-                         primary_loader, fixupcontext);
+                         primary_loader, fixupcontext, as);
 
         if (info->nb_cpus > 1) {
             info->write_secondary_boot(cpu, info);
-- 
2.16.2

Instead of loading guest images to the system address space, use the
CPU's address space.  This is important if we're trying to load the
file to memory or via an alias memory region that is provided by an
SoC object and thus not mapped into the system address space.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-4-peter.maydell@linaro.org
---
 hw/arm/armv7m.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size)
     uint64_t entry;
     uint64_t lowaddr;
     int big_endian;
+    AddressSpace *as;
+    int asidx;
+    CPUState *cs = CPU(cpu);
 
 #ifdef TARGET_WORDS_BIGENDIAN
     big_endian = 1;
@@ -XXX,XX +XXX,XX @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size)
         exit(1);
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
+        asidx = ARMASIdx_S;
+    } else {
+        asidx = ARMASIdx_NS;
+    }
+    as = cpu_get_address_space(cs, asidx);
+
     if (kernel_filename) {
-        image_size = load_elf(kernel_filename, NULL, NULL, &entry, &lowaddr,
-                              NULL, big_endian, EM_ARM, 1, 0);
+        image_size = load_elf_as(kernel_filename, NULL, NULL, &entry, &lowaddr,
+                                 NULL, big_endian, EM_ARM, 1, 0, as);
         if (image_size < 0) {
-            image_size = load_image_targphys(kernel_filename, 0, mem_size);
+            image_size = load_image_targphys_as(kernel_filename, 0,
+                                                mem_size, as);
             lowaddr = 0;
         }
         if (image_size < 0) {
-- 
2.16.2

In v8M, the Implementation Defined Attribution Unit (IDAU) is
a small piece of hardware typically implemented in the SoC
which provides board or SoC specific security attribution
information for each address that the CPU performs MPU/SAU
checks on. For QEMU, we model this with a QOM interface which
is implemented by the board or SoC object and connected to
the CPU using a link property.

This commit defines the new interface class, adds the link
property to the CPU object, and makes the SAU checking
code call the IDAU interface if one is present.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-5-peter.maydell@linaro.org
---
 target/arm/cpu.h    |  3 +++
 target/arm/idau.h   | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.c    | 15 +++++++++++++
 target/arm/helper.c | 28 +++++++++++++++++++++---
 4 files changed, 104 insertions(+), 3 deletions(-)
 create mode 100644 target/arm/idau.h

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* MemoryRegion to use for secure physical accesses */
     MemoryRegion *secure_memory;
 
+    /* For v8M, pointer to the IDAU interface provided by board/SoC */
+    Object *idau;
+
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;
 
diff --git a/target/arm/idau.h b/target/arm/idau.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/idau.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARM CPU -- interface for the Arm v8M IDAU
+ *
+ * Copyright (c) 2018 Linaro Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see
+ * <http://www.gnu.org/licenses/gpl-2.0.html>
+ *
+ * In the v8M architecture, the IDAU is a small piece of hardware
+ * typically implemented in the SoC which provides board or SoC
+ * specific security attribution information for each address that
+ * the CPU performs MPU/SAU checks on. For QEMU, we model this with a
+ * QOM interface which is implemented by the board or SoC object and
+ * connected to the CPU using a link property.
+ */
+
+#ifndef TARGET_ARM_IDAU_H
+#define TARGET_ARM_IDAU_H
+
+#include "qom/object.h"
+
+#define TYPE_IDAU_INTERFACE "idau-interface"
+#define IDAU_INTERFACE(obj) \
+    INTERFACE_CHECK(IDAUInterface, (obj), TYPE_IDAU_INTERFACE)
+#define IDAU_INTERFACE_CLASS(class) \
+    OBJECT_CLASS_CHECK(IDAUInterfaceClass, (class), TYPE_IDAU_INTERFACE)
+#define IDAU_INTERFACE_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(IDAUInterfaceClass, (obj), TYPE_IDAU_INTERFACE)
+
+typedef struct IDAUInterface {
+    Object parent;
+} IDAUInterface;
+
+#define IREGION_NOTVALID -1
+
+typedef struct IDAUInterfaceClass {
+    InterfaceClass parent;
+
+    /* Check the specified address and return the IDAU security information
+     * for it by filling in iregion, exempt, ns and nsc:
+     *  iregion: IDAU region number, or IREGION_NOTVALID if not valid
+     *  exempt: true if address is exempt from security attribution
+     *  ns: true if the address is NonSecure
+     *  nsc: true if the address is NonSecure-callable
+     */
+    void (*check)(IDAUInterface *ii, uint32_t address, int *iregion,
+                  bool *exempt, bool *ns, bool *nsc);
+} IDAUInterfaceClass;
+
+#endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "target/arm/idau.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
         }
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {
+        object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_UNREF_ON_RELEASE,
+                                 &error_abort);
+    }
+
     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
                              &error_abort);
 }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_cpu_type_info = {
     .class_init = arm_cpu_class_init,
 };
 
+static const TypeInfo idau_interface_type_info = {
+    .name = TYPE_IDAU_INTERFACE,
+    .parent = TYPE_INTERFACE,
+    .class_size = sizeof(IDAUInterfaceClass),
+};
+
 static void arm_cpu_register_types(void)
 {
     const ARMCPUInfo *info = arm_cpus;
 
     type_register_static(&arm_cpu_type_info);
+    type_register_static(&idau_interface_type_info);
 
     while (info->name) {
         cpu_register(info);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
+#include "target/arm/idau.h"
 #include "trace.h"
 #include "cpu.h"
 #include "internals.h"
@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,
      */
     ARMCPU *cpu = arm_env_get_cpu(env);
     int r;
+    bool idau_exempt = false, idau_ns = true, idau_nsc = true;
+    int idau_region = IREGION_NOTVALID;
 
-    /* TODO: implement IDAU */
+    if (cpu->idau) {
+        IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
+        IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
+
+        iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
+                   &idau_nsc);
+    }
 
     if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
         /* 0xf0000000..0xffffffff is always S for insn fetches */
         return;
     }
 
-    if (v8m_is_sau_exempt(env, address, access_type)) {
+    if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
         sattrs->ns = !regime_is_secure(env, mmu_idx);
         return;
     }
 
+    if (idau_region != IREGION_NOTVALID) {
+        sattrs->irvalid = true;
+        sattrs->iregion = idau_region;
+    }
+
     switch (env->sau.ctrl & 3) {
     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
         break;
@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,
             }
         }
 
-        /* TODO when we support the IDAU then it may override the result here */
+        /* The IDAU will override the SAU lookup results if it specifies
+         * higher security than the SAU does.
+         */
+        if (!idau_ns) {
+            if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
+                sattrs->ns = false;
+                sattrs->nsc = idau_nsc;
+            }
+        }
         break;
     }
 }
-- 
2.16.2

Create an "idau" property on the armv7m container object which
we can forward to the CPU object. Annoyingly, we can't use
object_property_add_alias() because the CPU object we want to
forward to doesn't exist until the armv7m container is realized.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-6-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h | 3 +++
 hw/arm/armv7m.c         | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/intc/armv7m_nvic.h"
+#include "target/arm/idau.h"
 
 #define TYPE_BITBAND "ARM,bitband-memory"
 #define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
@@ -XXX,XX +XXX,XX @@ typedef struct {
  * + Property "memory": MemoryRegion defining the physical address space
  *   that CPU accesses see. (The NVIC, bitbanding and other CPU-internal
  *   devices will be automatically layered on top of this view.)
+ * + Property "idau": IDAU interface (forwarded to CPU object)
  */
 typedef struct ARMv7MState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     char *cpu_type;
     /* MemoryRegion the board provides to us (with its devices, RAM, etc) */
     MemoryRegion *board_memory;
+    Object *idau;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "target/arm/idau.h"
 
 /* Bitbanded IO.  Each word corresponds to a single bit.  */
 
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
 
     object_property_set_link(OBJECT(s->cpu), OBJECT(&s->container), "memory",
                              &error_abort);
+    if (object_property_find(OBJECT(s->cpu), "idau", NULL)) {
+        object_property_set_link(OBJECT(s->cpu), s->idau, "idau", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
     object_property_set_bool(OBJECT(s->cpu), true, "realized", &err);
     if (err != NULL) {
         error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_STRING("cpu-type", ARMv7MState, cpu_type),
     DEFINE_PROP_LINK("memory", ARMv7MState, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
+    DEFINE_PROP_LINK("idau", ARMv7MState, idau, TYPE_IDAU_INTERFACE, Object *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.16.2

The Cortex-M33 allows the system to specify the reset value of the
secure Vector Table Offset Register (VTOR) by asserting config
signals. In particular, guest images for the MPS2 AN505 board rely
on the MPS2's initial VTOR being correct for that board.
Implement a QEMU property so board and SoC code can set the reset
value to the correct value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-7-peter.maydell@linaro.org
---
 target/arm/cpu.h |  3 +++
 target/arm/cpu.c | 18 ++++++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      */
     uint32_t psci_conduit;
 
+    /* For v8M, initial value of the Secure VTOR */
+    uint32_t init_svtor;
+
     /* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or
      * QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type.
      */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         uint32_t initial_msp; /* Loaded from 0x0 */
         uint32_t initial_pc; /* Loaded from 0x4 */
         uint8_t *rom;
+        uint32_t vecbase;
 
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
             env->v7m.secure = true;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         /* Unlike A/R profile, M profile defines the reset LR value */
         env->regs[14] = 0xffffffff;
 
-        /* Load the initial SP and PC from the vector table at address 0 */
-        rom = rom_ptr(0);
+        env->v7m.vecbase[M_REG_S] = cpu->init_svtor & 0xffffff80;
+
+        /* Load the initial SP and PC from offset 0 and 4 in the vector table */
+        vecbase = env->v7m.vecbase[env->v7m.secure];
+        rom = rom_ptr(vecbase);
         if (rom) {
             /* Address zero is covered by ROM which hasn't yet been
              * copied into physical memory.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
              * it got copied into memory. In the latter case, rom_ptr
              * will return a NULL pointer and we should use ldl_phys instead.
              */
-            initial_msp = ldl_phys(s->as, 0);
-            initial_pc = ldl_phys(s->as, 4);
+            initial_msp = ldl_phys(s->as, vecbase);
+            initial_pc = ldl_phys(s->as, vecbase + 4);
         }
 
         env->regs[13] = initial_msp & 0xFFFFFFFC;
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
                                            pmsav7_dregion,
                                            qdev_prop_uint32, uint32_t);
 
+/* M profile: initial value of the Secure VTOR */
+static Property arm_cpu_initsvtor_property =
+            DEFINE_PROP_UINT32("init-svtor", ARMCPU, init_svtor, 0);
+
 static void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
                                  qdev_prop_allow_set_link_before_realize,
                                  OBJ_PROP_LINK_UNREF_ON_RELEASE,
                                  &error_abort);
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_initsvtor_property,
+                                 &error_abort);
     }
 
     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
-- 
2.16.2

Create an "init-svtor" property on the armv7m container
object which we can forward to the CPU object.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-8-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h | 2 ++
 hw/arm/armv7m.c         | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  *   that CPU accesses see. (The NVIC, bitbanding and other CPU-internal
  *   devices will be automatically layered on top of this view.)
  * + Property "idau": IDAU interface (forwarded to CPU object)
+ * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
  */
 typedef struct ARMv7MState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     /* MemoryRegion the board provides to us (with its devices, RAM, etc) */
     MemoryRegion *board_memory;
     Object *idau;
+    uint32_t init_svtor;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (object_property_find(OBJECT(s->cpu), "init-svtor", NULL)) {
+        object_property_set_uint(OBJECT(s->cpu), s->init_svtor,
+                                 "init-svtor", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
     object_property_set_bool(OBJECT(s->cpu), true, "realized", &err);
     if (err != NULL) {
         error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_LINK("memory", ARMv7MState, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_LINK("idau", ARMv7MState, idau, TYPE_IDAU_INTERFACE, Object *),
+    DEFINE_PROP_UINT32("init-svtor", ARMv7MState, init_svtor, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.16.2

Add a Cortex-M33 definition. The M33 is an M profile CPU
which implements the ARM v8M architecture, including the
M profile Security Extension.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-9-peter.maydell@linaro.org
---
 target/arm/cpu.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     cpu->id_isar5 = 0x00000000;
 }
 
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->id_pfr0 = 0x00000030;
+    cpu->id_pfr1 = 0x00000210;
+    cpu->id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->id_mmfr0 = 0x00101F40;
+    cpu->id_mmfr1 = 0x00000000;
+    cpu->id_mmfr2 = 0x01000000;
+    cpu->id_mmfr3 = 0x00000000;
+    cpu->id_isar0 = 0x01101110;
+    cpu->id_isar1 = 0x02212000;
+    cpu->id_isar2 = 0x20232232;
+    cpu->id_isar3 = 0x01111131;
+    cpu->id_isar4 = 0x01310132;
+    cpu->id_isar5 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_cpus[] = {
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
                              .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
-- 
2.16.2

Move the definition of the struct for the unimplemented-device
from unimp.c to unimp.h, so that users can embed the struct
in their own device structs if they prefer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-10-peter.maydell@linaro.org
---
 include/hw/misc/unimp.h | 10 ++++++++++
 hw/misc/unimp.c         | 10 ----------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/unimp.h
+++ b/include/hw/misc/unimp.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_UNIMPLEMENTED_DEVICE "unimplemented-device"
 
+#define UNIMPLEMENTED_DEVICE(obj) \
+    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
+
+typedef struct {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    char *name;
+    uint64_t size;
+} UnimplementedDeviceState;
+
 /**
  * create_unimplemented_device: create and map a dummy device
  * @name: name of the device for debug logging
diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/unimp.c
+++ b/hw/misc/unimp.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qapi/error.h"
 
-#define UNIMPLEMENTED_DEVICE(obj) \
-    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
-
-typedef struct {
-    SysBusDevice parent_obj;
-    MemoryRegion iomem;
-    char *name;
-    uint64_t size;
-} UnimplementedDeviceState;
-
 static uint64_t unimp_read(void *opaque, hwaddr offset, unsigned size)
 {
     UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
-- 
2.16.2

The function qdev_init_gpio_in_named() passes the DeviceState pointer
as the opaque data pointor for the irq handler function.  Usually
this is what you want, but in some cases it would be helpful to use
some other data pointer.

Add a new function qdev_init_gpio_in_named_with_opaque() which allows
the caller to specify the data pointer they want.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-12-peter.maydell@linaro.org
---
 include/hw/qdev-core.h | 30 ++++++++++++++++++++++++++++--
 hw/core/qdev.c         |  8 +++++---
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -XXX,XX +XXX,XX @@ BusState *qdev_get_child_bus(DeviceState *dev, const char *name);
 /* GPIO inputs also double as IRQ sinks.  */
 void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n);
 void qdev_init_gpio_out(DeviceState *dev, qemu_irq *pins, int n);
-void qdev_init_gpio_in_named(DeviceState *dev, qemu_irq_handler handler,
-                             const char *name, int n);
 void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,
                               const char *name, int n);
+/**
+ * qdev_init_gpio_in_named_with_opaque: create an array of input GPIO lines
+ *   for the specified device
+ *
+ * @dev: Device to create input GPIOs for
+ * @handler: Function to call when GPIO line value is set
+ * @opaque: Opaque data pointer to pass to @handler
+ * @name: Name of the GPIO input (must be unique for this device)
+ * @n: Number of GPIO lines in this input set
+ */
+void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
+                                         qemu_irq_handler handler,
+                                         void *opaque,
+                                         const char *name, int n);
+
+/**
+ * qdev_init_gpio_in_named: create an array of input GPIO lines
+ *   for the specified device
+ *
+ * Like qdev_init_gpio_in_named_with_opaque(), but the opaque pointer
+ * passed to the handler is @dev (which is the most commonly desired behaviour).
+ */
+static inline void qdev_init_gpio_in_named(DeviceState *dev,
+                                           qemu_irq_handler handler,
+                                           const char *name, int n)
+{
+    qdev_init_gpio_in_named_with_opaque(dev, handler, dev, name, n);
+}
 
 void qdev_pass_gpios(DeviceState *dev, DeviceState *container,
                      const char *name);
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -XXX,XX +XXX,XX @@ static NamedGPIOList *qdev_get_named_gpio_list(DeviceState *dev,
     return ngl;
 }
 
-void qdev_init_gpio_in_named(DeviceState *dev, qemu_irq_handler handler,
-                             const char *name, int n)
+void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
+                                         qemu_irq_handler handler,
+                                         void *opaque,
+                                         const char *name, int n)
 {
     int i;
     NamedGPIOList *gpio_list = qdev_get_named_gpio_list(dev, name);
 
     assert(gpio_list->num_out == 0 || !name);
     gpio_list->in = qemu_extend_irqs(gpio_list->in, gpio_list->num_in, handler,
-                                     dev, n);
+                                     opaque, n);
 
     if (!name) {
         name = "unnamed-gpio-in";
-- 
2.16.2

In some board or SoC models it is necessary to split a qemu_irq line
so that one input can feed multiple outputs.  We currently have
qemu_irq_split() for this, but that has several deficiencies:
 * it can only handle splitting a line into two
 * it unavoidably leaks memory, so it can't be used
   in a device that can be deleted

Implement a qdev device that encapsulates splitting of IRQs, with a
configurable number of outputs.  (This is in some ways the inverse of
the TYPE_OR_IRQ device.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-13-peter.maydell@linaro.org
---
 hw/core/Makefile.objs       |  1 +
 include/hw/core/split-irq.h | 57 +++++++++++++++++++++++++++++
 include/hw/irq.h            |  4 +-
 hw/core/split-irq.c         | 89 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 150 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/core/split-irq.h
 create mode 100644 hw/core/split-irq.c

diff --git a/hw/core/Makefile.objs b/hw/core/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/Makefile.objs
+++ b/hw/core/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_FITLOADER) += loader-fit.o
 common-obj-$(CONFIG_SOFTMMU) += qdev-properties-system.o
 common-obj-$(CONFIG_SOFTMMU) += register.o
 common-obj-$(CONFIG_SOFTMMU) += or-irq.o
+common-obj-$(CONFIG_SOFTMMU) += split-irq.o
 common-obj-$(CONFIG_PLATFORM_BUS) += platform-bus.o
 
 obj-$(CONFIG_SOFTMMU) += generic-loader.o
diff --git a/include/hw/core/split-irq.h b/include/hw/core/split-irq.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/split-irq.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * IRQ splitter device.
+ *
+ * Copyright (c) 2018 Linaro Limited.
+ * Written by Peter Maydell
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/* This is a simple device which has one GPIO input line and multiple
+ * GPIO output lines. Any change on the input line is forwarded to all
+ * of the outputs.
+ *
+ * QEMU interface:
+ *  + one unnamed GPIO input: the input line
+ *  + N unnamed GPIO outputs: the output lines
+ *  + QOM property "num-lines": sets the number of output lines
+ */
+#ifndef HW_SPLIT_IRQ_H
+#define HW_SPLIT_IRQ_H
+
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SPLIT_IRQ "split-irq"
+
+#define MAX_SPLIT_LINES 16
+
+typedef struct SplitIRQ SplitIRQ;
+
+#define SPLIT_IRQ(obj) OBJECT_CHECK(SplitIRQ, (obj), TYPE_SPLIT_IRQ)
+
+struct SplitIRQ {
+    DeviceState parent_obj;
+
+    qemu_irq out_irq[MAX_SPLIT_LINES];
+    uint16_t num_lines;
+};
+
+#endif
diff --git a/include/hw/irq.h b/include/hw/irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
 /* Returns a new IRQ with opposite polarity.  */
 qemu_irq qemu_irq_invert(qemu_irq irq);
 
-/* Returns a new IRQ which feeds into both the passed IRQs */
+/* Returns a new IRQ which feeds into both the passed IRQs.
+ * It's probably better to use the TYPE_SPLIT_IRQ device instead.
+ */
 qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
 
 /* Returns a new IRQ set which connects 1:1 to another IRQ set, which
diff --git a/hw/core/split-irq.c b/hw/core/split-irq.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/core/split-irq.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * IRQ splitter device.
+ *
+ * Copyright (c) 2018 Linaro Limited.
+ * Written by Peter Maydell
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/core/split-irq.h"
+#include "qapi/error.h"
+
+static void split_irq_handler(void *opaque, int n, int level)
+{
+    SplitIRQ *s = SPLIT_IRQ(opaque);
+    int i;
+
+    for (i = 0; i < s->num_lines; i++) {
+        qemu_set_irq(s->out_irq[i], level);
+    }
+}
+
+static void split_irq_init(Object *obj)
+{
+    qdev_init_gpio_in(DEVICE(obj), split_irq_handler, 1);
+}
+
+static void split_irq_realize(DeviceState *dev, Error **errp)
+{
+    SplitIRQ *s = SPLIT_IRQ(dev);
+
+    if (s->num_lines < 1 || s->num_lines >= MAX_SPLIT_LINES) {
+        error_setg(errp,
+                   "IRQ splitter number of lines %d is not between 1 and %d",
+                   s->num_lines, MAX_SPLIT_LINES);
+        return;
+    }
+
+    qdev_init_gpio_out(dev, s->out_irq, s->num_lines);
+}
+
+static Property split_irq_properties[] = {
+    DEFINE_PROP_UINT16("num-lines", SplitIRQ, num_lines, 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void split_irq_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    /* No state to reset or migrate */
+    dc->props = split_irq_properties;
+    dc->realize = split_irq_realize;
+
+    /* Reason: Needs to be wired up to work */
+    dc->user_creatable = false;
+}
+
+static const TypeInfo split_irq_type_info = {
+   .name = TYPE_SPLIT_IRQ,
+   .parent = TYPE_DEVICE,
+   .instance_size = sizeof(SplitIRQ),
+   .instance_init = split_irq_init,
+   .class_init = split_irq_class_init,
+};
+
+static void split_irq_register_types(void)
+{
+    type_register_static(&split_irq_type_info);
+}
+
+type_init(split_irq_register_types)
-- 
2.16.2

The MPS2 AN505 FPGA image includes a "FPGA control block"
which is a small set of registers handling LEDs, buttons
and some counters.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-14-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs           |   1 +
 include/hw/misc/mps2-fpgaio.h   |  43 ++++++++++
 hw/misc/mps2-fpgaio.c           | 176 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 hw/misc/trace-events            |   6 ++
 5 files changed, 227 insertions(+)
 create mode 100644 include/hw/misc/mps2-fpgaio.h
 create mode 100644 hw/misc/mps2-fpgaio.c

Add a model of the TrustZone peripheral protection controller (PPC),
which is used to gate transactions to non-TZ-aware peripherals so
that secure software can configure them to not be accessible to
non-secure software.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-15-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs           |   2 +
 include/hw/misc/tz-ppc.h        | 101 ++++++++++++++
 hw/misc/tz-ppc.c                | 302 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   2 +
 hw/misc/trace-events            |  11 ++
 5 files changed, 418 insertions(+)
 create mode 100644 include/hw/misc/tz-ppc.h
 create mode 100644 hw/misc/tz-ppc.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MIPS_ITU) += mips_itu.o
 obj-$(CONFIG_MPS2_FPGAIO) += mps2-fpgaio.o
 obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
 
+obj-$(CONFIG_TZ_PPC) += tz-ppc.o
+
 obj-$(CONFIG_PVPANIC) += pvpanic.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 obj-$(CONFIG_AUX) += auxbus.o
diff --git a/include/hw/misc/tz-ppc.h b/include/hw/misc/tz-ppc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/tz-ppc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM TrustZone peripheral protection controller emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the TrustZone peripheral protection controller (PPC).
+ * It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM
+ * (DDI 0571G):
+ * https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g
+ *
+ * The PPC sits in front of peripherals and allows secure software to
+ * configure it to either pass through or reject transactions.
+ * Rejected transactions may be configured to either be aborted, or to
+ * behave as RAZ/WI. An interrupt can be signalled for a rejected transaction.
+ *
+ * The PPC has no register interface -- it is configured purely by a
+ * collection of input signals from other hardware in the system. Typically
+ * they are either hardwired or exposed in an ad-hoc register interface by
+ * the SoC that uses the PPC.
+ *
+ * This QEMU model can be used to model either the AHB5 or APB4 TZ PPC,
+ * since the only difference between them is that the AHB version has a
+ * "default" port which has no security checks applied. In QEMU the default
+ * port can be emulated simply by wiring its downstream devices directly
+ * into the parent address space, since the PPC does not need to intercept
+ * transactions there.
+ *
+ * In the hardware, selection of which downstream port to use is done by
+ * the user's decode logic asserting one of the hsel[] signals. In QEMU,
+ * we provide 16 MMIO regions, one per port, and the user maps these into
+ * the desired addresses to implement the address decode.
+ *
+ * QEMU interface:
+ * + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end
+ *   of each of the 16 ports of the PPC
+ * + Property "port[0..15]": MemoryRegion defining the downstream device(s)
+ *   for each of the 16 ports of the PPC
+ * + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be
+ *   accessible to NonSecure transactions
+ * + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be
+ *   accessible to non-privileged transactions
+ * + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should
+ *   result in a transaction error, or 0 for the transaction to RAZ/WI
+ * + Named GPIO input "irq_enable": set to 1 to enable interrupts
+ * + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt
+ * + Named GPIO output "irq": set for a transaction-failed interrupt
+ * + Property "NONSEC_MASK": if a bit is set in this mask then accesses to
+ *   the associated port do not have the TZ security check performed. (This
+ *   corresponds to the hardware allowing this to be set as a Verilog
+ *   parameter.)
+ */
+
+#ifndef TZ_PPC_H
+#define TZ_PPC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_TZ_PPC "tz-ppc"
+#define TZ_PPC(obj) OBJECT_CHECK(TZPPC, (obj), TYPE_TZ_PPC)
+
+#define TZ_NUM_PORTS 16
+
+typedef struct TZPPC TZPPC;
+
+typedef struct TZPPCPort {
+    TZPPC *ppc;
+    MemoryRegion upstream;
+    AddressSpace downstream_as;
+    MemoryRegion *downstream;
+} TZPPCPort;
+
+struct TZPPC {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+
+    /* State: these just track the values of our input signals */
+    bool cfg_nonsec[TZ_NUM_PORTS];
+    bool cfg_ap[TZ_NUM_PORTS];
+    bool cfg_sec_resp;
+    bool irq_enable;
+    bool irq_clear;
+    /* State: are we asserting irq ? */
+    bool irq_status;
+
+    qemu_irq irq;
+
+    /* Properties */
+    uint32_t nonsec_mask;
+
+    TZPPCPort port[TZ_NUM_PORTS];
+};
+
+#endif
diff --git a/hw/misc/tz-ppc.c b/hw/misc/tz-ppc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tz-ppc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM TrustZone peripheral protection controller emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/misc/tz-ppc.h"
+
+static void tz_ppc_update_irq(TZPPC *s)
+{
+    bool level = s->irq_status && s->irq_enable;
+
+    trace_tz_ppc_update_irq(level);
+    qemu_set_irq(s->irq, level);
+}
+
+static void tz_ppc_cfg_nonsec(void *opaque, int n, int level)
+{
+    TZPPC *s = TZ_PPC(opaque);
+
+    assert(n < TZ_NUM_PORTS);
+    trace_tz_ppc_cfg_nonsec(n, level);
+    s->cfg_nonsec[n] = level;
+}
+
+static void tz_ppc_cfg_ap(void *opaque, int n, int level)
+{
+    TZPPC *s = TZ_PPC(opaque);
+
+    assert(n < TZ_NUM_PORTS);
+    trace_tz_ppc_cfg_ap(n, level);
+    s->cfg_ap[n] = level;
+}
+
+static void tz_ppc_cfg_sec_resp(void *opaque, int n, int level)
+{
+    TZPPC *s = TZ_PPC(opaque);
+
+    trace_tz_ppc_cfg_sec_resp(level);
+    s->cfg_sec_resp = level;
+}
+
+static void tz_ppc_irq_enable(void *opaque, int n, int level)
+{
+    TZPPC *s = TZ_PPC(opaque);
+
+    trace_tz_ppc_irq_enable(level);
+    s->irq_enable = level;
+    tz_ppc_update_irq(s);
+}
+
+static void tz_ppc_irq_clear(void *opaque, int n, int level)
+{
+    TZPPC *s = TZ_PPC(opaque);
+
+    trace_tz_ppc_irq_clear(level);
+
+    s->irq_clear = level;
+    if (level) {
+        s->irq_status = false;
+        tz_ppc_update_irq(s);
+    }
+}
+
+static bool tz_ppc_check(TZPPC *s, int n, MemTxAttrs attrs)
+{
+    /* Check whether to allow an access to port n; return true if
+     * the check passes, and false if the transaction must be blocked.
+     * If the latter, the caller must check cfg_sec_resp to determine
+     * whether to abort or RAZ/WI the transaction.
+     * The checks are:
+     *  + nonsec_mask suppresses any check of the secure attribute
+     *  + otherwise, block if cfg_nonsec is 1 and transaction is secure,
+     *    or if cfg_nonsec is 0 and transaction is non-secure
+     *  + block if transaction is usermode and cfg_ap is 0
+     */
+    if ((attrs.secure == s->cfg_nonsec[n] && !(s->nonsec_mask & (1 << n))) ||
+        (attrs.user && !s->cfg_ap[n])) {
+        /* Block the transaction. */
+        if (!s->irq_clear) {
+            /* Note that holding irq_clear high suppresses interrupts */
+            s->irq_status = true;
+            tz_ppc_update_irq(s);
+        }
+        return false;
+    }
+    return true;
+}
+
+static MemTxResult tz_ppc_read(void *opaque, hwaddr addr, uint64_t *pdata,
+                               unsigned size, MemTxAttrs attrs)
+{
+    TZPPCPort *p = opaque;
+    TZPPC *s = p->ppc;
+    int n = p - s->port;
+    AddressSpace *as = &p->downstream_as;
+    uint64_t data;
+    MemTxResult res;
+
+    if (!tz_ppc_check(s, n, attrs)) {
+        trace_tz_ppc_read_blocked(n, addr, attrs.secure, attrs.user);
+        if (s->cfg_sec_resp) {
+            return MEMTX_ERROR;
+        } else {
+            *pdata = 0;
+            return MEMTX_OK;
+        }
+    }
+
+    switch (size) {
+    case 1:
+        data = address_space_ldub(as, addr, attrs, &res);
+        break;
+    case 2:
+        data = address_space_lduw_le(as, addr, attrs, &res);
+        break;
+    case 4:
+        data = address_space_ldl_le(as, addr, attrs, &res);
+        break;
+    case 8:
+        data = address_space_ldq_le(as, addr, attrs, &res);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    *pdata = data;
+    return res;
+}
+
+static MemTxResult tz_ppc_write(void *opaque, hwaddr addr, uint64_t val,
+                                unsigned size, MemTxAttrs attrs)
+{
+    TZPPCPort *p = opaque;
+    TZPPC *s = p->ppc;
+    AddressSpace *as = &p->downstream_as;
+    int n = p - s->port;
+    MemTxResult res;
+
+    if (!tz_ppc_check(s, n, attrs)) {
+        trace_tz_ppc_write_blocked(n, addr, attrs.secure, attrs.user);
+        if (s->cfg_sec_resp) {
+            return MEMTX_ERROR;
+        } else {
+            return MEMTX_OK;
+        }
+    }
+
+    switch (size) {
+    case 1:
+        address_space_stb(as, addr, val, attrs, &res);
+        break;
+    case 2:
+        address_space_stw_le(as, addr, val, attrs, &res);
+        break;
+    case 4:
+        address_space_stl_le(as, addr, val, attrs, &res);
+        break;
+    case 8:
+        address_space_stq_le(as, addr, val, attrs, &res);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return res;
+}
+
+static const MemoryRegionOps tz_ppc_ops = {
+    .read_with_attrs = tz_ppc_read,
+    .write_with_attrs = tz_ppc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void tz_ppc_reset(DeviceState *dev)
+{
+    TZPPC *s = TZ_PPC(dev);
+
+    trace_tz_ppc_reset();
+    s->cfg_sec_resp = false;
+    memset(s->cfg_nonsec, 0, sizeof(s->cfg_nonsec));
+    memset(s->cfg_ap, 0, sizeof(s->cfg_ap));
+}
+
+static void tz_ppc_init(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+    TZPPC *s = TZ_PPC(obj);
+
+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_nonsec, "cfg_nonsec", TZ_NUM_PORTS);
+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_ap, "cfg_ap", TZ_NUM_PORTS);
+    qdev_init_gpio_in_named(dev, tz_ppc_cfg_sec_resp, "cfg_sec_resp", 1);
+    qdev_init_gpio_in_named(dev, tz_ppc_irq_enable, "irq_enable", 1);
+    qdev_init_gpio_in_named(dev, tz_ppc_irq_clear, "irq_clear", 1);
+    qdev_init_gpio_out_named(dev, &s->irq, "irq", 1);
+}
+
+static void tz_ppc_realize(DeviceState *dev, Error **errp)
+{
+    Object *obj = OBJECT(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    TZPPC *s = TZ_PPC(dev);
+    int i;
+
+    /* We can't create the upstream end of the port until realize,
+     * as we don't know the size of the MR used as the downstream until then.
+     */
+    for (i = 0; i < TZ_NUM_PORTS; i++) {
+        TZPPCPort *port = &s->port[i];
+        char *name;
+        uint64_t size;
+
+        if (!port->downstream) {
+            continue;
+        }
+
+        name = g_strdup_printf("tz-ppc-port[%d]", i);
+
+        port->ppc = s;
+        address_space_init(&port->downstream_as, port->downstream, name);
+
+        size = memory_region_size(port->downstream);
+        memory_region_init_io(&port->upstream, obj, &tz_ppc_ops,
+                              port, name, size);
+        sysbus_init_mmio(sbd, &port->upstream);
+        g_free(name);
+    }
+}
+
+static const VMStateDescription tz_ppc_vmstate = {
+    .name = "tz-ppc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL_ARRAY(cfg_nonsec, TZPPC, 16),
+        VMSTATE_BOOL_ARRAY(cfg_ap, TZPPC, 16),
+        VMSTATE_BOOL(cfg_sec_resp, TZPPC),
+        VMSTATE_BOOL(irq_enable, TZPPC),
+        VMSTATE_BOOL(irq_clear, TZPPC),
+        VMSTATE_BOOL(irq_status, TZPPC),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+#define DEFINE_PORT(N)                                          \
+    DEFINE_PROP_LINK("port[" #N "]", TZPPC, port[N].downstream, \
+                     TYPE_MEMORY_REGION, MemoryRegion *)
+
+static Property tz_ppc_properties[] = {
+    DEFINE_PROP_UINT32("NONSEC_MASK", TZPPC, nonsec_mask, 0),
+    DEFINE_PORT(0),
+    DEFINE_PORT(1),
+    DEFINE_PORT(2),
+    DEFINE_PORT(3),
+    DEFINE_PORT(4),
+    DEFINE_PORT(5),
+    DEFINE_PORT(6),
+    DEFINE_PORT(7),
+    DEFINE_PORT(8),
+    DEFINE_PORT(9),
+    DEFINE_PORT(10),
+    DEFINE_PORT(11),
+    DEFINE_PORT(12),
+    DEFINE_PORT(13),
+    DEFINE_PORT(14),
+    DEFINE_PORT(15),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void tz_ppc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = tz_ppc_realize;
+    dc->vmsd = &tz_ppc_vmstate;
+    dc->reset = tz_ppc_reset;
+    dc->props = tz_ppc_properties;
+}
+
+static const TypeInfo tz_ppc_info = {
+    .name = TYPE_TZ_PPC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(TZPPC),
+    .instance_init = tz_ppc_init,
+    .class_init = tz_ppc_class_init,
+};
+
+static void tz_ppc_register_types(void)
+{
+    type_register_static(&tz_ppc_info);
+}
+
+type_init(tz_ppc_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_CMSDK_APB_UART=y
 CONFIG_MPS2_FPGAIO=y
 CONFIG_MPS2_SCC=y
 
+CONFIG_TZ_PPC=y
+
 CONFIG_VERSATILE_PCI=y
 CONFIG_VERSATILE_I2C=y
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d co
 mos6522_set_sr_int(void) "set sr_int"
 mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
 mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
+
+# hw/misc/tz-ppc.c
+tz_ppc_reset(void) "TZ PPC: reset"
+tz_ppc_cfg_nonsec(int n, int level) "TZ PPC: cfg_nonsec[%d] = %d"
+tz_ppc_cfg_ap(int n, int level) "TZ PPC: cfg_ap[%d] = %d"
+tz_ppc_cfg_sec_resp(int level) "TZ PPC: cfg_sec_resp = %d"
+tz_ppc_irq_enable(int level) "TZ PPC: int_enable = %d"
+tz_ppc_irq_clear(int level) "TZ PPC: int_clear = %d"
+tz_ppc_update_irq(int level) "TZ PPC: setting irq line to %d"
+tz_ppc_read_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " read (secure %d user %d) blocked"
+tz_ppc_write_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " write (secure %d user %d) blocked"
-- 
2.16.2

The Arm IoT Kit includes a "security controller" which is largely a
collection of registers for controlling the PPCs and other bits of
glue in the system.  This commit provides the initial skeleton of the
device, implementing just the ID registers, and a couple of read-only
read-as-zero registers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-16-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs           |   1 +
 include/hw/misc/iotkit-secctl.h |  39 ++++
 hw/misc/iotkit-secctl.c         | 448 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 hw/misc/trace-events            |   7 +
 5 files changed, 496 insertions(+)
 create mode 100644 include/hw/misc/iotkit-secctl.h
 create mode 100644 hw/misc/iotkit-secctl.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2_FPGAIO) += mps2-fpgaio.o
 obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
 
 obj-$(CONFIG_TZ_PPC) += tz-ppc.o
+obj-$(CONFIG_IOTKIT_SECCTL) += iotkit-secctl.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/iotkit-secctl.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM IoT Kit security controller
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the security controller which is part of the
+ * Arm IoT Kit and documented in
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+ *
+ * QEMU interface:
+ *  + sysbus MMIO region 0 is the "secure privilege control block" registers
+ *  + sysbus MMIO region 1 is the "non-secure privilege control block" registers
+ */
+
+#ifndef IOTKIT_SECCTL_H
+#define IOTKIT_SECCTL_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_IOTKIT_SECCTL "iotkit-secctl"
+#define IOTKIT_SECCTL(obj) OBJECT_CHECK(IoTKitSecCtl, (obj), TYPE_IOTKIT_SECCTL)
+
+typedef struct IoTKitSecCtl {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+
+    MemoryRegion s_regs;
+    MemoryRegion ns_regs;
+} IoTKitSecCtl;
+
+#endif
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/iotkit-secctl.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Arm IoT Kit security controller
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/misc/iotkit-secctl.h"
+
+/* Registers in the secure privilege control block */
+REG32(SECRESPCFG, 0x10)
+REG32(NSCCFG, 0x14)
+REG32(SECMPCINTSTATUS, 0x1c)
+REG32(SECPPCINTSTAT, 0x20)
+REG32(SECPPCINTCLR, 0x24)
+REG32(SECPPCINTEN, 0x28)
+REG32(SECMSCINTSTAT, 0x30)
+REG32(SECMSCINTCLR, 0x34)
+REG32(SECMSCINTEN, 0x38)
+REG32(BRGINTSTAT, 0x40)
+REG32(BRGINTCLR, 0x44)
+REG32(BRGINTEN, 0x48)
+REG32(AHBNSPPC0, 0x50)
+REG32(AHBNSPPCEXP0, 0x60)
+REG32(AHBNSPPCEXP1, 0x64)
+REG32(AHBNSPPCEXP2, 0x68)
+REG32(AHBNSPPCEXP3, 0x6c)
+REG32(APBNSPPC0, 0x70)
+REG32(APBNSPPC1, 0x74)
+REG32(APBNSPPCEXP0, 0x80)
+REG32(APBNSPPCEXP1, 0x84)
+REG32(APBNSPPCEXP2, 0x88)
+REG32(APBNSPPCEXP3, 0x8c)
+REG32(AHBSPPPC0, 0x90)
+REG32(AHBSPPPCEXP0, 0xa0)
+REG32(AHBSPPPCEXP1, 0xa4)
+REG32(AHBSPPPCEXP2, 0xa8)
+REG32(AHBSPPPCEXP3, 0xac)
+REG32(APBSPPPC0, 0xb0)
+REG32(APBSPPPC1, 0xb4)
+REG32(APBSPPPCEXP0, 0xc0)
+REG32(APBSPPPCEXP1, 0xc4)
+REG32(APBSPPPCEXP2, 0xc8)
+REG32(APBSPPPCEXP3, 0xcc)
+REG32(NSMSCEXP, 0xd0)
+REG32(PID4, 0xfd0)
+REG32(PID5, 0xfd4)
+REG32(PID6, 0xfd8)
+REG32(PID7, 0xfdc)
+REG32(PID0, 0xfe0)
+REG32(PID1, 0xfe4)
+REG32(PID2, 0xfe8)
+REG32(PID3, 0xfec)
+REG32(CID0, 0xff0)
+REG32(CID1, 0xff4)
+REG32(CID2, 0xff8)
+REG32(CID3, 0xffc)
+
+/* Registers in the non-secure privilege control block */
+REG32(AHBNSPPPC0, 0x90)
+REG32(AHBNSPPPCEXP0, 0xa0)
+REG32(AHBNSPPPCEXP1, 0xa4)
+REG32(AHBNSPPPCEXP2, 0xa8)
+REG32(AHBNSPPPCEXP3, 0xac)
+REG32(APBNSPPPC0, 0xb0)
+REG32(APBNSPPPC1, 0xb4)
+REG32(APBNSPPPCEXP0, 0xc0)
+REG32(APBNSPPPCEXP1, 0xc4)
+REG32(APBNSPPPCEXP2, 0xc8)
+REG32(APBNSPPPCEXP3, 0xcc)
+/* PID and CID registers are also present in the NS block */
+
+static const uint8_t iotkit_secctl_s_idregs[] = {
+    0x04, 0x00, 0x00, 0x00,
+    0x52, 0xb8, 0x0b, 0x00,
+    0x0d, 0xf0, 0x05, 0xb1,
+};
+
+static const uint8_t iotkit_secctl_ns_idregs[] = {
+    0x04, 0x00, 0x00, 0x00,
+    0x53, 0xb8, 0x0b, 0x00,
+    0x0d, 0xf0, 0x05, 0xb1,
+};
+
+static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
+                                        uint64_t *pdata,
+                                        unsigned size, MemTxAttrs attrs)
+{
+    uint64_t r;
+    uint32_t offset = addr & ~0x3;
+
+    switch (offset) {
+    case A_AHBNSPPC0:
+    case A_AHBSPPPC0:
+        r = 0;
+        break;
+    case A_SECRESPCFG:
+    case A_NSCCFG:
+    case A_SECMPCINTSTATUS:
+    case A_SECPPCINTSTAT:
+    case A_SECPPCINTEN:
+    case A_SECMSCINTSTAT:
+    case A_SECMSCINTEN:
+    case A_BRGINTSTAT:
+    case A_BRGINTEN:
+    case A_AHBNSPPCEXP0:
+    case A_AHBNSPPCEXP1:
+    case A_AHBNSPPCEXP2:
+    case A_AHBNSPPCEXP3:
+    case A_APBNSPPC0:
+    case A_APBNSPPC1:
+    case A_APBNSPPCEXP0:
+    case A_APBNSPPCEXP1:
+    case A_APBNSPPCEXP2:
+    case A_APBNSPPCEXP3:
+    case A_AHBSPPPCEXP0:
+    case A_AHBSPPPCEXP1:
+    case A_AHBSPPPCEXP2:
+    case A_AHBSPPPCEXP3:
+    case A_APBSPPPC0:
+    case A_APBSPPPC1:
+    case A_APBSPPPCEXP0:
+    case A_APBSPPPCEXP1:
+    case A_APBSPPPCEXP2:
+    case A_APBSPPPCEXP3:
+    case A_NSMSCEXP:
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SecCtl S block read: "
+                      "unimplemented offset 0x%x\n", offset);
+        r = 0;
+        break;
+    case A_PID4:
+    case A_PID5:
+    case A_PID6:
+    case A_PID7:
+    case A_PID0:
+    case A_PID1:
+    case A_PID2:
+    case A_PID3:
+    case A_CID0:
+    case A_CID1:
+    case A_CID2:
+    case A_CID3:
+        r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4];
+        break;
+    case A_SECPPCINTCLR:
+    case A_SECMSCINTCLR:
+    case A_BRGINTCLR:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl S block read: write-only offset 0x%x\n",
+                      offset);
+        r = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl S block read: bad offset 0x%x\n", offset);
+        r = 0;
+        break;
+    }
+
+    if (size != 4) {
+        /* None of our registers are access-sensitive, so just pull the right
+         * byte out of the word read result.
+         */
+        r = extract32(r, (addr & 3) * 8, size * 8);
+    }
+
+    trace_iotkit_secctl_s_read(offset, r, size);
+    *pdata = r;
+    return MEMTX_OK;
+}
+
+static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
+                                         uint64_t value,
+                                         unsigned size, MemTxAttrs attrs)
+{
+    uint32_t offset = addr;
+
+    trace_iotkit_secctl_s_write(offset, value, size);
+
+    if (size != 4) {
+        /* Byte and halfword writes are ignored */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl S block write: bad size, ignored\n");
+        return MEMTX_OK;
+    }
+
+    switch (offset) {
+    case A_SECRESPCFG:
+    case A_NSCCFG:
+    case A_SECPPCINTCLR:
+    case A_SECPPCINTEN:
+    case A_SECMSCINTCLR:
+    case A_SECMSCINTEN:
+    case A_BRGINTCLR:
+    case A_BRGINTEN:
+    case A_AHBNSPPCEXP0:
+    case A_AHBNSPPCEXP1:
+    case A_AHBNSPPCEXP2:
+    case A_AHBNSPPCEXP3:
+    case A_APBNSPPC0:
+    case A_APBNSPPC1:
+    case A_APBNSPPCEXP0:
+    case A_APBNSPPCEXP1:
+    case A_APBNSPPCEXP2:
+    case A_APBNSPPCEXP3:
+    case A_AHBSPPPCEXP0:
+    case A_AHBSPPPCEXP1:
+    case A_AHBSPPPCEXP2:
+    case A_AHBSPPPCEXP3:
+    case A_APBSPPPC0:
+    case A_APBSPPPC1:
+    case A_APBSPPPCEXP0:
+    case A_APBSPPPCEXP1:
+    case A_APBSPPPCEXP2:
+    case A_APBSPPPCEXP3:
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SecCtl S block write: "
+                      "unimplemented offset 0x%x\n", offset);
+        break;
+    case A_SECMPCINTSTATUS:
+    case A_SECPPCINTSTAT:
+    case A_SECMSCINTSTAT:
+    case A_BRGINTSTAT:
+    case A_AHBNSPPC0:
+    case A_AHBSPPPC0:
+    case A_NSMSCEXP:
+    case A_PID4:
+    case A_PID5:
+    case A_PID6:
+    case A_PID7:
+    case A_PID0:
+    case A_PID1:
+    case A_PID2:
+    case A_PID3:
+    case A_CID0:
+    case A_CID1:
+    case A_CID2:
+    case A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IoTKit SecCtl S block write: "
+                      "read-only offset 0x%x\n", offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl S block write: bad offset 0x%x\n",
+                      offset);
+        break;
+    }
+
+    return MEMTX_OK;
+}
+
+static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
+                                         uint64_t *pdata,
+                                         unsigned size, MemTxAttrs attrs)
+{
+    uint64_t r;
+    uint32_t offset = addr & ~0x3;
+
+    switch (offset) {
+    case A_AHBNSPPPC0:
+        r = 0;
+        break;
+    case A_AHBNSPPPCEXP0:
+    case A_AHBNSPPPCEXP1:
+    case A_AHBNSPPPCEXP2:
+    case A_AHBNSPPPCEXP3:
+    case A_APBNSPPPC0:
+    case A_APBNSPPPC1:
+    case A_APBNSPPPCEXP0:
+    case A_APBNSPPPCEXP1:
+    case A_APBNSPPPCEXP2:
+    case A_APBNSPPPCEXP3:
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SecCtl NS block read: "
+                      "unimplemented offset 0x%x\n", offset);
+        break;
+    case A_PID4:
+    case A_PID5:
+    case A_PID6:
+    case A_PID7:
+    case A_PID0:
+    case A_PID1:
+    case A_PID2:
+    case A_PID3:
+    case A_CID0:
+    case A_CID1:
+    case A_CID2:
+    case A_CID3:
+        r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4];
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl NS block write: bad offset 0x%x\n",
+                      offset);
+        r = 0;
+        break;
+    }
+
+    if (size != 4) {
+        /* None of our registers are access-sensitive, so just pull the right
+         * byte out of the word read result.
+         */
+        r = extract32(r, (addr & 3) * 8, size * 8);
+    }
+
+    trace_iotkit_secctl_ns_read(offset, r, size);
+    *pdata = r;
+    return MEMTX_OK;
+}
+
+static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
+                                          uint64_t value,
+                                          unsigned size, MemTxAttrs attrs)
+{
+    uint32_t offset = addr;
+
+    trace_iotkit_secctl_ns_write(offset, value, size);
+
+    if (size != 4) {
+        /* Byte and halfword writes are ignored */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl NS block write: bad size, ignored\n");
+        return MEMTX_OK;
+    }
+
+    switch (offset) {
+    case A_AHBNSPPPCEXP0:
+    case A_AHBNSPPPCEXP1:
+    case A_AHBNSPPPCEXP2:
+    case A_AHBNSPPPCEXP3:
+    case A_APBNSPPPC0:
+    case A_APBNSPPPC1:
+    case A_APBNSPPPCEXP0:
+    case A_APBNSPPPCEXP1:
+    case A_APBNSPPPCEXP2:
+    case A_APBNSPPPCEXP3:
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SecCtl NS block write: "
+                      "unimplemented offset 0x%x\n", offset);
+        break;
+    case A_AHBNSPPPC0:
+    case A_PID4:
+    case A_PID5:
+    case A_PID6:
+    case A_PID7:
+    case A_PID0:
+    case A_PID1:
+    case A_PID2:
+    case A_PID3:
+    case A_CID0:
+    case A_CID1:
+    case A_CID2:
+    case A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IoTKit SecCtl NS block write: "
+                      "read-only offset 0x%x\n", offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "IotKit SecCtl NS block write: bad offset 0x%x\n",
+                      offset);
+        break;
+    }
+
+    return MEMTX_OK;
+}
+
+static const MemoryRegionOps iotkit_secctl_s_ops = {
+    .read_with_attrs = iotkit_secctl_s_read,
+    .write_with_attrs = iotkit_secctl_s_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 4,
+};
+
+static const MemoryRegionOps iotkit_secctl_ns_ops = {
+    .read_with_attrs = iotkit_secctl_ns_read,
+    .write_with_attrs = iotkit_secctl_ns_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 4,
+};
+
+static void iotkit_secctl_reset(DeviceState *dev)
+{
+
+}
+
+static void iotkit_secctl_init(Object *obj)
+{
+    IoTKitSecCtl *s = IOTKIT_SECCTL(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
+                          s, "iotkit-secctl-s-regs", 0x1000);
+    memory_region_init_io(&s->ns_regs, obj, &iotkit_secctl_ns_ops,
+                          s, "iotkit-secctl-ns-regs", 0x1000);
+    sysbus_init_mmio(sbd, &s->s_regs);
+    sysbus_init_mmio(sbd, &s->ns_regs);
+}
+
+static const VMStateDescription iotkit_secctl_vmstate = {
+    .name = "iotkit-secctl",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void iotkit_secctl_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &iotkit_secctl_vmstate;
+    dc->reset = iotkit_secctl_reset;
+}
+
+static const TypeInfo iotkit_secctl_info = {
+    .name = TYPE_IOTKIT_SECCTL,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IoTKitSecCtl),
+    .instance_init = iotkit_secctl_init,
+    .class_init = iotkit_secctl_class_init,
+};
+
+static void iotkit_secctl_register_types(void)
+{
+    type_register_static(&iotkit_secctl_info);
+}
+
+type_init(iotkit_secctl_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_MPS2_FPGAIO=y
 CONFIG_MPS2_SCC=y
 
 CONFIG_TZ_PPC=y
+CONFIG_IOTKIT_SECCTL=y
 
 CONFIG_VERSATILE_PCI=y
 CONFIG_VERSATILE_I2C=y
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ tz_ppc_irq_clear(int level) "TZ PPC: int_clear = %d"
 tz_ppc_update_irq(int level) "TZ PPC: setting irq line to %d"
 tz_ppc_read_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " read (secure %d user %d) blocked"
 tz_ppc_write_blocked(int n, hwaddr offset, bool secure, bool user) "TZ PPC: port %d offset 0x%" HWADDR_PRIx " write (secure %d user %d) blocked"
+
+# hw/misc/iotkit-secctl.c
+iotkit_secctl_s_read(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl S regs read: offset 0x%x data 0x%" PRIx64 " size %u"
+iotkit_secctl_s_write(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl S regs write: offset 0x%x data 0x%" PRIx64 " size %u"
+iotkit_secctl_ns_read(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl NS regs read: offset 0x%x data 0x%" PRIx64 " size %u"
+iotkit_secctl_ns_write(uint32_t offset, uint64_t data, unsigned size) "IoTKit SecCtl NS regs write: offset 0x%x data 0x%" PRIx64 " size %u"
+iotkit_secctl_reset(void) "IoTKit SecCtl: reset"
-- 
2.16.2

The IoTKit Security Controller includes various registers
that expose to software the controls for the Peripheral
Protection Controllers in the system. Implement these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-17-peter.maydell@linaro.org
---
 include/hw/misc/iotkit-secctl.h |  64 +++++++++-
 hw/misc/iotkit-secctl.c         | 270 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 315 insertions(+), 19 deletions(-)

diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/iotkit-secctl.h
+++ b/include/hw/misc/iotkit-secctl.h
@@ -XXX,XX +XXX,XX @@
  * QEMU interface:
  *  + sysbus MMIO region 0 is the "secure privilege control block" registers
  *  + sysbus MMIO region 1 is the "non-secure privilege control block" registers
+ *  + named GPIO output "sec_resp_cfg" indicating whether blocked accesses
+ *    should RAZ/WI or bus error
+ * Controlling the 2 APB PPCs in the IoTKit:
+ *  + named GPIO outputs apb_ppc0_nonsec[0..2] and apb_ppc1_nonsec
+ *  + named GPIO outputs apb_ppc0_ap[0..2] and apb_ppc1_ap
+ *  + named GPIO outputs apb_ppc{0,1}_irq_enable
+ *  + named GPIO outputs apb_ppc{0,1}_irq_clear
+ *  + named GPIO inputs apb_ppc{0,1}_irq_status
+ * Controlling each of the 4 expansion APB PPCs which a system using the IoTKit
+ * might provide:
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
+ *  + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
+ * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
+ * might provide:
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
+ *  + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
  */
 
 #ifndef IOTKIT_SECCTL_H
@@ -XXX,XX +XXX,XX @@
 #define TYPE_IOTKIT_SECCTL "iotkit-secctl"
 #define IOTKIT_SECCTL(obj) OBJECT_CHECK(IoTKitSecCtl, (obj), TYPE_IOTKIT_SECCTL)
 
-typedef struct IoTKitSecCtl {
+#define IOTS_APB_PPC0_NUM_PORTS 3
+#define IOTS_APB_PPC1_NUM_PORTS 1
+#define IOTS_PPC_NUM_PORTS 16
+#define IOTS_NUM_APB_PPC 2
+#define IOTS_NUM_APB_EXP_PPC 4
+#define IOTS_NUM_AHB_EXP_PPC 4
+
+typedef struct IoTKitSecCtl IoTKitSecCtl;
+
+/* State and IRQ lines relating to a PPC. For the
+ * PPCs in the IoTKit not all the IRQ lines are used.
+ */
+typedef struct IoTKitSecCtlPPC {
+    qemu_irq nonsec[IOTS_PPC_NUM_PORTS];
+    qemu_irq ap[IOTS_PPC_NUM_PORTS];
+    qemu_irq irq_enable;
+    qemu_irq irq_clear;
+
+    uint32_t ns;
+    uint32_t sp;
+    uint32_t nsp;
+
+    /* Number of ports actually present */
+    int numports;
+    /* Offset of this PPC's interrupt bits in SECPPCINTSTAT */
+    int irq_bit_offset;
+    IoTKitSecCtl *parent;
+} IoTKitSecCtlPPC;
+
+struct IoTKitSecCtl {
     /*< private >*/
     SysBusDevice parent_obj;
 
     /*< public >*/
+    qemu_irq sec_resp_cfg;
 
     MemoryRegion s_regs;
     MemoryRegion ns_regs;
-} IoTKitSecCtl;
+
+    uint32_t secppcintstat;
+    uint32_t secppcinten;
+    uint32_t secrespcfg;
+
+    IoTKitSecCtlPPC apb[IOTS_NUM_APB_PPC];
+    IoTKitSecCtlPPC apbexp[IOTS_NUM_APB_EXP_PPC];
+    IoTKitSecCtlPPC ahbexp[IOTS_NUM_APB_EXP_PPC];
+};
 
 #endif
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t iotkit_secctl_ns_idregs[] = {
     0x0d, 0xf0, 0x05, 0xb1,
 };
 
+/* The register sets for the various PPCs (AHB internal, APB internal,
+ * AHB expansion, APB expansion) are all set up so that they are
+ * in 16-aligned blocks so offsets 0xN0, 0xN4, 0xN8, 0xNC are PPCs
+ * 0, 1, 2, 3 of that type, so we can convert a register address offset
+ * into an an index into a PPC array easily.
+ */
+static inline int offset_to_ppc_idx(uint32_t offset)
+{
+    return extract32(offset, 2, 2);
+}
+
+typedef void PerPPCFunction(IoTKitSecCtlPPC *ppc);
+
+static void foreach_ppc(IoTKitSecCtl *s, PerPPCFunction *fn)
+{
+    int i;
+
+    for (i = 0; i < IOTS_NUM_APB_PPC; i++) {
+        fn(&s->apb[i]);
+    }
+    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
+        fn(&s->apbexp[i]);
+    }
+    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
+        fn(&s->ahbexp[i]);
+    }
+}
+
 static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
                                         uint64_t *pdata,
                                         unsigned size, MemTxAttrs attrs)
 {
     uint64_t r;
     uint32_t offset = addr & ~0x3;
+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
 
     switch (offset) {
     case A_AHBNSPPC0:
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
         r = 0;
         break;
     case A_SECRESPCFG:
-    case A_NSCCFG:
-    case A_SECMPCINTSTATUS:
+        r = s->secrespcfg;
+        break;
     case A_SECPPCINTSTAT:
+        r = s->secppcintstat;
+        break;
     case A_SECPPCINTEN:
-    case A_SECMSCINTSTAT:
-    case A_SECMSCINTEN:
-    case A_BRGINTSTAT:
-    case A_BRGINTEN:
+        r = s->secppcinten;
+        break;
     case A_AHBNSPPCEXP0:
     case A_AHBNSPPCEXP1:
     case A_AHBNSPPCEXP2:
     case A_AHBNSPPCEXP3:
+        r = s->ahbexp[offset_to_ppc_idx(offset)].ns;
+        break;
     case A_APBNSPPC0:
     case A_APBNSPPC1:
+        r = s->apb[offset_to_ppc_idx(offset)].ns;
+        break;
     case A_APBNSPPCEXP0:
     case A_APBNSPPCEXP1:
     case A_APBNSPPCEXP2:
     case A_APBNSPPCEXP3:
+        r = s->apbexp[offset_to_ppc_idx(offset)].ns;
+        break;
     case A_AHBSPPPCEXP0:
     case A_AHBSPPPCEXP1:
     case A_AHBSPPPCEXP2:
     case A_AHBSPPPCEXP3:
+        r = s->apbexp[offset_to_ppc_idx(offset)].sp;
+        break;
     case A_APBSPPPC0:
     case A_APBSPPPC1:
+        r = s->apb[offset_to_ppc_idx(offset)].sp;
+        break;
     case A_APBSPPPCEXP0:
     case A_APBSPPPCEXP1:
     case A_APBSPPPCEXP2:
     case A_APBSPPPCEXP3:
+        r = s->apbexp[offset_to_ppc_idx(offset)].sp;
+        break;
+    case A_NSCCFG:
+    case A_SECMPCINTSTATUS:
+    case A_SECMSCINTSTAT:
+    case A_SECMSCINTEN:
+    case A_BRGINTSTAT:
+    case A_BRGINTEN:
     case A_NSMSCEXP:
         qemu_log_mask(LOG_UNIMP,
                       "IoTKit SecCtl S block read: "
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
     return MEMTX_OK;
 }
 
+static void iotkit_secctl_update_ppc_ap(IoTKitSecCtlPPC *ppc)
+{
+    int i;
+
+    for (i = 0; i < ppc->numports; i++) {
+        bool v;
+
+        if (extract32(ppc->ns, i, 1)) {
+            v = extract32(ppc->nsp, i, 1);
+        } else {
+            v = extract32(ppc->sp, i, 1);
+        }
+        qemu_set_irq(ppc->ap[i], v);
+    }
+}
+
+static void iotkit_secctl_ppc_ns_write(IoTKitSecCtlPPC *ppc, uint32_t value)
+{
+    int i;
+
+    ppc->ns = value & MAKE_64BIT_MASK(0, ppc->numports);
+    for (i = 0; i < ppc->numports; i++) {
+        qemu_set_irq(ppc->nonsec[i], extract32(ppc->ns, i, 1));
+    }
+    iotkit_secctl_update_ppc_ap(ppc);
+}
+
+static void iotkit_secctl_ppc_sp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
+{
+    ppc->sp = value & MAKE_64BIT_MASK(0, ppc->numports);
+    iotkit_secctl_update_ppc_ap(ppc);
+}
+
+static void iotkit_secctl_ppc_nsp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
+{
+    ppc->nsp = value & MAKE_64BIT_MASK(0, ppc->numports);
+    iotkit_secctl_update_ppc_ap(ppc);
+}
+
+static void iotkit_secctl_ppc_update_irq_clear(IoTKitSecCtlPPC *ppc)
+{
+    uint32_t value = ppc->parent->secppcintstat;
+
+    qemu_set_irq(ppc->irq_clear, extract32(value, ppc->irq_bit_offset, 1));
+}
+
+static void iotkit_secctl_ppc_update_irq_enable(IoTKitSecCtlPPC *ppc)
+{
+    uint32_t value = ppc->parent->secppcinten;
+
+    qemu_set_irq(ppc->irq_enable, extract32(value, ppc->irq_bit_offset, 1));
+}
+
 static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
                                          uint64_t value,
                                          unsigned size, MemTxAttrs attrs)
 {
+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
     uint32_t offset = addr;
+    IoTKitSecCtlPPC *ppc;
 
     trace_iotkit_secctl_s_write(offset, value, size);
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
 
     switch (offset) {
     case A_SECRESPCFG:
-    case A_NSCCFG:
+        value &= 1;
+        s->secrespcfg = value;
+        qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
+        break;
     case A_SECPPCINTCLR:
+        value &= 0x00f000f3;
+        foreach_ppc(s, iotkit_secctl_ppc_update_irq_clear);
+        break;
     case A_SECPPCINTEN:
-    case A_SECMSCINTCLR:
-    case A_SECMSCINTEN:
-    case A_BRGINTCLR:
-    case A_BRGINTEN:
+        s->secppcinten = value & 0x00f000f3;
+        foreach_ppc(s, iotkit_secctl_ppc_update_irq_enable);
+        break;
     case A_AHBNSPPCEXP0:
     case A_AHBNSPPCEXP1:
     case A_AHBNSPPCEXP2:
     case A_AHBNSPPCEXP3:
+        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_ns_write(ppc, value);
+        break;
     case A_APBNSPPC0:
     case A_APBNSPPC1:
+        ppc = &s->apb[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_ns_write(ppc, value);
+        break;
     case A_APBNSPPCEXP0:
     case A_APBNSPPCEXP1:
     case A_APBNSPPCEXP2:
     case A_APBNSPPCEXP3:
+        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_ns_write(ppc, value);
+        break;
     case A_AHBSPPPCEXP0:
     case A_AHBSPPPCEXP1:
     case A_AHBSPPPCEXP2:
     case A_AHBSPPPCEXP3:
+        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_sp_write(ppc, value);
+        break;
     case A_APBSPPPC0:
     case A_APBSPPPC1:
+        ppc = &s->apb[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_sp_write(ppc, value);
+        break;
     case A_APBSPPPCEXP0:
     case A_APBSPPPCEXP1:
     case A_APBSPPPCEXP2:
     case A_APBSPPPCEXP3:
+        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_sp_write(ppc, value);
+        break;
+    case A_NSCCFG:
+    case A_SECMSCINTCLR:
+    case A_SECMSCINTEN:
+    case A_BRGINTCLR:
+    case A_BRGINTEN:
         qemu_log_mask(LOG_UNIMP,
                       "IoTKit SecCtl S block write: "
                       "unimplemented offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
                                          uint64_t *pdata,
                                          unsigned size, MemTxAttrs attrs)
 {
+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
     uint64_t r;
     uint32_t offset = addr & ~0x3;
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
     case A_AHBNSPPPCEXP1:
     case A_AHBNSPPPCEXP2:
     case A_AHBNSPPPCEXP3:
+        r = s->ahbexp[offset_to_ppc_idx(offset)].nsp;
+        break;
     case A_APBNSPPPC0:
     case A_APBNSPPPC1:
+        r = s->apb[offset_to_ppc_idx(offset)].nsp;
+        break;
     case A_APBNSPPPCEXP0:
     case A_APBNSPPPCEXP1:
     case A_APBNSPPPCEXP2:
     case A_APBNSPPPCEXP3:
-        qemu_log_mask(LOG_UNIMP,
-                      "IoTKit SecCtl NS block read: "
-                      "unimplemented offset 0x%x\n", offset);
+        r = s->apbexp[offset_to_ppc_idx(offset)].nsp;
         break;
     case A_PID4:
     case A_PID5:
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
                                           uint64_t value,
                                           unsigned size, MemTxAttrs attrs)
 {
+    IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
     uint32_t offset = addr;
+    IoTKitSecCtlPPC *ppc;
 
     trace_iotkit_secctl_ns_write(offset, value, size);
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
     case A_AHBNSPPPCEXP1:
     case A_AHBNSPPPCEXP2:
     case A_AHBNSPPPCEXP3:
+        ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_nsp_write(ppc, value);
+        break;
     case A_APBNSPPPC0:
     case A_APBNSPPPC1:
+        ppc = &s->apb[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_nsp_write(ppc, value);
+        break;
     case A_APBNSPPPCEXP0:
     case A_APBNSPPPCEXP1:
     case A_APBNSPPPCEXP2:
     case A_APBNSPPPCEXP3:
-        qemu_log_mask(LOG_UNIMP,
-                      "IoTKit SecCtl NS block write: "
-                      "unimplemented offset 0x%x\n", offset);
+        ppc = &s->apbexp[offset_to_ppc_idx(offset)];
+        iotkit_secctl_ppc_nsp_write(ppc, value);
         break;
     case A_AHBNSPPPC0:
     case A_PID4:
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps iotkit_secctl_ns_ops = {
     .impl.max_access_size = 4,
 };
 
+static void iotkit_secctl_reset_ppc(IoTKitSecCtlPPC *ppc)
+{
+    ppc->ns = 0;
+    ppc->sp = 0;
+    ppc->nsp = 0;
+}
+
 static void iotkit_secctl_reset(DeviceState *dev)
 {
+    IoTKitSecCtl *s = IOTKIT_SECCTL(dev);
 
+    s->secppcintstat = 0;
+    s->secppcinten = 0;
+    s->secrespcfg = 0;
+
+    foreach_ppc(s, iotkit_secctl_reset_ppc);
+}
+
+static void iotkit_secctl_ppc_irqstatus(void *opaque, int n, int level)
+{
+    IoTKitSecCtlPPC *ppc = opaque;
+    IoTKitSecCtl *s = IOTKIT_SECCTL(ppc->parent);
+    int irqbit = ppc->irq_bit_offset + n;
+
+    s->secppcintstat = deposit32(s->secppcintstat, irqbit, 1, level);
+}
+
+static void iotkit_secctl_init_ppc(IoTKitSecCtl *s,
+                                   IoTKitSecCtlPPC *ppc,
+                                   const char *name,
+                                   int numports,
+                                   int irq_bit_offset)
+{
+    char *gpioname;
+    DeviceState *dev = DEVICE(s);
+
+    ppc->numports = numports;
+    ppc->irq_bit_offset = irq_bit_offset;
+    ppc->parent = s;
+
+    gpioname = g_strdup_printf("%s_nonsec", name);
+    qdev_init_gpio_out_named(dev, ppc->nonsec, gpioname, numports);
+    g_free(gpioname);
+    gpioname = g_strdup_printf("%s_ap", name);
+    qdev_init_gpio_out_named(dev, ppc->ap, gpioname, numports);
+    g_free(gpioname);
+    gpioname = g_strdup_printf("%s_irq_enable", name);
+    qdev_init_gpio_out_named(dev, &ppc->irq_enable, gpioname, 1);
+    g_free(gpioname);
+    gpioname = g_strdup_printf("%s_irq_clear", name);
+    qdev_init_gpio_out_named(dev, &ppc->irq_clear, gpioname, 1);
+    g_free(gpioname);
+    gpioname = g_strdup_printf("%s_irq_status", name);
+    qdev_init_gpio_in_named_with_opaque(dev, iotkit_secctl_ppc_irqstatus,
+                                        ppc, gpioname, 1);
+    g_free(gpioname);
 }
 
 static void iotkit_secctl_init(Object *obj)
 {
     IoTKitSecCtl *s = IOTKIT_SECCTL(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    DeviceState *dev = DEVICE(obj);
+    int i;
+
+    iotkit_secctl_init_ppc(s, &s->apb[0], "apb_ppc0",
+                           IOTS_APB_PPC0_NUM_PORTS, 0);
+    iotkit_secctl_init_ppc(s, &s->apb[1], "apb_ppc1",
+                           IOTS_APB_PPC1_NUM_PORTS, 1);
+
+    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
+        IoTKitSecCtlPPC *ppc = &s->apbexp[i];
+        char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
+        iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 4 + i);
+        g_free(ppcname);
+    }
+    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
+        IoTKitSecCtlPPC *ppc = &s->ahbexp[i];
+        char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
+        iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 20 + i);
+        g_free(ppcname);
+    }
+
+    qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
 
     memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
                           s, "iotkit-secctl-s-regs", 0x1000);
@@ -XXX,XX +XXX,XX @@ static void iotkit_secctl_init(Object *obj)
     sysbus_init_mmio(sbd, &s->ns_regs);
 }
 
+static const VMStateDescription iotkit_secctl_ppc_vmstate = {
+    .name = "iotkit-secctl-ppc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ns, IoTKitSecCtlPPC),
+        VMSTATE_UINT32(sp, IoTKitSecCtlPPC),
+        VMSTATE_UINT32(nsp, IoTKitSecCtlPPC),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription iotkit_secctl_vmstate = {
     .name = "iotkit-secctl",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
+        VMSTATE_UINT32(secppcintstat, IoTKitSecCtl),
+        VMSTATE_UINT32(secppcinten, IoTKitSecCtl),
+        VMSTATE_UINT32(secrespcfg, IoTKitSecCtl),
+        VMSTATE_STRUCT_ARRAY(apb, IoTKitSecCtl, IOTS_NUM_APB_PPC, 1,
+                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
+        VMSTATE_STRUCT_ARRAY(apbexp, IoTKitSecCtl, IOTS_NUM_APB_EXP_PPC, 1,
+                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
+        VMSTATE_STRUCT_ARRAY(ahbexp, IoTKitSecCtl, IOTS_NUM_AHB_EXP_PPC, 1,
+                             iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.16.2

Add remaining easy registers to iotkit-secctl:
 * NSCCFG just routes its two bits out to external GPIO lines
 * BRGINSTAT/BRGINTCLR/BRGINTEN can be dummies, because QEMU's
   bus fabric can never report errors

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180220180325.29818-18-peter.maydell@linaro.org
---
 include/hw/misc/iotkit-secctl.h |  4 ++++
 hw/misc/iotkit-secctl.c         | 32 ++++++++++++++++++++++++++------
 2 files changed, 30 insertions(+), 6 deletions(-)

Model the Arm IoT Kit documented in
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

The Arm IoT Kit is a subsystem which includes a CPU and some devices,
and is intended be extended by adding extra devices to form a
complete system.  It is used in the MPS2 board's AN505 image for the
Cortex-M33.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-19-peter.maydell@linaro.org
---
 hw/arm/Makefile.objs            |   1 +
 include/hw/arm/iotkit.h         | 109 ++++++++
 hw/arm/iotkit.c                 | 598 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 4 files changed, 709 insertions(+)
 create mode 100644 include/hw/arm/iotkit.h
 create mode 100644 hw/arm/iotkit.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
 obj-$(CONFIG_MPS2) += mps2.o
 obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
+obj-$(CONFIG_IOTKIT) += iotkit.o
diff --git a/include/hw/arm/iotkit.h b/include/hw/arm/iotkit.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/iotkit.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM IoT Kit
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the Arm IoT Kit which is documented in
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+ * It contains:
+ *  a Cortex-M33
+ *  the IDAU
+ *  some timers and watchdogs
+ *  two peripheral protection controllers
+ *  a memory protection controller
+ *  a security controller
+ *  a bus fabric which arranges that some parts of the address
+ *  space are secure and non-secure aliases of each other
+ *
+ * QEMU interface:
+ *  + QOM property "memory" is a MemoryRegion containing the devices provided
+ *    by the board model.
+ *  + QOM property "MAINCLK" is the frequency of the main system clock
+ *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts
+ *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts, which
+ *    are wired to the NVIC lines 32 .. n+32
+ * Controlling up to 4 AHB expansion PPBs which a system using the IoTKit
+ * might provide:
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
+ *  + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
+ *  + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
+ * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
+ * might provide:
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
+ *  + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
+ *  + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
+ */
+
+#ifndef IOTKIT_H
+#define IOTKIT_H
+
+#include "hw/sysbus.h"
+#include "hw/arm/armv7m.h"
+#include "hw/misc/iotkit-secctl.h"
+#include "hw/misc/tz-ppc.h"
+#include "hw/timer/cmsdk-apb-timer.h"
+#include "hw/misc/unimp.h"
+#include "hw/or-irq.h"
+#include "hw/core/split-irq.h"
+
+#define TYPE_IOTKIT "iotkit"
+#define IOTKIT(obj) OBJECT_CHECK(IoTKit, (obj), TYPE_IOTKIT)
+
+/* We have an IRQ splitter and an OR gate input for each external PPC
+ * and the 2 internal PPCs
+ */
+#define NUM_EXTERNAL_PPCS (IOTS_NUM_AHB_EXP_PPC + IOTS_NUM_APB_EXP_PPC)
+#define NUM_PPCS (NUM_EXTERNAL_PPCS + 2)
+
+typedef struct IoTKit {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    ARMv7MState armv7m;
+    IoTKitSecCtl secctl;
+    TZPPC apb_ppc0;
+    TZPPC apb_ppc1;
+    CMSDKAPBTIMER timer0;
+    CMSDKAPBTIMER timer1;
+    qemu_or_irq ppc_irq_orgate;
+    SplitIRQ sec_resp_splitter;
+    SplitIRQ ppc_irq_splitter[NUM_PPCS];
+
+    UnimplementedDeviceState dualtimer;
+    UnimplementedDeviceState s32ktimer;
+
+    MemoryRegion container;
+    MemoryRegion alias1;
+    MemoryRegion alias2;
+    MemoryRegion alias3;
+    MemoryRegion sram0;
+
+    qemu_irq *exp_irqs;
+    qemu_irq ppc0_irq;
+    qemu_irq ppc1_irq;
+    qemu_irq sec_resp_cfg;
+    qemu_irq sec_resp_cfg_in;
+    qemu_irq nsc_cfg_in;
+
+    qemu_irq irq_status_in[NUM_EXTERNAL_PPCS];
+
+    uint32_t nsccfg;
+
+    /* Properties */
+    MemoryRegion *board_memory;
+    uint32_t exp_numirq;
+    uint32_t mainclk_frq;
+} IoTKit;
+
+#endif
diff --git a/hw/arm/iotkit.c b/hw/arm/iotkit.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/iotkit.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Arm IoT Kit
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/arm/iotkit.h"
+#include "hw/misc/unimp.h"
+#include "hw/arm/arm.h"
+
+/* Create an alias region of @size bytes starting at @base
+ * which mirrors the memory starting at @orig.
+ */
+static void make_alias(IoTKit *s, MemoryRegion *mr, const char *name,
+                       hwaddr base, hwaddr size, hwaddr orig)
+{
+    memory_region_init_alias(mr, NULL, name, &s->container, orig, size);
+    /* The alias is even lower priority than unimplemented_device regions */
+    memory_region_add_subregion_overlap(&s->container, base, mr, -1500);
+}
+
+static void init_sysbus_child(Object *parent, const char *childname,
+                              void *child, size_t childsize,
+                              const char *childtype)
+{
+    object_initialize(child, childsize, childtype);
+    object_property_add_child(parent, childname, OBJECT(child), &error_abort);
+    qdev_set_parent_bus(DEVICE(child), sysbus_get_default());
+}
+
+static void irq_status_forwarder(void *opaque, int n, int level)
+{
+    qemu_irq destirq = opaque;
+
+    qemu_set_irq(destirq, level);
+}
+
+static void nsccfg_handler(void *opaque, int n, int level)
+{
+    IoTKit *s = IOTKIT(opaque);
+
+    s->nsccfg = level;
+}
+
+static void iotkit_forward_ppc(IoTKit *s, const char *ppcname, int ppcnum)
+{
+    /* Each of the 4 AHB and 4 APB PPCs that might be present in a
+     * system using the IoTKit has a collection of control lines which
+     * are provided by the security controller and which we want to
+     * expose as control lines on the IoTKit device itself, so the
+     * code using the IoTKit can wire them up to the PPCs.
+     */
+    SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum];
+    DeviceState *iotkitdev = DEVICE(s);
+    DeviceState *dev_secctl = DEVICE(&s->secctl);
+    DeviceState *dev_splitter = DEVICE(splitter);
+    char *name;
+
+    name = g_strdup_printf("%s_nonsec", ppcname);
+    qdev_pass_gpios(dev_secctl, iotkitdev, name);
+    g_free(name);
+    name = g_strdup_printf("%s_ap", ppcname);
+    qdev_pass_gpios(dev_secctl, iotkitdev, name);
+    g_free(name);
+    name = g_strdup_printf("%s_irq_enable", ppcname);
+    qdev_pass_gpios(dev_secctl, iotkitdev, name);
+    g_free(name);
+    name = g_strdup_printf("%s_irq_clear", ppcname);
+    qdev_pass_gpios(dev_secctl, iotkitdev, name);
+    g_free(name);
+
+    /* irq_status is a little more tricky, because we need to
+     * split it so we can send it both to the security controller
+     * and to our OR gate for the NVIC interrupt line.
+     * Connect up the splitter's outputs, and create a GPIO input
+     * which will pass the line state to the input splitter.
+     */
+    name = g_strdup_printf("%s_irq_status", ppcname);
+    qdev_connect_gpio_out(dev_splitter, 0,
+                          qdev_get_gpio_in_named(dev_secctl,
+                                                 name, 0));
+    qdev_connect_gpio_out(dev_splitter, 1,
+                          qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum));
+    s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0);
+    qdev_init_gpio_in_named_with_opaque(iotkitdev, irq_status_forwarder,
+                                        s->irq_status_in[ppcnum], name, 1);
+    g_free(name);
+}
+
+static void iotkit_forward_sec_resp_cfg(IoTKit *s)
+{
+    /* Forward the 3rd output from the splitter device as a
+     * named GPIO output of the iotkit object.
+     */
+    DeviceState *dev = DEVICE(s);
+    DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter);
+
+    qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
+    s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder,
+                                           s->sec_resp_cfg, 1);
+    qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
+}
+
+static void iotkit_init(Object *obj)
+{
+    IoTKit *s = IOTKIT(obj);
+    int i;
+
+    memory_region_init(&s->container, obj, "iotkit-container", UINT64_MAX);
+
+    init_sysbus_child(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
+                      TYPE_ARMV7M);
+    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
+                         ARM_CPU_TYPE_NAME("cortex-m33"));
+
+    init_sysbus_child(obj, "secctl", &s->secctl, sizeof(s->secctl),
+                      TYPE_IOTKIT_SECCTL);
+    init_sysbus_child(obj, "apb-ppc0", &s->apb_ppc0, sizeof(s->apb_ppc0),
+                      TYPE_TZ_PPC);
+    init_sysbus_child(obj, "apb-ppc1", &s->apb_ppc1, sizeof(s->apb_ppc1),
+                      TYPE_TZ_PPC);
+    init_sysbus_child(obj, "timer0", &s->timer0, sizeof(s->timer0),
+                      TYPE_CMSDK_APB_TIMER);
+    init_sysbus_child(obj, "timer1", &s->timer1, sizeof(s->timer1),
+                      TYPE_CMSDK_APB_TIMER);
+    init_sysbus_child(obj, "dualtimer", &s->dualtimer, sizeof(s->dualtimer),
+                      TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize(&s->ppc_irq_orgate, sizeof(s->ppc_irq_orgate),
+                      TYPE_OR_IRQ);
+    object_property_add_child(obj, "ppc-irq-orgate",
+                              OBJECT(&s->ppc_irq_orgate), &error_abort);
+    object_initialize(&s->sec_resp_splitter, sizeof(s->sec_resp_splitter),
+                      TYPE_SPLIT_IRQ);
+    object_property_add_child(obj, "sec-resp-splitter",
+                              OBJECT(&s->sec_resp_splitter), &error_abort);
+    for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
+        char *name = g_strdup_printf("ppc-irq-splitter-%d", i);
+        SplitIRQ *splitter = &s->ppc_irq_splitter[i];
+
+        object_initialize(splitter, sizeof(*splitter), TYPE_SPLIT_IRQ);
+        object_property_add_child(obj, name, OBJECT(splitter), &error_abort);
+    }
+    init_sysbus_child(obj, "s32ktimer", &s->s32ktimer, sizeof(s->s32ktimer),
+                      TYPE_UNIMPLEMENTED_DEVICE);
+}
+
+static void iotkit_exp_irq(void *opaque, int n, int level)
+{
+    IoTKit *s = IOTKIT(opaque);
+
+    qemu_set_irq(s->exp_irqs[n], level);
+}
+
+static void iotkit_realize(DeviceState *dev, Error **errp)
+{
+    IoTKit *s = IOTKIT(dev);
+    int i;
+    MemoryRegion *mr;
+    Error *err = NULL;
+    SysBusDevice *sbd_apb_ppc0;
+    SysBusDevice *sbd_secctl;
+    DeviceState *dev_apb_ppc0;
+    DeviceState *dev_apb_ppc1;
+    DeviceState *dev_secctl;
+    DeviceState *dev_splitter;
+
+    if (!s->board_memory) {
+        error_setg(errp, "memory property was not set");
+        return;
+    }
+
+    if (!s->mainclk_frq) {
+        error_setg(errp, "MAINCLK property was not set");
+        return;
+    }
+
+    /* Handling of which devices should be available only to secure
+     * code is usually done differently for M profile than for A profile.
+     * Instead of putting some devices only into the secure address space,
+     * devices exist in both address spaces but with hard-wired security
+     * permissions that will cause the CPU to fault for non-secure accesses.
+     *
+     * The IoTKit has an IDAU (Implementation Defined Access Unit),
+     * which specifies hard-wired security permissions for different
+     * areas of the physical address space. For the IoTKit IDAU, the
+     * top 4 bits of the physical address are the IDAU region ID, and
+     * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS
+     * region, otherwise it is an S region.
+     *
+     * The various devices and RAMs are generally all mapped twice,
+     * once into a region that the IDAU defines as secure and once
+     * into a non-secure region. They sit behind either a Memory
+     * Protection Controller (for RAM) or a Peripheral Protection
+     * Controller (for devices), which allow a more fine grained
+     * configuration of whether non-secure accesses are permitted.
+     *
+     * (The other place that guest software can configure security
+     * permissions is in the architected SAU (Security Attribution
+     * Unit), which is entirely inside the CPU. The IDAU can upgrade
+     * the security attributes for a region to more restrictive than
+     * the SAU specifies, but cannot downgrade them.)
+     *
+     * 0x10000000..0x1fffffff  alias of 0x00000000..0x0fffffff
+     * 0x20000000..0x2007ffff  32KB FPGA block RAM
+     * 0x30000000..0x3fffffff  alias of 0x20000000..0x2fffffff
+     * 0x40000000..0x4000ffff  base peripheral region 1
+     * 0x40010000..0x4001ffff  CPU peripherals (none for IoTKit)
+     * 0x40020000..0x4002ffff  system control element peripherals
+     * 0x40080000..0x400fffff  base peripheral region 2
+     * 0x50000000..0x5fffffff  alias of 0x40000000..0x4fffffff
+     */
+
+    memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -1);
+
+    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", s->exp_numirq + 32);
+    /* In real hardware the initial Secure VTOR is set from the INITSVTOR0
+     * register in the IoT Kit System Control Register block, and the
+     * initial value of that is in turn specifiable by the FPGA that
+     * instantiates the IoT Kit. In QEMU we don't implement this wrinkle,
+     * and simply set the CPU's init-svtor to the IoT Kit default value.
+     */
+    qdev_prop_set_uint32(DEVICE(&s->armv7m), "init-svtor", 0x10000000);
+    object_property_set_link(OBJECT(&s->armv7m), OBJECT(&s->container),
+                             "memory", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_link(OBJECT(&s->armv7m), OBJECT(s), "idau", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    /* Connect our EXP_IRQ GPIOs to the NVIC's lines 32 and up. */
+    s->exp_irqs = g_new(qemu_irq, s->exp_numirq);
+    for (i = 0; i < s->exp_numirq; i++) {
+        s->exp_irqs[i] = qdev_get_gpio_in(DEVICE(&s->armv7m), i + 32);
+    }
+    qdev_init_gpio_in_named(dev, iotkit_exp_irq, "EXP_IRQ", s->exp_numirq);
+
+    /* Set up the big aliases first */
+    make_alias(s, &s->alias1, "alias 1", 0x10000000, 0x10000000, 0x00000000);
+    make_alias(s, &s->alias2, "alias 2", 0x30000000, 0x10000000, 0x20000000);
+    /* The 0x50000000..0x5fffffff region is not a pure alias: it has
+     * a few extra devices that only appear there (generally the
+     * control interfaces for the protection controllers).
+     * We implement this by mapping those devices over the top of this
+     * alias MR at a higher priority.
+     */
+    make_alias(s, &s->alias3, "alias 3", 0x50000000, 0x10000000, 0x40000000);
+
+    /* This RAM should be behind a Memory Protection Controller, but we
+     * don't implement that yet.
+     */
+    memory_region_init_ram(&s->sram0, NULL, "iotkit.sram0", 0x00008000, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(&s->container, 0x20000000, &s->sram0);
+
+    /* Security controller */
+    object_property_set_bool(OBJECT(&s->secctl), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sbd_secctl = SYS_BUS_DEVICE(&s->secctl);
+    dev_secctl = DEVICE(&s->secctl);
+    sysbus_mmio_map(sbd_secctl, 0, 0x50080000);
+    sysbus_mmio_map(sbd_secctl, 1, 0x40080000);
+
+    s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1);
+    qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in);
+
+    /* The sec_resp_cfg output from the security controller must be split into
+     * multiple lines, one for each of the PPCs within the IoTKit and one
+     * that will be an output from the IoTKit to the system.
+     */
+    object_property_set_int(OBJECT(&s->sec_resp_splitter), 3,
+                            "num-lines", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_bool(OBJECT(&s->sec_resp_splitter), true,
+                             "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    dev_splitter = DEVICE(&s->sec_resp_splitter);
+    qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0,
+                                qdev_get_gpio_in(dev_splitter, 0));
+
+    /* Devices behind APB PPC0:
+     *   0x40000000: timer0
+     *   0x40001000: timer1
+     *   0x40002000: dual timer
+     * We must configure and realize each downstream device and connect
+     * it to the appropriate PPC port; then we can realize the PPC and
+     * map its upstream ends to the right place in the container.
+     */
+    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
+    object_property_set_bool(OBJECT(&s->timer0), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer0), 0,
+                       qdev_get_gpio_in(DEVICE(&s->armv7m), 3));
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer0), 0);
+    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[0]", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
+    object_property_set_bool(OBJECT(&s->timer1), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0,
+                       qdev_get_gpio_in(DEVICE(&s->armv7m), 3));
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0);
+    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[1]", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    qdev_prop_set_string(DEVICE(&s->dualtimer), "name", "Dual timer");
+    qdev_prop_set_uint64(DEVICE(&s->dualtimer), "size", 0x1000);
+    object_property_set_bool(OBJECT(&s->dualtimer), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0);
+    object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[2]", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    object_property_set_bool(OBJECT(&s->apb_ppc0), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc0);
+    dev_apb_ppc0 = DEVICE(&s->apb_ppc0);
+
+    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 0);
+    memory_region_add_subregion(&s->container, 0x40000000, mr);
+    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 1);
+    memory_region_add_subregion(&s->container, 0x40001000, mr);
+    mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2);
+    memory_region_add_subregion(&s->container, 0x40002000, mr);
+    for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) {
+        qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i,
+                                    qdev_get_gpio_in_named(dev_apb_ppc0,
+                                                           "cfg_nonsec", i));
+        qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i,
+                                    qdev_get_gpio_in_named(dev_apb_ppc0,
+                                                           "cfg_ap", i));
+    }
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc0,
+                                                       "irq_enable", 0));
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc0,
+                                                       "irq_clear", 0));
+    qdev_connect_gpio_out(dev_splitter, 0,
+                          qdev_get_gpio_in_named(dev_apb_ppc0,
+                                                 "cfg_sec_resp", 0));
+
+    /* All the PPC irq lines (from the 2 internal PPCs and the 8 external
+     * ones) are sent individually to the security controller, and also
+     * ORed together to give a single combined PPC interrupt to the NVIC.
+     */
+    object_property_set_int(OBJECT(&s->ppc_irq_orgate),
+                            NUM_PPCS, "num-lines", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_bool(OBJECT(&s->ppc_irq_orgate), true,
+                             "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0,
+                          qdev_get_gpio_in(DEVICE(&s->armv7m), 10));
+
+    /* 0x40010000 .. 0x4001ffff: private CPU region: unused in IoTKit */
+
+    /* 0x40020000 .. 0x4002ffff : IoTKit system control peripheral region */
+    /* Devices behind APB PPC1:
+     *   0x4002f000: S32K timer
+     */
+    qdev_prop_set_string(DEVICE(&s->s32ktimer), "name", "S32KTIMER");
+    qdev_prop_set_uint64(DEVICE(&s->s32ktimer), "size", 0x1000);
+    object_property_set_bool(OBJECT(&s->s32ktimer), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0);
+    object_property_set_link(OBJECT(&s->apb_ppc1), OBJECT(mr), "port[0]", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    object_property_set_bool(OBJECT(&s->apb_ppc1), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc1), 0);
+    memory_region_add_subregion(&s->container, 0x4002f000, mr);
+
+    dev_apb_ppc1 = DEVICE(&s->apb_ppc1);
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc1,
+                                                       "cfg_nonsec", 0));
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc1,
+                                                       "cfg_ap", 0));
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc1,
+                                                       "irq_enable", 0));
+    qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0,
+                                qdev_get_gpio_in_named(dev_apb_ppc1,
+                                                       "irq_clear", 0));
+    qdev_connect_gpio_out(dev_splitter, 1,
+                          qdev_get_gpio_in_named(dev_apb_ppc1,
+                                                 "cfg_sec_resp", 0));
+
+    /* Using create_unimplemented_device() maps the stub into the
+     * system address space rather than into our container, but the
+     * overall effect to the guest is the same.
+     */
+    create_unimplemented_device("SYSINFO", 0x40020000, 0x1000);
+
+    create_unimplemented_device("SYSCONTROL", 0x50021000, 0x1000);
+    create_unimplemented_device("S32KWATCHDOG", 0x5002e000, 0x1000);
+
+    /* 0x40080000 .. 0x4008ffff : IoTKit second Base peripheral region */
+
+    create_unimplemented_device("NS watchdog", 0x40081000, 0x1000);
+    create_unimplemented_device("S watchdog", 0x50081000, 0x1000);
+
+    create_unimplemented_device("SRAM0 MPC", 0x50083000, 0x1000);
+
+    for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
+        Object *splitter = OBJECT(&s->ppc_irq_splitter[i]);
+
+        object_property_set_int(splitter, 2, "num-lines", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        object_property_set_bool(splitter, true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+
+    for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
+        char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
+
+        iotkit_forward_ppc(s, ppcname, i);
+        g_free(ppcname);
+    }
+
+    for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
+        char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
+
+        iotkit_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC);
+        g_free(ppcname);
+    }
+
+    for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) {
+        /* Wire up IRQ splitter for internal PPCs */
+        DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]);
+        char *gpioname = g_strdup_printf("apb_ppc%d_irq_status",
+                                         i - NUM_EXTERNAL_PPCS);
+        TZPPC *ppc = (i == NUM_EXTERNAL_PPCS) ? &s->apb_ppc0 : &s->apb_ppc1;
+
+        qdev_connect_gpio_out(devs, 0,
+                              qdev_get_gpio_in_named(dev_secctl, gpioname, 0));
+        qdev_connect_gpio_out(devs, 1,
+                              qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i));
+        qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0,
+                                    qdev_get_gpio_in(devs, 0));
+    }
+
+    iotkit_forward_sec_resp_cfg(s);
+
+    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
+}
+
+static void iotkit_idau_check(IDAUInterface *ii, uint32_t address,
+                              int *iregion, bool *exempt, bool *ns, bool *nsc)
+{
+    /* For IoTKit systems the IDAU responses are simple logical functions
+     * of the address bits. The NSC attribute is guest-adjustable via the
+     * NSCCFG register in the security controller.
+     */
+    IoTKit *s = IOTKIT(ii);
+    int region = extract32(address, 28, 4);
+
+    *ns = !(region & 1);
+    *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2));
+    /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
+    *exempt = (address & 0xeff00000) == 0xe0000000;
+    *iregion = region;
+}
+
+static const VMStateDescription iotkit_vmstate = {
+    .name = "iotkit",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(nsccfg, IoTKit),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property iotkit_properties[] = {
+    DEFINE_PROP_LINK("memory", IoTKit, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", IoTKit, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", IoTKit, mainclk_frq, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void iotkit_reset(DeviceState *dev)
+{
+    IoTKit *s = IOTKIT(dev);
+
+    s->nsccfg = 0;
+}
+
+static void iotkit_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
+
+    dc->realize = iotkit_realize;
+    dc->vmsd = &iotkit_vmstate;
+    dc->props = iotkit_properties;
+    dc->reset = iotkit_reset;
+    iic->check = iotkit_idau_check;
+}
+
+static const TypeInfo iotkit_info = {
+    .name = TYPE_IOTKIT,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IoTKit),
+    .instance_init = iotkit_init,
+    .class_init = iotkit_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { TYPE_IDAU_INTERFACE },
+        { }
+    }
+};
+
+static void iotkit_register_types(void)
+{
+    type_register_static(&iotkit_info);
+}
+
+type_init(iotkit_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_MPS2_FPGAIO=y
 CONFIG_MPS2_SCC=y
 
 CONFIG_TZ_PPC=y
+CONFIG_IOTKIT=y
 CONFIG_IOTKIT_SECCTL=y
 
 CONFIG_VERSATILE_PCI=y
-- 
2.16.2

Define a new board model for the MPS2 with an AN505 FPGA image
containing a Cortex-M33. Since the FPGA images for TrustZone
cores (AN505, and the similar AN519 for Cortex-M23) have a
significantly different layout of devices to the non-TrustZone
images, we use a new source file rather than shoehorning them
into the existing mps2.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180220180325.29818-20-peter.maydell@linaro.org
---
 hw/arm/Makefile.objs |   1 +
 hw/arm/mps2-tz.c     | 503 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 504 insertions(+)
 create mode 100644 hw/arm/mps2-tz.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
 obj-$(CONFIG_MPS2) += mps2.o
+obj-$(CONFIG_MPS2) += mps2-tz.o
 obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
 obj-$(CONFIG_IOTKIT) += iotkit.o
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM V2M MPS2 board emulation, trustzone aware FPGA images
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
+ * FPGA but is otherwise the same as the 2). Since the CPU itself
+ * and most of the devices are in the FPGA, the details of the board
+ * as seen by the guest depend significantly on the FPGA image.
+ * This source file covers the following FPGA images, for TrustZone cores:
+ *  "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
+ *
+ * Links to the TRM for the board itself and to the various Application
+ * Notes which document the FPGA images can be found here:
+ * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
+ *
+ * Board TRM:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
+ * Application Note AN505:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
+ *
+ * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
+ * (ARM ECM0601256) for the details of some of the device layout:
+ *   http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "hw/arm/arm.h"
+#include "hw/arm/armv7m.h"
+#include "hw/or-irq.h"
+#include "hw/boards.h"
+#include "exec/address-spaces.h"
+#include "sysemu/sysemu.h"
+#include "hw/misc/unimp.h"
+#include "hw/char/cmsdk-apb-uart.h"
+#include "hw/timer/cmsdk-apb-timer.h"
+#include "hw/misc/mps2-scc.h"
+#include "hw/misc/mps2-fpgaio.h"
+#include "hw/arm/iotkit.h"
+#include "hw/devices.h"
+#include "net/net.h"
+#include "hw/core/split-irq.h"
+
+typedef enum MPS2TZFPGAType {
+    FPGA_AN505,
+} MPS2TZFPGAType;
+
+typedef struct {
+    MachineClass parent;
+    MPS2TZFPGAType fpga_type;
+    uint32_t scc_id;
+} MPS2TZMachineClass;
+
+typedef struct {
+    MachineState parent;
+
+    IoTKit iotkit;
+    MemoryRegion psram;
+    MemoryRegion ssram1;
+    MemoryRegion ssram1_m;
+    MemoryRegion ssram23;
+    MPS2SCC scc;
+    MPS2FPGAIO fpgaio;
+    TZPPC ppc[5];
+    UnimplementedDeviceState ssram_mpc[3];
+    UnimplementedDeviceState spi[5];
+    UnimplementedDeviceState i2c[4];
+    UnimplementedDeviceState i2s_audio;
+    UnimplementedDeviceState gpio[5];
+    UnimplementedDeviceState dma[4];
+    UnimplementedDeviceState gfx;
+    CMSDKAPBUART uart[5];
+    SplitIRQ sec_resp_splitter;
+    qemu_or_irq uart_irq_orgate;
+} MPS2TZMachineState;
+
+#define TYPE_MPS2TZ_MACHINE "mps2tz"
+#define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
+
+#define MPS2TZ_MACHINE(obj) \
+    OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
+#define MPS2TZ_MACHINE_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
+#define MPS2TZ_MACHINE_CLASS(klass) \
+    OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
+
+/* Main SYSCLK frequency in Hz */
+#define SYSCLK_FRQ 20000000
+
+/* Initialize the auxiliary RAM region @mr and map it into
+ * the memory map at @base.
+ */
+static void make_ram(MemoryRegion *mr, const char *name,
+                     hwaddr base, hwaddr size)
+{
+    memory_region_init_ram(mr, NULL, name, size, &error_fatal);
+    memory_region_add_subregion(get_system_memory(), base, mr);
+}
+
+/* Create an alias of an entire original MemoryRegion @orig
+ * located at @base in the memory map.
+ */
+static void make_ram_alias(MemoryRegion *mr, const char *name,
+                           MemoryRegion *orig, hwaddr base)
+{
+    memory_region_init_alias(mr, NULL, name, orig, 0,
+                             memory_region_size(orig));
+    memory_region_add_subregion(get_system_memory(), base, mr);
+}
+
+static void init_sysbus_child(Object *parent, const char *childname,
+                              void *child, size_t childsize,
+                              const char *childtype)
+{
+    object_initialize(child, childsize, childtype);
+    object_property_add_child(parent, childname, OBJECT(child), &error_abort);
+    qdev_set_parent_bus(DEVICE(child), sysbus_get_default());
+
+}
+
+/* Most of the devices in the AN505 FPGA image sit behind
+ * Peripheral Protection Controllers. These data structures
+ * define the layout of which devices sit behind which PPCs.
+ * The devfn for each port is a function which creates, configures
+ * and initializes the device, returning the MemoryRegion which
+ * needs to be plugged into the downstream end of the PPC port.
+ */
+typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
+                                const char *name, hwaddr size);
+
+typedef struct PPCPortInfo {
+    const char *name;
+    MakeDevFn *devfn;
+    void *opaque;
+    hwaddr addr;
+    hwaddr size;
+} PPCPortInfo;
+
+typedef struct PPCInfo {
+    const char *name;
+    PPCPortInfo ports[TZ_NUM_PORTS];
+} PPCInfo;
+
+static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
+                                       void *opaque,
+                                       const char *name, hwaddr size)
+{
+    /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
+     * and return a pointer to its MemoryRegion.
+     */
+    UnimplementedDeviceState *uds = opaque;
+
+    init_sysbus_child(OBJECT(mms), name, uds,
+                      sizeof(UnimplementedDeviceState),
+                      TYPE_UNIMPLEMENTED_DEVICE);
+    qdev_prop_set_string(DEVICE(uds), "name", name);
+    qdev_prop_set_uint64(DEVICE(uds), "size", size);
+    object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
+    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
+}
+
+static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size)
+{
+    CMSDKAPBUART *uart = opaque;
+    int i = uart - &mms->uart[0];
+    Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
+    int rxirqno = i * 2;
+    int txirqno = i * 2 + 1;
+    int combirqno = i + 10;
+    SysBusDevice *s;
+    DeviceState *iotkitdev = DEVICE(&mms->iotkit);
+    DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
+
+    init_sysbus_child(OBJECT(mms), name, uart,
+                      sizeof(mms->uart[0]), TYPE_CMSDK_APB_UART);
+    qdev_prop_set_chr(DEVICE(uart), "chardev", uartchr);
+    qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
+    object_property_set_bool(OBJECT(uart), true, "realized", &error_fatal);
+    s = SYS_BUS_DEVICE(uart);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in_named(iotkitdev,
+                                                    "EXP_IRQ", txirqno));
+    sysbus_connect_irq(s, 1, qdev_get_gpio_in_named(iotkitdev,
+                                                    "EXP_IRQ", rxirqno));
+    sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
+    sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
+    sysbus_connect_irq(s, 4, qdev_get_gpio_in_named(iotkitdev,
+                                                    "EXP_IRQ", combirqno));
+    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
+}
+
+static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
+                              const char *name, hwaddr size)
+{
+    MPS2SCC *scc = opaque;
+    DeviceState *sccdev;
+    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+
+    object_initialize(scc, sizeof(mms->scc), TYPE_MPS2_SCC);
+    sccdev = DEVICE(scc);
+    qdev_set_parent_bus(sccdev, sysbus_get_default());
+    qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
+    qdev_prop_set_uint32(sccdev, "scc-aid", 0x02000008);
+    qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
+    object_property_set_bool(OBJECT(scc), true, "realized", &error_fatal);
+    return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
+}
+
+static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
+                                 const char *name, hwaddr size)
+{
+    MPS2FPGAIO *fpgaio = opaque;
+
+    object_initialize(fpgaio, sizeof(mms->fpgaio), TYPE_MPS2_FPGAIO);
+    qdev_set_parent_bus(DEVICE(fpgaio), sysbus_get_default());
+    object_property_set_bool(OBJECT(fpgaio), true, "realized", &error_fatal);
+    return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
+}
+
+static void mps2tz_common_init(MachineState *machine)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    DeviceState *iotkitdev;
+    DeviceState *dev_splitter;
+    int i;
+
+    if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
+        error_report("This board can only be used with CPU %s",
+                     mc->default_cpu_type);
+        exit(1);
+    }
+
+    init_sysbus_child(OBJECT(machine), "iotkit", &mms->iotkit,
+                      sizeof(mms->iotkit), TYPE_IOTKIT);
+    iotkitdev = DEVICE(&mms->iotkit);
+    object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
+                             "memory", &error_abort);
+    qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", 92);
+    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
+    object_property_set_bool(OBJECT(&mms->iotkit), true, "realized",
+                             &error_fatal);
+
+    /* The sec_resp_cfg output from the IoTKit must be split into multiple
+     * lines, one for each of the PPCs we create here.
+     */
+    object_initialize(&mms->sec_resp_splitter, sizeof(mms->sec_resp_splitter),
+                      TYPE_SPLIT_IRQ);
+    object_property_add_child(OBJECT(machine), "sec-resp-splitter",
+                              OBJECT(&mms->sec_resp_splitter), &error_abort);
+    object_property_set_int(OBJECT(&mms->sec_resp_splitter), 5,
+                            "num-lines", &error_fatal);
+    object_property_set_bool(OBJECT(&mms->sec_resp_splitter), true,
+                             "realized", &error_fatal);
+    dev_splitter = DEVICE(&mms->sec_resp_splitter);
+    qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
+                                qdev_get_gpio_in(dev_splitter, 0));
+
+    /* The IoTKit sets up much of the memory layout, including
+     * the aliases between secure and non-secure regions in the
+     * address space. The FPGA itself contains:
+     *
+     * 0x00000000..0x003fffff  SSRAM1
+     * 0x00400000..0x007fffff  alias of SSRAM1
+     * 0x28000000..0x283fffff  4MB SSRAM2 + SSRAM3
+     * 0x40100000..0x4fffffff  AHB Master Expansion 1 interface devices
+     * 0x80000000..0x80ffffff  16MB PSRAM
+     */
+
+    /* The FPGA images have an odd combination of different RAMs,
+     * because in hardware they are different implementations and
+     * connected to different buses, giving varying performance/size
+     * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
+     * call the 16MB our "system memory", as it's the largest lump.
+     */
+    memory_region_allocate_system_memory(&mms->psram,
+                                         NULL, "mps.ram", 0x01000000);
+    memory_region_add_subregion(system_memory, 0x80000000, &mms->psram);
+
+    /* The SSRAM memories should all be behind Memory Protection Controllers,
+     * but we don't implement that yet.
+     */
+    make_ram(&mms->ssram1, "mps.ssram1", 0x00000000, 0x00400000);
+    make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", &mms->ssram1, 0x00400000);
+
+    make_ram(&mms->ssram23, "mps.ssram23", 0x28000000, 0x00400000);
+
+    /* The overflow IRQs for all UARTs are ORed together.
+     * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
+     * Create the OR gate for this.
+     */
+    object_initialize(&mms->uart_irq_orgate, sizeof(mms->uart_irq_orgate),
+                      TYPE_OR_IRQ);
+    object_property_add_child(OBJECT(mms), "uart-irq-orgate",
+                              OBJECT(&mms->uart_irq_orgate), &error_abort);
+    object_property_set_int(OBJECT(&mms->uart_irq_orgate), 10, "num-lines",
+                            &error_fatal);
+    object_property_set_bool(OBJECT(&mms->uart_irq_orgate), true,
+                             "realized", &error_fatal);
+    qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
+                          qdev_get_gpio_in_named(iotkitdev, "EXP_IRQ", 15));
+
+    /* Most of the devices in the FPGA are behind Peripheral Protection
+     * Controllers. The required order for initializing things is:
+     *  + initialize the PPC
+     *  + initialize, configure and realize downstream devices
+     *  + connect downstream device MemoryRegions to the PPC
+     *  + realize the PPC
+     *  + map the PPC's MemoryRegions to the places in the address map
+     *    where the downstream devices should appear
+     *  + wire up the PPC's control lines to the IoTKit object
+     */
+
+    const PPCInfo ppcs[] = { {
+            .name = "apb_ppcexp0",
+            .ports = {
+                { "ssram-mpc0", make_unimp_dev, &mms->ssram_mpc[0],
+                  0x58007000, 0x1000 },
+                { "ssram-mpc1", make_unimp_dev, &mms->ssram_mpc[1],
+                  0x58008000, 0x1000 },
+                { "ssram-mpc2", make_unimp_dev, &mms->ssram_mpc[2],
+                  0x58009000, 0x1000 },
+            },
+        }, {
+            .name = "apb_ppcexp1",
+            .ports = {
+                { "spi0", make_unimp_dev, &mms->spi[0], 0x40205000, 0x1000 },
+                { "spi1", make_unimp_dev, &mms->spi[1], 0x40206000, 0x1000 },
+                { "spi2", make_unimp_dev, &mms->spi[2], 0x40209000, 0x1000 },
+                { "spi3", make_unimp_dev, &mms->spi[3], 0x4020a000, 0x1000 },
+                { "spi4", make_unimp_dev, &mms->spi[4], 0x4020b000, 0x1000 },
+                { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
+                { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
+                { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
+                { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
+                { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
+                { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40207000, 0x1000 },
+                { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40208000, 0x1000 },
+                { "i2c2", make_unimp_dev, &mms->i2c[2], 0x4020c000, 0x1000 },
+                { "i2c3", make_unimp_dev, &mms->i2c[3], 0x4020d000, 0x1000 },
+            },
+        }, {
+            .name = "apb_ppcexp2",
+            .ports = {
+                { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
+                { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
+                  0x40301000, 0x1000 },
+                { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
+            },
+        }, {
+            .name = "ahb_ppcexp0",
+            .ports = {
+                { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
+                { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
+                { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
+                { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
+                { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
+                { "gpio4", make_unimp_dev, &mms->gpio[4], 0x40104000, 0x1000 },
+            },
+        }, {
+            .name = "ahb_ppcexp1",
+            .ports = {
+                { "dma0", make_unimp_dev, &mms->dma[0], 0x40110000, 0x1000 },
+                { "dma1", make_unimp_dev, &mms->dma[1], 0x40111000, 0x1000 },
+                { "dma2", make_unimp_dev, &mms->dma[2], 0x40112000, 0x1000 },
+                { "dma3", make_unimp_dev, &mms->dma[3], 0x40113000, 0x1000 },
+            },
+        },
+    };
+
+    for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
+        const PPCInfo *ppcinfo = &ppcs[i];
+        TZPPC *ppc = &mms->ppc[i];
+        DeviceState *ppcdev;
+        int port;
+        char *gpioname;
+
+        init_sysbus_child(OBJECT(machine), ppcinfo->name, ppc,
+                          sizeof(TZPPC), TYPE_TZ_PPC);
+        ppcdev = DEVICE(ppc);
+
+        for (port = 0; port < TZ_NUM_PORTS; port++) {
+            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
+            MemoryRegion *mr;
+            char *portname;
+
+            if (!pinfo->devfn) {
+                continue;
+            }
+
+            mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
+            portname = g_strdup_printf("port[%d]", port);
+            object_property_set_link(OBJECT(ppc), OBJECT(mr),
+                                     portname, &error_fatal);
+            g_free(portname);
+        }
+
+        object_property_set_bool(OBJECT(ppc), true, "realized", &error_fatal);
+
+        for (port = 0; port < TZ_NUM_PORTS; port++) {
+            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
+
+            if (!pinfo->devfn) {
+                continue;
+            }
+            sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
+
+            gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
+            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
+                                        qdev_get_gpio_in_named(ppcdev,
+                                                               "cfg_nonsec",
+                                                               port));
+            g_free(gpioname);
+            gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
+            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
+                                        qdev_get_gpio_in_named(ppcdev,
+                                                               "cfg_ap", port));
+            g_free(gpioname);
+        }
+
+        gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
+        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
+                                    qdev_get_gpio_in_named(ppcdev,
+                                                           "irq_enable", 0));
+        g_free(gpioname);
+        gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
+        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
+                                    qdev_get_gpio_in_named(ppcdev,
+                                                           "irq_clear", 0));
+        g_free(gpioname);
+        gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
+        qdev_connect_gpio_out_named(ppcdev, "irq", 0,
+                                    qdev_get_gpio_in_named(iotkitdev,
+                                                           gpioname, 0));
+        g_free(gpioname);
+
+        qdev_connect_gpio_out(dev_splitter, i,
+                              qdev_get_gpio_in_named(ppcdev,
+                                                     "cfg_sec_resp", 0));
+    }
+
+    /* In hardware this is a LAN9220; the LAN9118 is software compatible
+     * except that it doesn't support the checksum-offload feature.
+     * The ethernet controller is not behind a PPC.
+     */
+    lan9118_init(&nd_table[0], 0x42000000,
+                 qdev_get_gpio_in_named(iotkitdev, "EXP_IRQ", 16));
+
+    create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
+
+    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
+}
+
+static void mps2tz_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->init = mps2tz_common_init;
+    mc->max_cpus = 1;
+}
+
+static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
+
+    mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
+    mmc->fpga_type = FPGA_AN505;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
+    mmc->scc_id = 0x41040000 | (505 << 4);
+}
+
+static const TypeInfo mps2tz_info = {
+    .name = TYPE_MPS2TZ_MACHINE,
+    .parent = TYPE_MACHINE,
+    .abstract = true,
+    .instance_size = sizeof(MPS2TZMachineState),
+    .class_size = sizeof(MPS2TZMachineClass),
+    .class_init = mps2tz_class_init,
+};
+
+static const TypeInfo mps2tz_an505_info = {
+    .name = TYPE_MPS2TZ_AN505_MACHINE,
+    .parent = TYPE_MPS2TZ_MACHINE,
+    .class_init = mps2tz_an505_class_init,
+};
+
+static void mps2tz_machine_init(void)
+{
+    type_register_static(&mps2tz_info);
+    type_register_static(&mps2tz_an505_info);
+}
+
+type_init(mps2tz_machine_init);
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Not enabled anywhere yet.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 1 +
 linux-user/elfload.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
+    ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
     ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
 };
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
     GET_FEATURE(ARM_FEATURE_V8_SHA512, ARM_HWCAP_A64_SHA512);
     GET_FEATURE(ARM_FEATURE_V8_FP16,
                 ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+    GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
 #undef GET_FEATURE
 
     return hwcaps;
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Include the U bit in the switches rather than testing separately.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180228193125.20577-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 129 +++++++++++++++++++++------------------------
 1 file changed, 61 insertions(+), 68 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     int index;
     TCGv_ptr fpst;
 
-    switch (opcode) {
-    case 0x0: /* MLA */
-    case 0x4: /* MLS */
-        if (!u || is_scalar) {
+    switch (16 * u + opcode) {
+    case 0x08: /* MUL */
+    case 0x10: /* MLA */
+    case 0x14: /* MLS */
+        if (is_scalar) {
             unallocated_encoding(s);
             return;
         }
         break;
-    case 0x2: /* SMLAL, SMLAL2, UMLAL, UMLAL2 */
-    case 0x6: /* SMLSL, SMLSL2, UMLSL, UMLSL2 */
-    case 0xa: /* SMULL, SMULL2, UMULL, UMULL2 */
+    case 0x02: /* SMLAL, SMLAL2 */
+    case 0x12: /* UMLAL, UMLAL2 */
+    case 0x06: /* SMLSL, SMLSL2 */
+    case 0x16: /* UMLSL, UMLSL2 */
+    case 0x0a: /* SMULL, SMULL2 */
+    case 0x1a: /* UMULL, UMULL2 */
         if (is_scalar) {
             unallocated_encoding(s);
             return;
         }
         is_long = true;
         break;
-    case 0x3: /* SQDMLAL, SQDMLAL2 */
-    case 0x7: /* SQDMLSL, SQDMLSL2 */
-    case 0xb: /* SQDMULL, SQDMULL2 */
+    case 0x03: /* SQDMLAL, SQDMLAL2 */
+    case 0x07: /* SQDMLSL, SQDMLSL2 */
+    case 0x0b: /* SQDMULL, SQDMULL2 */
         is_long = true;
-        /* fall through */
-    case 0xc: /* SQDMULH */
-    case 0xd: /* SQRDMULH */
-        if (u) {
-            unallocated_encoding(s);
-            return;
-        }
         break;
-    case 0x8: /* MUL */
-        if (u || is_scalar) {
-            unallocated_encoding(s);
-            return;
-        }
+    case 0x0c: /* SQDMULH */
+    case 0x0d: /* SQRDMULH */
         break;
-    case 0x1: /* FMLA */
-    case 0x5: /* FMLS */
-        if (u) {
-            unallocated_encoding(s);
-            return;
-        }
-        /* fall through */
-    case 0x9: /* FMUL, FMULX */
+    case 0x01: /* FMLA */
+    case 0x05: /* FMLS */
+    case 0x09: /* FMUL */
+    case 0x19: /* FMULX */
         if (size == 1) {
             unallocated_encoding(s);
             return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
 
             read_vec_element(s, tcg_op, rn, pass, MO_64);
 
-            switch (opcode) {
-            case 0x5: /* FMLS */
+            switch (16 * u + opcode) {
+            case 0x05: /* FMLS */
                 /* As usual for ARM, separate negation for fused multiply-add */
                 gen_helper_vfp_negd(tcg_op, tcg_op);
                 /* fall through */
-            case 0x1: /* FMLA */
+            case 0x01: /* FMLA */
                 read_vec_element(s, tcg_res, rd, pass, MO_64);
                 gen_helper_vfp_muladdd(tcg_res, tcg_op, tcg_idx, tcg_res, fpst);
                 break;
-            case 0x9: /* FMUL, FMULX */
-                if (u) {
-                    gen_helper_vfp_mulxd(tcg_res, tcg_op, tcg_idx, fpst);
-                } else {
-                    gen_helper_vfp_muld(tcg_res, tcg_op, tcg_idx, fpst);
-                }
+            case 0x09: /* FMUL */
+                gen_helper_vfp_muld(tcg_res, tcg_op, tcg_idx, fpst);
+                break;
+            case 0x19: /* FMULX */
+                gen_helper_vfp_mulxd(tcg_res, tcg_op, tcg_idx, fpst);
                 break;
             default:
                 g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
 
             read_vec_element_i32(s, tcg_op, rn, pass, is_scalar ? size : MO_32);
 
-            switch (opcode) {
-            case 0x0: /* MLA */
-            case 0x4: /* MLS */
-            case 0x8: /* MUL */
+            switch (16 * u + opcode) {
+            case 0x08: /* MUL */
+            case 0x10: /* MLA */
+            case 0x14: /* MLS */
             {
                 static NeonGenTwoOpFn * const fns[2][2] = {
                     { gen_helper_neon_add_u16, gen_helper_neon_sub_u16 },
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                 genfn(tcg_res, tcg_op, tcg_res);
                 break;
             }
-            case 0x5: /* FMLS */
-            case 0x1: /* FMLA */
+            case 0x05: /* FMLS */
+            case 0x01: /* FMLA */
                 read_vec_element_i32(s, tcg_res, rd, pass,
                                      is_scalar ? size : MO_32);
                 switch (size) {
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                     g_assert_not_reached();
                 }
                 break;
-            case 0x9: /* FMUL, FMULX */
+            case 0x09: /* FMUL */
                 switch (size) {
                 case 1:
-                    if (u) {
-                        if (is_scalar) {
-                            gen_helper_advsimd_mulxh(tcg_res, tcg_op,
-                                                     tcg_idx, fpst);
-                        } else {
-                            gen_helper_advsimd_mulx2h(tcg_res, tcg_op,
-                                                      tcg_idx, fpst);
-                        }
+                    if (is_scalar) {
+                        gen_helper_advsimd_mulh(tcg_res, tcg_op,
+                                                tcg_idx, fpst);
                     } else {
-                        if (is_scalar) {
-                            gen_helper_advsimd_mulh(tcg_res, tcg_op,
-                                                    tcg_idx, fpst);
-                        } else {
-                            gen_helper_advsimd_mul2h(tcg_res, tcg_op,
-                                                     tcg_idx, fpst);
-                        }
+                        gen_helper_advsimd_mul2h(tcg_res, tcg_op,
+                                                 tcg_idx, fpst);
                     }
                     break;
                 case 2:
-                    if (u) {
-                        gen_helper_vfp_mulxs(tcg_res, tcg_op, tcg_idx, fpst);
-                    } else {
-                        gen_helper_vfp_muls(tcg_res, tcg_op, tcg_idx, fpst);
-                    }
+                    gen_helper_vfp_muls(tcg_res, tcg_op, tcg_idx, fpst);
                     break;
                 default:
                     g_assert_not_reached();
                 }
                 break;
-            case 0xc: /* SQDMULH */
+            case 0x19: /* FMULX */
+                switch (size) {
+                case 1:
+                    if (is_scalar) {
+                        gen_helper_advsimd_mulxh(tcg_res, tcg_op,
+                                                 tcg_idx, fpst);
+                    } else {
+                        gen_helper_advsimd_mulx2h(tcg_res, tcg_op,
+                                                  tcg_idx, fpst);
+                    }
+                    break;
+                case 2:
+                    gen_helper_vfp_mulxs(tcg_res, tcg_op, tcg_idx, fpst);
+                    break;
+                default:
+                    g_assert_not_reached();
+                }
+                break;
+            case 0x0c: /* SQDMULH */
                 if (size == 1) {
                     gen_helper_neon_qdmulh_s16(tcg_res, cpu_env,
                                                tcg_op, tcg_idx);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                                                tcg_op, tcg_idx);
                 }
                 break;
-            case 0xd: /* SQRDMULH */
+            case 0x0d: /* SQRDMULH */
                 if (size == 1) {
                     gen_helper_neon_qrdmulh_s16(tcg_res, cpu_env,
                                                 tcg_op, tcg_idx);
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

The integer size check was already outside of the opcode switch;
move the floating-point size check outside as well.  Unify the
size vs index adjustment between fp and integer paths.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180228193125.20577-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 +++++++++++++++++++++++-----------------------
 1 file changed, 32 insertions(+), 33 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     case 0x05: /* FMLS */
     case 0x09: /* FMUL */
     case 0x19: /* FMULX */
-        if (size == 1) {
-            unallocated_encoding(s);
-            return;
-        }
         is_fp = true;
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     if (is_fp) {
         /* convert insn encoded size to TCGMemOp size */
         switch (size) {
-        case 2: /* single precision */
-            size = MO_32;
-            index = h << 1 | l;
-            rm |= (m << 4);
-            break;
-        case 3: /* double precision */
-            size = MO_64;
-            if (l || !is_q) {
+        case 0: /* half-precision */
+            if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
                 unallocated_encoding(s);
                 return;
             }
-            index = h;
-            rm |= (m << 4);
-            break;
-        case 0: /* half precision */
             size = MO_16;
-            index = h << 2 | l << 1 | m;
-            is_fp16 = true;
-            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-                break;
-            }
-            /* fallthru */
-        default: /* unallocated */
-            unallocated_encoding(s);
-            return;
-        }
-    } else {
-        switch (size) {
-        case 1:
-            index = h << 2 | l << 1 | m;
             break;
-        case 2:
-            index = h << 1 | l;
-            rm |= (m << 4);
+        case MO_32: /* single precision */
+        case MO_64: /* double precision */
             break;
         default:
             unallocated_encoding(s);
             return;
         }
+    } else {
+        switch (size) {
+        case MO_8:
+        case MO_64:
+            unallocated_encoding(s);
+            return;
+        }
+    }
+
+    /* Given TCGMemOp size, adjust register and indexing.  */
+    switch (size) {
+    case MO_16:
+        index = h << 2 | l << 1 | m;
+        break;
+    case MO_32:
+        index = h << 1 | l;
+        rm |= m << 4;
+        break;
+    case MO_64:
+        if (l || !is_q) {
+            unallocated_encoding(s);
+            return;
+        }
+        index = h;
+        rm |= m << 4;
+        break;
+    default:
+        g_assert_not_reached();
     }
 
     if (!fp_access_check(s)) {
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/Makefile.objs   |   2 +-
 target/arm/helper.h        |   4 ++
 target/arm/translate-a64.c |  84 ++++++++++++++++++++++++++++++++++
 target/arm/vec_helper.c    | 109 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 198 insertions(+), 1 deletion(-)
 create mode 100644 target/arm/vec_helper.c

diff --git a/target/arm/Makefile.objs b/target/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/Makefile.objs
+++ b/target/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(call land,$(CONFIG_KVM),$(call lnot,$(TARGET_AARCH64))) += kvm32.o
 obj-$(call land,$(CONFIG_KVM),$(TARGET_AARCH64)) += kvm64.o
 obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
 obj-y += translate.o op_helper.o helper.o cpu.o
-obj-y += neon_helper.o iwmmxt_helper.o
+obj-y += neon_helper.o iwmmxt_helper.o vec_helper.o
 obj-y += gdbstub.o
 obj-$(TARGET_AARCH64) += cpu64.o translate-a64.o helper-a64.o gdbstub64.o
 obj-y += crypto_helper.o
diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(neon_rbit_u8, TCG_CALL_NO_RWG_SE, i32, i32)
 
 DEF_HELPER_3(neon_qdmulh_s16, i32, env, i32, i32)
 DEF_HELPER_3(neon_qrdmulh_s16, i32, env, i32, i32)
+DEF_HELPER_4(neon_qrdmlah_s16, i32, env, i32, i32, i32)
+DEF_HELPER_4(neon_qrdmlsh_s16, i32, env, i32, i32, i32)
 DEF_HELPER_3(neon_qdmulh_s32, i32, env, i32, i32)
 DEF_HELPER_3(neon_qrdmulh_s32, i32, env, i32, i32)
+DEF_HELPER_4(neon_qrdmlah_s32, i32, env, s32, s32, s32)
+DEF_HELPER_4(neon_qrdmlsh_s32, i32, env, s32, s32, s32)
 
 DEF_HELPER_1(neon_narrow_u8, i32, i64)
 DEF_HELPER_1(neon_narrow_u16, i32, i64)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
     tcg_temp_free_ptr(fpst);
 }
 
+/* AdvSIMD scalar three same extra
+ *  31 30  29 28       24 23  22  21 20  16  15 14    11  10 9  5 4  0
+ * +-----+---+-----------+------+---+------+---+--------+---+----+----+
+ * | 0 1 | U | 1 1 1 1 0 | size | 0 |  Rm  | 1 | opcode | 1 | Rn | Rd |
+ * +-----+---+-----------+------+---+------+---+--------+---+----+----+
+ */
+static void disas_simd_scalar_three_reg_same_extra(DisasContext *s,
+                                                   uint32_t insn)
+{
+    int rd = extract32(insn, 0, 5);
+    int rn = extract32(insn, 5, 5);
+    int opcode = extract32(insn, 11, 4);
+    int rm = extract32(insn, 16, 5);
+    int size = extract32(insn, 22, 2);
+    bool u = extract32(insn, 29, 1);
+    TCGv_i32 ele1, ele2, ele3;
+    TCGv_i64 res;
+    int feature;
+
+    switch (u * 16 + opcode) {
+    case 0x10: /* SQRDMLAH (vector) */
+    case 0x11: /* SQRDMLSH (vector) */
+        if (size != 1 && size != 2) {
+            unallocated_encoding(s);
+            return;
+        }
+        feature = ARM_FEATURE_V8_RDM;
+        break;
+    default:
+        unallocated_encoding(s);
+        return;
+    }
+    if (!arm_dc_feature(s, feature)) {
+        unallocated_encoding(s);
+        return;
+    }
+    if (!fp_access_check(s)) {
+        return;
+    }
+
+    /* Do a single operation on the lowest element in the vector.
+     * We use the standard Neon helpers and rely on 0 OP 0 == 0
+     * with no side effects for all these operations.
+     * OPTME: special-purpose helpers would avoid doing some
+     * unnecessary work in the helper for the 16 bit cases.
+     */
+    ele1 = tcg_temp_new_i32();
+    ele2 = tcg_temp_new_i32();
+    ele3 = tcg_temp_new_i32();
+
+    read_vec_element_i32(s, ele1, rn, 0, size);
+    read_vec_element_i32(s, ele2, rm, 0, size);
+    read_vec_element_i32(s, ele3, rd, 0, size);
+
+    switch (opcode) {
+    case 0x0: /* SQRDMLAH */
+        if (size == 1) {
+            gen_helper_neon_qrdmlah_s16(ele3, cpu_env, ele1, ele2, ele3);
+        } else {
+            gen_helper_neon_qrdmlah_s32(ele3, cpu_env, ele1, ele2, ele3);
+        }
+        break;
+    case 0x1: /* SQRDMLSH */
+        if (size == 1) {
+            gen_helper_neon_qrdmlsh_s16(ele3, cpu_env, ele1, ele2, ele3);
+        } else {
+            gen_helper_neon_qrdmlsh_s32(ele3, cpu_env, ele1, ele2, ele3);
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    tcg_temp_free_i32(ele1);
+    tcg_temp_free_i32(ele2);
+
+    res = tcg_temp_new_i64();
+    tcg_gen_extu_i32_i64(res, ele3);
+    tcg_temp_free_i32(ele3);
+
+    write_fp_dreg(s, rd, res);
+    tcg_temp_free_i64(res);
+}
+
 static void handle_2misc_64(DisasContext *s, int opcode, bool u,
                             TCGv_i64 tcg_rd, TCGv_i64 tcg_rn,
                             TCGv_i32 tcg_rmode, TCGv_ptr tcg_fpstatus)
@@ -XXX,XX +XXX,XX @@ static const AArch64DecodeTable data_proc_simd[] = {
     { 0x0e000800, 0xbf208c00, disas_simd_zip_trn },
     { 0x2e000000, 0xbf208400, disas_simd_ext },
     { 0x5e200400, 0xdf200400, disas_simd_scalar_three_reg_same },
+    { 0x5e008400, 0xdf208400, disas_simd_scalar_three_reg_same_extra },
     { 0x5e200000, 0xdf200c00, disas_simd_scalar_three_reg_diff },
     { 0x5e200800, 0xdf3e0c00, disas_simd_scalar_two_reg_misc },
     { 0x5e300800, 0xdf3e0c00, disas_simd_scalar_pairwise },
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM AdvSIMD / SVE Vector Operations
+ *
+ * Copyright (c) 2018 Linaro
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "exec/exec-all.h"
+#include "exec/helper-proto.h"
+#include "tcg/tcg-gvec-desc.h"
+
+
+#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
+
+/* Signed saturating rounding doubling multiply-accumulate high half, 16-bit */
+static uint16_t inl_qrdmlah_s16(CPUARMState *env, int16_t src1,
+                                int16_t src2, int16_t src3)
+{
+    /* Simplify:
+     * = ((a3 << 16) + ((e1 * e2) << 1) + (1 << 15)) >> 16
+     * = ((a3 << 15) + (e1 * e2) + (1 << 14)) >> 15
+     */
+    int32_t ret = (int32_t)src1 * src2;
+    ret = ((int32_t)src3 << 15) + ret + (1 << 14);
+    ret >>= 15;
+    if (ret != (int16_t)ret) {
+        SET_QC();
+        ret = (ret < 0 ? -0x8000 : 0x7fff);
+    }
+    return ret;
+}
+
+uint32_t HELPER(neon_qrdmlah_s16)(CPUARMState *env, uint32_t src1,
+                                  uint32_t src2, uint32_t src3)
+{
+    uint16_t e1 = inl_qrdmlah_s16(env, src1, src2, src3);
+    uint16_t e2 = inl_qrdmlah_s16(env, src1 >> 16, src2 >> 16, src3 >> 16);
+    return deposit32(e1, 16, 16, e2);
+}
+
+/* Signed saturating rounding doubling multiply-subtract high half, 16-bit */
+static uint16_t inl_qrdmlsh_s16(CPUARMState *env, int16_t src1,
+                                int16_t src2, int16_t src3)
+{
+    /* Similarly, using subtraction:
+     * = ((a3 << 16) - ((e1 * e2) << 1) + (1 << 15)) >> 16
+     * = ((a3 << 15) - (e1 * e2) + (1 << 14)) >> 15
+     */
+    int32_t ret = (int32_t)src1 * src2;
+    ret = ((int32_t)src3 << 15) - ret + (1 << 14);
+    ret >>= 15;
+    if (ret != (int16_t)ret) {
+        SET_QC();
+        ret = (ret < 0 ? -0x8000 : 0x7fff);
+    }
+    return ret;
+}
+
+uint32_t HELPER(neon_qrdmlsh_s16)(CPUARMState *env, uint32_t src1,
+                                  uint32_t src2, uint32_t src3)
+{
+    uint16_t e1 = inl_qrdmlsh_s16(env, src1, src2, src3);
+    uint16_t e2 = inl_qrdmlsh_s16(env, src1 >> 16, src2 >> 16, src3 >> 16);
+    return deposit32(e1, 16, 16, e2);
+}
+
+/* Signed saturating rounding doubling multiply-accumulate high half, 32-bit */
+uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
+                                  int32_t src2, int32_t src3)
+{
+    /* Simplify similarly to int_qrdmlah_s16 above.  */
+    int64_t ret = (int64_t)src1 * src2;
+    ret = ((int64_t)src3 << 31) + ret + (1 << 30);
+    ret >>= 31;
+    if (ret != (int32_t)ret) {
+        SET_QC();
+        ret = (ret < 0 ? INT32_MIN : INT32_MAX);
+    }
+    return ret;
+}
+
+/* Signed saturating rounding doubling multiply-subtract high half, 32-bit */
+uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
+                                  int32_t src2, int32_t src3)
+{
+    /* Simplify similarly to int_qrdmlsh_s16 above.  */
+    int64_t ret = (int64_t)src1 * src2;
+    ret = ((int64_t)src3 << 31) - ret + (1 << 30);
+    ret >>= 31;
+    if (ret != (int32_t)ret) {
+        SET_QC();
+        ret = (ret < 0 ? INT32_MIN : INT32_MAX);
+    }
+    return ret;
+}
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  9 +++++
 target/arm/translate-a64.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/vec_helper.c    | 74 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 166 insertions(+)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(dc_zva, void, env, i64)
 DEF_HELPER_FLAGS_2(neon_pmull_64_lo, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(neon_pmull_64_hi, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 
+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #endif
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3(DisasContext *s, bool is_q, int rd,
                    vec_full_reg_size(s), gvec_op);
 }
 
+/* Expand a 3-operand + env pointer operation using
+ * an out-of-line helper.
+ */
+static void gen_gvec_op3_env(DisasContext *s, bool is_q, int rd,
+                             int rn, int rm, gen_helper_gvec_3_ptr *fn)
+{
+    tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                       vec_full_reg_offset(s, rn),
+                       vec_full_reg_offset(s, rm), cpu_env,
+                       is_q ? 16 : 8, vec_full_reg_size(s), 0, fn);
+}
+
 /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
  * than the 32 bit equivalent.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
     clear_vec_high(s, is_q, rd);
 }
 
+/* AdvSIMD three same extra
+ *  31   30  29 28       24 23  22  21 20  16  15 14    11  10 9  5 4  0
+ * +---+---+---+-----------+------+---+------+---+--------+---+----+----+
+ * | 0 | Q | U | 0 1 1 1 0 | size | 0 |  Rm  | 1 | opcode | 1 | Rn | Rd |
+ * +---+---+---+-----------+------+---+------+---+--------+---+----+----+
+ */
+static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
+{
+    int rd = extract32(insn, 0, 5);
+    int rn = extract32(insn, 5, 5);
+    int opcode = extract32(insn, 11, 4);
+    int rm = extract32(insn, 16, 5);
+    int size = extract32(insn, 22, 2);
+    bool u = extract32(insn, 29, 1);
+    bool is_q = extract32(insn, 30, 1);
+    int feature;
+
+    switch (u * 16 + opcode) {
+    case 0x10: /* SQRDMLAH (vector) */
+    case 0x11: /* SQRDMLSH (vector) */
+        if (size != 1 && size != 2) {
+            unallocated_encoding(s);
+            return;
+        }
+        feature = ARM_FEATURE_V8_RDM;
+        break;
+    default:
+        unallocated_encoding(s);
+        return;
+    }
+    if (!arm_dc_feature(s, feature)) {
+        unallocated_encoding(s);
+        return;
+    }
+    if (!fp_access_check(s)) {
+        return;
+    }
+
+    switch (opcode) {
+    case 0x0: /* SQRDMLAH (vector) */
+        switch (size) {
+        case 1:
+            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlah_s16);
+            break;
+        case 2:
+            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlah_s32);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        return;
+
+    case 0x1: /* SQRDMLSH (vector) */
+        switch (size) {
+        case 1:
+            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlsh_s16);
+            break;
+        case 2:
+            gen_gvec_op3_env(s, is_q, rd, rn, rm, gen_helper_gvec_qrdmlsh_s32);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        return;
+
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void handle_2misc_widening(DisasContext *s, int opcode, bool is_q,
                                   int size, int rn, int rd)
 {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_imm2(DisasContext *s, uint32_t insn)
 static const AArch64DecodeTable data_proc_simd[] = {
     /* pattern  ,  mask     ,  fn                        */
     { 0x0e200400, 0x9f200400, disas_simd_three_reg_same },
+    { 0x0e008400, 0x9f208400, disas_simd_three_reg_same_extra },
     { 0x0e200000, 0x9f200c00, disas_simd_three_reg_diff },
     { 0x0e200800, 0x9f3e0c00, disas_simd_two_reg_misc },
     { 0x0e300800, 0x9f3e0c00, disas_simd_across_lanes },
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
 
 #define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
 
+static void clear_tail(void *vd, uintptr_t opr_sz, uintptr_t max_sz)
+{
+    uint64_t *d = vd + opr_sz;
+    uintptr_t i;
+
+    for (i = opr_sz; i < max_sz; i += 8) {
+        *d++ = 0;
+    }
+}
+
 /* Signed saturating rounding doubling multiply-accumulate high half, 16-bit */
 static uint16_t inl_qrdmlah_s16(CPUARMState *env, int16_t src1,
                                 int16_t src2, int16_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlah_s16)(CPUARMState *env, uint32_t src1,
     return deposit32(e1, 16, 16, e2);
 }
 
+void HELPER(gvec_qrdmlah_s16)(void *vd, void *vn, void *vm,
+                              void *ve, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    int16_t *d = vd;
+    int16_t *n = vn;
+    int16_t *m = vm;
+    CPUARMState *env = ve;
+    uintptr_t i;
+
+    for (i = 0; i < opr_sz / 2; ++i) {
+        d[i] = inl_qrdmlah_s16(env, n[i], m[i], d[i]);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
 /* Signed saturating rounding doubling multiply-subtract high half, 16-bit */
 static uint16_t inl_qrdmlsh_s16(CPUARMState *env, int16_t src1,
                                 int16_t src2, int16_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlsh_s16)(CPUARMState *env, uint32_t src1,
     return deposit32(e1, 16, 16, e2);
 }
 
+void HELPER(gvec_qrdmlsh_s16)(void *vd, void *vn, void *vm,
+                              void *ve, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    int16_t *d = vd;
+    int16_t *n = vn;
+    int16_t *m = vm;
+    CPUARMState *env = ve;
+    uintptr_t i;
+
+    for (i = 0; i < opr_sz / 2; ++i) {
+        d[i] = inl_qrdmlsh_s16(env, n[i], m[i], d[i]);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
 /* Signed saturating rounding doubling multiply-accumulate high half, 32-bit */
 uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
                                   int32_t src2, int32_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlah_s32)(CPUARMState *env, int32_t src1,
     return ret;
 }
 
+void HELPER(gvec_qrdmlah_s32)(void *vd, void *vn, void *vm,
+                              void *ve, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    int32_t *d = vd;
+    int32_t *n = vn;
+    int32_t *m = vm;
+    CPUARMState *env = ve;
+    uintptr_t i;
+
+    for (i = 0; i < opr_sz / 4; ++i) {
+        d[i] = helper_neon_qrdmlah_s32(env, n[i], m[i], d[i]);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
 /* Signed saturating rounding doubling multiply-subtract high half, 32-bit */
 uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
                                   int32_t src2, int32_t src3)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_qrdmlsh_s32)(CPUARMState *env, int32_t src1,
     }
     return ret;
 }
+
+void HELPER(gvec_qrdmlsh_s32)(void *vd, void *vn, void *vm,
+                              void *ve, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    int32_t *d = vd;
+    int32_t *n = vn;
+    int32_t *m = vm;
+    CPUARMState *env = ve;
+    uintptr_t i;
+
+    for (i = 0; i < opr_sz / 4; ++i) {
+        d[i] = helper_neon_qrdmlsh_s32(env, n[i], m[i], d[i]);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     case 0x19: /* FMULX */
         is_fp = true;
         break;
+    case 0x1d: /* SQRDMLAH */
+    case 0x1f: /* SQRDMLSH */
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
+            unallocated_encoding(s);
+            return;
+        }
+        break;
     default:
         unallocated_encoding(s);
         return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
                                                 tcg_op, tcg_idx);
                 }
                 break;
+            case 0x1d: /* SQRDMLAH */
+                read_vec_element_i32(s, tcg_res, rd, pass,
+                                     is_scalar ? size : MO_32);
+                if (size == 1) {
+                    gen_helper_neon_qrdmlah_s16(tcg_res, cpu_env,
+                                                tcg_op, tcg_idx, tcg_res);
+                } else {
+                    gen_helper_neon_qrdmlah_s32(tcg_res, cpu_env,
+                                                tcg_op, tcg_idx, tcg_res);
+                }
+                break;
+            case 0x1f: /* SQRDMLSH */
+                read_vec_element_i32(s, tcg_res, rd, pass,
+                                     is_scalar ? size : MO_32);
+                if (size == 1) {
+                    gen_helper_neon_qrdmlsh_s16(tcg_res, cpu_env,
+                                                tcg_op, tcg_idx, tcg_res);
+                } else {
+                    gen_helper_neon_qrdmlsh_s32(tcg_res, cpu_env,
+                                                tcg_op, tcg_idx, tcg_res);
+                }
+                break;
             default:
                 g_assert_not_reached();
             }
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 86 +++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 67 insertions(+), 19 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "disas/disas.h"
 #include "exec/exec-all.h"
 #include "tcg-op.h"
+#include "tcg-op-gvec.h"
 #include "qemu/log.h"
 #include "qemu/bitops.h"
 #include "arm_ldst.h"
@@ -XXX,XX +XXX,XX @@ static void gen_neon_narrow_op(int op, int u, int size,
 #define NEON_3R_VPMAX 20
 #define NEON_3R_VPMIN 21
 #define NEON_3R_VQDMULH_VQRDMULH 22
-#define NEON_3R_VPADD 23
+#define NEON_3R_VPADD_VQRDMLAH 23
 #define NEON_3R_SHA 24 /* SHA1C,SHA1P,SHA1M,SHA1SU0,SHA256H{2},SHA256SU1 */
-#define NEON_3R_VFM 25 /* VFMA, VFMS : float fused multiply-add */
+#define NEON_3R_VFM_VQRDMLSH 25 /* VFMA, VFMS, VQRDMLSH */
 #define NEON_3R_FLOAT_ARITH 26 /* float VADD, VSUB, VPADD, VABD */
 #define NEON_3R_FLOAT_MULTIPLY 27 /* float VMLA, VMLS, VMUL */
 #define NEON_3R_FLOAT_CMP 28 /* float VCEQ, VCGE, VCGT */
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
     [NEON_3R_VPMAX] = 0x7,
     [NEON_3R_VPMIN] = 0x7,
     [NEON_3R_VQDMULH_VQRDMULH] = 0x6,
-    [NEON_3R_VPADD] = 0x7,
+    [NEON_3R_VPADD_VQRDMLAH] = 0x7,
     [NEON_3R_SHA] = 0xf, /* size field encodes op type */
-    [NEON_3R_VFM] = 0x5, /* size bit 1 encodes op */
+    [NEON_3R_VFM_VQRDMLSH] = 0x7, /* For VFM, size bit 1 encodes op */
     [NEON_3R_FLOAT_ARITH] = 0x5, /* size bit 1 encodes op */
     [NEON_3R_FLOAT_MULTIPLY] = 0x5, /* size bit 1 encodes op */
     [NEON_3R_FLOAT_CMP] = 0x5, /* size bit 1 encodes op */
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_2rm_sizes[] = {
     [NEON_2RM_VCVT_UF] = 0x4,
 };
 
+
+/* Expand v8.1 simd helper.  */
+static int do_v81_helper(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                         int q, int rd, int rn, int rm)
+{
+    if (arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
+        int opr_sz = (1 + q) * 8;
+        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
+                           vfp_reg_offset(1, rn),
+                           vfp_reg_offset(1, rm), cpu_env,
+                           opr_sz, opr_sz, 0, fn);
+        return 0;
+    }
+    return 1;
+}
+
 /* Translate a NEON data processing instruction.  Return nonzero if the
    instruction is invalid.
    We process data in a mixture of 32-bit and 64-bit chunks.
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         if (q && ((rd | rn | rm) & 1)) {
             return 1;
         }
-        /*
-         * The SHA-1/SHA-256 3-register instructions require special treatment
-         * here, as their size field is overloaded as an op type selector, and
-         * they all consume their input in a single pass.
-         */
-        if (op == NEON_3R_SHA) {
+        switch (op) {
+        case NEON_3R_SHA:
+            /* The SHA-1/SHA-256 3-register instructions require special
+             * treatment here, as their size field is overloaded as an
+             * op type selector, and they all consume their input in a
+             * single pass.
+             */
             if (!q) {
                 return 1;
             }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_temp_free_ptr(ptr2);
             tcg_temp_free_ptr(ptr3);
             return 0;
+
+        case NEON_3R_VPADD_VQRDMLAH:
+            if (!u) {
+                break;  /* VPADD */
+            }
+            /* VQRDMLAH */
+            switch (size) {
+            case 1:
+                return do_v81_helper(s, gen_helper_gvec_qrdmlah_s16,
+                                     q, rd, rn, rm);
+            case 2:
+                return do_v81_helper(s, gen_helper_gvec_qrdmlah_s32,
+                                     q, rd, rn, rm);
+            }
+            return 1;
+
+        case NEON_3R_VFM_VQRDMLSH:
+            if (!u) {
+                /* VFM, VFMS */
+                if (size == 1) {
+                    return 1;
+                }
+                break;
+            }
+            /* VQRDMLSH */
+            switch (size) {
+            case 1:
+                return do_v81_helper(s, gen_helper_gvec_qrdmlsh_s16,
+                                     q, rd, rn, rm);
+            case 2:
+                return do_v81_helper(s, gen_helper_gvec_qrdmlsh_s32,
+                                     q, rd, rn, rm);
+            }
+            return 1;
         }
         if (size == 3 && op != NEON_3R_LOGIC) {
             /* 64-bit element instructions. */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 rm = rtmp;
             }
             break;
-        case NEON_3R_VPADD:
-            if (u) {
-                return 1;
-            }
-            /* Fall through */
+        case NEON_3R_VPADD_VQRDMLAH:
         case NEON_3R_VPMAX:
         case NEON_3R_VPMIN:
             pairwise = 1;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 return 1;
             }
             break;
-        case NEON_3R_VFM:
-            if (!arm_dc_feature(s, ARM_FEATURE_VFP4) || u) {
+        case NEON_3R_VFM_VQRDMLSH:
+            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
                 return 1;
             }
             break;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 }
             }
             break;
-        case NEON_3R_VPADD:
+        case NEON_3R_VPADD_VQRDMLAH:
             switch (size) {
             case 0: gen_helper_neon_padd_u8(tmp, tmp, tmp2); break;
             case 1: gen_helper_neon_padd_u16(tmp, tmp, tmp2); break;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
               }
             }
             break;
-        case NEON_3R_VFM:
+        case NEON_3R_VFM_VQRDMLSH:
         {
             /* VFMA, VFMS: fused multiply-add */
             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char *regnames[] =
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
 
+/* Function prototypes for gen_ functions calling Neon helpers.  */
+typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                 TCGv_i32, TCGv_i32);
+
 /* initialize TCG globals.  */
 void arm_translate_init(void)
 {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         }
                         neon_store_reg64(cpu_V0, rd + pass);
                     }
-
-
                     break;
-                default: /* 14 and 15 are RESERVED */
-                    return 1;
+                case 14: /* VQRDMLAH scalar */
+                case 15: /* VQRDMLSH scalar */
+                    {
+                        NeonGenThreeOpEnvFn *fn;
+
+                        if (!arm_dc_feature(s, ARM_FEATURE_V8_RDM)) {
+                            return 1;
+                        }
+                        if (u && ((rd | rn) & 1)) {
+                            return 1;
+                        }
+                        if (op == 14) {
+                            if (size == 1) {
+                                fn = gen_helper_neon_qrdmlah_s16;
+                            } else {
+                                fn = gen_helper_neon_qrdmlah_s32;
+                            }
+                        } else {
+                            if (size == 1) {
+                                fn = gen_helper_neon_qrdmlsh_s16;
+                            } else {
+                                fn = gen_helper_neon_qrdmlsh_s32;
+                            }
+                        }
+
+                        tmp2 = neon_get_scalar(size, rm);
+                        for (pass = 0; pass < (u ? 4 : 2); pass++) {
+                            tmp = neon_load_reg(rn, pass);
+                            tmp3 = neon_load_reg(rd, pass);
+                            fn(tmp, cpu_env, tmp, tmp2, tmp3);
+                            tcg_temp_free_i32(tmp3);
+                            neon_store_reg(rd, pass, tmp);
+                        }
+                        tcg_temp_free_i32(tmp2);
+                    }
+                    break;
+                default:
+                    g_assert_not_reached();
                 }
             }
         } else { /* size == 3 */
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Enable it for the "any" CPU used by *-linux-user.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180228193125.20577-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c   | 1 +
 target/arm/cpu64.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_any_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_V8_SHA256);
     set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
     set_feature(&cpu->env, ARM_FEATURE_CRC);
+    set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
     cpu->midr = 0xffffffff;
 }
 #endif
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_any_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_V8_SM4);
     set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
     set_feature(&cpu->env, ARM_FEATURE_CRC);
+    set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
     set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
     cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
     cpu->dcz_blocksize = 7; /*  512 bytes */
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Not enabled anywhere yet.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 1 +
 linux-user/elfload.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
     ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
+    ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions.  */
 };
 
 static inline int arm_feature(CPUARMState *env, int feature)
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
     GET_FEATURE(ARM_FEATURE_V8_FP16,
                 ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
     GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
+    GET_FEATURE(ARM_FEATURE_V8_FCMA, ARM_HWCAP_A64_FCMA);
 #undef GET_FEATURE
 
     return hwcaps;
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  7 ++++
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++-
 target/arm/vec_helper.c    | 97 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+), 1 deletion(-)

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: renamed e1/e2/e3/e4 to use the same naming as the version
 of the pseudocode in the Arm ARM]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  11 ++++
 target/arm/translate-a64.c |  94 +++++++++++++++++++++++++---
 target/arm/vec_helper.c    | 149 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 246 insertions(+), 8 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(gvec_fcaddd, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fcmlah, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fcmlah_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fcmlas, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fcmlas_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fcmlad, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #endif
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
         }
         feature = ARM_FEATURE_V8_RDM;
         break;
+    case 0x8: /* FCMLA, #0 */
+    case 0x9: /* FCMLA, #90 */
+    case 0xa: /* FCMLA, #180 */
+    case 0xb: /* FCMLA, #270 */
     case 0xc: /* FCADD, #90 */
     case 0xe: /* FCADD, #270 */
         if (size == 0
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_extra(DisasContext *s, uint32_t insn)
         }
         return;
 
+    case 0x8: /* FCMLA, #0 */
+    case 0x9: /* FCMLA, #90 */
+    case 0xa: /* FCMLA, #180 */
+    case 0xb: /* FCMLA, #270 */
+        rot = extract32(opcode, 0, 2);
+        switch (size) {
+        case 1:
+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, true, rot,
+                              gen_helper_gvec_fcmlah);
+            break;
+        case 2:
+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, false, rot,
+                              gen_helper_gvec_fcmlas);
+            break;
+        case 3:
+            gen_gvec_op3_fpst(s, is_q, rd, rn, rm, false, rot,
+                              gen_helper_gvec_fcmlad);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        return;
+
     case 0xc: /* FCADD, #90 */
     case 0xe: /* FCADD, #270 */
         rot = extract32(opcode, 1, 1);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
     bool is_long = false;
-    bool is_fp = false;
+    int is_fp = 0;
     bool is_fp16 = false;
     int index;
     TCGv_ptr fpst;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
     case 0x05: /* FMLS */
     case 0x09: /* FMUL */
     case 0x19: /* FMULX */
-        is_fp = true;
+        is_fp = 1;
         break;
     case 0x1d: /* SQRDMLAH */
     case 0x1f: /* SQRDMLSH */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
             return;
         }
         break;
+    case 0x11: /* FCMLA #0 */
+    case 0x13: /* FCMLA #90 */
+    case 0x15: /* FCMLA #180 */
+    case 0x17: /* FCMLA #270 */
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)) {
+            unallocated_encoding(s);
+            return;
+        }
+        is_fp = 2;
+        break;
     default:
         unallocated_encoding(s);
         return;
     }
 
-    if (is_fp) {
+    switch (is_fp) {
+    case 1: /* normal fp */
         /* convert insn encoded size to TCGMemOp size */
         switch (size) {
         case 0: /* half-precision */
-            if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-                unallocated_encoding(s);
-                return;
-            }
             size = MO_16;
+            is_fp16 = true;
             break;
         case MO_32: /* single precision */
         case MO_64: /* double precision */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
             unallocated_encoding(s);
             return;
         }
-    } else {
+        break;
+
+    case 2: /* complex fp */
+        /* Each indexable element is a complex pair.  */
+        size <<= 1;
+        switch (size) {
+        case MO_32:
+            if (h && !is_q) {
+                unallocated_encoding(s);
+                return;
+            }
+            is_fp16 = true;
+            break;
+        case MO_64:
+            break;
+        default:
+            unallocated_encoding(s);
+            return;
+        }
+        break;
+
+    default: /* integer */
         switch (size) {
         case MO_8:
         case MO_64:
             unallocated_encoding(s);
             return;
         }
+        break;
+    }
+    if (is_fp16 && !arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+        unallocated_encoding(s);
+        return;
     }
 
     /* Given TCGMemOp size, adjust register and indexing.  */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
         fpst = NULL;
     }
 
+    switch (16 * u + opcode) {
+    case 0x11: /* FCMLA #0 */
+    case 0x13: /* FCMLA #90 */
+    case 0x15: /* FCMLA #180 */
+    case 0x17: /* FCMLA #270 */
+        tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                           vec_full_reg_offset(s, rn),
+                           vec_reg_offset(s, rm, index, size), fpst,
+                           is_q ? 16 : 8, vec_full_reg_size(s),
+                           extract32(insn, 13, 2), /* rot */
+                           size == MO_64
+                           ? gen_helper_gvec_fcmlas_idx
+                           : gen_helper_gvec_fcmlah_idx);
+        tcg_temp_free_ptr(fpst);
+        return;
+    }
+
     if (size == 3) {
         TCGv_i64 tcg_idx = tcg_temp_new_i64();
         int pass;
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddd)(void *vd, void *vn, void *vm,
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
+
+void HELPER(gvec_fcmlah)(void *vd, void *vn, void *vm,
+                         void *vfpst, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    float16 *d = vd;
+    float16 *n = vn;
+    float16 *m = vm;
+    float_status *fpst = vfpst;
+    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t neg_real = flip ^ neg_imag;
+    uintptr_t i;
+
+    /* Shift boolean to the sign bit so we can xor to negate.  */
+    neg_real <<= 15;
+    neg_imag <<= 15;
+
+    for (i = 0; i < opr_sz / 2; i += 2) {
+        float16 e2 = n[H2(i + flip)];
+        float16 e1 = m[H2(i + flip)] ^ neg_real;
+        float16 e4 = e2;
+        float16 e3 = m[H2(i + 1 - flip)] ^ neg_imag;
+
+        d[H2(i)] = float16_muladd(e2, e1, d[H2(i)], 0, fpst);
+        d[H2(i + 1)] = float16_muladd(e4, e3, d[H2(i + 1)], 0, fpst);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fcmlah_idx)(void *vd, void *vn, void *vm,
+                             void *vfpst, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    float16 *d = vd;
+    float16 *n = vn;
+    float16 *m = vm;
+    float_status *fpst = vfpst;
+    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t neg_real = flip ^ neg_imag;
+    uintptr_t i;
+    float16 e1 = m[H2(flip)];
+    float16 e3 = m[H2(1 - flip)];
+
+    /* Shift boolean to the sign bit so we can xor to negate.  */
+    neg_real <<= 15;
+    neg_imag <<= 15;
+    e1 ^= neg_real;
+    e3 ^= neg_imag;
+
+    for (i = 0; i < opr_sz / 2; i += 2) {
+        float16 e2 = n[H2(i + flip)];
+        float16 e4 = e2;
+
+        d[H2(i)] = float16_muladd(e2, e1, d[H2(i)], 0, fpst);
+        d[H2(i + 1)] = float16_muladd(e4, e3, d[H2(i + 1)], 0, fpst);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fcmlas)(void *vd, void *vn, void *vm,
+                         void *vfpst, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    float32 *d = vd;
+    float32 *n = vn;
+    float32 *m = vm;
+    float_status *fpst = vfpst;
+    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t neg_real = flip ^ neg_imag;
+    uintptr_t i;
+
+    /* Shift boolean to the sign bit so we can xor to negate.  */
+    neg_real <<= 31;
+    neg_imag <<= 31;
+
+    for (i = 0; i < opr_sz / 4; i += 2) {
+        float32 e2 = n[H4(i + flip)];
+        float32 e1 = m[H4(i + flip)] ^ neg_real;
+        float32 e4 = e2;
+        float32 e3 = m[H4(i + 1 - flip)] ^ neg_imag;
+
+        d[H4(i)] = float32_muladd(e2, e1, d[H4(i)], 0, fpst);
+        d[H4(i + 1)] = float32_muladd(e4, e3, d[H4(i + 1)], 0, fpst);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fcmlas_idx)(void *vd, void *vn, void *vm,
+                             void *vfpst, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    float32 *d = vd;
+    float32 *n = vn;
+    float32 *m = vm;
+    float_status *fpst = vfpst;
+    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t neg_real = flip ^ neg_imag;
+    uintptr_t i;
+    float32 e1 = m[H4(flip)];
+    float32 e3 = m[H4(1 - flip)];
+
+    /* Shift boolean to the sign bit so we can xor to negate.  */
+    neg_real <<= 31;
+    neg_imag <<= 31;
+    e1 ^= neg_real;
+    e3 ^= neg_imag;
+
+    for (i = 0; i < opr_sz / 4; i += 2) {
+        float32 e2 = n[H4(i + flip)];
+        float32 e4 = e2;
+
+        d[H4(i)] = float32_muladd(e2, e1, d[H4(i)], 0, fpst);
+        d[H4(i + 1)] = float32_muladd(e4, e3, d[H4(i + 1)], 0, fpst);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fcmlad)(void *vd, void *vn, void *vm,
+                         void *vfpst, uint32_t desc)
+{
+    uintptr_t opr_sz = simd_oprsz(desc);
+    float64 *d = vd;
+    float64 *n = vn;
+    float64 *m = vm;
+    float_status *fpst = vfpst;
+    intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint64_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint64_t neg_real = flip ^ neg_imag;
+    uintptr_t i;
+
+    /* Shift boolean to the sign bit so we can xor to negate.  */
+    neg_real <<= 63;
+    neg_imag <<= 63;
+
+    for (i = 0; i < opr_sz / 8; i += 2) {
+        float64 e2 = n[i + flip];
+        float64 e1 = m[i + flip] ^ neg_real;
+        float64 e4 = e2;
+        float64 e3 = m[i + 1 - flip] ^ neg_imag;
+
+        d[i] = float64_muladd(e2, e1, d[i], 0, fpst);
+        d[i + 1] = float64_muladd(e4, e3, d[i + 1], 0, fpst);
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180228193125.20577-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     return 0;
 }
 
+/* Advanced SIMD three registers of the same length extension.
+ *  31           25    23  22    20   16   12  11   10   9    8        3     0
+ * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
+ * | 1 1 1 1 1 1 0 | op1 | D | op2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
+ * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
+ */
+static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
+{
+    gen_helper_gvec_3_ptr *fn_gvec_ptr;
+    int rd, rn, rm, rot, size, opr_sz;
+    TCGv_ptr fpst;
+    bool q;
+
+    q = extract32(insn, 6, 1);
+    VFP_DREG_D(rd, insn);
+    VFP_DREG_N(rn, insn);
+    VFP_DREG_M(rm, insn);
+    if ((rd | rn | rm) & q) {
+        return 1;
+    }
+
+    if ((insn & 0xfe200f10) == 0xfc200800) {
+        /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
+        size = extract32(insn, 20, 1);
+        rot = extract32(insn, 23, 2);
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
+            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
+            return 1;
+        }
+        fn_gvec_ptr = size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
+    } else if ((insn & 0xfea00f10) == 0xfc800800) {
+        /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
+        size = extract32(insn, 20, 1);
+        rot = extract32(insn, 24, 1);
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
+            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
+            return 1;
+        }
+        fn_gvec_ptr = size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
+    } else {
+        return 1;
+    }
+
+    if (s->fp_excp_el) {
+        gen_exception_insn(s, 4, EXCP_UDEF,
+                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+        return 0;
+    }
+    if (!s->vfp_enabled) {
+        return 1;
+    }
+
+    opr_sz = (1 + q) * 8;
+    fpst = get_fpstatus_ptr(1);
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
+                       vfp_reg_offset(1, rn),
+                       vfp_reg_offset(1, rm), fpst,
+                       opr_sz, opr_sz, rot, fn_gvec_ptr);
+    tcg_temp_free_ptr(fpst);
+    return 0;
+}
+
 static int disas_coproc_insn(DisasContext *s, uint32_t insn)
 {
     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                     }
                 }
             }
+        } else if ((insn & 0x0e000a00) == 0x0c000800
+                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+            if (disas_neon_insn_3same_ext(s, insn)) {
+                goto illegal_op;
+            }
+            return;
         } else if ((insn & 0x0fe00000) == 0x0c400000) {
             /* Coprocessor double register transfer.  */
             ARCH(5TE);
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-15-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
     return 0;
 }
 
+/* Advanced SIMD two registers and a scalar extension.
+ *  31             24   23  22   20   16   12  11   10   9    8        3     0
+ * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
+ * | 1 1 1 1 1 1 1 0 | o1 | D | o2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
+ * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
+ *
+ */
+
+static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
+{
+    int rd, rn, rm, rot, size, opr_sz;
+    TCGv_ptr fpst;
+    bool q;
+
+    q = extract32(insn, 6, 1);
+    VFP_DREG_D(rd, insn);
+    VFP_DREG_N(rn, insn);
+    VFP_DREG_M(rm, insn);
+    if ((rd | rn) & q) {
+        return 1;
+    }
+
+    if ((insn & 0xff000f10) == 0xfe000800) {
+        /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
+        rot = extract32(insn, 20, 2);
+        size = extract32(insn, 23, 1);
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)
+            || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {
+            return 1;
+        }
+    } else {
+        return 1;
+    }
+
+    if (s->fp_excp_el) {
+        gen_exception_insn(s, 4, EXCP_UDEF,
+                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+        return 0;
+    }
+    if (!s->vfp_enabled) {
+        return 1;
+    }
+
+    opr_sz = (1 + q) * 8;
+    fpst = get_fpstatus_ptr(1);
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
+                       vfp_reg_offset(1, rn),
+                       vfp_reg_offset(1, rm), fpst,
+                       opr_sz, opr_sz, rot,
+                       size ? gen_helper_gvec_fcmlas_idx
+                       : gen_helper_gvec_fcmlah_idx);
+    tcg_temp_free_ptr(fpst);
+    return 0;
+}
+
 static int disas_coproc_insn(DisasContext *s, uint32_t insn)
 {
     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 goto illegal_op;
             }
             return;
+        } else if ((insn & 0x0f000a00) == 0x0e000800
+                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
+                goto illegal_op;
+            }
+            return;
         } else if ((insn & 0x0fe00000) == 0x0c400000) {
             /* Coprocessor double register transfer.  */
             ARCH(5TE);
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Happily, the bits are in the same places compared to a32.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180228193125.20577-16-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                                default_exception_el(s));
             break;
         }
-        if (((insn >> 24) & 3) == 3) {
+        if ((insn & 0xfe000a00) == 0xfc000800
+            && arm_dc_feature(s, ARM_FEATURE_V8)) {
+            /* The Thumb2 and ARM encodings are identical.  */
+            if (disas_neon_insn_3same_ext(s, insn)) {
+                goto illegal_op;
+            }
+        } else if ((insn & 0xff000a00) == 0xfe000800
+                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+            /* The Thumb2 and ARM encodings are identical.  */
+            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
+                goto illegal_op;
+            }
+        } else if (((insn >> 24) & 3) == 3) {
             /* Translate into the equivalent ARM encoding.  */
             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
             if (disas_neon_data_insn(s, insn)) {
-- 
2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Enable it for the "any" CPU used by *-linux-user.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180228193125.20577-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c   | 1 +
 target/arm/cpu64.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_any_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
     set_feature(&cpu->env, ARM_FEATURE_CRC);
     set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
+    set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);
     cpu->midr = 0xffffffff;
 }
 #endif
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_any_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_CRC);
     set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
     set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
+    set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);
     cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
     cpu->dcz_blocksize = 7; /*  512 bytes */
 }
-- 
2.16.2

First arm pullreq of 4.2...

thanks
-- PMM

The following changes since commit 27608c7c66bd923eb5e5faab80e795408cbe2b51:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190814a' into staging (2019-08-16 12:00:18 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190816

for you to fetch changes up to 664b7e3b97d6376f3329986c465b3782458b0f8b:

target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word (2019-08-16 14:02:53 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: generate a custom MIDR for -cpu max
 * hw/misc/zynq_slcr: refactor to use standard register definition
 * Set ENET_BD_BDU in I.MX FEC controller
 * target/arm: Fix routing of singlestep exceptions
 * refactor a32/t32 decoder handling of PC
 * minor optimisations/cleanups of some a32/t32 codegen
 * target/arm/cpu64: Ensure kvm really supports aarch64=off
 * target/arm/cpu: Ensure we can use the pmu with kvm
 * target/arm: Minor cleanups preparatory to KVM SVE support

----------------------------------------------------------------
Aaron Hill (1):
      Set ENET_BD_BDU in I.MX FEC controller

Alex Bennée (1):
      target/arm: generate a custom MIDR for -cpu max

Andrew Jones (6):
      target/arm/cpu64: Ensure kvm really supports aarch64=off
      target/arm/cpu: Ensure we can use the pmu with kvm
      target/arm/helper: zcr: Add build bug next to value range assumption
      target/arm/cpu: Use div-round-up to determine predicate register array size
      target/arm/kvm64: Fix error returns
      target/arm/kvm64: Move the get/put of fpsimd registers out

Damien Hedde (1):
      hw/misc/zynq_slcr: use standard register definition

Peter Maydell (2):
      target/arm: Factor out 'generate singlestep exception' function
      target/arm: Fix routing of singlestep exceptions

Richard Henderson (18):
      target/arm: Pass in pc to thumb_insn_is_16bit
      target/arm: Introduce pc_curr
      target/arm: Introduce read_pc
      target/arm: Introduce add_reg_for_lit
      target/arm: Remove redundant s->pc & ~1
      target/arm: Replace s->pc with s->base.pc_next
      target/arm: Replace offset with pc in gen_exception_insn
      target/arm: Replace offset with pc in gen_exception_internal_insn
      target/arm: Remove offset argument to gen_exception_bkpt_insn
      target/arm: Use unallocated_encoding for aarch32
      target/arm: Remove helper_double_saturate
      target/arm: Use tcg_gen_extract_i32 for shifter_out_im
      target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB
      target/arm: Remove redundant shift tests
      target/arm: Use ror32 instead of open-coding the operation
      target/arm: Use tcg_gen_rotri_i32 for gen_swap_half
      target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR
      target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word

From: Alex Bennée <alex.bennee@linaro.org>

While most features are now detected by probing the ID_* registers
kernels can (and do) use MIDR_EL1 for working out of they have to
apply errata. This can trip up warnings in the kernel as it tries to
work out if it should apply workarounds to features that don't
actually exist in the reported CPU type.

Avoid this problem by synthesising our own MIDR value.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190726113950.7499-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   |  6 ++++++
 target/arm/cpu64.c | 19 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_FPCCR, ASPEN, 31, 1)
 /*
  * System register ID fields.
  */
+FIELD(MIDR_EL1, REVISION, 0, 4)
+FIELD(MIDR_EL1, PARTNUM, 4, 12)
+FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
+FIELD(MIDR_EL1, VARIANT, 20, 4)
+FIELD(MIDR_EL1, IMPLEMENTER, 24, 8)
+
 FIELD(ID_ISAR0, SWAP, 0, 4)
 FIELD(ID_ISAR0, BITCOUNT, 4, 4)
 FIELD(ID_ISAR0, BITFIELD, 8, 4)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         uint32_t u;
         aarch64_a57_initfn(obj);
 
+        /*
+         * Reset MIDR so the guest doesn't mistake our 'max' CPU type for a real
+         * one and try to apply errata workarounds or use impdef features we
+         * don't provide.
+         * An IMPLEMENTER field of 0 means "reserved for software use";
+         * ARCHITECTURE must be 0xf indicating "v7 or later, check ID registers
+         * to see which features are present";
+         * the VARIANT, PARTNUM and REVISION fields are all implementation
+         * defined and we choose to define PARTNUM just in case guest
+         * code needs to distinguish this QEMU CPU from other software
+         * implementations, though this shouldn't be needed.
+         */
+        t = FIELD_DP64(0, MIDR_EL1, IMPLEMENTER, 0);
+        t = FIELD_DP64(t, MIDR_EL1, ARCHITECTURE, 0xf);
+        t = FIELD_DP64(t, MIDR_EL1, PARTNUM, 'Q');
+        t = FIELD_DP64(t, MIDR_EL1, VARIANT, 0);
+        t = FIELD_DP64(t, MIDR_EL1, REVISION, 0);
+        cpu->midr = t;
+
         t = cpu->isar.id_aa64isar0;
         t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */
         t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);
-- 
2.20.1

From: Damien Hedde <damien.hedde@greensocs.com>

Replace the zynq_slcr registers enum and macros using the
hw/registerfields.h macros.

Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190729145654.14644-30-damien.hedde@greensocs.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/zynq_slcr.c | 450 ++++++++++++++++++++++----------------------
 1 file changed, 225 insertions(+), 225 deletions(-)

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "hw/registerfields.h"
 
 #ifndef ZYNQ_SLCR_ERR_DEBUG
 #define ZYNQ_SLCR_ERR_DEBUG 0
@@ -XXX,XX +XXX,XX @@
 #define XILINX_LOCK_KEY 0x767b
 #define XILINX_UNLOCK_KEY 0xdf0d
 
-#define R_PSS_RST_CTRL_SOFT_RST 0x1
+REG32(SCL, 0x000)
+REG32(LOCK, 0x004)
+REG32(UNLOCK, 0x008)
+REG32(LOCKSTA, 0x00c)
 
-enum {
-    SCL             = 0x000 / 4,
-    LOCK,
-    UNLOCK,
-    LOCKSTA,
+REG32(ARM_PLL_CTRL, 0x100)
+REG32(DDR_PLL_CTRL, 0x104)
+REG32(IO_PLL_CTRL, 0x108)
+REG32(PLL_STATUS, 0x10c)
+REG32(ARM_PLL_CFG, 0x110)
+REG32(DDR_PLL_CFG, 0x114)
+REG32(IO_PLL_CFG, 0x118)
 
-    ARM_PLL_CTRL    = 0x100 / 4,
-    DDR_PLL_CTRL,
-    IO_PLL_CTRL,
-    PLL_STATUS,
-    ARM_PLL_CFG,
-    DDR_PLL_CFG,
-    IO_PLL_CFG,
-
-    ARM_CLK_CTRL    = 0x120 / 4,
-    DDR_CLK_CTRL,
-    DCI_CLK_CTRL,
-    APER_CLK_CTRL,
-    USB0_CLK_CTRL,
-    USB1_CLK_CTRL,
-    GEM0_RCLK_CTRL,
-    GEM1_RCLK_CTRL,
-    GEM0_CLK_CTRL,
-    GEM1_CLK_CTRL,
-    SMC_CLK_CTRL,
-    LQSPI_CLK_CTRL,
-    SDIO_CLK_CTRL,
-    UART_CLK_CTRL,
-    SPI_CLK_CTRL,
-    CAN_CLK_CTRL,
-    CAN_MIOCLK_CTRL,
-    DBG_CLK_CTRL,
-    PCAP_CLK_CTRL,
-    TOPSW_CLK_CTRL,
+REG32(ARM_CLK_CTRL, 0x120)
+REG32(DDR_CLK_CTRL, 0x124)
+REG32(DCI_CLK_CTRL, 0x128)
+REG32(APER_CLK_CTRL, 0x12c)
+REG32(USB0_CLK_CTRL, 0x130)
+REG32(USB1_CLK_CTRL, 0x134)
+REG32(GEM0_RCLK_CTRL, 0x138)
+REG32(GEM1_RCLK_CTRL, 0x13c)
+REG32(GEM0_CLK_CTRL, 0x140)
+REG32(GEM1_CLK_CTRL, 0x144)
+REG32(SMC_CLK_CTRL, 0x148)
+REG32(LQSPI_CLK_CTRL, 0x14c)
+REG32(SDIO_CLK_CTRL, 0x150)
+REG32(UART_CLK_CTRL, 0x154)
+REG32(SPI_CLK_CTRL, 0x158)
+REG32(CAN_CLK_CTRL, 0x15c)
+REG32(CAN_MIOCLK_CTRL, 0x160)
+REG32(DBG_CLK_CTRL, 0x164)
+REG32(PCAP_CLK_CTRL, 0x168)
+REG32(TOPSW_CLK_CTRL, 0x16c)
 
 #define FPGA_CTRL_REGS(n, start) \
-    FPGA ## n ## _CLK_CTRL = (start) / 4, \
-    FPGA ## n ## _THR_CTRL, \
-    FPGA ## n ## _THR_CNT, \
-    FPGA ## n ## _THR_STA,
-    FPGA_CTRL_REGS(0, 0x170)
-    FPGA_CTRL_REGS(1, 0x180)
-    FPGA_CTRL_REGS(2, 0x190)
-    FPGA_CTRL_REGS(3, 0x1a0)
+    REG32(FPGA ## n ## _CLK_CTRL, (start)) \
+    REG32(FPGA ## n ## _THR_CTRL, (start) + 0x4)\
+    REG32(FPGA ## n ## _THR_CNT,  (start) + 0x8)\
+    REG32(FPGA ## n ## _THR_STA,  (start) + 0xc)
+FPGA_CTRL_REGS(0, 0x170)
+FPGA_CTRL_REGS(1, 0x180)
+FPGA_CTRL_REGS(2, 0x190)
+FPGA_CTRL_REGS(3, 0x1a0)
 
-    BANDGAP_TRIP    = 0x1b8 / 4,
-    PLL_PREDIVISOR  = 0x1c0 / 4,
-    CLK_621_TRUE,
+REG32(BANDGAP_TRIP, 0x1b8)
+REG32(PLL_PREDIVISOR, 0x1c0)
+REG32(CLK_621_TRUE, 0x1c4)
 
-    PSS_RST_CTRL    = 0x200 / 4,
-    DDR_RST_CTRL,
-    TOPSW_RESET_CTRL,
-    DMAC_RST_CTRL,
-    USB_RST_CTRL,
-    GEM_RST_CTRL,
-    SDIO_RST_CTRL,
-    SPI_RST_CTRL,
-    CAN_RST_CTRL,
-    I2C_RST_CTRL,
-    UART_RST_CTRL,
-    GPIO_RST_CTRL,
-    LQSPI_RST_CTRL,
-    SMC_RST_CTRL,
-    OCM_RST_CTRL,
-    FPGA_RST_CTRL   = 0x240 / 4,
-    A9_CPU_RST_CTRL,
+REG32(PSS_RST_CTRL, 0x200)
+    FIELD(PSS_RST_CTRL, SOFT_RST, 0, 1)
+REG32(DDR_RST_CTRL, 0x204)
+REG32(TOPSW_RESET_CTRL, 0x208)
+REG32(DMAC_RST_CTRL, 0x20c)
+REG32(USB_RST_CTRL, 0x210)
+REG32(GEM_RST_CTRL, 0x214)
+REG32(SDIO_RST_CTRL, 0x218)
+REG32(SPI_RST_CTRL, 0x21c)
+REG32(CAN_RST_CTRL, 0x220)
+REG32(I2C_RST_CTRL, 0x224)
+REG32(UART_RST_CTRL, 0x228)
+REG32(GPIO_RST_CTRL, 0x22c)
+REG32(LQSPI_RST_CTRL, 0x230)
+REG32(SMC_RST_CTRL, 0x234)
+REG32(OCM_RST_CTRL, 0x238)
+REG32(FPGA_RST_CTRL, 0x240)
+REG32(A9_CPU_RST_CTRL, 0x244)
 
-    RS_AWDT_CTRL    = 0x24c / 4,
-    RST_REASON,
+REG32(RS_AWDT_CTRL, 0x24c)
+REG32(RST_REASON, 0x250)
 
-    REBOOT_STATUS   = 0x258 / 4,
-    BOOT_MODE,
+REG32(REBOOT_STATUS, 0x258)
+REG32(BOOT_MODE, 0x25c)
 
-    APU_CTRL        = 0x300 / 4,
-    WDT_CLK_SEL,
+REG32(APU_CTRL, 0x300)
+REG32(WDT_CLK_SEL, 0x304)
 
-    TZ_DMA_NS       = 0x440 / 4,
-    TZ_DMA_IRQ_NS,
-    TZ_DMA_PERIPH_NS,
+REG32(TZ_DMA_NS, 0x440)
+REG32(TZ_DMA_IRQ_NS, 0x444)
+REG32(TZ_DMA_PERIPH_NS, 0x448)
 
-    PSS_IDCODE      = 0x530 / 4,
+REG32(PSS_IDCODE, 0x530)
 
-    DDR_URGENT      = 0x600 / 4,
-    DDR_CAL_START   = 0x60c / 4,
-    DDR_REF_START   = 0x614 / 4,
-    DDR_CMD_STA,
-    DDR_URGENT_SEL,
-    DDR_DFI_STATUS,
+REG32(DDR_URGENT, 0x600)
+REG32(DDR_CAL_START, 0x60c)
+REG32(DDR_REF_START, 0x614)
+REG32(DDR_CMD_STA, 0x618)
+REG32(DDR_URGENT_SEL, 0x61c)
+REG32(DDR_DFI_STATUS, 0x620)
 
-    MIO             = 0x700 / 4,
+REG32(MIO, 0x700)
 #define MIO_LENGTH 54
 
-    MIO_LOOPBACK    = 0x804 / 4,
-    MIO_MST_TRI0,
-    MIO_MST_TRI1,
+REG32(MIO_LOOPBACK, 0x804)
+REG32(MIO_MST_TRI0, 0x808)
+REG32(MIO_MST_TRI1, 0x80c)
 
-    SD0_WP_CD_SEL   = 0x830 / 4,
-    SD1_WP_CD_SEL,
+REG32(SD0_WP_CD_SEL, 0x830)
+REG32(SD1_WP_CD_SEL, 0x834)
 
-    LVL_SHFTR_EN    = 0x900 / 4,
-    OCM_CFG         = 0x910 / 4,
+REG32(LVL_SHFTR_EN, 0x900)
+REG32(OCM_CFG, 0x910)
 
-    CPU_RAM         = 0xa00 / 4,
+REG32(CPU_RAM, 0xa00)
 
-    IOU             = 0xa30 / 4,
+REG32(IOU, 0xa30)
 
-    DMAC_RAM        = 0xa50 / 4,
+REG32(DMAC_RAM, 0xa50)
 
-    AFI0            = 0xa60 / 4,
-    AFI1 = AFI0 + 3,
-    AFI2 = AFI1 + 3,
-    AFI3 = AFI2 + 3,
+REG32(AFI0, 0xa60)
+REG32(AFI1, 0xa6c)
+REG32(AFI2, 0xa78)
+REG32(AFI3, 0xa84)
 #define AFI_LENGTH 3
 
-    OCM             = 0xa90 / 4,
+REG32(OCM, 0xa90)
 
-    DEVCI_RAM       = 0xaa0 / 4,
+REG32(DEVCI_RAM, 0xaa0)
 
-    CSG_RAM         = 0xab0 / 4,
+REG32(CSG_RAM, 0xab0)
 
-    GPIOB_CTRL      = 0xb00 / 4,
-    GPIOB_CFG_CMOS18,
-    GPIOB_CFG_CMOS25,
-    GPIOB_CFG_CMOS33,
-    GPIOB_CFG_HSTL  = 0xb14 / 4,
-    GPIOB_DRVR_BIAS_CTRL,
+REG32(GPIOB_CTRL, 0xb00)
+REG32(GPIOB_CFG_CMOS18, 0xb04)
+REG32(GPIOB_CFG_CMOS25, 0xb08)
+REG32(GPIOB_CFG_CMOS33, 0xb0c)
+REG32(GPIOB_CFG_HSTL, 0xb14)
+REG32(GPIOB_DRVR_BIAS_CTRL, 0xb18)
 
-    DDRIOB          = 0xb40 / 4,
+REG32(DDRIOB, 0xb40)
 #define DDRIOB_LENGTH 14
-};
 
 #define ZYNQ_SLCR_MMIO_SIZE     0x1000
 #define ZYNQ_SLCR_NUM_REGS      (ZYNQ_SLCR_MMIO_SIZE / 4)
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset(DeviceState *d)
 
     DB_PRINT("RESET\n");
 
-    s->regs[LOCKSTA] = 1;
+    s->regs[R_LOCKSTA] = 1;
     /* 0x100 - 0x11C */
-    s->regs[ARM_PLL_CTRL]   = 0x0001A008;
-    s->regs[DDR_PLL_CTRL]   = 0x0001A008;
-    s->regs[IO_PLL_CTRL]    = 0x0001A008;
-    s->regs[PLL_STATUS]     = 0x0000003F;
-    s->regs[ARM_PLL_CFG]    = 0x00014000;
-    s->regs[DDR_PLL_CFG]    = 0x00014000;
-    s->regs[IO_PLL_CFG]     = 0x00014000;
+    s->regs[R_ARM_PLL_CTRL]   = 0x0001A008;
+    s->regs[R_DDR_PLL_CTRL]   = 0x0001A008;
+    s->regs[R_IO_PLL_CTRL]    = 0x0001A008;
+    s->regs[R_PLL_STATUS]     = 0x0000003F;
+    s->regs[R_ARM_PLL_CFG]    = 0x00014000;
+    s->regs[R_DDR_PLL_CFG]    = 0x00014000;
+    s->regs[R_IO_PLL_CFG]     = 0x00014000;
 
     /* 0x120 - 0x16C */
-    s->regs[ARM_CLK_CTRL]   = 0x1F000400;
-    s->regs[DDR_CLK_CTRL]   = 0x18400003;
-    s->regs[DCI_CLK_CTRL]   = 0x01E03201;
-    s->regs[APER_CLK_CTRL]  = 0x01FFCCCD;
-    s->regs[USB0_CLK_CTRL]  = s->regs[USB1_CLK_CTRL]    = 0x00101941;
-    s->regs[GEM0_RCLK_CTRL] = s->regs[GEM1_RCLK_CTRL]   = 0x00000001;
-    s->regs[GEM0_CLK_CTRL]  = s->regs[GEM1_CLK_CTRL]    = 0x00003C01;
-    s->regs[SMC_CLK_CTRL]   = 0x00003C01;
-    s->regs[LQSPI_CLK_CTRL] = 0x00002821;
-    s->regs[SDIO_CLK_CTRL]  = 0x00001E03;
-    s->regs[UART_CLK_CTRL]  = 0x00003F03;
-    s->regs[SPI_CLK_CTRL]   = 0x00003F03;
-    s->regs[CAN_CLK_CTRL]   = 0x00501903;
-    s->regs[DBG_CLK_CTRL]   = 0x00000F03;
-    s->regs[PCAP_CLK_CTRL]  = 0x00000F01;
+    s->regs[R_ARM_CLK_CTRL]   = 0x1F000400;
+    s->regs[R_DDR_CLK_CTRL]   = 0x18400003;
+    s->regs[R_DCI_CLK_CTRL]   = 0x01E03201;
+    s->regs[R_APER_CLK_CTRL]  = 0x01FFCCCD;
+    s->regs[R_USB0_CLK_CTRL]  = s->regs[R_USB1_CLK_CTRL]  = 0x00101941;
+    s->regs[R_GEM0_RCLK_CTRL] = s->regs[R_GEM1_RCLK_CTRL] = 0x00000001;
+    s->regs[R_GEM0_CLK_CTRL]  = s->regs[R_GEM1_CLK_CTRL]  = 0x00003C01;
+    s->regs[R_SMC_CLK_CTRL]   = 0x00003C01;
+    s->regs[R_LQSPI_CLK_CTRL] = 0x00002821;
+    s->regs[R_SDIO_CLK_CTRL]  = 0x00001E03;
+    s->regs[R_UART_CLK_CTRL]  = 0x00003F03;
+    s->regs[R_SPI_CLK_CTRL]   = 0x00003F03;
+    s->regs[R_CAN_CLK_CTRL]   = 0x00501903;
+    s->regs[R_DBG_CLK_CTRL]   = 0x00000F03;
+    s->regs[R_PCAP_CLK_CTRL]  = 0x00000F01;
 
     /* 0x170 - 0x1AC */
-    s->regs[FPGA0_CLK_CTRL] = s->regs[FPGA1_CLK_CTRL] = s->regs[FPGA2_CLK_CTRL]
-                            = s->regs[FPGA3_CLK_CTRL] = 0x00101800;
-    s->regs[FPGA0_THR_STA] = s->regs[FPGA1_THR_STA] = s->regs[FPGA2_THR_STA]
-                           = s->regs[FPGA3_THR_STA] = 0x00010000;
+    s->regs[R_FPGA0_CLK_CTRL] = s->regs[R_FPGA1_CLK_CTRL]
+                              = s->regs[R_FPGA2_CLK_CTRL]
+                              = s->regs[R_FPGA3_CLK_CTRL] = 0x00101800;
+    s->regs[R_FPGA0_THR_STA] = s->regs[R_FPGA1_THR_STA]
+                             = s->regs[R_FPGA2_THR_STA]
+                             = s->regs[R_FPGA3_THR_STA] = 0x00010000;
 
     /* 0x1B0 - 0x1D8 */
-    s->regs[BANDGAP_TRIP]   = 0x0000001F;
-    s->regs[PLL_PREDIVISOR] = 0x00000001;
-    s->regs[CLK_621_TRUE]   = 0x00000001;
+    s->regs[R_BANDGAP_TRIP]   = 0x0000001F;
+    s->regs[R_PLL_PREDIVISOR] = 0x00000001;
+    s->regs[R_CLK_621_TRUE]   = 0x00000001;
 
     /* 0x200 - 0x25C */
-    s->regs[FPGA_RST_CTRL]  = 0x01F33F0F;
-    s->regs[RST_REASON]     = 0x00000040;
+    s->regs[R_FPGA_RST_CTRL]  = 0x01F33F0F;
+    s->regs[R_RST_REASON]     = 0x00000040;
 
-    s->regs[BOOT_MODE]      = 0x00000001;
+    s->regs[R_BOOT_MODE]      = 0x00000001;
 
     /* 0x700 - 0x7D4 */
     for (i = 0; i < 54; i++) {
-        s->regs[MIO + i] = 0x00001601;
+        s->regs[R_MIO + i] = 0x00001601;
     }
     for (i = 2; i <= 8; i++) {
-        s->regs[MIO + i] = 0x00000601;
+        s->regs[R_MIO + i] = 0x00000601;
     }
 
-    s->regs[MIO_MST_TRI0] = s->regs[MIO_MST_TRI1] = 0xFFFFFFFF;
+    s->regs[R_MIO_MST_TRI0] = s->regs[R_MIO_MST_TRI1] = 0xFFFFFFFF;
 
-    s->regs[CPU_RAM + 0] = s->regs[CPU_RAM + 1] = s->regs[CPU_RAM + 3]
-                         = s->regs[CPU_RAM + 4] = s->regs[CPU_RAM + 7]
-                         = 0x00010101;
-    s->regs[CPU_RAM + 2] = s->regs[CPU_RAM + 5] = 0x01010101;
-    s->regs[CPU_RAM + 6] = 0x00000001;
+    s->regs[R_CPU_RAM + 0] = s->regs[R_CPU_RAM + 1] = s->regs[R_CPU_RAM + 3]
+                           = s->regs[R_CPU_RAM + 4] = s->regs[R_CPU_RAM + 7]
+                           = 0x00010101;
+    s->regs[R_CPU_RAM + 2] = s->regs[R_CPU_RAM + 5] = 0x01010101;
+    s->regs[R_CPU_RAM + 6] = 0x00000001;
 
-    s->regs[IOU + 0] = s->regs[IOU + 1] = s->regs[IOU + 2] = s->regs[IOU + 3]
-                     = 0x09090909;
-    s->regs[IOU + 4] = s->regs[IOU + 5] = 0x00090909;
-    s->regs[IOU + 6] = 0x00000909;
+    s->regs[R_IOU + 0] = s->regs[R_IOU + 1] = s->regs[R_IOU + 2]
+                       = s->regs[R_IOU + 3] = 0x09090909;
+    s->regs[R_IOU + 4] = s->regs[R_IOU + 5] = 0x00090909;
+    s->regs[R_IOU + 6] = 0x00000909;
 
-    s->regs[DMAC_RAM] = 0x00000009;
+    s->regs[R_DMAC_RAM] = 0x00000009;
 
-    s->regs[AFI0 + 0] = s->regs[AFI0 + 1] = 0x09090909;
-    s->regs[AFI1 + 0] = s->regs[AFI1 + 1] = 0x09090909;
-    s->regs[AFI2 + 0] = s->regs[AFI2 + 1] = 0x09090909;
-    s->regs[AFI3 + 0] = s->regs[AFI3 + 1] = 0x09090909;
-    s->regs[AFI0 + 2] = s->regs[AFI1 + 2] = s->regs[AFI2 + 2]
-                      = s->regs[AFI3 + 2] = 0x00000909;
+    s->regs[R_AFI0 + 0] = s->regs[R_AFI0 + 1] = 0x09090909;
+    s->regs[R_AFI1 + 0] = s->regs[R_AFI1 + 1] = 0x09090909;
+    s->regs[R_AFI2 + 0] = s->regs[R_AFI2 + 1] = 0x09090909;
+    s->regs[R_AFI3 + 0] = s->regs[R_AFI3 + 1] = 0x09090909;
+    s->regs[R_AFI0 + 2] = s->regs[R_AFI1 + 2] = s->regs[R_AFI2 + 2]
+                        = s->regs[R_AFI3 + 2] = 0x00000909;
 
-    s->regs[OCM + 0]    = 0x01010101;
-    s->regs[OCM + 1]    = s->regs[OCM + 2] = 0x09090909;
+    s->regs[R_OCM + 0] = 0x01010101;
+    s->regs[R_OCM + 1] = s->regs[R_OCM + 2] = 0x09090909;
 
-    s->regs[DEVCI_RAM]  = 0x00000909;
-    s->regs[CSG_RAM]    = 0x00000001;
+    s->regs[R_DEVCI_RAM] = 0x00000909;
+    s->regs[R_CSG_RAM]   = 0x00000001;
 
-    s->regs[DDRIOB + 0] = s->regs[DDRIOB + 1] = s->regs[DDRIOB + 2]
-                        = s->regs[DDRIOB + 3] = 0x00000e00;
-    s->regs[DDRIOB + 4] = s->regs[DDRIOB + 5] = s->regs[DDRIOB + 6]
-                        = 0x00000e00;
-    s->regs[DDRIOB + 12] = 0x00000021;
+    s->regs[R_DDRIOB + 0] = s->regs[R_DDRIOB + 1] = s->regs[R_DDRIOB + 2]
+                          = s->regs[R_DDRIOB + 3] = 0x00000e00;
+    s->regs[R_DDRIOB + 4] = s->regs[R_DDRIOB + 5] = s->regs[R_DDRIOB + 6]
+                          = 0x00000e00;
+    s->regs[R_DDRIOB + 12] = 0x00000021;
 }
 
 
 static bool zynq_slcr_check_offset(hwaddr offset, bool rnw)
 {
     switch (offset) {
-    case LOCK:
-    case UNLOCK:
-    case DDR_CAL_START:
-    case DDR_REF_START:
+    case R_LOCK:
+    case R_UNLOCK:
+    case R_DDR_CAL_START:
+    case R_DDR_REF_START:
         return !rnw; /* Write only */
-    case LOCKSTA:
-    case FPGA0_THR_STA:
-    case FPGA1_THR_STA:
-    case FPGA2_THR_STA:
-    case FPGA3_THR_STA:
-    case BOOT_MODE:
-    case PSS_IDCODE:
-    case DDR_CMD_STA:
-    case DDR_DFI_STATUS:
-    case PLL_STATUS:
+    case R_LOCKSTA:
+    case R_FPGA0_THR_STA:
+    case R_FPGA1_THR_STA:
+    case R_FPGA2_THR_STA:
+    case R_FPGA3_THR_STA:
+    case R_BOOT_MODE:
+    case R_PSS_IDCODE:
+    case R_DDR_CMD_STA:
+    case R_DDR_DFI_STATUS:
+    case R_PLL_STATUS:
         return rnw;/* read only */
-    case SCL:
-    case ARM_PLL_CTRL ... IO_PLL_CTRL:
-    case ARM_PLL_CFG ... IO_PLL_CFG:
-    case ARM_CLK_CTRL ... TOPSW_CLK_CTRL:
-    case FPGA0_CLK_CTRL ... FPGA0_THR_CNT:
-    case FPGA1_CLK_CTRL ... FPGA1_THR_CNT:
-    case FPGA2_CLK_CTRL ... FPGA2_THR_CNT:
-    case FPGA3_CLK_CTRL ... FPGA3_THR_CNT:
-    case BANDGAP_TRIP:
-    case PLL_PREDIVISOR:
-    case CLK_621_TRUE:
-    case PSS_RST_CTRL ... A9_CPU_RST_CTRL:
-    case RS_AWDT_CTRL:
-    case RST_REASON:
-    case REBOOT_STATUS:
-    case APU_CTRL:
-    case WDT_CLK_SEL:
-    case TZ_DMA_NS ... TZ_DMA_PERIPH_NS:
-    case DDR_URGENT:
-    case DDR_URGENT_SEL:
-    case MIO ... MIO + MIO_LENGTH - 1:
-    case MIO_LOOPBACK ... MIO_MST_TRI1:
-    case SD0_WP_CD_SEL:
-    case SD1_WP_CD_SEL:
-    case LVL_SHFTR_EN:
-    case OCM_CFG:
-    case CPU_RAM:
-    case IOU:
-    case DMAC_RAM:
-    case AFI0 ... AFI3 + AFI_LENGTH - 1:
-    case OCM:
-    case DEVCI_RAM:
-    case CSG_RAM:
-    case GPIOB_CTRL ... GPIOB_CFG_CMOS33:
-    case GPIOB_CFG_HSTL:
-    case GPIOB_DRVR_BIAS_CTRL:
-    case DDRIOB ... DDRIOB + DDRIOB_LENGTH - 1:
+    case R_SCL:
+    case R_ARM_PLL_CTRL ... R_IO_PLL_CTRL:
+    case R_ARM_PLL_CFG ... R_IO_PLL_CFG:
+    case R_ARM_CLK_CTRL ... R_TOPSW_CLK_CTRL:
+    case R_FPGA0_CLK_CTRL ... R_FPGA0_THR_CNT:
+    case R_FPGA1_CLK_CTRL ... R_FPGA1_THR_CNT:
+    case R_FPGA2_CLK_CTRL ... R_FPGA2_THR_CNT:
+    case R_FPGA3_CLK_CTRL ... R_FPGA3_THR_CNT:
+    case R_BANDGAP_TRIP:
+    case R_PLL_PREDIVISOR:
+    case R_CLK_621_TRUE:
+    case R_PSS_RST_CTRL ... R_A9_CPU_RST_CTRL:
+    case R_RS_AWDT_CTRL:
+    case R_RST_REASON:
+    case R_REBOOT_STATUS:
+    case R_APU_CTRL:
+    case R_WDT_CLK_SEL:
+    case R_TZ_DMA_NS ... R_TZ_DMA_PERIPH_NS:
+    case R_DDR_URGENT:
+    case R_DDR_URGENT_SEL:
+    case R_MIO ... R_MIO + MIO_LENGTH - 1:
+    case R_MIO_LOOPBACK ... R_MIO_MST_TRI1:
+    case R_SD0_WP_CD_SEL:
+    case R_SD1_WP_CD_SEL:
+    case R_LVL_SHFTR_EN:
+    case R_OCM_CFG:
+    case R_CPU_RAM:
+    case R_IOU:
+    case R_DMAC_RAM:
+    case R_AFI0 ... R_AFI3 + AFI_LENGTH - 1:
+    case R_OCM:
+    case R_DEVCI_RAM:
+    case R_CSG_RAM:
+    case R_GPIOB_CTRL ... R_GPIOB_CFG_CMOS33:
+    case R_GPIOB_CFG_HSTL:
+    case R_GPIOB_DRVR_BIAS_CTRL:
+    case R_DDRIOB ... R_DDRIOB + DDRIOB_LENGTH - 1:
         return true;
     default:
         return false;
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
     }
 
     switch (offset) {
-    case SCL:
-        s->regs[SCL] = val & 0x1;
+    case R_SCL:
+        s->regs[R_SCL] = val & 0x1;
         return;
-    case LOCK:
+    case R_LOCK:
         if ((val & 0xFFFF) == XILINX_LOCK_KEY) {
             DB_PRINT("XILINX LOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
                 (unsigned)val & 0xFFFF);
-            s->regs[LOCKSTA] = 1;
+            s->regs[R_LOCKSTA] = 1;
         } else {
             DB_PRINT("WRONG XILINX LOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
                 (int)offset, (unsigned)val & 0xFFFF);
         }
         return;
-    case UNLOCK:
+    case R_UNLOCK:
         if ((val & 0xFFFF) == XILINX_UNLOCK_KEY) {
             DB_PRINT("XILINX UNLOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
                 (unsigned)val & 0xFFFF);
-            s->regs[LOCKSTA] = 0;
+            s->regs[R_LOCKSTA] = 0;
         } else {
             DB_PRINT("WRONG XILINX UNLOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
                 (int)offset, (unsigned)val & 0xFFFF);
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
         return;
     }
 
-    if (s->regs[LOCKSTA]) {
+    if (s->regs[R_LOCKSTA]) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "SCLR registers are locked. Unlock them first\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
     s->regs[offset] = val;
 
     switch (offset) {
-    case PSS_RST_CTRL:
-        if (val & R_PSS_RST_CTRL_SOFT_RST) {
+    case R_PSS_RST_CTRL:
+        if (FIELD_EX32(val, PSS_RST_CTRL, SOFT_RST)) {
             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
         }
         break;
-- 
2.20.1

From: Aaron Hill <aa1ronham@gmail.com>

This commit properly sets the ENET_BD_BDU flag once the emulated FEC controller
has finished processing the last descriptor. This is done for both transmit
and receive descriptors.

This allows the QNX 7.0.0 BSP for the Sabrelite board (which can be
found at http://blackberry.qnx.com/en/developers/bsp) to properly
control the FEC. Without this patch, the BSP ethernet driver will never
re-use FEC descriptors, as the unset ENET_BD_BDU flag will cause
it to believe that the descriptors are still in use by the NIC.

Note that Linux does not appear to use this field at all, and is
unaffected by this patch.

Without this patch, QNX will think that the NIC is still processing its
transaction descriptors, and won't send any more data over the network.

For reference:

On page 1192 of the I.MX 6DQ reference manual revision (Rev. 5, 06/2018),
which can be found at https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-6-processors/i.mx-6quad-processors-high-performance-3d-graphics-hd-video-arm-cortex-a9-core:i.MX6Q?&tab=Documentation_Tab&linkline=Application-Note

the 'BDU' field is described as follows for the 'Enhanced transmit
buffer descriptor':

'Last buffer descriptor update done. Indicates that the last BD data has been updated by
uDMA. This field is written by the user (=0) and uDMA (=1).'

The same description is used for the receive buffer descriptor.

Signed-off-by: Aaron Hill <aa1ronham@gmail.com>
Message-id: 20190805142417.10433-1-aaron.hill@alertinnovation.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
             if (bd.option & ENET_BD_TX_INT) {
                 s->regs[ENET_EIR] |= int_txf;
             }
+            /* Indicate that we've updated the last buffer descriptor. */
+            bd.last_buffer = ENET_BD_BDU;
         }
         if (bd.option & ENET_BD_TX_INT) {
             s->regs[ENET_EIR] |= int_txb;
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
             /* Last buffer in frame.  */
             bd.flags |= flags | ENET_BD_L;
             FEC_PRINTF("rx frame flags %04x\n", bd.flags);
+            /* Indicate that we've updated the last buffer descriptor. */
+            bd.last_buffer = ENET_BD_BDU;
             if (bd.option & ENET_BD_RX_INT) {
                 s->regs[ENET_EIR] |= ENET_INT_RXF;
             }
-- 
2.20.1

Factor out code to 'generate a singlestep exception', which is
currently repeated in four places.

To do this we need to also pull the identical copies of the
gen-exception() function out of translate-a64.c and translate.c
into translate.h.

(There is a bug in the code: we're taking the exception to the wrong
target EL.  This will be simpler to fix if there's only one place to
do it.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190805130952.4415-2-peter.maydell@linaro.org
---
 target/arm/translate.h     | 23 +++++++++++++++++++++++
 target/arm/translate-a64.c | 19 ++-----------------
 target/arm/translate.c     | 20 ++------------------
 3 files changed, 27 insertions(+), 35 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_ARM_TRANSLATE_H
 
 #include "exec/translator.h"
+#include "internals.h"
 
 
 /* internal defines */
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
+static inline void gen_exception(int excp, uint32_t syndrome,
+                                 uint32_t target_el)
+{
+    TCGv_i32 tcg_excp = tcg_const_i32(excp);
+    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
+    TCGv_i32 tcg_el = tcg_const_i32(target_el);
+
+    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
+                                       tcg_syn, tcg_el);
+
+    tcg_temp_free_i32(tcg_el);
+    tcg_temp_free_i32(tcg_syn);
+    tcg_temp_free_i32(tcg_excp);
+}
+
+/* Generate an architectural singlestep exception */
+static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
+{
+    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
+                  default_exception_el(s));
+}
+
 /*
  * Given a VFP floating point constant encoded into an 8 bit immediate in an
  * instruction, expand it to the actual constant value of the specified
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
     tcg_temp_free_i32(tcg_excp);
 }
 
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
-{
-    TCGv_i32 tcg_excp = tcg_const_i32(excp);
-    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
-    TCGv_i32 tcg_el = tcg_const_i32(target_el);
-
-    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
-                                       tcg_syn, tcg_el);
-    tcg_temp_free_i32(tcg_el);
-    tcg_temp_free_i32(tcg_syn);
-    tcg_temp_free_i32(tcg_excp);
-}
-
 static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 {
     gen_a64_set_pc_im(s->pc - offset);
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
      * of the exception, and our syndrome information is always correct.
      */
     gen_ss_advance(s);
-    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
-                  default_exception_el(s));
+    gen_swstep_exception(s, 1, s->is_ldex);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * bits should be zero.
          */
         assert(dc->base.num_insns == 1);
-        gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
-                      default_exception_el(dc));
+        gen_swstep_exception(dc, 0, 0);
         dc->base.is_jmp = DISAS_NORETURN;
     } else {
         disas_a64_insn(env, dc);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
     tcg_temp_free_i32(tcg_excp);
 }
 
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
-{
-    TCGv_i32 tcg_excp = tcg_const_i32(excp);
-    TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
-    TCGv_i32 tcg_el = tcg_const_i32(target_el);
-
-    gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
-                                       tcg_syn, tcg_el);
-
-    tcg_temp_free_i32(tcg_el);
-    tcg_temp_free_i32(tcg_syn);
-    tcg_temp_free_i32(tcg_excp);
-}
-
 static void gen_step_complete_exception(DisasContext *s)
 {
     /* We just completed step of an insn. Move from Active-not-pending
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
      * of the exception, and our syndrome information is always correct.
      */
     gen_ss_advance(s);
-    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
-                  default_exception_el(s));
+    gen_swstep_exception(s, 1, s->is_ldex);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
          * bits should be zero.
          */
         assert(dc->base.num_insns == 1);
-        gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
-                      default_exception_el(dc));
+        gen_swstep_exception(dc, 0, 0);
         dc->base.is_jmp = DISAS_NORETURN;
         return true;
     }
-- 
2.20.1

When generating an architectural single-step exception we were
routing it to the "default exception level", which is to say
the same exception level we execute at except that EL0 exceptions
go to EL1. This is incorrect because the debug exception level
can be configured by the guest for situations such as single
stepping of EL0 and EL1 code by EL2.

We have to track the target debug exception level in the TB
flags, because it is dependent on CPU state like HCR_EL2.TGE
and MDCR_EL2.TDE. (That we were previously calling the
arm_debug_target_el() function to determine dc->ss_same_el
is itself a bug, though one that would only have manifested
as incorrect syndrome information.) Since we are out of TB
flag bits unless we want to expand into the cs_base field,
we share some bits with the M-profile only HANDLER and
STACKCHECK bits, since only A-profile has this singlestep.

Fixes: https://bugs.launchpad.net/qemu/+bug/1838913
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190805130952.4415-3-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  5 +++++
 target/arm/translate.h     | 15 +++++++++++----
 target/arm/helper.c        |  6 ++++++
 target/arm/translate-a64.c |  2 +-
 target/arm/translate.c     |  4 +++-
 5 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)
 /* Target EL if we take a floating-point-disabled exception */
 FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2)
 FIELD(TBFLAG_ANY, BE_DATA, 23, 1)
+/*
+ * For A-profile only, target EL for debug exceptions.
+ * Note that this overlaps with the M-profile-only HANDLER and STACKCHECK bits.
+ */
+FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2)
 
 /* Bit usage when in AArch32 state: */
 FIELD(TBFLAG_A32, THUMB, 0, 1)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint32_t svc_imm;
     int aarch64;
     int current_el;
+    /* Debug target exception level for single-step exceptions */
+    int debug_target_el;
     GHashTable *cp_regs;
     uint64_t features; /* CPU features bits */
     /* Because unallocated encodings generate different exception syndrome
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      * ie A64 LDX*, LDAX*, A32/T32 LDREX*, LDAEX*.
      */
     bool is_ldex;
-    /* True if a single-step exception will be taken to the current EL */
-    bool ss_same_el;
     /* True if v8.3-PAuth is active.  */
     bool pauth_active;
     /* True with v8.5-BTI and SCTLR_ELx.BT* set.  */
@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
 /* Generate an architectural singlestep exception */
 static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 {
-    gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
-                  default_exception_el(s));
+    bool same_el = (s->debug_target_el == s->current_el);
+
+    /*
+     * If singlestep is targeting a lower EL than the current one,
+     * then s->ss_active must be false and we can never get here.
+     */
+    assert(s->debug_target_el >= s->current_el);
+
+    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
 }
 
 /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
         }
     }
 
+    if (!arm_feature(env, ARM_FEATURE_M)) {
+        int target_el = arm_debug_target_el(env);
+
+        flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);
+    }
+
     *pflags = flags;
     *cs_base = 0;
 }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
     dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
     dc->is_ldex = false;
-    dc->ss_same_el = (arm_debug_target_el(env) == dc->current_el);
+    dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
 
     /* Bound the number of insns to execute to those left on the page.  */
     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
     dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
     dc->is_ldex = false;
-    dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */
+    if (!arm_feature(env, ARM_FEATURE_M)) {
+        dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
+    }
 
     dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is used in two different contexts, and it will be
clearer if the function is given the address to which it applies.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     }
 }
 
-static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
+static bool thumb_insn_is_16bit(DisasContext *s, uint32_t pc, uint32_t insn)
 {
-    /* Return true if this is a 16 bit instruction. We must be precise
-     * about this (matching the decode).  We assume that s->pc still
-     * points to the first 16 bits of the insn.
+    /*
+     * Return true if this is a 16 bit instruction. We must be precise
+     * about this (matching the decode).
      */
     if ((insn >> 11) < 0x1d) {
         /* Definitely a 16-bit instruction */
@@ -XXX,XX +XXX,XX @@ static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
         return false;
     }
 
-    if ((insn >> 11) == 0x1e && s->pc - s->page_start < TARGET_PAGE_SIZE - 3) {
+    if ((insn >> 11) == 0x1e && pc - s->page_start < TARGET_PAGE_SIZE - 3) {
         /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
          * is not on the next page; we merge this into a 32-bit
          * insn.
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
      */
     uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 
-    return !thumb_insn_is_16bit(s, insn);
+    return !thumb_insn_is_16bit(s, s->pc, insn);
 }
 
 static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-    is_16bit = thumb_insn_is_16bit(dc, insn);
+    is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
     dc->pc += 2;
     if (!is_16bit) {
         uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Add a new field to retain the address of the instruction currently
being translated.  The 32-bit uses are all within subroutines used
by a32 and t32.  This will become less obvious when t16 support is
merged with a32+t32, and having a clear definition will help.

Convert aarch64 as well for consistency.  Note that there is one
instance of a pre-assert fprintf that used the wrong value for the
address of the current instruction.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.h |  2 +-
 target/arm/translate.h     |  2 ++
 target/arm/translate-a64.c | 21 +++++++++++----------
 target/arm/translate.c     | 14 ++++++++------
 4 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s);
         qemu_log_mask(LOG_UNIMP,                                         \
                       "%s:%d: unsupported instruction encoding 0x%08x "  \
                       "at pc=%016" PRIx64 "\n",                          \
-                      __FILE__, __LINE__, insn, s->pc - 4);              \
+                      __FILE__, __LINE__, insn, s->pc_curr);             \
         unallocated_encoding(s);                                         \
     } while (0)
 
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     const ARMISARegisters *isar;
 
     target_ulong pc;
+    /* The address of the current instruction being translated. */
+    target_ulong pc_curr;
     target_ulong page_start;
     uint32_t insn;
     /* Nonzero if this instruction has been conditionally skipped.  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline AArch64DecodeFn *lookup_disas_fn(const AArch64DecodeTable *table,
  */
 static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
 {
-    uint64_t addr = s->pc + sextract32(insn, 0, 26) * 4 - 4;
+    uint64_t addr = s->pc_curr + sextract32(insn, 0, 26) * 4;
 
     if (insn & (1U << 31)) {
         /* BL Branch with link */
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
     sf = extract32(insn, 31, 1);
     op = extract32(insn, 24, 1); /* 0: CBZ; 1: CBNZ */
     rt = extract32(insn, 0, 5);
-    addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
+    addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
 
     tcg_cmp = read_cpu_reg(s, rt, sf);
     label_match = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
 
     bit_pos = (extract32(insn, 31, 1) << 5) | extract32(insn, 19, 5);
     op = extract32(insn, 24, 1); /* 0: TBZ; 1: TBNZ */
-    addr = s->pc + sextract32(insn, 5, 14) * 4 - 4;
+    addr = s->pc_curr + sextract32(insn, 5, 14) * 4;
     rt = extract32(insn, 0, 5);
 
     tcg_cmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
         unallocated_encoding(s);
         return;
     }
-    addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
+    addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
     cond = extract32(insn, 0, 4);
 
     reset_btype(s);
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
         TCGv_i32 tcg_syn, tcg_isread;
         uint32_t syndrome;
 
-        gen_a64_set_pc_im(s->pc - 4);
+        gen_a64_set_pc_im(s->pc_curr);
         tmpptr = tcg_const_ptr(ri);
         syndrome = syn_aa64_sysregtrap(op0, op1, op2, crn, crm, rt, isread);
         tcg_syn = tcg_const_i32(syndrome);
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             /* The pre HVC helper handles cases when HVC gets trapped
              * as an undefined insn by runtime configuration.
              */
-            gen_a64_set_pc_im(s->pc - 4);
+            gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_hvc(cpu_env);
             gen_ss_advance(s);
             gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
                 unallocated_encoding(s);
                 break;
             }
-            gen_a64_set_pc_im(s->pc - 4);
+            gen_a64_set_pc_im(s->pc_curr);
             tmp = tcg_const_i32(syn_aa64_smc(imm16));
             gen_helper_pre_smc(cpu_env, tmp);
             tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
 
     tcg_rt = cpu_reg(s, rt);
 
-    clean_addr = tcg_const_i64((s->pc - 4) + imm);
+    clean_addr = tcg_const_i64(s->pc_curr + imm);
     if (is_vector) {
         do_fp_ld(s, rt, clean_addr, size);
     } else {
@@ -XXX,XX +XXX,XX @@ static void disas_pc_rel_adr(DisasContext *s, uint32_t insn)
     offset = sextract64(insn, 5, 19);
     offset = offset << 2 | extract32(insn, 29, 2);
     rd = extract32(insn, 0, 5);
-    base = s->pc - 4;
+    base = s->pc_curr;
 
     if (page) {
         /* ADRP (page based) */
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 break;
             default:
                 fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-                        __func__, insn, fpopcode, s->pc);
+                        __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
 
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
 {
     uint32_t insn;
 
+    s->pc_curr = s->pc;
     insn = arm_ldl_code(env, s->pc, s->sctlr_b);
     s->insn = insn;
     s->pc += 4;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
      * as an undefined insn by runtime configuration (ie before
      * the insn really executes).
      */
-    gen_set_pc_im(s, s->pc - 4);
+    gen_set_pc_im(s, s->pc_curr);
     gen_helper_pre_hvc(cpu_env);
     /* Otherwise we will treat this as a real exception which
      * happens after execution of the insn. (The distinction matters
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
      */
     TCGv_i32 tmp;
 
-    gen_set_pc_im(s, s->pc - 4);
+    gen_set_pc_im(s, s->pc_curr);
     tmp = tcg_const_i32(syn_aa32_smc());
     gen_helper_pre_smc(cpu_env, tmp);
     tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static void gen_msr_banked(DisasContext *s, int r, int sysm, int rn)
 
     /* Sync state because msr_banked() can raise exceptions */
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - 4);
+    gen_set_pc_im(s, s->pc_curr);
     tcg_reg = load_reg(s, rn);
     tcg_tgtmode = tcg_const_i32(tgtmode);
     tcg_regno = tcg_const_i32(regno);
@@ -XXX,XX +XXX,XX @@ static void gen_mrs_banked(DisasContext *s, int r, int sysm, int rn)
 
     /* Sync state because mrs_banked() can raise exceptions */
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - 4);
+    gen_set_pc_im(s, s->pc_curr);
     tcg_reg = tcg_temp_new_i32();
     tcg_tgtmode = tcg_const_i32(tgtmode);
     tcg_regno = tcg_const_i32(regno);
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
             }
 
             gen_set_condexec(s);
-            gen_set_pc_im(s, s->pc - 4);
+            gen_set_pc_im(s, s->pc_curr);
             tmpptr = tcg_const_ptr(ri);
             tcg_syn = tcg_const_i32(syndrome);
             tcg_isread = tcg_const_i32(isread);
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
     tmp = tcg_const_i32(mode);
     /* get_r13_banked() will raise an exception if called from System mode */
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - 4);
+    gen_set_pc_im(s, s->pc_curr);
     gen_helper_get_r13_banked(addr, cpu_env, tmp);
     tcg_temp_free_i32(tmp);
     switch (amode) {
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
+    dc->pc_curr = dc->pc;
     insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
     dc->insn = insn;
     dc->pc += 4;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
+    dc->pc_curr = dc->pc;
     insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
     is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
     dc->pc += 2;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We currently have 3 different ways of computing the architectural
value of "PC" as seen in the ARM ARM.

The value of s->pc has been incremented past the current insn,
but that is all.  Thus for a32, PC = s->pc + 4; for t32, PC = s->pc;
for t16, PC = s->pc + 2.  These differing computations make it
impossible at present to unify the various code paths.

With the newly introduced s->pc_curr, we can compute the correct
value for all cases, using the formula given in the ARM ARM.

This changes the behaviour for load_reg() and load_reg_var()
when called with reg==15 from a 32-bit Thumb instruction:
previously they would have returned the incorrect value
of pc_curr + 6, and now they will return the architecturally
correct value of PC, which is pc_curr + 4. This will not
affect well-behaved guest software, because all of the places
we call these functions from T32 code are instructions where
using r15 is UNPREDICTABLE. Using the architectural PC value
here is more consistent with the T16 and A32 behaviour.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-4-richard.henderson@linaro.org
[PMM: added commit message note about UNPREDICTABLE T32 cases]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 59 ++++++++++++++++--------------------------
 1 file changed, 23 insertions(+), 36 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void store_cpu_offset(TCGv_i32 var, int offset)
 #define store_cpu_field(var, name) \
     store_cpu_offset(var, offsetof(CPUARMState, name))
 
+/* The architectural value of PC.  */
+static uint32_t read_pc(DisasContext *s)
+{
+    return s->pc_curr + (s->thumb ? 4 : 8);
+}
+
 /* Set a variable to the value of a CPU register.  */
 static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 {
     if (reg == 15) {
-        uint32_t addr;
-        /* normally, since we updated PC, we need only to add one insn */
-        if (s->thumb)
-            addr = (long)s->pc + 2;
-        else
-            addr = (long)s->pc + 4;
-        tcg_gen_movi_i32(var, addr);
+        tcg_gen_movi_i32(var, read_pc(s));
     } else {
         tcg_gen_mov_i32(var, cpu_R[reg]);
     }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             /* branch link and change to thumb (blx <offset>) */
             int32_t offset;
 
-            val = (uint32_t)s->pc;
             tmp = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp, val);
+            tcg_gen_movi_i32(tmp, s->pc);
             store_reg(s, 14, tmp);
             /* Sign-extend the 24-bit offset */
             offset = (((int32_t)insn) << 8) >> 8;
+            val = read_pc(s);
             /* offset * 4 + bit24 * 2 + (thumb bit) */
             val += (offset << 2) | ((insn >> 23) & 2) | 1;
-            /* pipeline offset */
-            val += 4;
             /* protected by ARCH(5); above, near the start of uncond block */
             gen_bx_im(s, val);
             return;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                         } else {
                             /* store */
                             if (i == 15) {
-                                /* special case: r15 = PC + 8 */
-                                val = (long)s->pc + 4;
                                 tmp = tcg_temp_new_i32();
-                                tcg_gen_movi_i32(tmp, val);
+                                tcg_gen_movi_i32(tmp, read_pc(s));
                             } else if (user) {
                                 tmp = tcg_temp_new_i32();
                                 tmp2 = tcg_const_i32(i);
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 int32_t offset;
 
                 /* branch (and link) */
-                val = (int32_t)s->pc;
                 if (insn & (1 << 24)) {
                     tmp = tcg_temp_new_i32();
-                    tcg_gen_movi_i32(tmp, val);
+                    tcg_gen_movi_i32(tmp, s->pc);
                     store_reg(s, 14, tmp);
                 }
                 offset = sextract32(insn << 2, 0, 26);
-                val += offset + 4;
-                gen_jmp(s, val);
+                gen_jmp(s, read_pc(s) + offset);
             }
             break;
         case 0xc:
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 tcg_temp_free_i32(addr);
             } else if ((insn & (7 << 5)) == 0) {
                 /* Table Branch.  */
-                if (rn == 15) {
-                    addr = tcg_temp_new_i32();
-                    tcg_gen_movi_i32(addr, s->pc);
-                } else {
-                    addr = load_reg(s, rn);
-                }
+                addr = load_reg(s, rn);
                 tmp = load_reg(s, rm);
                 tcg_gen_add_i32(addr, addr, tmp);
                 if (insn & (1 << 4)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 }
                 tcg_temp_free_i32(addr);
                 tcg_gen_shli_i32(tmp, tmp, 1);
-                tcg_gen_addi_i32(tmp, tmp, s->pc);
+                tcg_gen_addi_i32(tmp, tmp, read_pc(s));
                 store_reg(s, 15, tmp);
             } else {
                 bool is_lasr = false;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                     tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
                 }
 
-                offset += s->pc;
+                offset += read_pc(s);
                 if (insn & (1 << 12)) {
                     /* b/bl */
                     gen_jmp(s, offset);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 offset |= (insn & (1 << 11)) << 8;
 
                 /* jump to the offset */
-                gen_jmp(s, s->pc + offset);
+                gen_jmp(s, read_pc(s) + offset);
             }
         } else {
             /*
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
         if (insn & (1 << 11)) {
             rd = (insn >> 8) & 7;
             /* load pc-relative.  Bit 1 of PC is ignored.  */
-            val = s->pc + 2 + ((insn & 0xff) * 4);
+            val = read_pc(s) + ((insn & 0xff) * 4);
             val &= ~(uint32_t)2;
             addr = tcg_temp_new_i32();
             tcg_gen_movi_i32(addr, val);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
         } else {
             /* PC. bit 1 is ignored.  */
             tmp = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
+            tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
         }
         val = (insn & 0xff) * 4;
         tcg_gen_addi_i32(tmp, tmp, val);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
                 tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
             tcg_temp_free_i32(tmp);
             offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
-            val = (uint32_t)s->pc + 2;
-            val += offset;
-            gen_jmp(s, val);
+            gen_jmp(s, read_pc(s) + offset);
             break;
 
         case 15: /* IT, nop-hint.  */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
         arm_skip_unless(s, cond);
 
         /* jump to the offset */
-        val = (uint32_t)s->pc + 2;
+        val = read_pc(s);
         offset = ((int32_t)insn << 24) >> 24;
         val += offset << 1;
         gen_jmp(s, val);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
             break;
         }
         /* unconditional branch */
-        val = (uint32_t)s->pc;
+        val = read_pc(s);
         offset = ((int32_t)insn << 21) >> 21;
-        val += (offset << 1) + 2;
+        val += offset << 1;
         gen_jmp(s, val);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
             /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
             uint32_t uoffset = ((int32_t)insn << 21) >> 9;
 
-            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
+            tcg_gen_movi_i32(cpu_R[14], read_pc(s) + uoffset);
         }
         break;
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Provide a common routine for the places that require ALIGN(PC, 4)
as the base address as opposed to plain PC.  The two are always
the same for A32, but the difference is meaningful for thumb mode.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c |  38 ++------
 target/arm/translate.c         | 166 +++++++++++++++------------------
 2 files changed, 82 insertions(+), 122 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
         offset = -offset;
     }
 
-    if (s->thumb && a->rn == 15) {
-        /* This is actually UNPREDICTABLE */
-        addr = tcg_temp_new_i32();
-        tcg_gen_movi_i32(addr, s->pc & ~2);
-    } else {
-        addr = load_reg(s, a->rn);
-    }
-    tcg_gen_addi_i32(addr, addr, offset);
+    /* For thumb, use of PC is UNPREDICTABLE.  */
+    addr = add_reg_for_lit(s, a->rn, offset);
     tmp = tcg_temp_new_i32();
     if (a->l) {
         gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
         offset = -offset;
     }
 
-    if (s->thumb && a->rn == 15) {
-        /* This is actually UNPREDICTABLE */
-        addr = tcg_temp_new_i32();
-        tcg_gen_movi_i32(addr, s->pc & ~2);
-    } else {
-        addr = load_reg(s, a->rn);
-    }
-    tcg_gen_addi_i32(addr, addr, offset);
+    /* For thumb, use of PC is UNPREDICTABLE.  */
+    addr = add_reg_for_lit(s, a->rn, offset);
     tmp = tcg_temp_new_i64();
     if (a->l) {
         gen_aa32_ld64(s, tmp, addr, get_mem_index(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, arg_VLDM_VSTM_sp *a)
         return true;
     }
 
-    if (s->thumb && a->rn == 15) {
-        /* This is actually UNPREDICTABLE */
-        addr = tcg_temp_new_i32();
-        tcg_gen_movi_i32(addr, s->pc & ~2);
-    } else {
-        addr = load_reg(s, a->rn);
-    }
+    /* For thumb, use of PC is UNPREDICTABLE.  */
+    addr = add_reg_for_lit(s, a->rn, 0);
     if (a->p) {
         /* pre-decrement */
         tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, arg_VLDM_VSTM_dp *a)
         return true;
     }
 
-    if (s->thumb && a->rn == 15) {
-        /* This is actually UNPREDICTABLE */
-        addr = tcg_temp_new_i32();
-        tcg_gen_movi_i32(addr, s->pc & ~2);
-    } else {
-        addr = load_reg(s, a->rn);
-    }
+    /* For thumb, use of PC is UNPREDICTABLE.  */
+    addr = add_reg_for_lit(s, a->rn, 0);
     if (a->p) {
         /* pre-decrement */
         tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
     return tmp;
 }
 
+/*
+ * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
+ * This is used for load/store for which use of PC implies (literal),
+ * or ADD that implies ADR.
+ */
+static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    if (reg == 15) {
+        tcg_gen_movi_i32(tmp, (read_pc(s) & ~3) + ofs);
+    } else {
+        tcg_gen_addi_i32(tmp, cpu_R[reg], ofs);
+    }
+    return tmp;
+}
+
 /* Set a CPU register.  The source must be a temporary and will be
    marked as dead.  */
 static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                  */
                 bool wback = extract32(insn, 21, 1);
 
-                if (rn == 15) {
-                    if (insn & (1 << 21)) {
-                        /* UNPREDICTABLE */
-                        goto illegal_op;
-                    }
-                    addr = tcg_temp_new_i32();
-                    tcg_gen_movi_i32(addr, s->pc & ~3);
-                } else {
-                    addr = load_reg(s, rn);
+                if (rn == 15 && (insn & (1 << 21))) {
+                    /* UNPREDICTABLE */
+                    goto illegal_op;
                 }
+
+                addr = add_reg_for_lit(s, rn, 0);
                 offset = (insn & 0xff) * 4;
                 if ((insn & (1 << 23)) == 0) {
                     offset = -offset;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                         store_reg(s, rd, tmp);
                     } else {
                         /* Add/sub 12-bit immediate.  */
-                        if (rn == 15) {
-                            offset = s->pc & ~(uint32_t)3;
-                            if (insn & (1 << 23))
-                                offset -= imm;
-                            else
-                                offset += imm;
-                            tmp = tcg_temp_new_i32();
-                            tcg_gen_movi_i32(tmp, offset);
-                            store_reg(s, rd, tmp);
+                        if (insn & (1 << 23)) {
+                            imm = -imm;
+                        }
+                        tmp = add_reg_for_lit(s, rn, imm);
+                        if (rn == 13 && rd == 13) {
+                            /* ADD SP, SP, imm or SUB SP, SP, imm */
+                            store_sp_checked(s, tmp);
                         } else {
-                            tmp = load_reg(s, rn);
-                            if (insn & (1 << 23))
-                                tcg_gen_subi_i32(tmp, tmp, imm);
-                            else
-                                tcg_gen_addi_i32(tmp, tmp, imm);
-                            if (rn == 13 && rd == 13) {
-                                /* ADD SP, SP, imm or SUB SP, SP, imm */
-                                store_sp_checked(s, tmp);
-                            } else {
-                                store_reg(s, rd, tmp);
-                            }
+                            store_reg(s, rd, tmp);
                         }
                     }
                 }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             }
         }
         memidx = get_mem_index(s);
-        if (rn == 15) {
-            addr = tcg_temp_new_i32();
-            /* PC relative.  */
-            /* s->pc has already been incremented by 4.  */
-            imm = s->pc & 0xfffffffc;
-            if (insn & (1 << 23))
-                imm += insn & 0xfff;
-            else
-                imm -= insn & 0xfff;
-            tcg_gen_movi_i32(addr, imm);
+        imm = insn & 0xfff;
+        if (insn & (1 << 23)) {
+            /* PC relative or Positive offset.  */
+            addr = add_reg_for_lit(s, rn, imm);
+        } else if (rn == 15) {
+            /* PC relative with negative offset.  */
+            addr = add_reg_for_lit(s, rn, -imm);
         } else {
             addr = load_reg(s, rn);
-            if (insn & (1 << 23)) {
-                /* Positive offset.  */
-                imm = insn & 0xfff;
-                tcg_gen_addi_i32(addr, addr, imm);
-            } else {
-                imm = insn & 0xff;
-                switch ((insn >> 8) & 0xf) {
-                case 0x0: /* Shifted Register.  */
-                    shift = (insn >> 4) & 0xf;
-                    if (shift > 3) {
-                        tcg_temp_free_i32(addr);
-                        goto illegal_op;
-                    }
-                    tmp = load_reg(s, rm);
-                    if (shift)
-                        tcg_gen_shli_i32(tmp, tmp, shift);
-                    tcg_gen_add_i32(addr, addr, tmp);
-                    tcg_temp_free_i32(tmp);
-                    break;
-                case 0xc: /* Negative offset.  */
-                    tcg_gen_addi_i32(addr, addr, -imm);
-                    break;
-                case 0xe: /* User privilege.  */
-                    tcg_gen_addi_i32(addr, addr, imm);
-                    memidx = get_a32_user_mem_index(s);
-                    break;
-                case 0x9: /* Post-decrement.  */
-                    imm = -imm;
-                    /* Fall through.  */
-                case 0xb: /* Post-increment.  */
-                    postinc = 1;
-                    writeback = 1;
-                    break;
-                case 0xd: /* Pre-decrement.  */
-                    imm = -imm;
-                    /* Fall through.  */
-                case 0xf: /* Pre-increment.  */
-                    writeback = 1;
-                    break;
-                default:
+            imm = insn & 0xff;
+            switch ((insn >> 8) & 0xf) {
+            case 0x0: /* Shifted Register.  */
+                shift = (insn >> 4) & 0xf;
+                if (shift > 3) {
                     tcg_temp_free_i32(addr);
                     goto illegal_op;
                 }
+                tmp = load_reg(s, rm);
+                if (shift) {
+                    tcg_gen_shli_i32(tmp, tmp, shift);
+                }
+                tcg_gen_add_i32(addr, addr, tmp);
+                tcg_temp_free_i32(tmp);
+                break;
+            case 0xc: /* Negative offset.  */
+                tcg_gen_addi_i32(addr, addr, -imm);
+                break;
+            case 0xe: /* User privilege.  */
+                tcg_gen_addi_i32(addr, addr, imm);
+                memidx = get_a32_user_mem_index(s);
+                break;
+            case 0x9: /* Post-decrement.  */
+                imm = -imm;
+                /* Fall through.  */
+            case 0xb: /* Post-increment.  */
+                postinc = 1;
+                writeback = 1;
+                break;
+            case 0xd: /* Pre-decrement.  */
+                imm = -imm;
+                /* Fall through.  */
+            case 0xf: /* Pre-increment.  */
+                writeback = 1;
+                break;
+            default:
+                tcg_temp_free_i32(addr);
+                goto illegal_op;
             }
         }
 
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
         if (insn & (1 << 11)) {
             rd = (insn >> 8) & 7;
             /* load pc-relative.  Bit 1 of PC is ignored.  */
-            val = read_pc(s) + ((insn & 0xff) * 4);
-            val &= ~(uint32_t)2;
-            addr = tcg_temp_new_i32();
-            tcg_gen_movi_i32(addr, val);
+            addr = add_reg_for_lit(s, 15, (insn & 0xff) * 4);
             tmp = tcg_temp_new_i32();
             gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
                                rd | ISSIs16Bit);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
          *  - Add PC/SP (immediate)
          */
         rd = (insn >> 8) & 7;
-        if (insn & (1 << 11)) {
-            /* SP */
-            tmp = load_reg(s, 13);
-        } else {
-            /* PC. bit 1 is ignored.  */
-            tmp = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
-        }
         val = (insn & 0xff) * 4;
-        tcg_gen_addi_i32(tmp, tmp, val);
+        tmp = add_reg_for_lit(s, insn & (1 << 11) ? 13 : 15, val);
         store_reg(s, rd, tmp);
         break;
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The thumb bit has already been removed from s->pc, and is always even.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 static inline void gen_lookup_tb(DisasContext *s)
 {
-    tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
+    tcg_gen_movi_i32(cpu_R[15], s->pc);
     s->base.is_jmp = DISAS_EXIT;
 }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  * self-modifying code correctly and also to take
                  * any pending interrupts immediately.
                  */
-                gen_goto_tb(s, 0, s->pc & ~1);
+                gen_goto_tb(s, 0, s->pc);
                 return;
             case 7: /* sb */
                 if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  * for TCG; MB and end the TB instead.
                  */
                 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-                gen_goto_tb(s, 0, s->pc & ~1);
+                gen_goto_tb(s, 0, s->pc);
                 return;
             default:
                 goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                              * and also to take any pending interrupts
                              * immediately.
                              */
-                            gen_goto_tb(s, 0, s->pc & ~1);
+                            gen_goto_tb(s, 0, s->pc);
                             break;
                         case 7: /* sb */
                             if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                              * for TCG; MB and end the TB instead.
                              */
                             tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-                            gen_goto_tb(s, 0, s->pc & ~1);
+                            gen_goto_tb(s, 0, s->pc);
                             break;
                         default:
                             goto illegal_op;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We must update s->base.pc_next when we return from the translate_insn
hook to the main translator loop.  By incrementing s->base.pc_next
immediately after reading the insn word, "pc_next" contains the address
of the next instruction throughout translation.

All remaining uses of s->pc are referencing the address of the next insn,
so this is now a simple global replacement.  Remove the "s->pc" field.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h     |   1 -
 target/arm/translate-a64.c |  51 +++++++++---------
 target/arm/translate.c     | 103 ++++++++++++++++++-------------------
 3 files changed, 72 insertions(+), 83 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     DisasContextBase base;
     const ARMISARegisters *isar;
 
-    target_ulong pc;
     /* The address of the current instruction being translated. */
     target_ulong pc_curr;
     target_ulong page_start;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
 
 static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 {
-    gen_a64_set_pc_im(s->pc - offset);
+    gen_a64_set_pc_im(s->base.pc_next - offset);
     gen_exception_internal(excp);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 static void gen_exception_insn(DisasContext *s, int offset, int excp,
                                uint32_t syndrome, uint32_t target_el)
 {
-    gen_a64_set_pc_im(s->pc - offset);
+    gen_a64_set_pc_im(s->base.pc_next - offset);
     gen_exception(excp, syndrome, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset,
 {
     TCGv_i32 tcg_syn;
 
-    gen_a64_set_pc_im(s->pc - offset);
+    gen_a64_set_pc_im(s->base.pc_next - offset);
     tcg_syn = tcg_const_i32(syndrome);
     gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
     tcg_temp_free_i32(tcg_syn);
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
 
     if (insn & (1U << 31)) {
         /* BL Branch with link */
-        tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
+        tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
     }
 
     /* B Branch / BL Branch with link */
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
     tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
                         tcg_cmp, 0, label_match);
 
-    gen_goto_tb(s, 0, s->pc);
+    gen_goto_tb(s, 0, s->base.pc_next);
     gen_set_label(label_match);
     gen_goto_tb(s, 1, addr);
 }
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
     tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
                         tcg_cmp, 0, label_match);
     tcg_temp_free_i64(tcg_cmp);
-    gen_goto_tb(s, 0, s->pc);
+    gen_goto_tb(s, 0, s->base.pc_next);
     gen_set_label(label_match);
     gen_goto_tb(s, 1, addr);
 }
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
         /* genuinely conditional branches */
         TCGLabel *label_match = gen_new_label();
         arm_gen_test_cc(cond, label_match);
-        gen_goto_tb(s, 0, s->pc);
+        gen_goto_tb(s, 0, s->base.pc_next);
         gen_set_label(label_match);
         gen_goto_tb(s, 1, addr);
     } else {
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
          * any pending interrupts immediately.
          */
         reset_btype(s);
-        gen_goto_tb(s, 0, s->pc);
+        gen_goto_tb(s, 0, s->base.pc_next);
         return;
 
     case 7: /* SB */
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
          * MB and end the TB instead.
          */
         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-        gen_goto_tb(s, 0, s->pc);
+        gen_goto_tb(s, 0, s->base.pc_next);
         return;
 
     default:
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
         gen_a64_set_pc(s, dst);
         /* BLR also needs to load return address */
         if (opc == 1) {
-            tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
+            tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
         gen_a64_set_pc(s, dst);
         /* BLRAA also needs to load return address */
         if (opc == 9) {
-            tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
+            tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
 {
     uint32_t insn;
 
-    s->pc_curr = s->pc;
-    insn = arm_ldl_code(env, s->pc, s->sctlr_b);
+    s->pc_curr = s->base.pc_next;
+    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
     s->insn = insn;
-    s->pc += 4;
+    s->base.pc_next += 4;
 
     s->fp_access_checked = false;
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     int bound, core_mmu_idx;
 
     dc->isar = &arm_cpu->isar;
-    dc->pc = dc->base.pc_first;
     dc->condjmp = 0;
 
     dc->aarch64 = 1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    tcg_gen_insn_start(dc->pc, 0, 0);
+    tcg_gen_insn_start(dc->base.pc_next, 0, 0);
     dc->insn_start = tcg_last_op();
 }
 
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
     if (bp->flags & BP_CPU) {
-        gen_a64_set_pc_im(dc->pc);
+        gen_a64_set_pc_im(dc->base.pc_next);
         gen_helper_check_breakpoints(cpu_env);
         /* End the TB early; it likely won't be executed */
         dc->base.is_jmp = DISAS_TOO_MANY;
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
            to for it to be properly cleared -- thus we
            increment the PC here so that the logic setting
            tb->size below does the right thing.  */
-        dc->pc += 4;
+        dc->base.pc_next += 4;
         dc->base.is_jmp = DISAS_NORETURN;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         disas_a64_insn(env, dc);
     }
 
-    dc->base.pc_next = dc->pc;
     translator_loop_temp_check(&dc->base);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          */
         switch (dc->base.is_jmp) {
         default:
-            gen_a64_set_pc_im(dc->pc);
+            gen_a64_set_pc_im(dc->base.pc_next);
             /* fall through */
         case DISAS_EXIT:
         case DISAS_JUMP:
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
-            gen_goto_tb(dc, 1, dc->pc);
+            gen_goto_tb(dc, 1, dc->base.pc_next);
             break;
         default:
         case DISAS_UPDATE:
-            gen_a64_set_pc_im(dc->pc);
+            gen_a64_set_pc_im(dc->base.pc_next);
             /* fall through */
         case DISAS_EXIT:
             tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         case DISAS_SWI:
             break;
         case DISAS_WFE:
-            gen_a64_set_pc_im(dc->pc);
+            gen_a64_set_pc_im(dc->base.pc_next);
             gen_helper_wfe(cpu_env);
             break;
         case DISAS_YIELD:
-            gen_a64_set_pc_im(dc->pc);
+            gen_a64_set_pc_im(dc->base.pc_next);
             gen_helper_yield(cpu_env);
             break;
         case DISAS_WFI:
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
              */
             TCGv_i32 tmp = tcg_const_i32(4);
 
-            gen_a64_set_pc_im(dc->pc);
+            gen_a64_set_pc_im(dc->base.pc_next);
             gen_helper_wfi(cpu_env, tmp);
             tcg_temp_free_i32(tmp);
             /* The helper doesn't necessarily throw an exception, but we
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         }
         }
     }
-
-    /* Functions above can change dc->pc, so re-align db->pc_next */
-    dc->base.pc_next = dc->pc;
 }
 
 static void aarch64_tr_disas_log(const DisasContextBase *dcbase,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_blxns(DisasContext *s, int rm)
      * We do however need to set the PC, because the blxns helper reads it.
      * The blxns helper may throw an exception.
      */
-    gen_set_pc_im(s, s->pc);
+    gen_set_pc_im(s, s->base.pc_next);
     gen_helper_v7m_blxns(cpu_env, var);
     tcg_temp_free_i32(var);
     s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
      * for single stepping.)
      */
     s->svc_imm = imm16;
-    gen_set_pc_im(s, s->pc);
+    gen_set_pc_im(s, s->base.pc_next);
     s->base.is_jmp = DISAS_HVC;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
     tmp = tcg_const_i32(syn_aa32_smc());
     gen_helper_pre_smc(cpu_env, tmp);
     tcg_temp_free_i32(tmp);
-    gen_set_pc_im(s, s->pc);
+    gen_set_pc_im(s, s->base.pc_next);
     s->base.is_jmp = DISAS_SMC;
 }
 
 static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 {
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - offset);
+    gen_set_pc_im(s, s->base.pc_next - offset);
     gen_exception_internal(excp);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, int offset, int excp,
                                int syn, uint32_t target_el)
 {
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - offset);
+    gen_set_pc_im(s, s->base.pc_next - offset);
     gen_exception(excp, syn, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
     TCGv_i32 tcg_syn;
 
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc - offset);
+    gen_set_pc_im(s, s->base.pc_next - offset);
     tcg_syn = tcg_const_i32(syn);
     gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
     tcg_temp_free_i32(tcg_syn);
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 static inline void gen_lookup_tb(DisasContext *s)
 {
-    tcg_gen_movi_i32(cpu_R[15], s->pc);
+    tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
     s->base.is_jmp = DISAS_EXIT;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
 {
 #ifndef CONFIG_USER_ONLY
     return (s->base.tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
-           ((s->pc - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
+           ((s->base.pc_next - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
 #else
     return true;
 #endif
@@ -XXX,XX +XXX,XX @@ static void gen_nop_hint(DisasContext *s, int val)
          */
     case 1: /* yield */
         if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
-            gen_set_pc_im(s, s->pc);
+            gen_set_pc_im(s, s->base.pc_next);
             s->base.is_jmp = DISAS_YIELD;
         }
         break;
     case 3: /* wfi */
-        gen_set_pc_im(s, s->pc);
+        gen_set_pc_im(s, s->base.pc_next);
         s->base.is_jmp = DISAS_WFI;
         break;
     case 2: /* wfe */
         if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
-            gen_set_pc_im(s, s->pc);
+            gen_set_pc_im(s, s->base.pc_next);
             s->base.is_jmp = DISAS_WFE;
         }
         break;
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
             if (isread) {
                 return 1;
             }
-            gen_set_pc_im(s, s->pc);
+            gen_set_pc_im(s, s->base.pc_next);
             s->base.is_jmp = DISAS_WFI;
             return 0;
         default:
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  * self-modifying code correctly and also to take
                  * any pending interrupts immediately.
                  */
-                gen_goto_tb(s, 0, s->pc);
+                gen_goto_tb(s, 0, s->base.pc_next);
                 return;
             case 7: /* sb */
                 if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  * for TCG; MB and end the TB instead.
                  */
                 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-                gen_goto_tb(s, 0, s->pc);
+                gen_goto_tb(s, 0, s->base.pc_next);
                 return;
             default:
                 goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             int32_t offset;
 
             tmp = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp, s->pc);
+            tcg_gen_movi_i32(tmp, s->base.pc_next);
             store_reg(s, 14, tmp);
             /* Sign-extend the 24-bit offset */
             offset = (((int32_t)insn) << 8) >> 8;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             /* branch link/exchange thumb (blx) */
             tmp = load_reg(s, rm);
             tmp2 = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp2, s->pc);
+            tcg_gen_movi_i32(tmp2, s->base.pc_next);
             store_reg(s, 14, tmp2);
             gen_bx(s, tmp);
             break;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 /* branch (and link) */
                 if (insn & (1 << 24)) {
                     tmp = tcg_temp_new_i32();
-                    tcg_gen_movi_i32(tmp, s->pc);
+                    tcg_gen_movi_i32(tmp, s->base.pc_next);
                     store_reg(s, 14, tmp);
                 }
                 offset = sextract32(insn << 2, 0, 26);
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             break;
         case 0xf:
             /* swi */
-            gen_set_pc_im(s, s->pc);
+            gen_set_pc_im(s, s->base.pc_next);
             s->svc_imm = extract32(insn, 0, 24);
             s->base.is_jmp = DISAS_SWI;
             break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
 
                 if (insn & (1 << 14)) {
                     /* Branch and link.  */
-                    tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
+                    tcg_gen_movi_i32(cpu_R[14], s->base.pc_next | 1);
                 }
 
                 offset += read_pc(s);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                              * and also to take any pending interrupts
                              * immediately.
                              */
-                            gen_goto_tb(s, 0, s->pc);
+                            gen_goto_tb(s, 0, s->base.pc_next);
                             break;
                         case 7: /* sb */
                             if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                              * for TCG; MB and end the TB instead.
                              */
                             tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
-                            gen_goto_tb(s, 0, s->pc);
+                            gen_goto_tb(s, 0, s->base.pc_next);
                             break;
                         default:
                             goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
                 /* BLX/BX */
                 tmp = load_reg(s, rm);
                 if (link) {
-                    val = (uint32_t)s->pc | 1;
+                    val = (uint32_t)s->base.pc_next | 1;
                     tmp2 = tcg_temp_new_i32();
                     tcg_gen_movi_i32(tmp2, val);
                     store_reg(s, 14, tmp2);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
 
         if (cond == 0xf) {
             /* swi */
-            gen_set_pc_im(s, s->pc);
+            gen_set_pc_im(s, s->base.pc_next);
             s->svc_imm = extract32(insn, 0, 8);
             s->base.is_jmp = DISAS_SWI;
             break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
             tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
 
             tmp2 = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
             store_reg(s, 14, tmp2);
             gen_bx(s, tmp);
             break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
             tcg_gen_addi_i32(tmp, tmp, offset);
 
             tmp2 = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
             store_reg(s, 14, tmp2);
             gen_bx(s, tmp);
         } else {
@@ -XXX,XX +XXX,XX @@ undef:
 
 static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
 {
-    /* Return true if the insn at dc->pc might cross a page boundary.
+    /* Return true if the insn at dc->base.pc_next might cross a page boundary.
      * (False positives are OK, false negatives are not.)
      * We know this is a Thumb insn, and our caller ensures we are
-     * only called if dc->pc is less than 4 bytes from the page
+     * only called if dc->base.pc_next is less than 4 bytes from the page
      * boundary, so we cross the page if the first 16 bits indicate
      * that this is a 32 bit insn.
      */
-    uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
+    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
 
-    return !thumb_insn_is_16bit(s, s->pc, insn);
+    return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
 }
 
 static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     uint32_t condexec, core_mmu_idx;
 
     dc->isar = &cpu->isar;
-    dc->pc = dc->base.pc_first;
     dc->condjmp = 0;
 
     dc->aarch64 = 0;
@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    tcg_gen_insn_start(dc->pc,
+    tcg_gen_insn_start(dc->base.pc_next,
                        (dc->condexec_cond << 4) | (dc->condexec_mask >> 1),
                        0);
     dc->insn_start = tcg_last_op();
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
 
     if (bp->flags & BP_CPU) {
         gen_set_condexec(dc);
-        gen_set_pc_im(dc, dc->pc);
+        gen_set_pc_im(dc, dc->base.pc_next);
         gen_helper_check_breakpoints(cpu_env);
         /* End the TB early; it's likely not going to be executed */
         dc->base.is_jmp = DISAS_TOO_MANY;
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
            tb->size below does the right thing.  */
         /* TODO: Advance PC by correct instruction length to
          * avoid disassembler error messages */
-        dc->pc += 2;
+        dc->base.pc_next += 2;
         dc->base.is_jmp = DISAS_NORETURN;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
 {
 #ifdef CONFIG_USER_ONLY
     /* Intercept jump to the magic kernel page.  */
-    if (dc->pc >= 0xffff0000) {
+    if (dc->base.pc_next >= 0xffff0000) {
         /* We always get here via a jump, so know we are not in a
            conditional execution block.  */
         gen_exception_internal(EXCP_KERNEL_TRAP);
@@ -XXX,XX +XXX,XX @@ static void arm_post_translate_insn(DisasContext *dc)
         gen_set_label(dc->condlabel);
         dc->condjmp = 0;
     }
-    dc->base.pc_next = dc->pc;
     translator_loop_temp_check(&dc->base);
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
-    dc->pc_curr = dc->pc;
-    insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
+    dc->pc_curr = dc->base.pc_next;
+    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
     dc->insn = insn;
-    dc->pc += 4;
+    dc->base.pc_next += 4;
     disas_arm_insn(dc, insn);
 
     arm_post_translate_insn(dc);
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
-    dc->pc_curr = dc->pc;
-    insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-    is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
-    dc->pc += 2;
+    dc->pc_curr = dc->base.pc_next;
+    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+    is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
+    dc->base.pc_next += 2;
     if (!is_16bit) {
-        uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
+        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
 
         insn = insn << 16 | insn2;
-        dc->pc += 2;
+        dc->base.pc_next += 2;
     }
     dc->insn = insn;
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      * but isn't very efficient).
      */
     if (dc->base.is_jmp == DISAS_NEXT
-        && (dc->pc - dc->page_start >= TARGET_PAGE_SIZE
-            || (dc->pc - dc->page_start >= TARGET_PAGE_SIZE - 3
+        && (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE
+            || (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE - 3
                 && insn_crosses_page(env, dc)))) {
         dc->base.is_jmp = DISAS_TOO_MANY;
     }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
         case DISAS_UPDATE:
-            gen_set_pc_im(dc, dc->pc);
+            gen_set_pc_im(dc, dc->base.pc_next);
             /* fall through */
         default:
             /* FIXME: Single stepping a WFI insn will not halt the CPU. */
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch(dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
-            gen_goto_tb(dc, 1, dc->pc);
+            gen_goto_tb(dc, 1, dc->base.pc_next);
             break;
         case DISAS_JUMP:
             gen_goto_ptr();
             break;
         case DISAS_UPDATE:
-            gen_set_pc_im(dc, dc->pc);
+            gen_set_pc_im(dc, dc->base.pc_next);
             /* fall through */
         default:
             /* indicate that the hash table must be used to find the next TB */
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         gen_set_label(dc->condlabel);
         gen_set_condexec(dc);
         if (unlikely(is_singlestepping(dc))) {
-            gen_set_pc_im(dc, dc->pc);
+            gen_set_pc_im(dc, dc->base.pc_next);
             gen_singlestep_exception(dc);
         } else {
-            gen_goto_tb(dc, 1, dc->pc);
+            gen_goto_tb(dc, 1, dc->base.pc_next);
         }
     }
-
-    /* Functions above can change dc->pc, so re-align db->pc_next */
-    dc->base.pc_next = dc->pc;
 }
 
 static void arm_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The offset is variable depending on the instruction set, whereas
we have stored values for the current pc and the next pc.  Passing
in the actual value is clearer in intent.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c     | 25 ++++++++++++++-----------
 target/arm/translate-vfp.inc.c |  6 +++---
 target/arm/translate.c         | 31 ++++++++++++++++---------------
 3 files changed, 33 insertions(+), 29 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, int offset, int excp,
+static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
                                uint32_t syndrome, uint32_t target_el)
 {
-    gen_a64_set_pc_im(s->base.pc_next - offset);
+    gen_a64_set_pc_im(pc);
     gen_exception(excp, syndrome, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
 void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                        default_exception_el(s));
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
         return true;
     }
 
-    gen_exception_insn(s, 4, EXCP_UDEF, syn_fp_access_trap(1, 0xe, false),
-                       s->fp_excp_el);
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                       syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
 bool sve_access_check(DisasContext *s)
 {
     if (s->sve_excp_el) {
-        gen_exception_insn(s, 4, EXCP_UDEF, syn_sve_access_trap(),
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_sve_access_trap(),
                            s->sve_excp_el);
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
         switch (op2_ll) {
         case 1:                                                     /* SVC */
             gen_ss_advance(s);
-            gen_exception_insn(s, 0, EXCP_SWI, syn_aa64_svc(imm16),
-                               default_exception_el(s));
+            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
+                               syn_aa64_svc(imm16), default_exception_el(s));
             break;
         case 2:                                                     /* HVC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_hvc(cpu_env);
             gen_ss_advance(s);
-            gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
+            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
+                               syn_aa64_hvc(imm16), 2);
             break;
         case 3:                                                     /* SMC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_helper_pre_smc(cpu_env, tmp);
             tcg_temp_free_i32(tmp);
             gen_ss_advance(s);
-            gen_exception_insn(s, 0, EXCP_SMC, syn_aa64_smc(imm16), 3);
+            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
+                               syn_aa64_smc(imm16), 3);
             break;
         default:
             unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
             if (s->btype != 0
                 && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, 4, EXCP_UDEF, syn_btitrap(s->btype),
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype),
                                    default_exception_el(s));
                 return;
             }
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
 {
     if (s->fp_excp_el) {
         if (arm_dc_feature(s, ARM_FEATURE_M)) {
-            gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
+            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
                                s->fp_excp_el);
         } else {
-            gen_exception_insn(s, 4, EXCP_UDEF,
+            gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                                syn_fp_access_trap(1, 0xe, false),
                                s->fp_excp_el);
         }
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
 
     if (!s->vfp_enabled && !ignore_vfp_enabled) {
         assert(!arm_dc_feature(s, ARM_FEATURE_M));
-        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                            default_exception_el(s));
         return false;
     }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, int offset, int excp,
+static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
                                int syn, uint32_t target_el)
 {
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->base.pc_next - offset);
+    gen_set_pc_im(s, pc);
     gen_exception(excp, syn, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
         return;
     }
 
-    gen_exception_insn(s, s->thumb ? 2 : 4, EXCP_UDEF, syn_uncategorized(),
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                        default_exception_el(s));
 }
 
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
 
 undef:
     /* If we get here then some access check did not pass */
-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), exc_target);
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                       syn_uncategorized(), exc_target);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
      * for attempts to execute invalid vfp/neon encodings with FP disabled.
      */
     if (s->fp_excp_el) {
-        gen_exception_insn(s, 4, EXCP_UDEF,
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
      * for attempts to execute invalid vfp/neon encodings with FP disabled.
      */
     if (s->fp_excp_el) {
-        gen_exception_insn(s, 4, EXCP_UDEF,
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
     }
 
     if (s->fp_excp_el) {
-        gen_exception_insn(s, 4, EXCP_UDEF,
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
         off_rm = vfp_reg_offset(0, rm);
     }
     if (s->fp_excp_el) {
-        gen_exception_insn(s, 4, EXCP_UDEF,
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
      * For the UNPREDICTABLE cases we choose to UNDEF.
      */
     if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
-        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3);
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
     }
 
     if (undef) {
-        gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                            default_exception_el(s));
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
      * UsageFault exception.
      */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        gen_exception_insn(s, 4, EXCP_INVSTATE, syn_uncategorized(),
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
                            default_exception_el(s));
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             break;
         default:
         illegal_op:
-            gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+            gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                                default_exception_el(s));
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             }
 
             /* All other insns: NOCP */
-            gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
+            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
                                default_exception_el(s));
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
     }
     return;
 illegal_op:
-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                        default_exception_el(s));
 }
 
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
     return;
 illegal_op:
 undef:
-    gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
                        default_exception_el(s));
 }
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The offset is variable depending on the instruction set.
Passing in the actual value is clearer in intent.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 8 ++++----
 target/arm/translate.c     | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
     tcg_temp_free_i32(tcg_excp);
 }
 
-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
+static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
 {
-    gen_a64_set_pc_im(s->base.pc_next - offset);
+    gen_a64_set_pc_im(pc);
     gen_exception_internal(excp);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
                 break;
             }
 #endif
-            gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
+            gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
         } else {
             unsupported_encoding(s, insn);
         }
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
         /* End the TB early; it likely won't be executed */
         dc->base.is_jmp = DISAS_TOO_MANY;
     } else {
-        gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
+        gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
         /* The address covered by the breakpoint must be
            included in [tb->pc, tb->pc + tb->size) in order
            to for it to be properly cleared -- thus we
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
     s->base.is_jmp = DISAS_SMC;
 }
 
-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
+static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
 {
     gen_set_condexec(s);
-    gen_set_pc_im(s, s->base.pc_next - offset);
+    gen_set_pc_im(s, pc);
     gen_exception_internal(excp);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
         s->current_el != 0 &&
 #endif
         (imm == (s->thumb ? 0x3c : 0xf000))) {
-        gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
+        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
         /* End the TB early; it's likely not going to be executed */
         dc->base.is_jmp = DISAS_TOO_MANY;
     } else {
-        gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
+        gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
         /* The address covered by the breakpoint must be
            included in [tb->pc, tb->pc + tb->size) in order
            to for it to be properly cleared -- thus we
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Unlike the other more generic gen_exception{,_internal}_insn
interfaces, breakpoints always refer to the current instruction.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 7 +++----
 target/arm/translate.c     | 8 ++++----
 2 files changed, 7 insertions(+), 8 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Promote this function from aarch64 to fully general use.
Use it to unify the code sequences for generating illegal
opcode exceptions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.h     |  2 --
 target/arm/translate.h         |  2 ++
 target/arm/translate-a64.c     |  7 -------
 target/arm/translate-vfp.inc.c |  3 +--
 target/arm/translate.c         | 22 ++++++++++++----------
 5 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_TRANSLATE_A64_H
 #define TARGET_ARM_TRANSLATE_A64_H
 
-void unallocated_encoding(DisasContext *s);
-
 #define unsupported_encoding(s, insn)                                    \
     do {                                                                 \
         qemu_log_mask(LOG_UNIMP,                                         \
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasCompare {
     bool value_global;
 } DisasCompare;
 
+void unallocated_encoding(DisasContext *s);
+
 /* Share the TCG temporaries common between 32 and 64 bit modes.  */
 extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
 extern TCGv_i64 cpu_exclusive_addr;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
     }
 }
 
-void unallocated_encoding(DisasContext *s)
-{
-    /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
-}
-
 static void init_tmp_a64_array(DisasContext *s)
 {
 #ifdef CONFIG_DEBUG_TCG
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
 
     if (!s->vfp_enabled && !ignore_vfp_enabled) {
         assert(!arm_dc_feature(s, ARM_FEATURE_M));
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                           default_exception_el(s));
+        unallocated_encoding(s);
         return false;
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+void unallocated_encoding(DisasContext *s)
+{
+    /* Unallocated and reserved encodings are uncategorized */
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+                       default_exception_el(s));
+}
+
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 static inline void gen_lookup_tb(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
         return;
     }
 
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
+    unallocated_encoding(s);
 }
 
 static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
     }
 
     if (undef) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                           default_exception_el(s));
+        unallocated_encoding(s);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             break;
         default:
         illegal_op:
-            gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                               default_exception_el(s));
+            unallocated_encoding(s);
             break;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
     }
     return;
 illegal_op:
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
+    unallocated_encoding(s);
 }
 
 static void disas_thumb_insn(DisasContext *s, uint32_t insn)
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
     return;
 illegal_op:
 undef:
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
+    unallocated_encoding(s);
 }
 
 static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace x = double_saturate(y) with x = add_saturate(y, y).
There is no need for a separate more specialized helper.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807045335.1361-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    |  1 -
 target/arm/op_helper.c | 15 ---------------
 target/arm/translate.c |  4 ++--
 3 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(add_saturate, i32, env, i32, i32)
 DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
 DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
 DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
-DEF_HELPER_2(double_saturate, i32, env, s32)
 DEF_HELPER_FLAGS_2(sdiv, TCG_CALL_NO_RWG_SE, s32, s32, s32)
 DEF_HELPER_FLAGS_2(udiv, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_1(rbit, TCG_CALL_NO_RWG_SE, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
     return res;
 }
 
-uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
-{
-    uint32_t res;
-    if (val >= 0x40000000) {
-        res = ~SIGNBIT;
-        env->QF = 1;
-    } else if (val <= (int32_t)0xc0000000) {
-        res = SIGNBIT;
-        env->QF = 1;
-    } else {
-        res = val << 1;
-    }
-    return res;
-}
-
 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 {
     uint32_t res = a + b;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             tmp = load_reg(s, rm);
             tmp2 = load_reg(s, rn);
             if (op1 & 2)
-                gen_helper_double_saturate(tmp2, cpu_env, tmp2);
+                gen_helper_add_saturate(tmp2, cpu_env, tmp2, tmp2);
             if (op1 & 1)
                 gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
             else
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 tmp = load_reg(s, rn);
                 tmp2 = load_reg(s, rm);
                 if (op & 1)
-                    gen_helper_double_saturate(tmp, cpu_env, tmp);
+                    gen_helper_add_saturate(tmp, cpu_env, tmp, tmp);
                 if (op & 2)
                     gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
                 else
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

If -cpu <cpu>,aarch64=off is used then KVM must also be used, and it
and the host must support running the vcpu in 32-bit mode. Also, if
-cpu <cpu>,aarch64=on is used, then it doesn't matter if kvm is
enabled or not.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 14 ++++++++++++++
 target/arm/cpu64.c   | 12 ++++++------
 target/arm/kvm64.c   |  9 +++++++++
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
  */
 void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
 
+/**
+ * kvm_arm_aarch32_supported:
+ * @cs: CPUState
+ *
+ * Returns: true if the KVM VCPU can enable AArch32 mode
+ * and false otherwise.
+ */
+bool kvm_arm_aarch32_supported(CPUState *cs);
+
 /**
  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
  * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
     cpu->host_cpu_probe_failed = true;
 }
 
+static inline bool kvm_arm_aarch32_supported(CPUState *cs)
+{
+    return false;
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
     return -ENOENT;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_set_aarch64(Object *obj, bool value, Error **errp)
      * restriction allows us to avoid fixing up functionality that assumes a
      * uniform execution state like do_interrupt.
      */
-    if (!kvm_enabled()) {
-        error_setg(errp, "'aarch64' feature cannot be disabled "
-                         "unless KVM is enabled");
-        return;
-    }
-
     if (value == false) {
+        if (!kvm_enabled() || !kvm_arm_aarch32_supported(CPU(cpu))) {
+            error_setg(errp, "'aarch64' feature cannot be disabled "
+                             "unless KVM is enabled and 32-bit EL1 "
+                             "is supported");
+            return;
+        }
         unset_feature(&cpu->env, ARM_FEATURE_AARCH64);
     } else {
         set_feature(&cpu->env, ARM_FEATURE_AARCH64);
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/gdbstub.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "sysemu/kvm_int.h"
 #include "kvm_arm.h"
+#include "hw/boards.h"
 #include "internals.h"
 
 static bool have_guest_debug;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     return true;
 }
 
+bool kvm_arm_aarch32_supported(CPUState *cpu)
+{
+    KVMState *s = KVM_STATE(current_machine->accelerator);
+
+    return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
+}
+
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
 int kvm_arch_init_vcpu(CPUState *cs)
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

We first convert the pmu property from a static property to one with
its own accessors. Then we use the set accessor to check if the PMU is
supported when using KVM. Indeed a 32-bit KVM host does not support
the PMU, so this check will catch an attempt to use it at property-set
time.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 14 ++++++++++++++
 target/arm/cpu.c     | 30 +++++++++++++++++++++++++-----
 target/arm/kvm.c     |  7 +++++++
 3 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
  */
 bool kvm_arm_aarch32_supported(CPUState *cs);
 
+/**
+ * bool kvm_arm_pmu_supported:
+ * @cs: CPUState
+ *
+ * Returns: true if the KVM VCPU can enable its PMU
+ * and false otherwise.
+ */
+bool kvm_arm_pmu_supported(CPUState *cs);
+
 /**
  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
  * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_aarch32_supported(CPUState *cs)
     return false;
 }
 
+static inline bool kvm_arm_pmu_supported(CPUState *cs)
+{
+    return false;
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
     return -ENOENT;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_el3_property =
 static Property arm_cpu_cfgend_property =
             DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
 
-/* use property name "pmu" to match other archs and virt tools */
-static Property arm_cpu_has_pmu_property =
-            DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
-
 static Property arm_cpu_has_vfp_property =
             DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
 
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
                                            pmsav7_dregion,
                                            qdev_prop_uint32, uint32_t);
 
+static bool arm_get_pmu(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    return cpu->has_pmu;
+}
+
+static void arm_set_pmu(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    if (value) {
+        if (kvm_enabled() && !kvm_arm_pmu_supported(CPU(cpu))) {
+            error_setg(errp, "'pmu' feature not supported by KVM on this host");
+            return;
+        }
+        set_feature(&cpu->env, ARM_FEATURE_PMU);
+    } else {
+        unset_feature(&cpu->env, ARM_FEATURE_PMU);
+    }
+    cpu->has_pmu = value;
+}
+
 static void arm_get_init_svtor(Object *obj, Visitor *v, const char *name,
                                void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {
-        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_pmu_property,
+        cpu->has_pmu = true;
+        object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu,
                                  &error_abort);
     }
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
     env->features = arm_host_cpu_features.features;
 }
 
+bool kvm_arm_pmu_supported(CPUState *cpu)
+{
+    KVMState *s = KVM_STATE(current_machine->accelerator);
+
+    return kvm_check_extension(s, KVM_CAP_ARM_PMU_V3);
+}
+
 int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
     KVMState *s = KVM_STATE(ms->accelerator);
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

The current implementation of ZCR_ELx matches the architecture, only
implementing the lower four bits, with the rest RAZ/WI. This puts
a strict limit on ARM_MAX_VQ of 16. Make sure we don't let ARM_MAX_VQ
grow without a corresponding update here.

Suggested-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     int new_len;
 
     /* Bits other than [3:0] are RAZ/WI.  */
+    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
     raw_write(env, ri, value & 0xf);
 
     /*
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

A couple return -EINVAL's forgot their '-'s.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     write_cpustate_to_list(cpu, true);
 
     if (!write_list_to_kvmstate(cpu, level)) {
-        return EINVAL;
+        return -EINVAL;
     }
 
     kvm_arm_sync_mpstate_to_kvm(cpu);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     }
 
     if (!write_kvmstate_to_list(cpu)) {
-        return EINVAL;
+        return -EINVAL;
     }
     /* Note that it's OK to have registers which aren't in CPUState,
      * so we can ignore a failure return here.
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Move the getting/putting of the fpsimd registers out of
kvm_arch_get/put_registers() into their own helper functions
to prepare for alternatively getting/putting SVE registers.

No functional change.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 148 +++++++++++++++++++++++++++------------------
 1 file changed, 88 insertions(+), 60 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
 #define AARCH64_SIMD_CTRL_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \
                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
 
+static int kvm_arch_put_fpsimd(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    uint32_t fpr;
+    int i, ret;
+
+    for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
+#ifdef HOST_WORDS_BIGENDIAN
+        uint64_t fp_val[2] = { q[1], q[0] };
+        reg.addr = (uintptr_t)fp_val;
+#else
+        reg.addr = (uintptr_t)q;
+#endif
+        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpsr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpcr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+
+    return 0;
+}
+
 int kvm_arch_put_registers(CPUState *cs, int level)
 {
     struct kvm_one_reg reg;
-    uint32_t fpr;
     uint64_t val;
-    int i;
-    int ret;
+    int i, ret;
     unsigned int el;
 
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         }
     }
 
-    /* Advanced SIMD and FP registers. */
-    for (i = 0; i < 32; i++) {
-        uint64_t *q = aa64_vfp_qreg(env, i);
-#ifdef HOST_WORDS_BIGENDIAN
-        uint64_t fp_val[2] = { q[1], q[0] };
-        reg.addr = (uintptr_t)fp_val;
-#else
-        reg.addr = (uintptr_t)q;
-#endif
-        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-        if (ret) {
-            return ret;
-        }
-    }
-
-    reg.addr = (uintptr_t)(&fpr);
-    fpr = vfp_get_fpsr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
-    }
-
-    fpr = vfp_get_fpcr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_arch_put_fpsimd(cs);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     return ret;
 }
 
+static int kvm_arch_get_fpsimd(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    uint32_t fpr;
+    int i, ret;
+
+    for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
+        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
+        reg.addr = (uintptr_t)q;
+        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        } else {
+#ifdef HOST_WORDS_BIGENDIAN
+            uint64_t t;
+            t = q[0], q[0] = q[1], q[1] = t;
+#endif
+        }
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpsr(env, fpr);
+
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpcr(env, fpr);
+
+    return 0;
+}
+
 int kvm_arch_get_registers(CPUState *cs)
 {
     struct kvm_one_reg reg;
     uint64_t val;
-    uint32_t fpr;
     unsigned int el;
-    int i;
-    int ret;
+    int i, ret;
 
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         env->spsr = env->banked_spsr[i];
     }
 
-    /* Advanced SIMD and FP registers */
-    for (i = 0; i < 32; i++) {
-        uint64_t *q = aa64_vfp_qreg(env, i);
-        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)q;
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-        if (ret) {
-            return ret;
-        } else {
-#ifdef HOST_WORDS_BIGENDIAN
-            uint64_t t;
-            t = q[0], q[0] = q[1], q[1] = t;
-#endif
-        }
-    }
-
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_arch_get_fpsimd(cs);
     if (ret) {
         return ret;
     }
-    vfp_set_fpsr(env, fpr);
-
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
-    }
-    vfp_set_fpcr(env, fpr);
 
     ret = kvm_get_vcpu_events(cpu);
     if (ret) {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Extract is a compact combination of shift + and.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 
 static void shifter_out_im(TCGv_i32 var, int shift)
 {
-    if (shift == 0) {
-        tcg_gen_andi_i32(cpu_CF, var, 1);
-    } else {
-        tcg_gen_shri_i32(cpu_CF, var, shift);
-        if (shift != 31) {
-            tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
-        }
-    }
+    tcg_gen_extract_i32(cpu_CF, var, shift, 1);
 }
 
 /* Shift by immediate.  Includes special handling for shift == 0.  */
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Use deposit as the composit operation to merge the
bits from the two inputs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                         shift = (insn >> 7) & 0x1f;
                         if (insn & (1 << 6)) {
                             /* pkhtb */
-                            if (shift == 0)
+                            if (shift == 0) {
                                 shift = 31;
+                            }
                             tcg_gen_sari_i32(tmp2, tmp2, shift);
-                            tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
-                            tcg_gen_ext16u_i32(tmp2, tmp2);
+                            tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
                         } else {
                             /* pkhbt */
-                            if (shift)
-                                tcg_gen_shli_i32(tmp2, tmp2, shift);
-                            tcg_gen_ext16u_i32(tmp, tmp);
-                            tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
+                            tcg_gen_shli_i32(tmp2, tmp2, shift);
+                            tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
                         }
-                        tcg_gen_or_i32(tmp, tmp, tmp2);
                         tcg_temp_free_i32(tmp2);
                         store_reg(s, rd, tmp);
                     } else if ((insn & 0x00200020) == 0x00200000) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
             if (insn & (1 << 5)) {
                 /* pkhtb */
-                if (shift == 0)
+                if (shift == 0) {
                     shift = 31;
+                }
                 tcg_gen_sari_i32(tmp2, tmp2, shift);
-                tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
-                tcg_gen_ext16u_i32(tmp2, tmp2);
+                tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
             } else {
                 /* pkhbt */
-                if (shift)
-                    tcg_gen_shli_i32(tmp2, tmp2, shift);
-                tcg_gen_ext16u_i32(tmp, tmp);
-                tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
+                tcg_gen_shli_i32(tmp2, tmp2, shift);
+                tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
             }
-            tcg_gen_or_i32(tmp, tmp, tmp2);
             tcg_temp_free_i32(tmp2);
             store_reg(s, rd, tmp);
         } else {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The immediate shift generator functions already test for,
and eliminate, the case of a shift by zero.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                         shift = (insn >> 10) & 3;
                         /* ??? In many cases it's not necessary to do a
                            rotate, a shift is sufficient.  */
-                        if (shift != 0)
-                            tcg_gen_rotri_i32(tmp, tmp, shift * 8);
+                        tcg_gen_rotri_i32(tmp, tmp, shift * 8);
                         op1 = (insn >> 20) & 7;
                         switch (op1) {
                         case 0: gen_sxtb16(tmp);  break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             shift = (insn >> 4) & 3;
             /* ??? In many cases it's not necessary to do a
                rotate, a shift is sufficient.  */
-            if (shift != 0)
-                tcg_gen_rotri_i32(tmp, tmp, shift * 8);
+            tcg_gen_rotri_i32(tmp, tmp, shift * 8);
             op = (insn >> 20) & 7;
             switch (op) {
             case 0: gen_sxth(tmp);   break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                     case 7:
                         goto illegal_op;
                     default: /* Saturate.  */
-                        if (shift) {
-                            if (op & 1)
-                                tcg_gen_sari_i32(tmp, tmp, shift);
-                            else
-                                tcg_gen_shli_i32(tmp, tmp, shift);
+                        if (op & 1) {
+                            tcg_gen_sari_i32(tmp, tmp, shift);
+                        } else {
+                            tcg_gen_shli_i32(tmp, tmp, shift);
                         }
                         tmp2 = tcg_const_i32(imm);
                         if (op & 4) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                     goto illegal_op;
                 }
                 tmp = load_reg(s, rm);
-                if (shift) {
-                    tcg_gen_shli_i32(tmp, tmp, shift);
-                }
+                tcg_gen_shli_i32(tmp, tmp, shift);
                 tcg_gen_add_i32(addr, addr, tmp);
                 tcg_temp_free_i32(tmp);
                 break;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function is more documentary, and also already
handles the case of rotate by zero.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 /* CPSR = immediate */
                 val = insn & 0xff;
                 shift = ((insn >> 8) & 0xf) * 2;
-                if (shift)
-                    val = (val >> shift) | (val << (32 - shift));
+                val = ror32(val, shift);
                 i = ((insn & (1 << 22)) != 0);
                 if (gen_set_psr_im(s, msr_mask(s, (insn >> 16) & 0xf, i),
                                    i, val)) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             /* immediate operand */
             val = insn & 0xff;
             shift = ((insn >> 8) & 0xf) * 2;
-            if (shift) {
-                val = (val >> shift) | (val << (32 - shift));
-            }
+            val = ror32(val, shift);
             tmp2 = tcg_temp_new_i32();
             tcg_gen_movi_i32(tmp2, val);
             if (logic_cc && shift) {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rotate is the more compact and obvious way to swap 16-bit
elements of a 32-bit word.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-6-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
 /* Swap low and high halfwords.  */
 static void gen_swap_half(TCGv_i32 var)
 {
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    tcg_gen_shri_i32(tmp, var, 16);
-    tcg_gen_shli_i32(var, var, 16);
-    tcg_gen_or_i32(var, var, tmp);
-    tcg_temp_free_i32(tmp);
+    tcg_gen_rotri_i32(var, var, 16);
 }
 
 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

All of the inputs to these instructions are 32-bits.  Rather than
extend each input to 64-bits and then extract the high 32-bits of
the output, use tcg_gen_muls2_i32 and other 32-bit generator functions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-7-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 72 +++++++++++++++---------------------------
 1 file changed, 26 insertions(+), 46 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 var)
     tcg_gen_ext16s_i32(var, var);
 }
 
-/* Return (b << 32) + a. Mark inputs as dead */
-static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
-{
-    TCGv_i64 tmp64 = tcg_temp_new_i64();
-
-    tcg_gen_extu_i32_i64(tmp64, b);
-    tcg_temp_free_i32(b);
-    tcg_gen_shli_i64(tmp64, tmp64, 32);
-    tcg_gen_add_i64(a, tmp64, a);
-
-    tcg_temp_free_i64(tmp64);
-    return a;
-}
-
-/* Return (b << 32) - a. Mark inputs as dead. */
-static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
-{
-    TCGv_i64 tmp64 = tcg_temp_new_i64();
-
-    tcg_gen_extu_i32_i64(tmp64, b);
-    tcg_temp_free_i32(b);
-    tcg_gen_shli_i64(tmp64, tmp64, 32);
-    tcg_gen_sub_i64(a, tmp64, a);
-
-    tcg_temp_free_i64(tmp64);
-    return a;
-}
-
 /* 32x32->64 multiply.  Marks inputs as dead.  */
 static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
 {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                            (SMMUL, SMMLA, SMMLS) */
                         tmp = load_reg(s, rm);
                         tmp2 = load_reg(s, rs);
-                        tmp64 = gen_muls_i64_i32(tmp, tmp2);
+                        tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
 
                         if (rd != 15) {
-                            tmp = load_reg(s, rd);
+                            tmp3 = load_reg(s, rd);
                             if (insn & (1 << 6)) {
-                                tmp64 = gen_subq_msw(tmp64, tmp);
+                                tcg_gen_sub_i32(tmp, tmp, tmp3);
                             } else {
-                                tmp64 = gen_addq_msw(tmp64, tmp);
+                                tcg_gen_add_i32(tmp, tmp, tmp3);
                             }
+                            tcg_temp_free_i32(tmp3);
                         }
                         if (insn & (1 << 5)) {
-                            tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
+                            /*
+                             * Adding 0x80000000 to the 64-bit quantity
+                             * means that we have carry in to the high
+                             * word when the low word has the high bit set.
+                             */
+                            tcg_gen_shri_i32(tmp2, tmp2, 31);
+                            tcg_gen_add_i32(tmp, tmp, tmp2);
                         }
-                        tcg_gen_shri_i64(tmp64, tmp64, 32);
-                        tmp = tcg_temp_new_i32();
-                        tcg_gen_extrl_i64_i32(tmp, tmp64);
-                        tcg_temp_free_i64(tmp64);
+                        tcg_temp_free_i32(tmp2);
                         store_reg(s, rn, tmp);
                         break;
                     case 0:
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                   }
                 break;
             case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
-                tmp64 = gen_muls_i64_i32(tmp, tmp2);
+                tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
                 if (rs != 15) {
-                    tmp = load_reg(s, rs);
+                    tmp3 = load_reg(s, rs);
                     if (insn & (1 << 20)) {
-                        tmp64 = gen_addq_msw(tmp64, tmp);
+                        tcg_gen_add_i32(tmp, tmp, tmp3);
                     } else {
-                        tmp64 = gen_subq_msw(tmp64, tmp);
+                        tcg_gen_sub_i32(tmp, tmp, tmp3);
                     }
+                    tcg_temp_free_i32(tmp3);
                 }
                 if (insn & (1 << 4)) {
-                    tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
+                    /*
+                     * Adding 0x80000000 to the 64-bit quantity
+                     * means that we have carry in to the high
+                     * word when the low word has the high bit set.
+                     */
+                    tcg_gen_shri_i32(tmp2, tmp2, 31);
+                    tcg_gen_add_i32(tmp, tmp, tmp2);
                 }
-                tcg_gen_shri_i64(tmp64, tmp64, 32);
-                tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tmp64);
-                tcg_temp_free_i64(tmp64);
+                tcg_temp_free_i32(tmp2);
                 break;
             case 7: /* Unsigned sum of absolute differences.  */
                 gen_helper_usad8(tmp, tmp, tmp2);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Separate shift + extract low will result in one extra insn
for hosts like RISC-V, MIPS, and Sparc.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190808202616.13782-8-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_iwmmxt_insn(DisasContext *s, uint32_t insn)
             if (insn & ARM_CP_RW_BIT) {                         /* TMRRC */
                 iwmmxt_load_reg(cpu_V0, wrd);
                 tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
-                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-                tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
+                tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
             } else {                                    /* TMCRR */
                 tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
                 iwmmxt_store_reg(cpu_V0, wrd);
@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
         if (insn & ARM_CP_RW_BIT) {                     /* MRA */
             iwmmxt_load_reg(cpu_V0, acc);
             tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
-            tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-            tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
+            tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
             tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
         } else {                                        /* MAR */
             tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                 gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
                                 break;
                             case 2:
-                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-                                tcg_gen_extrl_i64_i32(tmp, cpu_V0);
+                                tcg_gen_extrh_i64_i32(tmp, cpu_V0);
                                 break;
                             default: abort();
                             }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                 break;
                             case 2:
                                 tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
-                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
-                                tcg_gen_extrl_i64_i32(tmp, cpu_V0);
+                                tcg_gen_extrh_i64_i32(tmp, cpu_V0);
                                 break;
                             default: abort();
                             }
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
                 tmp = tcg_temp_new_i32();
                 tcg_gen_extrl_i64_i32(tmp, tmp64);
                 store_reg(s, rt, tmp);
-                tcg_gen_shri_i64(tmp64, tmp64, 32);
                 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tmp64);
+                tcg_gen_extrh_i64_i32(tmp, tmp64);
                 tcg_temp_free_i64(tmp64);
                 store_reg(s, rt2, tmp);
             } else {
@@ -XXX,XX +XXX,XX @@ static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
     tcg_gen_extrl_i64_i32(tmp, val);
     store_reg(s, rlow, tmp);
     tmp = tcg_temp_new_i32();
-    tcg_gen_shri_i64(val, val, 32);
-    tcg_gen_extrl_i64_i32(tmp, val);
+    tcg_gen_extrh_i64_i32(tmp, val);
     store_reg(s, rhigh, tmp);
 }
 
-- 
2.20.1