Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 00/26] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+The following changes since commit 4cc10cae64c51e17844dc4358481c393d7bf1ed4:
 as well put them in to rc0...
-thanks
+  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-05-06 18:56:17 +0100)
 -- PMM
 The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210510
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 8f96812baa53005f32aece3e30b140826c20aa19:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 (2021-05-10 13:24:09 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * docs: fix link in sbsa description
- * dump: Update correct kdump phys_base field for AArch64
+ * linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
- * char: i.MX: Add support for "TX complete" interrupt
+ * target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * target/arm: Split neon and vfp translation to their own
-   to boot a Debian Linux kernel on raspi3
+   compilation units
  * target/arm: Make WFI a NOP for userspace emulators
  * hw/sd/omap_mmc: Use device_cold_reset() instead of
    device_legacy_reset()
  * include: More fixes for 'extern "C"' block use
  * hw/arm/imx25_pdk: Fix error message for invalid RAM size
  * hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
  * hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Alex Bennée (1):
-      char: i.MX: Simplify imx_update()
+      docs: fix link in sbsa description
       char: i.MX: Add support for "TX complete" interrupt
 Guenter Roeck (1):
-      fsl-imx6: Swap Ethernet interrupt defines
+      hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
-Peter Maydell (9):
+Peter Maydell (22):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
-      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+      target/arm: Move constant expanders to translate.h
-      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+      target/arm: Share unallocated_encoding() and gen_exception_insn()
-      hw/arm/bcm2386: Fix parent type of bcm2386
+      target/arm: Make functions used by m-nocp global
-      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+      target/arm: Split m-nocp trans functions into their own file
-      hw/arm/bcm2836: Create proper bcm2837 device
+      target/arm: Move gen_aa32 functions to translate-a32.h
-      hw/arm/bcm2836: Use correct affinity values for BCM2837
+      target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
-      hw/arm/bcm2836: Hardcode correct CPU type
+      target/arm: Make functions used by translate-vfp global
-      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+      target/arm: Make translate-vfp.c.inc its own compilation unit
       target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
       target/arm: Delete unused typedef
       target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
       target/arm: Make functions used by translate-neon global
       target/arm: Make translate-neon.c.inc its own compilation unit
       target/arm: Make WFI a NOP for userspace emulators
       hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
       osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
       include/qemu/bswap.h: Handle being included outside extern "C" block
       include/disas/dis-asm.h: Handle being included outside 'extern "C"'
       hw/misc/mps2-scc: Add "QEMU interface" comment
       hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
       hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
-Wei Huang (1):
+Philippe Mathieu-Daudé (1):
-      dump: Update correct kdump phys_base field for AArch64
+      hw/arm/imx25_pdk: Fix error message for invalid RAM size
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+Richard Henderson (1):
- include/hw/arm/fsl-imx6.h    |  4 +-
+      linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
  include/hw/char/imx_serial.h |  3 ++
  dump.c                       | 14 +++++--
  hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
  hw/arm/boot.c                | 12 ++++++
  hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
  hw/char/imx_serial.c         | 44 ++++++++++++++++------
  hw/net/imx_fec.c             | 28 +++++++++++++-
 files changed, 237 insertions(+), 63 deletions(-)
+ docs/system/arm/mps2.rst                           |  10 +
+ docs/system/arm/sbsa.rst                           |   2 +-
+ include/disas/dis-asm.h                            |  12 +-
+ include/hw/misc/mps2-scc.h                         |  21 ++
+ include/qemu/bswap.h                               |  26 ++-
+ include/qemu/osdep.h                               |   8 +-
+ include/sysemu/os-posix.h                          |   8 +
+ include/sysemu/os-win32.h                          |   8 +
+ target/arm/translate-a32.h                         | 144 +++++++++++++
+ target/arm/translate-a64.h                         |   2 -
+ target/arm/translate.h                             |  29 +++
+ hw/arm/imx25_pdk.c                                 |   5 +-
+ hw/arm/mps2-tz.c                                   | 108 +++++++++-
+ hw/arm/xilinx_zynq.c                               |   2 +-
+ hw/misc/mps2-scc.c                                 |  13 +-
+ hw/sd/omap_mmc.c                                   |   2 +-
+ linux-user/elfload.c                               |  13 ++
+ target/arm/helper.c                                |   2 +-
+ target/arm/op_helper.c                             |  12 ++
+ target/arm/translate-a64.c                         |  15 --
+ target/arm/translate-m-nocp.c                      | 221 ++++++++++++++++++++
+ .../arm/{translate-neon.c.inc => translate-neon.c} |  19 +-
+ .../arm/{translate-vfp.c.inc => translate-vfp.c}   | 230 +++------------------
+ target/arm/translate.c                             | 200 ++++--------------
+ disas/arm-a64.cc                                   |   2 -
+ disas/nanomips.cpp                                 |   2 -
+ target/arm/meson.build                             |  15 +-
+files changed, 718 insertions(+), 413 deletions(-)
+ create mode 100644 target/arm/translate-a32.h
+ create mode 100644 target/arm/translate-m-nocp.c
+ rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
+ rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (94%)

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 01/26] docs: fix link in sbsa description
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+A trailing _ makes all the difference to the rendered link.
 it is needed to support guests other than Linux.
-Based on the patch by Bill Paul as found here:
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-https://bugs.launchpad.net/qemu/+bug/1753314
+Message-id: 20210428131316.31390-1-alex.bennee@linaro.org
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Bill Paul <wpaul@windriver.com>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/char/imx_serial.h |  3 +++
+ docs/system/arm/sbsa.rst | 2 +-
- hw/char/imx_serial.c         | 20 +++++++++++++++++---
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 20 insertions(+), 3 deletions(-)
-diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/docs/system/arm/sbsa.rst
-+++ b/include/hw/char/imx_serial.h
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ Arm Server Base System Architecture Reference board (``sbsa-ref``)
- #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+ While the `virt` board is a generic board platform that doesn't match
- #define UCR2_SRST       (1<<0)    /* Reset complete */
+ any real hardware the `sbsa-ref` board intends to look like real
+ hardware. The `Server Base System Architecture
-+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+-<https://developer.arm.com/documentation/den0029/latest>` defines a
-+
++<https://developer.arm.com/documentation/den0029/latest>`_ defines a
- #define UTS1_TXEMPTY    (1<<6)
+ minimum base line of hardware support and importantly how the firmware
- #define UTS1_RXEMPTY    (1<<5)
+ reports that to any operating system. It is a static system that
- #define UTS1_TXFULL     (1<<4)
+ reports a very minimal DT to the firmware for non-discoverable
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
      uint32_t ubmr;
      uint32_t ubrc;
      uint32_t ucr3;
 +    uint32_t ucr4;
      qemu_irq irq;
      CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
  static const VMStateDescription vmstate_imx_serial = {
      .name = TYPE_IMX_SERIAL,
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_INT32(readbuff, IMXSerialState),
          VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
 +     * TCEN and TXDC are both bit 3
 +     */
 +    mask |= s->ucr4 & UCR4_TCEN;
 +
      usr2 = s->usr2 & mask;
      qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
          return s->ucr3;
      case 0x23: /* UCR4 */
 +        return s->ucr4;
 +
      case 0x29: /* BRM Incremental */
          return 0x0; /* TODO */
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
              s->usr1 &= ~USR1_TRDY;
 +            s->usr2 &= ~USR2_TXDC;
              imx_update(s);
              s->usr1 |= USR1_TRDY;
 +            s->usr2 |= USR2_TXDC;
              imx_update(s);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
          s->ucr3 = value & 0xffff;
          break;
 -    case 0x2d: /* UTS1 */
      case 0x23: /* UCR4 */
 +        s->ucr4 = value & 0xffff;
 +        imx_update(s);
 +        break;
 +
 +    case 0x2d: /* UTS1 */
          qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                        HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
          /* TODO */
 --
-.16.2
+.20.1

-New patch
+[PULL 02/26] linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
+From: Richard Henderson <richard.henderson@linaro.org>
+These three features are already enabled by TCG, but are missing
+their hwcap bits.  Update HWCAP2 from linux v5.12.
+Cc: qemu-stable@nongnu.org (for 6.0.1)
+Buglink: https://bugs.launchpad.net/bugs/1926044
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210427214108.88503-1-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ linux-user/elfload.c | 13 +++++++++++++
+file changed, 13 insertions(+)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -XXX,XX +XXX,XX @@ enum {
+     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
+     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
+     ARM_HWCAP2_A64_FRINT        = 1 << 8,
++    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
++    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
++    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
++    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
++    ARM_HWCAP2_A64_I8MM         = 1 << 13,
++    ARM_HWCAP2_A64_BF16         = 1 << 14,
++    ARM_HWCAP2_A64_DGH          = 1 << 15,
++    ARM_HWCAP2_A64_RNG          = 1 << 16,
++    ARM_HWCAP2_A64_BTI          = 1 << 17,
++    ARM_HWCAP2_A64_MTE          = 1 << 18,
+ };
+ #define ELF_HWCAP   get_elf_hwcap()
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap2(void)
+     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
+     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
+     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
++    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
++    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
++    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
+     return hwcaps;
+ }
+--
+.20.1

-New patch
+[PULL 03/26] target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
+In tlbi_aa64_vae2is_write() the calculation
+  bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
+                            pageaddr)
+has the two arms of the ?: expression reversed. Fix the bug.
+Fixes: b6ad6062f1e5
+Reported-by: Rebecca Cran <rebecca@nuviainc.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Reviewed-by: Rebecca Cran <rebecca@nuviainc.com>
+Message-id: 20210420123106.10861-1-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     uint64_t pageaddr = sextract64(value << 12, 0, 56);
+     bool secure = arm_is_secure_below_el3(env);
+     int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
+-    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
++    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
+                                   pageaddr);
+     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
+--
+.20.1

-New patch
+[PULL 04/26] target/arm: Move constant expanders to translate.h
+Some of the constant expanders defined in translate.c are generically
+useful and will be used by the separate C files for VFP and Neon once
+they are created; move the expander definitions to translate.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-2-peter.maydell@linaro.org
+---
+ target/arm/translate.h | 24 ++++++++++++++++++++++++
+ target/arm/translate.c | 24 ------------------------
+files changed, 24 insertions(+), 24 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
+ extern TCGv_i64 cpu_exclusive_addr;
+ extern TCGv_i64 cpu_exclusive_val;
++/*
++ * Constant expanders for the decoders.
++ */
++
++static inline int negate(DisasContext *s, int x)
++{
++    return -x;
++}
++
++static inline int plus_2(DisasContext *s, int x)
++{
++    return x + 2;
++}
++
++static inline int times_2(DisasContext *s, int x)
++{
++    return x * 2;
++}
++
++static inline int times_4(DisasContext *s, int x)
++{
++    return x * 4;
++}
++
+ static inline int arm_dc_feature(DisasContext *dc, int feature)
+ {
+     return (dc->features & (1ULL << feature)) != 0;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
+     }
+ }
+-/*
+- * Constant expanders for the decoders.
+- */
+-
+-static int negate(DisasContext *s, int x)
+-{
+-    return -x;
+-}
+-
+-static int plus_2(DisasContext *s, int x)
+-{
+-    return x + 2;
+-}
+-
+-static int times_2(DisasContext *s, int x)
+-{
+-    return x * 2;
+-}
+-
+-static int times_4(DisasContext *s, int x)
+-{
+-    return x * 4;
+-}
+-
+ /* Flags for the disas_set_da_iss info argument:
+  * lower bits hold the Rt register number, higher bits are flags.
+  */
+--
+.20.1

-New patch
+[PULL 05/26] target/arm: Share unallocated_encoding() and gen_exception_insn()
+The unallocated_encoding() function is the same in both
+translate-a64.c and translate.c; make the translate.c function global
+and drop the translate-a64.c version.  To do this we need to also
+share gen_exception_insn(), which currently exists in two slightly
+different versions for A32 and A64: merge those into a single
+function that can work for both.
+This will be useful for splitting up translate.c, which will require
+unallocated_encoding() to no longer be file-local.  It's also
+hopefully less confusing to have only one version of the function
+rather than two.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-3-peter.maydell@linaro.org
+---
+ target/arm/translate-a64.h |  2 --
+ target/arm/translate.h     |  3 +++
+ target/arm/translate-a64.c | 15 ---------------
+ target/arm/translate.c     | 14 +++++++++-----
+files changed, 12 insertions(+), 22 deletions(-)
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.h
++++ b/target/arm/translate-a64.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef TARGET_ARM_TRANSLATE_A64_H
+ #define TARGET_ARM_TRANSLATE_A64_H
+-void unallocated_encoding(DisasContext *s);
+-
+ #define unsupported_encoding(s, insn)                                    \
+     do {                                                                 \
+         qemu_log_mask(LOG_UNIMP,                                         \
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ void arm_free_cc(DisasCompare *cmp);
+ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
+ void arm_gen_test_cc(int cc, TCGLabel *label);
+ MemOp pow2_align(unsigned i);
++void unallocated_encoding(DisasContext *s);
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
++                        uint32_t syn, uint32_t target_el);
+ /* Return state of Alternate Half-precision flag, caller frees result */
+ static inline TCGv_i32 get_ahp_flag(void)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                               uint32_t syndrome, uint32_t target_el)
+-{
+-    gen_a64_set_pc_im(pc);
+-    gen_exception(excp, syndrome, target_el);
+-    s->base.is_jmp = DISAS_NORETURN;
+-}
+-
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
+ {
+     TCGv_i32 tcg_syn;
+@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
+     }
+ }
+-void unallocated_encoding(DisasContext *s)
+-{
+-    /* Unallocated and reserved encodings are uncategorized */
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+-                       default_exception_el(s));
+-}
+-
+ static void init_tmp_a64_array(DisasContext *s)
+ {
+ #ifdef CONFIG_DEBUG_TCG
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
+-                               int syn, uint32_t target_el)
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
++                        uint32_t syn, uint32_t target_el)
+ {
+-    gen_set_condexec(s);
+-    gen_set_pc_im(s, pc);
++    if (s->aarch64) {
++        gen_a64_set_pc_im(pc);
++    } else {
++        gen_set_condexec(s);
++        gen_set_pc_im(s, pc);
++    }
+     gen_exception(excp, syn, target_el);
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-static void unallocated_encoding(DisasContext *s)
++void unallocated_encoding(DisasContext *s)
+ {
+     /* Unallocated and reserved encodings are uncategorized */
+     gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+--
+.20.1

-New patch
+[PULL 06/26] target/arm: Make functions used by m-nocp global
+We want to split out the .c.inc files which are currently included
 into translate.c so they are separate compilation units.  To do this
 we need to make some functions which are currently file-local to
 translate.c have global scope; create a translate-a32.h paralleling
 the existing translate-a64.h as a place for these declarations to
 live, so that code moved into the new compilation units can call
 them.
 The functions made global here are those required by the
 m-nocp.decode functions, except that I have converted the whole
 family of {read,write}_neon_element* and also both the load_cpu and
 store_cpu functions for consistency, even though m-nocp only wants a
 few functions from each.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-4-peter.maydell@linaro.org
 ---
  target/arm/translate-a32.h     | 57 ++++++++++++++++++++++++++++++++++
  target/arm/translate.c         | 39 +++++------------------
  target/arm/translate-vfp.c.inc |  2 +-
 files changed, 65 insertions(+), 33 deletions(-)
  create mode 100644 target/arm/translate-a32.h
 diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  AArch32 translation, common definitions.
 + *
 + * Copyright (c) 2021 Linaro, Ltd.
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef TARGET_ARM_TRANSLATE_A64_H
 +#define TARGET_ARM_TRANSLATE_A64_H
 +
 +void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 +void arm_gen_condlabel(DisasContext *s);
 +bool vfp_access_check(DisasContext *s);
 +void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
 +void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
 +void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
 +void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
 +
 +static inline TCGv_i32 load_cpu_offset(int offset)
 +{
 +    TCGv_i32 tmp = tcg_temp_new_i32();
 +    tcg_gen_ld_i32(tmp, cpu_env, offset);
 +    return tmp;
 +}
 +
 +#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 +
 +static inline void store_cpu_offset(TCGv_i32 var, int offset)
 +{
 +    tcg_gen_st_i32(var, cpu_env, offset);
 +    tcg_temp_free_i32(var);
 +}
 +
 +#define store_cpu_field(var, name) \
 +    store_cpu_offset(var, offsetof(CPUARMState, name))
 +
 +/* Create a new temporary and set it to the value of a CPU register.  */
 +static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 +{
 +    TCGv_i32 tmp = tcg_temp_new_i32();
 +    load_reg_var(s, tmp, reg);
 +    return tmp;
 +}
 +
 +#endif
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
  #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
  #include "translate.h"
 +#include "translate-a32.h"
  #if defined(CONFIG_USER_ONLY)
  #define IS_USER(s) 1
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
  }
  /* Generate a label used for skipping this instruction */
 -static void arm_gen_condlabel(DisasContext *s)
 +void arm_gen_condlabel(DisasContext *s)
  {
      if (!s->condjmp) {
          s->condlabel = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
      }
  }
 -static inline TCGv_i32 load_cpu_offset(int offset)
 -{
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    tcg_gen_ld_i32(tmp, cpu_env, offset);
 -    return tmp;
 -}
 -
 -#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 -
 -static inline void store_cpu_offset(TCGv_i32 var, int offset)
 -{
 -    tcg_gen_st_i32(var, cpu_env, offset);
 -    tcg_temp_free_i32(var);
 -}
 -
 -#define store_cpu_field(var, name) \
 -    store_cpu_offset(var, offsetof(CPUARMState, name))
 -
  /* The architectural value of PC.  */
  static uint32_t read_pc(DisasContext *s)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t read_pc(DisasContext *s)
  }
  /* Set a variable to the value of a CPU register.  */
 -static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 +void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
  {
      if (reg == 15) {
          tcg_gen_movi_i32(var, read_pc(s));
@@ -XXX,XX +XXX,XX @@ static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
      }
  }
 -/* Create a new temporary and set it to the value of a CPU register.  */
 -static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 -{
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    load_reg_var(s, tmp, reg);
 -    return tmp;
 -}
 -
  /*
   * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
   * This is used for load/store for which use of PC implies (literal),
@@ -XXX,XX +XXX,XX @@ static inline void vfp_store_reg32(TCGv_i32 var, int reg)
      tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
  }
 -static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 +void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
      }
  }
 -static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
 +void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
      }
  }
 -static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
 +void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
      }
  }
 -static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 +void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
 diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c.inc
 +++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
   * The most usual kind of VFP access check, for everything except
   * FMXR/FMRX to the always-available special registers.
   */
 -static bool vfp_access_check(DisasContext *s)
 +bool vfp_access_check(DisasContext *s)
  {
      return full_vfp_access_check(s, false);
  }
 --
 .20.1

-New patch
+[PULL 07/26] target/arm: Split m-nocp trans functions into their own file
+Currently the trans functions for m-nocp.decode all live in
+translate-vfp.inc.c; move them out into their own translation unit,
+translate-m-nocp.c.
+The trans_* functions here are pure code motion with no changes.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-5-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h     |   3 +
+ target/arm/translate-m-nocp.c  | 221 +++++++++++++++++++++++++++++++++
+ target/arm/translate.c         |   1 -
+ target/arm/translate-vfp.c.inc | 196 -----------------------------
+ target/arm/meson.build         |   3 +-
+files changed, 226 insertions(+), 198 deletions(-)
+ create mode 100644 target/arm/translate-m-nocp.c
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef TARGET_ARM_TRANSLATE_A64_H
+ #define TARGET_ARM_TRANSLATE_A64_H
++/* Prototypes for autogenerated disassembler functions */
++bool disas_m_nocp(DisasContext *dc, uint32_t insn);
++
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
+ void arm_gen_condlabel(DisasContext *s);
+ bool vfp_access_check(DisasContext *s);
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ *  ARM translation: M-profile NOCP special-case instructions
++ *
++ *  Copyright (c) 2020 Linaro, Ltd.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "qemu/osdep.h"
++#include "tcg/tcg-op.h"
++#include "translate.h"
++#include "translate-a32.h"
++
++#include "decode-m-nocp.c.inc"
++
++/*
++ * Decode VLLDM and VLSTM are nonstandard because:
++ *  * if there is no FPU then these insns must NOP in
++ *    Secure state and UNDEF in Nonsecure state
++ *  * if there is an FPU then these insns do not have
++ *    the usual behaviour that vfp_access_check() provides of
++ *    being controlled by CPACR/NSACR enable bits or the
++ *    lazy-stacking logic.
++ */
++static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
++{
++    TCGv_i32 fptr;
++
++    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
++        !arm_dc_feature(s, ARM_FEATURE_V8)) {
++        return false;
++    }
++
++    if (a->op) {
++        /*
++         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
++         * to take the IMPDEF option to make memory accesses to the stack
++         * slots that correspond to the D16-D31 registers (discarding
++         * read data and writing UNKNOWN values), so for us the T2
++         * encoding behaves identically to the T1 encoding.
++         */
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++            return false;
++        }
++    } else {
++        /*
++         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
++         * This is currently architecturally impossible, but we add the
++         * check to stay in line with the pseudocode. Note that we must
++         * emit code for the UNDEF so it takes precedence over the NOCP.
++         */
++        if (dc_isar_feature(aa32_simd_r32, s)) {
++            unallocated_encoding(s);
++            return true;
++        }
++    }
++
++    /*
++     * If not secure, UNDEF. We must emit code for this
++     * rather than returning false so that this takes
++     * precedence over the m-nocp.decode NOCP fallback.
++     */
++    if (!s->v8m_secure) {
++        unallocated_encoding(s);
++        return true;
++    }
++    /* If no fpu, NOP. */
++    if (!dc_isar_feature(aa32_vfp, s)) {
++        return true;
++    }
++
++    fptr = load_reg(s, a->rn);
++    if (a->l) {
++        gen_helper_v7m_vlldm(cpu_env, fptr);
++    } else {
++        gen_helper_v7m_vlstm(cpu_env, fptr);
++    }
++    tcg_temp_free_i32(fptr);
++
++    /* End the TB, because we have updated FP control bits */
++    s->base.is_jmp = DISAS_UPDATE_EXIT;
++    return true;
++}
++
++static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
++{
++    int btmreg, topreg;
++    TCGv_i64 zero;
++    TCGv_i32 aspen, sfpa;
++
++    if (!dc_isar_feature(aa32_m_sec_state, s)) {
++        /* Before v8.1M, fall through in decode to NOCP check */
++        return false;
++    }
++
++    /* Explicitly UNDEF because this takes precedence over NOCP */
++    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
++        unallocated_encoding(s);
++        return true;
++    }
++
++    if (!dc_isar_feature(aa32_vfp_simd, s)) {
++        /* NOP if we have neither FP nor MVE */
++        return true;
++    }
++
++    /*
++     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
++     * active floating point context so we must NOP (without doing
++     * any lazy state preservation or the NOCP check).
++     */
++    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
++    sfpa = load_cpu_field(v7m.control[M_REG_S]);
++    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
++    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
++    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
++    tcg_gen_or_i32(sfpa, sfpa, aspen);
++    arm_gen_condlabel(s);
++    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
++
++    if (s->fp_excp_el != 0) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), s->fp_excp_el);
++        return true;
++    }
++
++    topreg = a->vd + a->imm - 1;
++    btmreg = a->vd;
++
++    /* Convert to Sreg numbers if the insn specified in Dregs */
++    if (a->size == 3) {
++        topreg = topreg * 2 + 1;
++        btmreg *= 2;
++    }
++
++    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
++        /* UNPREDICTABLE: we choose to undef */
++        unallocated_encoding(s);
++        return true;
++    }
++
++    /* Silently ignore requests to clear D16-D31 if they don't exist */
++    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
++        topreg = 31;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    /* Zero the Sregs from btmreg to topreg inclusive. */
++    zero = tcg_const_i64(0);
++    if (btmreg & 1) {
++        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
++        btmreg++;
++    }
++    for (; btmreg + 1 <= topreg; btmreg += 2) {
++        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
++    }
++    if (btmreg == topreg) {
++        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
++        btmreg++;
++    }
++    assert(btmreg == topreg + 1);
++    /* TODO: when MVE is implemented, zero VPR here */
++    return true;
++}
++
++static bool trans_NOCP(DisasContext *s, arg_nocp *a)
++{
++    /*
++     * Handle M-profile early check for disabled coprocessor:
++     * all we need to do here is emit the NOCP exception if
++     * the coprocessor is disabled. Otherwise we return false
++     * and the real VFP/etc decode will handle the insn.
++     */
++    assert(arm_dc_feature(s, ARM_FEATURE_M));
++
++    if (a->cp == 11) {
++        a->cp = 10;
++    }
++    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
++        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
++        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
++        a->cp = 10;
++    }
++
++    if (a->cp != 10) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), default_exception_el(s));
++        return true;
++    }
++
++    if (s->fp_excp_el != 0) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), s->fp_excp_el);
++        return true;
++    }
++
++    return false;
++}
++
++static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
++{
++    /* This range needs a coprocessor check for v8.1M and later only */
++    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++        return false;
++    }
++    return trans_NOCP(s, a);
++}
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+ #define ARM_CP_RW_BIT   (1 << 20)
+ /* Include the VFP and Neon decoders */
+-#include "decode-m-nocp.c.inc"
+ #include "translate-vfp.c.inc"
+ #include "translate-neon.c.inc"
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c.inc
++++ b/target/arm/translate-vfp.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+     return true;
+ }
+-/*
+- * Decode VLLDM and VLSTM are nonstandard because:
+- *  * if there is no FPU then these insns must NOP in
+- *    Secure state and UNDEF in Nonsecure state
+- *  * if there is an FPU then these insns do not have
+- *    the usual behaviour that vfp_access_check() provides of
+- *    being controlled by CPACR/NSACR enable bits or the
+- *    lazy-stacking logic.
+- */
+-static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+-{
+-    TCGv_i32 fptr;
+-
+-    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+-        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+-        return false;
+-    }
+-
+-    if (a->op) {
+-        /*
+-         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
+-         * to take the IMPDEF option to make memory accesses to the stack
+-         * slots that correspond to the D16-D31 registers (discarding
+-         * read data and writing UNKNOWN values), so for us the T2
+-         * encoding behaves identically to the T1 encoding.
+-         */
+-        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+-            return false;
+-        }
+-    } else {
+-        /*
+-         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
+-         * This is currently architecturally impossible, but we add the
+-         * check to stay in line with the pseudocode. Note that we must
+-         * emit code for the UNDEF so it takes precedence over the NOCP.
+-         */
+-        if (dc_isar_feature(aa32_simd_r32, s)) {
+-            unallocated_encoding(s);
+-            return true;
+-        }
+-    }
+-
+-    /*
+-     * If not secure, UNDEF. We must emit code for this
+-     * rather than returning false so that this takes
+-     * precedence over the m-nocp.decode NOCP fallback.
+-     */
+-    if (!s->v8m_secure) {
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-    /* If no fpu, NOP. */
+-    if (!dc_isar_feature(aa32_vfp, s)) {
+-        return true;
+-    }
+-
+-    fptr = load_reg(s, a->rn);
+-    if (a->l) {
+-        gen_helper_v7m_vlldm(cpu_env, fptr);
+-    } else {
+-        gen_helper_v7m_vlstm(cpu_env, fptr);
+-    }
+-    tcg_temp_free_i32(fptr);
+-
+-    /* End the TB, because we have updated FP control bits */
+-    s->base.is_jmp = DISAS_UPDATE_EXIT;
+-    return true;
+-}
+-
+-static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+-{
+-    int btmreg, topreg;
+-    TCGv_i64 zero;
+-    TCGv_i32 aspen, sfpa;
+-
+-    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+-        /* Before v8.1M, fall through in decode to NOCP check */
+-        return false;
+-    }
+-
+-    /* Explicitly UNDEF because this takes precedence over NOCP */
+-    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-
+-    if (!dc_isar_feature(aa32_vfp_simd, s)) {
+-        /* NOP if we have neither FP nor MVE */
+-        return true;
+-    }
+-
+-    /*
+-     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
+-     * active floating point context so we must NOP (without doing
+-     * any lazy state preservation or the NOCP check).
+-     */
+-    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
+-    sfpa = load_cpu_field(v7m.control[M_REG_S]);
+-    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+-    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+-    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
+-    tcg_gen_or_i32(sfpa, sfpa, aspen);
+-    arm_gen_condlabel(s);
+-    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+-
+-    if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
+-        return true;
+-    }
+-
+-    topreg = a->vd + a->imm - 1;
+-    btmreg = a->vd;
+-
+-    /* Convert to Sreg numbers if the insn specified in Dregs */
+-    if (a->size == 3) {
+-        topreg = topreg * 2 + 1;
+-        btmreg *= 2;
+-    }
+-
+-    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
+-        /* UNPREDICTABLE: we choose to undef */
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-
+-    /* Silently ignore requests to clear D16-D31 if they don't exist */
+-    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
+-        topreg = 31;
+-    }
+-
+-    if (!vfp_access_check(s)) {
+-        return true;
+-    }
+-
+-    /* Zero the Sregs from btmreg to topreg inclusive. */
+-    zero = tcg_const_i64(0);
+-    if (btmreg & 1) {
+-        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
+-        btmreg++;
+-    }
+-    for (; btmreg + 1 <= topreg; btmreg += 2) {
+-        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
+-    }
+-    if (btmreg == topreg) {
+-        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
+-        btmreg++;
+-    }
+-    assert(btmreg == topreg + 1);
+-    /* TODO: when MVE is implemented, zero VPR here */
+-    return true;
+-}
+-
+-static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+-{
+-    /*
+-     * Handle M-profile early check for disabled coprocessor:
+-     * all we need to do here is emit the NOCP exception if
+-     * the coprocessor is disabled. Otherwise we return false
+-     * and the real VFP/etc decode will handle the insn.
+-     */
+-    assert(arm_dc_feature(s, ARM_FEATURE_M));
+-
+-    if (a->cp == 11) {
+-        a->cp = 10;
+-    }
+-    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
+-        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
+-        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
+-        a->cp = 10;
+-    }
+-
+-    if (a->cp != 10) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), default_exception_el(s));
+-        return true;
+-    }
+-
+-    if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
+-        return true;
+-    }
+-
+-    return false;
+-}
+-
+-static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
+-{
+-    /* This range needs a coprocessor check for v8.1M and later only */
+-    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+-        return false;
+-    }
+-    return trans_NOCP(s, a);
+-}
+-
+ static bool trans_VINS(DisasContext *s, arg_VINS *a)
+ {
+     TCGv_i32 rd, rm;
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ gen = [
+   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
+   decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
+   decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
+-  decodetree.process('m-nocp.decode', extra_args: '--static-decode=disas_m_nocp'),
++  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
+   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
+   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
+   decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
+   'op_helper.c',
+   'tlb_helper.c',
+   'translate.c',
++  'translate-m-nocp.c',
+   'vec_helper.c',
+   'vfp_helper.c',
+   'cpu_tcg.c',
+--
+.20.1

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+[PULL 08/26] target/arm: Move gen_aa32 functions to translate-a32.h
-Our BCM2836 type is really a generic one that can be any of
+Move the various gen_aa32* functions and macros out of translate.c
-the bcm283x family. Rename it accordingly. We change only
+and into translate-a32.h.
 the names which are visible via the header file to the
 rest of the QEMU code, leaving private function names
 in bcm2836.c as they are.
 This is a preliminary to making bcm283x be an abstract
 parent class to specific types for the bcm2836 and bcm2837.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-6-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 12 ++++++------
+ target/arm/translate-a32.h | 53 ++++++++++++++++++++++++++++++++++++++
- hw/arm/bcm2836.c         | 17 +++++++++--------
+ target/arm/translate.c     | 51 ++++++++++++------------------------
- hw/arm/raspi.c           | 16 ++++++++--------
+files changed, 69 insertions(+), 35 deletions(-)
 files changed, 23 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/translate-a32.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/translate-a32.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
- #include "hw/arm/bcm2835_peripherals.h"
+     return tmp;
- #include "hw/intc/bcm2836_control.h"
+ }
--#define TYPE_BCM2836 "bcm2836"
++void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
--#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
++                              TCGv_i32 a32, int index, MemOp opc);
-+#define TYPE_BCM283X "bcm283x"
++void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
-+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
++                              TCGv_i32 a32, int index, MemOp opc);
++void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
--#define BCM2836_NCPUS 4
++                              TCGv_i32 a32, int index, MemOp opc);
-+#define BCM283X_NCPUS 4
++void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
++                              TCGv_i32 a32, int index, MemOp opc);
--typedef struct BCM2836State {
++void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-+typedef struct BCM283XState {
++                     int index, MemOp opc);
-     /*< private >*/
++void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-     DeviceState parent_obj;
++                     int index, MemOp opc);
-     /*< public >*/
++void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
++                     int index, MemOp opc);
-     char *cpu_type;
++void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-     uint32_t enabled_cpus;
++                     int index, MemOp opc);
++
--    ARMCPU cpus[BCM2836_NCPUS];
++#define DO_GEN_LD(SUFF, OPC)                                            \
-+    ARMCPU cpus[BCM283X_NCPUS];
++    static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
-     BCM2836ControlState control;
++                                         TCGv_i32 a32, int index)       \
-     BCM2835PeripheralState peripherals;
++    {                                                                   \
--} BCM2836State;
++        gen_aa32_ld_i32(s, val, a32, index, OPC);                       \
-+} BCM283XState;
++    }
++
- #endif /* BCM2836_H */
++#define DO_GEN_ST(SUFF, OPC)                                            \
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
++    static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val, \
 +                                         TCGv_i32 a32, int index)       \
 +    {                                                                   \
 +        gen_aa32_st_i32(s, val, a32, index, OPC);                       \
 +    }
 +
 +static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
 +                                 TCGv_i32 a32, int index)
 +{
 +    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
 +}
 +
 +static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
 +                                 TCGv_i32 a32, int index)
 +{
 +    gen_aa32_st_i64(s, val, a32, index, MO_Q);
 +}
 +
 +DO_GEN_LD(8u, MO_UB)
 +DO_GEN_LD(16u, MO_UW)
 +DO_GEN_LD(32u, MO_UL)
 +DO_GEN_ST(8, MO_UB)
 +DO_GEN_ST(16, MO_UW)
 +DO_GEN_ST(32, MO_UL)
 +
 +#undef DO_GEN_LD
 +#undef DO_GEN_ST
 +
  #endif
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
+  * Internal routines are used for NEON cases where the endianness
- static void bcm2836_init(Object *obj)
+  * and/or alignment has already been taken into account and manipulated.
   */
 -static void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
 -                                     TCGv_i32 a32, int index, MemOp opc)
 +void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
 +                              TCGv_i32 a32, int index, MemOp opc)
  {
--    BCM2836State *s = BCM2836(obj);
+     TCGv addr = gen_aa32_addr(s, a32, opc);
-+    BCM283XState *s = BCM283X(obj);
+     tcg_gen_qemu_ld_i32(val, addr, index, opc);
+     tcg_temp_free(addr);
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
+ }
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
+-static void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+-                                     TCGv_i32 a32, int index, MemOp opc)
- static void bcm2836_realize(DeviceState *dev, Error **errp)
++void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
 +                              TCGv_i32 a32, int index, MemOp opc)
  {
--    BCM2836State *s = BCM2836(dev);
+     TCGv addr = gen_aa32_addr(s, a32, opc);
-+    BCM283XState *s = BCM283X(dev);
+     tcg_gen_qemu_st_i32(val, addr, index, opc);
-     Object *obj;
+     tcg_temp_free(addr);
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
      obj = OBJECT(dev);
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                            s->cpu_type);
          object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          /* Mirror bcm2836, which has clusterid set to 0xf
           * TODO: this should be converted to a property of ARM_CPU
           */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
- static Property bcm2836_props[] = {
+-static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
--    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
+-                                     TCGv_i32 a32, int index, MemOp opc)
--    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
++void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
-+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
++                              TCGv_i32 a32, int index, MemOp opc)
-+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+ {
-+                       BCM283X_NCPUS),
+     TCGv addr = gen_aa32_addr(s, a32, opc);
-     DEFINE_PROP_END_OF_LIST()
- };
+@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+     tcg_temp_free(addr);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
  }
- static const TypeInfo bcm2836_type_info = {
+-static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
--    .name = TYPE_BCM2836,
+-                                     TCGv_i32 a32, int index, MemOp opc)
-+    .name = TYPE_BCM283X,
++void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
-     .parent = TYPE_DEVICE,
++                              TCGv_i32 a32, int index, MemOp opc)
--    .instance_size = sizeof(BCM2836State),
+ {
-+    .instance_size = sizeof(BCM283XState),
+     TCGv addr = gen_aa32_addr(s, a32, opc);
-     .instance_init = bcm2836_init,
-     .class_init = bcm2836_class_init,
+@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
- };
+     tcg_temp_free(addr);
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
  typedef struct RasPiState {
 -    BCM2836State soc;
 +    BCM283XState soc;
      MemoryRegion ram;
  } RasPiState;
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
  }
- DEFINE_MACHINE("raspi3", raspi3_machine_init)
 -static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 -                            int index, MemOp opc)
 +void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 +                     int index, MemOp opc)
  {
      gen_aa32_ld_internal_i32(s, val, a32, index, finalize_memop(s, opc));
  }
 -static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 -                            int index, MemOp opc)
 +void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 +                     int index, MemOp opc)
  {
      gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
  }
 -static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
 -                            int index, MemOp opc)
 +void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
 +                     int index, MemOp opc)
  {
      gen_aa32_ld_internal_i64(s, val, a32, index, finalize_memop(s, opc));
  }
 -static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
 -                            int index, MemOp opc)
 +void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
 +                     int index, MemOp opc)
  {
      gen_aa32_st_internal_i64(s, val, a32, index, finalize_memop(s, opc));
  }
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
          gen_aa32_st_i32(s, val, a32, index, OPC);                       \
      }
 -static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
 -                                 TCGv_i32 a32, int index)
 -{
 -    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
 -}
 -
 -static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
 -                                 TCGv_i32 a32, int index)
 -{
 -    gen_aa32_st_i64(s, val, a32, index, MO_Q);
 -}
 -
 -DO_GEN_LD(8u, MO_UB)
 -DO_GEN_LD(16u, MO_UW)
 -DO_GEN_LD(32u, MO_UL)
 -DO_GEN_ST(8, MO_UB)
 -DO_GEN_ST(16, MO_UW)
 -DO_GEN_ST(32, MO_UL)
 -
  static inline void gen_hvc(DisasContext *s, int imm16)
  {
      /* The pre HVC helper handles cases when HVC gets trapped
 --
-.16.2
+.20.1

-New patch
+[PULL 09/26] target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
+The functions vfp_load_reg32(), vfp_load_reg64(), vfp_store_reg32()
+and vfp_store_reg64() are used only in translate-vfp.c.inc. Move
+them to that file.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-7-peter.maydell@linaro.org
+---
+ target/arm/translate.c         | 20 --------------------
+ target/arm/translate-vfp.c.inc | 20 ++++++++++++++++++++
+files changed, 20 insertions(+), 20 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static long vfp_reg_offset(bool dp, unsigned reg)
+     }
+ }
+-static inline void vfp_load_reg64(TCGv_i64 var, int reg)
+-{
+-    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
+-}
+-
+-static inline void vfp_store_reg64(TCGv_i64 var, int reg)
+-{
+-    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
+-}
+-
+-static inline void vfp_load_reg32(TCGv_i32 var, int reg)
+-{
+-    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
+-}
+-
+-static inline void vfp_store_reg32(TCGv_i32 var, int reg)
+-{
+-    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
+-}
+-
+ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
+ {
+     long off = neon_element_offset(reg, ele, memop);
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c.inc
++++ b/target/arm/translate-vfp.c.inc
+@@ -XXX,XX +XXX,XX @@
+ #include "decode-vfp.c.inc"
+ #include "decode-vfp-uncond.c.inc"
++static inline void vfp_load_reg64(TCGv_i64 var, int reg)
++{
++    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
++}
++
++static inline void vfp_store_reg64(TCGv_i64 var, int reg)
++{
++    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
++}
++
++static inline void vfp_load_reg32(TCGv_i32 var, int reg)
++{
++    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
++}
++
++static inline void vfp_store_reg32(TCGv_i32 var, int reg)
++{
++    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
++}
++
+ /*
+  * The imm8 encodes the sign bit, enough bits to represent an exponent in
+  * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+--
+.20.1

-New patch
+[PULL 10/26] target/arm: Make functions used by translate-vfp global
+Make the remaining functions which are needed by translate-vfp.c.inc
+global.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-8-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h | 18 ++++++++++++++++++
+ target/arm/translate.c     | 25 ++++++++-----------------
+files changed, 26 insertions(+), 17 deletions(-)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
+ void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
+ void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
+ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
++TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs);
++void gen_set_cpsr(TCGv_i32 var, uint32_t mask);
++void gen_set_condexec(DisasContext *s);
++void gen_set_pc_im(DisasContext *s, target_ulong val);
++void gen_lookup_tb(DisasContext *s);
++long vfp_reg_offset(bool dp, unsigned reg);
++long neon_full_reg_offset(unsigned reg);
+ static inline TCGv_i32 load_cpu_offset(int offset)
+ {
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
+     return tmp;
+ }
++void store_reg(DisasContext *s, int reg, TCGv_i32 var);
++
+ void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                               TCGv_i32 a32, int index, MemOp opc);
+ void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
+ #undef DO_GEN_LD
+ #undef DO_GEN_ST
++#if defined(CONFIG_USER_ONLY)
++#define IS_USER(s) 1
++#else
++#define IS_USER(s) (s->user)
++#endif
++
++/* Set NZCV flags from the high 4 bits of var.  */
++#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
++
+ #endif
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "translate.h"
+ #include "translate-a32.h"
+-#if defined(CONFIG_USER_ONLY)
+-#define IS_USER(s) 1
+-#else
+-#define IS_USER(s) (s->user)
+-#endif
+-
+ /* These are TCG temporaries used only by the legacy iwMMXt decoder */
+ static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
+ /* These are TCG globals which alias CPUARMState fields */
+@@ -XXX,XX +XXX,XX @@ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
+  * This is used for load/store for which use of PC implies (literal),
+  * or ADD that implies ADR.
+  */
+-static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
++TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+ /* Set a CPU register.  The source must be a temporary and will be
+    marked as dead.  */
+-static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
++void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+ {
+     if (reg == 15) {
+         /* In Thumb mode, we must ignore bit 0.
+@@ -XXX,XX +XXX,XX @@ static void store_sp_checked(DisasContext *s, TCGv_i32 var)
+ #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
+ #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
+-
+-static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
++void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
+ {
+     TCGv_i32 tmp_mask = tcg_const_i32(mask);
+     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
+     tcg_temp_free_i32(tmp_mask);
+ }
+-/* Set NZCV flags from the high 4 bits of var.  */
+-#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
+ static void gen_exception_internal(int excp)
+ {
+@@ -XXX,XX +XXX,XX @@ void arm_gen_test_cc(int cc, TCGLabel *label)
+     arm_free_cc(&cmp);
+ }
+-static inline void gen_set_condexec(DisasContext *s)
++void gen_set_condexec(DisasContext *s)
+ {
+     if (s->condexec_mask) {
+         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
+@@ -XXX,XX +XXX,XX @@ static inline void gen_set_condexec(DisasContext *s)
+     }
+ }
+-static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
++void gen_set_pc_im(DisasContext *s, target_ulong val)
+ {
+     tcg_gen_movi_i32(cpu_R[15], val);
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+-static inline void gen_lookup_tb(DisasContext *s)
++void gen_lookup_tb(DisasContext *s)
+ {
+     tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
+     s->base.is_jmp = DISAS_EXIT;
+@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
+ /*
+  * Return the offset of a "full" NEON Dreg.
+  */
+-static long neon_full_reg_offset(unsigned reg)
++long neon_full_reg_offset(unsigned reg)
+ {
+     return offsetof(CPUARMState, vfp.zregs[reg >> 1].d[reg & 1]);
+ }
+@@ -XXX,XX +XXX,XX @@ static long neon_element_offset(int reg, int element, MemOp memop)
+ }
+ /* Return the offset of a VFP Dreg (dp = true) or VFP Sreg (dp = false). */
+-static long vfp_reg_offset(bool dp, unsigned reg)
++long vfp_reg_offset(bool dp, unsigned reg)
+ {
+     if (dp) {
+         return neon_element_offset(reg, 0, MO_64);
+--
+.20.1

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 11/26] target/arm: Make translate-vfp.c.inc its own compilation unit
-The bcm2837 is pretty similar to the bcm2836, but it does have
+Switch translate-vfp.c.inc from being #included into translate.c
-some differences. Notably, the MPIDR affinity aff1 values it
+to being its own compilation unit.
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
 Rather than trying to have one device with properties that
 configure it differently for the two cases, create two
 separate QOM devices for the two SoCs. We use the same approach
 as hw/arm/aspeed_soc.c and share code and have a data table
 that might differ per-SoC. For the moment the two types don't
 actually have different behaviour.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-9-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ target/arm/translate-a32.h                          |  2 ++
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+ target/arm/{translate-vfp.c.inc => translate-vfp.c} | 12 +++++++-----
- hw/arm/raspi.c           |  3 ++-
+ target/arm/translate.c                              |  3 +--
-files changed, 53 insertions(+), 6 deletions(-)
+ target/arm/meson.build                              |  5 +++--
 files changed, 13 insertions(+), 9 deletions(-)
  rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (99%)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/translate-a32.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/translate-a32.h
 @@ -XXX,XX +XXX,XX @@
- #define BCM283X_NCPUS 4
+ /* Prototypes for autogenerated disassembler functions */
+ bool disas_m_nocp(DisasContext *dc, uint32_t insn);
-+/* These type names are for specific SoCs; other than instantiating
++bool disas_vfp(DisasContext *s, uint32_t insn);
-+ * them, code using these devices should always handle them via the
++bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
-+ */
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
-+#define TYPE_BCM2836 "bcm2836"
+ void arm_gen_condlabel(DisasContext *s);
-+#define TYPE_BCM2837 "bcm2837"
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c
-+
+similarity index 99%
- typedef struct BCM283XState {
+rename from target/arm/translate-vfp.c.inc
-     /*< private >*/
+rename to target/arm/translate-vfp.c
      DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
      BCM2835PeripheralState peripherals;
  } BCM283XState;
 +typedef struct BCM283XInfo BCM283XInfo;
 +
 +typedef struct BCM283XClass {
 +    DeviceClass parent_class;
 +    const BCM283XInfo *info;
 +} BCM283XClass;
 +
 +#define BCM283X_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
 +#define BCM283X_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 +
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/translate-vfp.c.inc
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/translate-vfp.c
 @@ -XXX,XX +XXX,XX @@
- /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
+  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- #define BCM2836_CONTROL_BASE    0x40000000
+  */
-+struct BCM283XInfo {
+-/*
-+    const char *name;
+- * This file is intended to be included from translate.c; it uses
-+};
+- * some macros and definitions provided by that file.
-+
+- * It might be possible to convert it to a standalone .c file eventually.
-+static const BCM283XInfo bcm283x_socs[] = {
+- */
-+    {
++#include "qemu/osdep.h"
-+        .name = TYPE_BCM2836,
++#include "tcg/tcg-op.h"
-+    },
++#include "tcg/tcg-op-gvec.h"
-+    {
++#include "exec/exec-all.h"
-+        .name = TYPE_BCM2837,
++#include "exec/gen-icount.h"
-+    },
++#include "translate.h"
-+};
++#include "translate-a32.h"
-+
- static void bcm2836_init(Object *obj)
+ /* Include the generated VFP decoder */
- {
+ #include "decode-vfp.c.inc"
-     BCM283XState *s = BCM283X(obj);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
      DEFINE_PROP_END_OF_LIST()
  };
 -static void bcm2836_class_init(ObjectClass *oc, void *data)
 +static void bcm283x_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 +    BCM283XClass *bc = BCM283X_CLASS(oc);
 -    dc->props = bcm2836_props;
 +    bc->info = data;
      dc->realize = bcm2836_realize;
 +    dc->props = bcm2836_props;
  }
 -static const TypeInfo bcm2836_type_info = {
 +static const TypeInfo bcm283x_type_info = {
      .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
      .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
 -    .class_init = bcm2836_class_init,
 +    .class_size = sizeof(BCM283XClass),
 +    .abstract = true,
  };
  static void bcm2836_register_types(void)
  {
 -    type_register_static(&bcm2836_type_info);
 +    int i;
 +
 +    type_register_static(&bcm283x_type_info);
 +    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
 +        TypeInfo ti = {
 +            .name = bcm283x_socs[i].name,
 +            .parent = TYPE_BCM283X,
 +            .class_init = bcm283x_class_init,
 +            .class_data = (void *) &bcm283x_socs[i],
 +        };
 +        type_register(&ti);
 +    }
  }
  type_init(bcm2836_register_types)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-     BusState *bus;
-     DeviceState *carddev;
+ #define ARM_CP_RW_BIT   (1 << 20)
--    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+-/* Include the VFP and Neon decoders */
-+    object_initialize(&s->soc, sizeof(s->soc),
+-#include "translate-vfp.c.inc"
-+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
++/* Include the Neon decoder */
-     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
+ #include "translate-neon.c.inc"
-                               &error_abort);
+ static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
    decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
    decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
    decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
 -  decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
 -  decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
 +  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
 +  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
    decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
    decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
    decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'tlb_helper.c',
    'translate.c',
    'translate-m-nocp.c',
 +  'translate-vfp.c',
    'vec_helper.c',
    'vfp_helper.c',
    'cpu_tcg.c',
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 12/26] target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
-The raspi3 has AArch64 CPUs, which means that our smpboot
+The function vfp_reg_ptr() is used only in translate-neon.c.inc;
-code for keeping the secondary CPUs in a pen needs to have
+move it there.
 a version for A64 as well as A32. Without this, the
 secondary CPUs go into an infinite loop of taking undefined
 instruction exceptions.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-10-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ target/arm/translate.c          | 7 -------
-file changed, 40 insertions(+), 1 deletion(-)
+ target/arm/translate-neon.c.inc | 7 +++++++
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+     }
  #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
  #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 +#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
  /* Table of Linux board IDs for different Pi versions */
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                         info->smp_loader_start);
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+-static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 -{
 -    TCGv_ptr ret = tcg_temp_new_ptr();
 -    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
 -    return ret;
 -}
 -
  #define ARM_CP_RW_BIT   (1 << 20)
  /* Include the Neon decoder */
 diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static inline int neon_3same_fp_size(DisasContext *s, int x)
  #include "decode-neon-ls.c.inc"
  #include "decode-neon-shared.c.inc"
 +static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 +{
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
++    TCGv_ptr ret = tcg_temp_new_ptr();
-+     * The mechanism for doing the spin-table is also entirely different.
++    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
-+     * We must have four 64-bit fields at absolute addresses
++    return ret;
 +     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
 +     * our CPUs, and which we must ensure are zero initialized before
 +     * the primary CPU goes into the kernel. We put these variables inside
 +     * a rom blob, so that the reset for ROM contents zeroes them for us.
 +     */
 +    static const uint32_t smpboot[] = {
 +        0xd2801b05, /*        mov     x5, 0xd8 */
 +        0xd53800a6, /*        mrs     x6, mpidr_el1 */
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
 +    static const uint64_t spintables[] = {
 +        0, 0, 0, 0
 +    };
 +
 +    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
 +                       info->smp_loader_start);
 +    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
 +                       SPINTABLE_ADDR);
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
+ static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
  {
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
+     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      /* Pi2 and Pi3 requires SMP setup */
      if (version >= 2) {
          binfo.smp_loader_start = SMPBOOT_ADDR;
 -        binfo.write_secondary_boot = write_smpboot;
 +        if (version == 2) {
 +            binfo.write_secondary_boot = write_smpboot;
 +        } else {
 +            binfo.write_secondary_boot = write_smpboot64;
 +        }
          binfo.secondary_cpu_reset_hook = reset_secondary;
      }
 --
-.16.2
+.20.1

-New patch
+[PULL 13/26] target/arm: Delete unused typedef
+The VFPGenFixPointFn typedef is unused; delete it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210430132740.10391-11-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 2 --
+file changed, 2 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+ /* Function prototypes for gen_ functions calling Neon helpers.  */
+ typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                  TCGv_i32, TCGv_i32);
+-/* Function prototypes for gen_ functions for fix point conversions */
+-typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+--
+.20.1

-New patch
+[PULL 14/26] target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
+Move the NeonGenThreeOpEnvFn typedef to translate.h together
+with the other similar typedefs.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210430132740.10391-12-peter.maydell@linaro.org
+---
+ target/arm/translate.h | 2 ++
+ target/arm/translate.c | 3 ---
+files changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i32, TCGv_i32);
+ typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
+ typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
+ typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
++typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
++                                 TCGv_i32, TCGv_i32);
+ typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
+ typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
+ typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
+-/* Function prototypes for gen_ functions calling Neon helpers.  */
+-typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+-                                 TCGv_i32, TCGv_i32);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+--
+.20.1

-New patch
+[PULL 15/26] target/arm: Make functions used by translate-neon global
+Make the remaining functions needed by the translate-neon code
+global.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-13-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h |  8 ++++++++
+ target/arm/translate.c     | 10 ++--------
+files changed, 10 insertions(+), 8 deletions(-)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@ void gen_set_pc_im(DisasContext *s, target_ulong val);
+ void gen_lookup_tb(DisasContext *s);
+ long vfp_reg_offset(bool dp, unsigned reg);
+ long neon_full_reg_offset(unsigned reg);
++long neon_element_offset(int reg, int element, MemOp memop);
++void gen_rev16(TCGv_i32 dest, TCGv_i32 var);
+ static inline TCGv_i32 load_cpu_offset(int offset)
+ {
+@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
+ /* Set NZCV flags from the high 4 bits of var.  */
+ #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
++/* Swap low and high halfwords.  */
++static inline void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
++{
++    tcg_gen_rotri_i32(dest, var, 16);
++}
++
+ #endif
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
+ }
+ /* Byteswap each halfword.  */
+-static void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
++void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+     TCGv_i32 mask = tcg_const_i32(0x00ff00ff);
+@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
+     tcg_gen_ext16s_i32(dest, var);
+ }
+-/* Swap low and high halfwords.  */
+-static void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
+-{
+-    tcg_gen_rotri_i32(dest, var, 16);
+-}
+-
+ /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
+     tmp = (t0 ^ t1) & 0x8000;
+     t0 &= ~0x8000;
+@@ -XXX,XX +XXX,XX @@ long neon_full_reg_offset(unsigned reg)
+  * Return the offset of a 2**SIZE piece of a NEON register, at index ELE,
+  * where 0 is the least significant end of the register.
+  */
+-static long neon_element_offset(int reg, int element, MemOp memop)
++long neon_element_offset(int reg, int element, MemOp memop)
+ {
+     int element_size = 1 << (memop & MO_SIZE);
+     int ofs = element * element_size;
+--
+.20.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 16/26] target/arm: Make translate-neon.c.inc its own compilation unit
-Add some assertions that if we're about to boot an AArch64 kernel,
+Switch translate-neon.c.inc from being #included into translate.c
-the board code has not mistakenly set either secure_boot or
+to being its own compilation unit.
 secure_board_setup. It doesn't make sense to set secure_boot,
 because all AArch64 kernels must be booted in non-secure mode.
 It might in theory make sense to set secure_board_setup, but
 we don't currently support that, because only the AArch32
 bootloader[] code calls this hook; bootloader_aarch64[] does not.
 Since we don't have a current need for this functionality, just
 assert that we don't try to use it. If it's needed we'll add
 it later.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-14-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ target/arm/translate-a32.h                           |  3 +++
-file changed, 7 insertions(+)
+ .../arm/{translate-neon.c.inc => translate-neon.c}   | 12 +++++++-----
  target/arm/translate.c                               |  3 ---
  target/arm/meson.build                               |  7 ++++---
 files changed, 14 insertions(+), 11 deletions(-)
  rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/translate-a32.h
-+++ b/hw/arm/boot.c
++++ b/target/arm/translate-a32.h
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@
-                     } else {
+ bool disas_m_nocp(DisasContext *dc, uint32_t insn);
-                         env->pstate = PSTATE_MODE_EL1h;
+ bool disas_vfp(DisasContext *s, uint32_t insn);
-                     }
+ bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
-+                    /* AArch64 kernels never boot in secure mode */
++bool disas_neon_dp(DisasContext *s, uint32_t insn);
-+                    assert(!info->secure_boot);
++bool disas_neon_ls(DisasContext *s, uint32_t insn);
-+                    /* This hook is only supported for AArch32 currently:
++bool disas_neon_shared(DisasContext *s, uint32_t insn);
-+                     * bootloader_aarch64[] will not call the hook, and
-+                     * the code above has already dropped us into EL2 or EL1.
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
-+                     */
+ void arm_gen_condlabel(DisasContext *s);
-+                    assert(!info->secure_board_setup);
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c
-                 }
+similarity index 99%
+rename from target/arm/translate-neon.c.inc
-                 /* Set to non-secure if not a secure boot */
+rename to target/arm/translate-neon.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@
   * License along with this library; if not, see <http://www.gnu.org/licenses/>.
   */
 -/*
 - * This file is intended to be included from translate.c; it uses
 - * some macros and definitions provided by that file.
 - * It might be possible to convert it to a standalone .c file eventually.
 - */
 +#include "qemu/osdep.h"
 +#include "tcg/tcg-op.h"
 +#include "tcg/tcg-op-gvec.h"
 +#include "exec/exec-all.h"
 +#include "exec/gen-icount.h"
 +#include "translate.h"
 +#include "translate-a32.h"
  static inline int plus1(DisasContext *s, int x)
  {
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
  #define ARM_CP_RW_BIT   (1 << 20)
 -/* Include the Neon decoder */
 -#include "translate-neon.c.inc"
 -
  static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
  {
      tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
  gen = [
    decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
 -  decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
 -  decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
 -  decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
 +  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
 +  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
 +  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
    decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
    decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
    decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'tlb_helper.c',
    'translate.c',
    'translate-m-nocp.c',
 +  'translate-neon.c',
    'translate-vfp.c',
    'vec_helper.c',
    'vfp_helper.c',
 --
-.16.2
+.20.1

-New patch
+[PULL 17/26] target/arm: Make WFI a NOP for userspace emulators
+The WFI insn is not system-mode only, though it doesn't usually make
+a huge amount of sense for userspace code to execute it.  Currently
+if you try it in qemu-arm then the helper function will raise an
+EXCP_HLT exception, which is not covered by the switch in cpu_loop()
+and results in an abort:
+qemu: unhandled CPU exception 0x10001 - aborting
+R00=00000001 R01=408003e4 R02=408003ec R03=000102ec
+R04=00010a28 R05=00010158 R06=00087460 R07=00010158
+R08=00000000 R09=00000000 R10=00085b7c R11=408002a4
+R12=408002b8 R13=408002a0 R14=0001057c R15=000102f8
+PSR=60000010 -ZC- A usr32
+qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fcbfa4f0a12
+Make the WFI helper function return immediately in the usermode
+emulator. This turns WFI into a NOP, which is OK because:
+ * architecturally "WFI is a NOP" is a permitted implementation
+ * aarch64 Linux kernels use the SCTLR_EL1.nTWI bit to trap
+   userspace WFI and NOP it (though aarch32 kernels currently
+   just let WFI do whatever it would do)
+We could in theory make the translate.c code special case user-mode
+emulation and NOP the insn entirely rather than making the helper
+do nothing, but because no real world code will be trying to
+execute WFI we don't care about efficiency and the helper provides
+a single place where we can make the change rather than having
+to touch multiple places in translate.c and translate-a64.c.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1926759
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430162212.825-1-peter.maydell@linaro.org
+---
+ target/arm/op_helper.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
+ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+ {
++#ifdef CONFIG_USER_ONLY
++    /*
++     * WFI in the user-mode emulator is technically permitted but not
++     * something any real-world code would do. AArch64 Linux kernels
++     * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP;
++     * AArch32 kernels don't trap it so it will delay a bit.
++     * For QEMU, make it NOP here, because trying to raise EXCP_HLT
++     * would trigger an abort.
++     */
++    return;
++#else
+     CPUState *cs = env_cpu(env);
+     int target_el = check_wfx_trap(env, false);
+@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+     cs->exception_index = EXCP_HLT;
+     cs->halted = 1;
+     cpu_loop_exit(cs);
++#endif
+ }
+ void HELPER(wfe)(CPUARMState *env)
+--
+.20.1

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+[PULL 18/26] hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
-The TypeInfo and state struct for bcm2386 disagree about what the
+The omap_mmc_reset() function resets its SD card via
-parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
+device_legacy_reset().  We know that the SD card does not have a qbus
-but the BCM2386State struct only defines the parent_obj field
+of its own, so the new device_cold_reset() function (which resets
-as DeviceState. This would have caused problems if anything
+both the device and its child buses) is equivalent here to
-actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
+device_legacy_reset() and we can just switch to the new API.
 Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
 need any of the additional functionality TYPE_SYS_BUS_DEVICE
 provides.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
+Message-id: 20210430222348.8514-1-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 2 +-
+ hw/sd/omap_mmc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/hw/sd/omap_mmc.c
-+++ b/hw/arm/bcm2836.c
++++ b/hw/sd/omap_mmc.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
+      * into any bus, and we must reset it manually. When omap_mmc is
- static const TypeInfo bcm2836_type_info = {
+      * QOMified this must move into the QOM reset function.
-     .name = TYPE_BCM2836,
+      */
--    .parent = TYPE_SYS_BUS_DEVICE,
+-    device_legacy_reset(DEVICE(host->card));
-+    .parent = TYPE_DEVICE,
++    device_cold_reset(DEVICE(host->card));
-     .instance_size = sizeof(BCM2836State),
+ }
-     .instance_init = bcm2836_init,
-     .class_init = bcm2836_class_init,
+ static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 19/26] osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+Both os-win32.h and os-posix.h include system header files. Instead
 of having osdep.h include them inside its 'extern "C"' block, make
 these headers handle that themselves, so that we don't include the
 system headers inside 'extern "C"'.
-Code of imx_update() is slightly confusing since the "flags" variable
+This doesn't fix any current problems, but it's conceptually the
-doesn't really corespond to anything in real hardware and server as a
+right way to handle system headers.
 kitchensink accumulating events normally reported via USR1 and USR2
 registers.
-Change the code to explicitly evaluate state of interrupts reported
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-via USR1 and USR2 against corresponding masking bits and use the to
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-detemine if IRQ line should be asserted or not.
+---
  include/qemu/osdep.h      | 8 ++++----
  include/sysemu/os-posix.h | 8 ++++++++
  include/sysemu/os-win32.h | 8 ++++++++
 files changed, 20 insertions(+), 4 deletions(-)
-NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
+diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 reasons:
 . Emulation code implements a single character FIFO, so this flag
        will always be set since characters are trasmitted as a part of
        the code emulating "push" into the FIFO
 . imx_update() is really just a function doing ORing and maksing
        of reported events, so checking for UTS1_TXEMPTY should happen,
        if it's ever really needed should probably happen outside of
        it.
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/char/imx_serial.c | 24 ++++++++++++++++--------
 file changed, 16 insertions(+), 8 deletions(-)
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/include/qemu/osdep.h
-+++ b/hw/char/imx_serial.c
++++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@ QEMU_EXTERN_C int daemon(int, int);
+  */
- static void imx_update(IMXSerialState *s)
+ #include "glib-compat.h"
- {
--    uint32_t flags;
+-#ifdef __cplusplus
-+    uint32_t usr1;
+-extern "C" {
-+    uint32_t usr2;
+-#endif
-+    uint32_t mask;
+-
+ #ifdef _WIN32
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
+ #include "sysemu/os-win32.h"
--    if (s->ucr1 & UCR1_TXMPTYEN) {
+ #endif
--        flags |= (s->uts1 & UTS1_TXEMPTY);
+@@ -XXX,XX +XXX,XX @@ extern "C" {
--    } else {
+ #include "sysemu/os-posix.h"
--        flags &= ~USR1_TRDY;
+ #endif
--    }
-+    /*
++#ifdef __cplusplus
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
++extern "C" {
-+     * UCR1, so we can get away with something as simple as the
++#endif
-+     * following:
++
-+     */
+ #include "qemu/typedefs.h"
-+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
-+    /*
+ /*
-+     * Bits that we want in USR2 are not as conveniently laid out,
+diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
-+     * unfortunately.
+index XXXXXXX..XXXXXXX 100644
-+     */
+--- a/include/sysemu/os-posix.h
-+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
++++ b/include/sysemu/os-posix.h
-+    usr2 = s->usr2 & mask;
+@@ -XXX,XX +XXX,XX @@
+ #include <sys/sysmacros.h>
--    qemu_set_irq(s->irq, !!flags);
+ #endif
-+    qemu_set_irq(s->irq, usr1 || usr2);
 +#ifdef __cplusplus
 +extern "C" {
 +#endif
 +
  void os_set_line_buffering(void);
  void os_set_proc_name(const char *s);
  void os_setup_signal_handling(void);
@@ -XXX,XX +XXX,XX @@ static inline void qemu_funlockfile(FILE *f)
      funlockfile(f);
  }
- static void imx_serial_reset(IMXSerialState *s)
++#ifdef __cplusplus
 +}
 +#endif
 +
  #endif
 diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/os-win32.h
 +++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@
  #include <windows.h>
  #include <ws2tcpip.h>
 +#ifdef __cplusplus
 +extern "C" {
 +#endif
 +
  #if defined(_WIN64)
  /* On w64, setjmp is implemented by _setjmp which needs a second parameter.
   * If this parameter is NULL, longjump does no stack unwinding.
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_recv_wrap(int sockfd, void *buf, size_t len, int flags);
  ssize_t qemu_recvfrom_wrap(int sockfd, void *buf, size_t len, int flags,
                             struct sockaddr *addr, socklen_t *addrlen);
 +#ifdef __cplusplus
 +}
 +#endif
 +
  #endif
 --
-.16.2
+.20.1

-New patch
+[PULL 20/26] include/qemu/bswap.h: Handle being included outside extern "C" block
+Make bswap.h handle being included outside an 'extern "C"' block:
+all system headers are included first, then all declarations are
+put inside an 'extern "C"' block.
+This requires a little rearrangement as currently we have an ifdef
+ladder that has some system includes and some local declarations
+or definitions, and we need to separate those out.
+We want to do this because dis-asm.h includes bswap.h, dis-asm.h
+may need to be included from C++ files, and system headers should
+not be included within 'extern "C"' blocks.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/qemu/bswap.h | 26 ++++++++++++++++++++++----
+file changed, 22 insertions(+), 4 deletions(-)
+diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/bswap.h
++++ b/include/qemu/bswap.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BSWAP_H
+ #define BSWAP_H
+-#include "fpu/softfloat-types.h"
+-
+ #ifdef CONFIG_MACHINE_BSWAP_H
+ # include <sys/endian.h>
+ # include <machine/bswap.h>
+@@ -XXX,XX +XXX,XX @@
+ # include <endian.h>
+ #elif defined(CONFIG_BYTESWAP_H)
+ # include <byteswap.h>
++#define BSWAP_FROM_BYTESWAP
++# else
++#define BSWAP_FROM_FALLBACKS
++#endif /* ! CONFIG_MACHINE_BSWAP_H */
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "fpu/softfloat-types.h"
++
++#ifdef BSWAP_FROM_BYTESWAP
+ static inline uint16_t bswap16(uint16_t x)
+ {
+     return bswap_16(x);
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
+ {
+     return bswap_64(x);
+ }
+-# else
++#endif
++
++#ifdef BSWAP_FROM_FALLBACKS
+ static inline uint16_t bswap16(uint16_t x)
+ {
+     return (((x & 0x00ff) << 8) |
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
+             ((x & 0x00ff000000000000ULL) >> 40) |
+             ((x & 0xff00000000000000ULL) >> 56));
+ }
+-#endif /* ! CONFIG_MACHINE_BSWAP_H */
++#endif
++
++#undef BSWAP_FROM_BYTESWAP
++#undef BSWAP_FROM_FALLBACKS
+ static inline void bswap16s(uint16_t *s)
+ {
+@@ -XXX,XX +XXX,XX @@ DO_STN_LDN_P(be)
+ #undef le_bswaps
+ #undef be_bswaps
++#ifdef __cplusplus
++}
++#endif
++
+ #endif /* BSWAP_H */
+--
+.20.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+[PULL 21/26] include/disas/dis-asm.h: Handle being included outside 'extern "C"'
-If we're directly booting a Linux kernel and the CPU supports both
+Make dis-asm.h handle being included outside an 'extern "C"' block;
-EL3 and EL2, we start the kernel in EL2, as it expects. We must also
+this allows us to remove the 'extern "C"' blocks that our two C++
-set the SCR_EL3.HCE bit in this situation, so that the HVC
+files that include it are using.
 instruction is enabled rather than UNDEFing. Otherwise at least some
 kernels will panic when trying to initialize KVM in the guest.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- hw/arm/boot.c | 5 +++++
+ include/disas/dis-asm.h | 12 ++++++++++--
-file changed, 5 insertions(+)
+ disas/arm-a64.cc        |  2 --
  disas/nanomips.cpp      |  2 --
 files changed, 10 insertions(+), 6 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/include/disas/dis-asm.h b/include/disas/dis-asm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/include/disas/dis-asm.h
-+++ b/hw/arm/boot.c
++++ b/include/disas/dis-asm.h
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@
-                     assert(!info->secure_board_setup);
+ #ifndef DISAS_DIS_ASM_H
-                 }
+ #define DISAS_DIS_ASM_H
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
++#include "qemu/bswap.h"
 +                    /* If we have EL2 then Linux expects the HVC insn to work */
 +                    env->cp15.scr_el3 |= SCR_HCE;
 +                }
 +
-                 /* Set to non-secure if not a secure boot */
++#ifdef __cplusplus
-                 if (!info->secure_boot &&
++extern "C" {
-                     (cs != first_cpu || !info->secure_board_setup)) {
++#endif
 +
  typedef void *PTR;
  typedef uint64_t bfd_vma;
  typedef int64_t bfd_signed_vma;
@@ -XXX,XX +XXX,XX @@ bool cap_disas_plugin(disassemble_info *info, uint64_t pc, size_t size);
  /* from libbfd */
 -#include "qemu/bswap.h"
 -
  static inline bfd_vma bfd_getl64(const bfd_byte *addr)
  {
      return ldq_le_p(addr);
@@ -XXX,XX +XXX,XX @@ static inline bfd_vma bfd_getb16(const bfd_byte *addr)
  typedef bool bfd_boolean;
 +#ifdef __cplusplus
 +}
 +#endif
 +
  #endif /* DISAS_DIS_ASM_H */
 diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/arm-a64.cc
 +++ b/disas/arm-a64.cc
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -extern "C" {
  #include "disas/dis-asm.h"
 -}
  #include "vixl/a64/disasm-a64.h"
 diff --git a/disas/nanomips.cpp b/disas/nanomips.cpp
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/nanomips.cpp
 +++ b/disas/nanomips.cpp
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -extern "C" {
  #include "disas/dis-asm.h"
 -}
  #include <cstring>
  #include <stdexcept>
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+[PULL 22/26] hw/arm/imx25_pdk: Fix error message for invalid RAM size
-From: Wei Huang <wei@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-For guest kernel that supports KASLR, the load address can change every
+The i.MX25 PDK board has 2 banks for SDRAM, each can
-time when guest VM runs. To find the physical base address correctly,
+address up to 256 MiB. So the total RAM usable for this
-current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
+board is 512M. When we ask for more we get a misleading
-However this string pattern is only available on x86_64. AArch64 uses a
+error message:
 different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
 QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
+  $ qemu-system-arm -M imx25-pdk -m 513M
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+  qemu-system-arm: Invalid RAM size, should be 128 MiB
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
 Update the error message to better match the reality:
   $ qemu-system-arm -M imx25-pdk -m 513M
   qemu-system-arm: RAM size more than 512 MiB is not supported
 Fixes: bf350daae02 ("arm/imx25_pdk: drop RAM size fixup")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Message-id: 20210407225608.1882855-1-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- dump.c | 14 +++++++++++---
+ hw/arm/imx25_pdk.c | 5 ++---
-file changed, 11 insertions(+), 3 deletions(-)
+file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/dump.c b/dump.c
+diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
 index XXXXXXX..XXXXXXX 100644
---- a/dump.c
+--- a/hw/arm/imx25_pdk.c
-+++ b/dump.c
++++ b/hw/arm/imx25_pdk.c
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info imx25_pdk_binfo;
-     lines = g_strsplit((char *)vmci, "\n", -1);
+ static void imx25_pdk_init(MachineState *machine)
-     for (i = 0; lines[i]; i++) {
+ {
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
+-    MachineClass *mc = MACHINE_GET_CLASS(machine);
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+     IMX25PDK *s = g_new0(IMX25PDK, 1);
-+        const char *prefix = NULL;
+     unsigned int ram_size;
-+
+     unsigned int alias_offset;
-+        if (s->dump_info.d_machine == EM_X86_64) {
+@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
-+            prefix = "NUMBER(phys_base)=";
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+     /* We need to initialize our memory */
-+            prefix = "NUMBER(PHYS_OFFSET)=";
+     if (machine->ram_size > (FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE)) {
-+        }
+-        char *sz = size_to_str(mc->default_ram_size);
-+
+-        error_report("Invalid RAM size, should be %s", sz);
-+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
++        char *sz = size_to_str(FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE);
-+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
++        error_report("RAM size more than %s is not supported", sz);
-                               &phys_base) < 0) {
+         g_free(sz);
--                warn_report("Failed to read NUMBER(phys_base)=");
+         exit(EXIT_FAILURE);
-+                warn_report("Failed to read %s", prefix);
+     }
              } else {
                  s->dump_info.phys_base = phys_base;
              }
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+[PULL 23/26] hw/misc/mps2-scc: Add "QEMU interface" comment
-For the rpi1 and 2 we want to boot the Linux kernel via some
+The MPS2 SCC device doesn't have any documentation of its properties;
-custom setup code that makes sure that the SMC instruction
+add a "QEMU interface" format comment describing them.
 acts as a no-op, because it's used for cache maintenance.
 The rpi3 boots AArch64 kernels, which don't need SMC for
 cache maintenance and always expect to be booted non-secure.
 Don't fill in the aarch32-specific parts of the binfo struct.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210504120912.23094-2-peter.maydell@linaro.org
 Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 17 +++++++++++++----
+ include/hw/misc/mps2-scc.h | 12 ++++++++++++
-file changed, 13 insertions(+), 4 deletions(-)
+file changed, 12 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/include/hw/misc/mps2-scc.h
-+++ b/hw/arm/raspi.c
++++ b/include/hw/misc/mps2-scc.h
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@
-     binfo.board_id = raspi_boardid[version];
+  *  (at your option) any later version.
-     binfo.ram_size = ram_size;
+  */
-     binfo.nb_cpus = smp_cpus;
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
++/*
--    binfo.write_board_setup = write_board_setup;
++ * This is a model of the Serial Communication Controller (SCC)
--    binfo.secure_board_setup = true;
++ * block found in most MPS FPGA images.
--    binfo.secure_boot = true;
++ *
-+
++ * QEMU interface:
-+    if (version <= 2) {
++ *  + sysbus MMIO region 0: the register bank
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
++ *  + QOM property "scc-cfg4": value of the read-only CFG4 register
-+         * mode before booting a kernel (to set up the SMC vectors so
++ *  + QOM property "scc-aid": value of the read-only SCC_AID register
-+         * that we get a no-op SMC; this is used by Linux to call the
++ *  + QOM property "scc-id": value of the read-only SCC_ID register
-+         * firmware for some cache maintenance operations.
++ *  + QOM property array "oscclk": reset values of the OSCCLK registers
-+         * The rpi3 doesn't need this.
++ *    (which are accessed via the SYS_CFG channel provided by this device)
-+         */
++ */
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+ #ifndef MPS2_SCC_H
-+        binfo.write_board_setup = write_board_setup;
+ #define MPS2_SCC_H
-+        binfo.secure_board_setup = true;
 +        binfo.secure_boot = true;
 +    }
      /* Pi2 and Pi3 requires SMP setup */
      if (version >= 2) {
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 24/26] hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
-Now we have separate types for BCM2386 and BCM2387, we might as well
+On some boards, SCC config register CFG0 bit 0 controls whether
-just hard-code the CPU type they use rather than having it passed
+parts of the board memory map are remapped. Support this with:
-through as an object property. This then lets us put the initialization
+ * a device property scc-cfg0 so the board can specify the
-of the CPU object in init rather than realize.
+   initial value of the CFG0 register
+ * an outbound GPIO line which tracks bit 0 and which the board
-Note that this change means that it's no longer possible on
+   can wire up to provide the remapping
 the command line to use -cpu to ask for a different kind of
 CPU than the SoC supports. This was never a supported thing to
 do anyway; we were just not sanity-checking the command line.
 This does require us to only build the bcm2837 object on
 TARGET_AARCH64 configs, since otherwise it won't instantiate
 due to the missing cortex-a53 device and "make check" will fail.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
+Message-id: 20210504120912.23094-3-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 24 +++++++++++++++---------
+ include/hw/misc/mps2-scc.h |  9 +++++++++
- hw/arm/raspi.c   |  2 --
+ hw/misc/mps2-scc.c         | 13 ++++++++++---
-files changed, 15 insertions(+), 11 deletions(-)
+files changed, 19 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/include/hw/misc/mps2-scc.h
-+++ b/hw/arm/bcm2836.c
++++ b/include/hw/misc/mps2-scc.h
 @@ -XXX,XX +XXX,XX @@
+  *  + QOM property "scc-cfg4": value of the read-only CFG4 register
- struct BCM283XInfo {
+  *  + QOM property "scc-aid": value of the read-only SCC_AID register
-     const char *name;
+  *  + QOM property "scc-id": value of the read-only SCC_ID register
-+    const char *cpu_type;
++ *  + QOM property "scc-cfg0": reset value of the CFG0 register
-     int clusterid;
+  *  + QOM property array "oscclk": reset values of the OSCCLK registers
   *    (which are accessed via the SYS_CFG channel provided by this device)
 + *  + named GPIO output "remap": this tracks the value of CFG0 register
 + *    bit 0. Boards where this bit controls memory remapping should
 + *    connect this GPIO line to a function performing that mapping.
 + *    Boards where bit 0 has no special function should leave the GPIO
 + *    output disconnected.
   */
  #ifndef MPS2_SCC_H
  #define MPS2_SCC_H
@@ -XXX,XX +XXX,XX @@ struct MPS2SCC {
      uint32_t num_oscclk;
      uint32_t *oscclk;
      uint32_t *oscclk_reset;
 +    uint32_t cfg0_reset;
 +
 +    qemu_irq remap;
  };
- static const BCM283XInfo bcm283x_socs[] = {
+ #endif
-     {
+diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
-         .name = TYPE_BCM2836,
+index XXXXXXX..XXXXXXX 100644
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
+--- a/hw/misc/mps2-scc.c
-         .clusterid = 0xf,
++++ b/hw/misc/mps2-scc.c
-     },
+@@ -XXX,XX +XXX,XX @@
-+#ifdef TARGET_AARCH64
+ #include "qemu/bitops.h"
-     {
+ #include "trace.h"
-         .name = TYPE_BCM2837,
+ #include "hw/sysbus.h"
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
++#include "hw/irq.h"
-         .clusterid = 0x0,
+ #include "migration/vmstate.h"
-     },
+ #include "hw/registerfields.h"
-+#endif
+ #include "hw/misc/mps2-scc.h"
- };
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
+     switch (offset) {
- static void bcm2836_init(Object *obj)
+     case A_CFG0:
- {
+         /*
-     BCM283XState *s = BCM283X(obj);
+-         * TODO on some boards bit 0 controls RAM remapping;
-+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+-         * on others bit 1 is CPU_WAIT.
-+    const BCM283XInfo *info = bc->info;
++         * On some boards bit 0 controls board-specific remapping;
-+    int n;
++         * we always reflect bit 0 in the 'remap' GPIO output line,
-+
++         * and let the board wire it up or not as it chooses.
-+    for (n = 0; n < BCM283X_NCPUS; n++) {
++         * TODO on some boards bit 1 is CPU_WAIT.
-+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+          */
-+                          info->cpu_type);
+         s->cfg0 = value;
-+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
++        qemu_set_irq(s->remap, s->cfg0 & 1);
-+                                  &error_abort);
+         break;
-+    }
+     case A_CFG1:
+         s->cfg1 = value;
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_reset(DeviceState *dev)
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
+     int i;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+     trace_mps2_scc_reset();
-     /* common peripherals from bcm2835 */
+-    s->cfg0 = 0;
++    s->cfg0 = s->cfg0_reset;
--    obj = OBJECT(dev);
+     s->cfg1 = 0;
--    for (n = 0; n < BCM283X_NCPUS; n++) {
+     s->cfg2 = 0;
--        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+     s->cfg5 = 0;
--                          s->cpu_type);
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_init(Object *obj)
--        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
--                                  &error_abort);
+     memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
--    }
+     sysbus_init_mmio(sbd, &s->iomem);
--
++    qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1);
      obj = object_property_get_link(OBJECT(dev), "ram", &err);
      if (obj == NULL) {
          error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
- static Property bcm2836_props[] = {
+ static void mps2_scc_realize(DeviceState *dev, Error **errp)
--    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
-     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+     DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
-                        BCM283X_NCPUS),
+     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
-     DEFINE_PROP_END_OF_LIST()
+     DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
++    /* Reset value for CFG0 register */
-index XXXXXXX..XXXXXXX 100644
++    DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0),
---- a/hw/arm/raspi.c
+     /*
-+++ b/hw/arm/raspi.c
+      * These are the initial settings for the source clocks on the board.
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+      * In hardware they can be configured via a config file read by the
      /* Setup the SOC */
      object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                     &error_abort);
 -    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
 -                            &error_abort);
      object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                              &error_abort);
      int board_rev = version == 3 ? 0xa02082 : 0xa21041;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 25/26] hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+The AN524 FPGA image supports two memory maps, which differ in where
-CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
+the QSPI and BRAM are.  In the default map, the BRAM is at
-is required for Linux to boot.
+x0000_0000, and the QSPI at 0x2800_0000.  In the second map, they
 are the other way around.
 In hardware, the initial mapping can be selected by the user by
 writing either "REMAP: BRAM" (the default) or "REMAP: QSPI" in the
 board configuration file.  The board config file is acted on by the
 "Motherboard Configuration Controller", which is an entirely separate
 microcontroller on the dev board but outside the FPGA.
 The guest can also dynamically change the mapping via the SCC
 CFG_REG0 register.
 Implement this functionality for QEMU, using a machine property
 "remap" with valid values "BRAM" and "QSPI" to allow the user to set
 the initial mapping, in the same way they can on the FPGA, and
 wiring up the bit from the SCC register to also switch the mapping.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
+Message-id: 20210504120912.23094-4-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ docs/system/arm/mps2.rst |  10 ++++
-file changed, 7 insertions(+), 4 deletions(-)
+ hw/arm/mps2-tz.c         | 108 ++++++++++++++++++++++++++++++++++++++-
+files changed, 117 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/docs/system/arm/mps2.rst
-+++ b/hw/arm/bcm2836.c
++++ b/docs/system/arm/mps2.rst
@@ -XXX,XX +XXX,XX @@ Differences between QEMU and real hardware:
    flash, but only as simple ROM, so attempting to rewrite the flash
    from the guest will fail
  - QEMU does not model the USB controller in MPS3 boards
 +
 +Machine-specific options
 +""""""""""""""""""""""""
 +
 +The following machine-specific options are supported:
 +
 +remap
 +  Supported for ``mps3-an524`` only.
 +  Set ``BRAM``/``QSPI`` to select the initial memory mapping. The
 +  default is ``BRAM``.
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
 @@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
- struct BCM283XInfo {
+ #include "exec/address-spaces.h"
-     const char *name;
+ #include "sysemu/sysemu.h"
-+    int clusterid;
++#include "sysemu/reset.h"
  #include "hw/misc/unimp.h"
  #include "hw/char/cmsdk-apb-uart.h"
  #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/core/split-irq.h"
  #include "hw/qdev-clock.h"
  #include "qom/object.h"
 +#include "hw/irq.h"
  #define MPS2TZ_NUMIRQ_MAX 96
  #define MPS2TZ_RAM_MAX 5
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
      SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
      Clock *sysclk;
      Clock *s32kclk;
 +
 +    bool remap;
 +    qemu_irq remap_irq;
  };
- static const BCM283XInfo bcm283x_socs[] = {
+ #define TYPE_MPS2TZ_MACHINE "mps2tz"
-     {
+@@ -XXX,XX +XXX,XX @@ static const RAMInfo an505_raminfo[] = { {
          .name = TYPE_BCM2836,
 +        .clusterid = 0xf,
      },
      {
          .name = TYPE_BCM2837,
 +        .clusterid = 0x0,
      },
  };
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
++/*
- static void bcm2836_realize(DeviceState *dev, Error **errp)
++ * Note that the addresses and MPC numbering here should match up
 + * with those used in remap_memory(), which can swap the BRAM and QSPI.
 + */
  static const RAMInfo an524_raminfo[] = { {
          .name = "bram",
          .base = 0x00000000,
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
      object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
      sccdev = DEVICE(scc);
 +    qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
      qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
      qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
      qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
      return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
  }
 +static hwaddr boot_mem_base(MPS2TZMachineState *mms)
 +{
 +    /*
 +     * Return the canonical address of the block which will be mapped
 +     * at address 0x0 (i.e. where the vector table is).
 +     * This is usually 0, but if the AN524 alternate memory map is
 +     * enabled it will be the base address of the QSPI block.
 +     */
 +    return mms->remap ? 0x28000000 : 0;
 +}
 +
 +static void remap_memory(MPS2TZMachineState *mms, int map)
 +{
 +    /*
 +     * Remap the memory for the AN524. 'map' is the value of
 +     * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
 +     * for the "option 1" mapping where QSPI is at address 0.
 +     *
 +     * Effectively we need to swap around the "upstream" ends of
 +     * MPC 0 and MPC 1.
 +     */
 +    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 +    int i;
 +
 +    if (mmc->fpga_type != FPGA_AN524) {
 +        return;
 +    }
 +
 +    memory_region_transaction_begin();
 +    for (i = 0; i < 2; i++) {
 +        TZMPC *mpc = &mms->mpc[i];
 +        MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
 +        hwaddr addr = (i ^ map) ? 0x28000000 : 0;
 +
 +        memory_region_set_address(upstream, addr);
 +    }
 +    memory_region_transaction_commit();
 +}
 +
 +static void remap_irq_fn(void *opaque, int n, int level)
 +{
 +    MPS2TZMachineState *mms = opaque;
 +
 +    remap_memory(mms, level);
 +}
 +
  static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                                const char *name, hwaddr size,
                                const int *irqs)
@@ -XXX,XX +XXX,XX @@ static uint32_t boot_ram_size(MPS2TZMachineState *mms)
      MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
      for (p = mmc->raminfo; p->name; p++) {
 -        if (p->base == 0) {
 +        if (p->base == boot_mem_base(mms)) {
              return p->size;
          }
      }
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
      create_non_mpc_ram(mms);
 +    if (mmc->fpga_type == FPGA_AN524) {
 +        /*
 +         * Connect the line from the SCC so that we can remap when the
 +         * guest updates that register.
 +         */
 +        mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
 +        qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
 +                                    mms->remap_irq);
 +    }
 +
      armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
                         boot_ram_size(mms));
  }
@@ -XXX,XX +XXX,XX @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
      *iregion = region;
  }
 +static char *mps2_get_remap(Object *obj, Error **errp)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
 +    const char *val = mms->remap ? "QSPI" : "BRAM";
 +    return g_strdup(val);
 +}
 +
 +static void mps2_set_remap(Object *obj, const char *value, Error **errp)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
 +
 +    if (!strcmp(value, "BRAM")) {
 +        mms->remap = false;
 +    } else if (!strcmp(value, "QSPI")) {
 +        mms->remap = true;
 +    } else {
 +        error_setg(errp, "Invalid remap value");
 +        error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
 +    }
 +}
 +
 +static void mps2_machine_reset(MachineState *machine)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 +
 +    /*
 +     * Set the initial memory mapping before triggering the reset of
 +     * the rest of the system, so that the guest image loader and CPU
 +     * reset see the correct mapping.
 +     */
 +    remap_memory(mms, mms->remap);
 +    qemu_devices_reset();
 +}
 +
  static void mps2tz_class_init(ObjectClass *oc, void *data)
  {
-     BCM283XState *s = BCM283X(dev);
+     MachineClass *mc = MACHINE_CLASS(oc);
-+    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
+     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
-+    const BCM283XInfo *info = bc->info;
-     Object *obj;
+     mc->init = mps2tz_common_init;
-     Error *err = NULL;
++    mc->reset = mps2_machine_reset;
-     int n;
+     iic->check = mps2_tz_idau_check;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+ }
-         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
+@@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
-     for (n = 0; n < BCM283X_NCPUS; n++) {
+     mmc->raminfo = an524_raminfo;
--        /* Mirror bcm2836, which has clusterid set to 0xf
+     mmc->armsse_type = TYPE_SSE200;
--         * TODO: this should be converted to a property of ARM_CPU
+     mps2tz_set_default_ram_info(mmc);
--         */
++
--        s->cpus[n].mp_affinity = 0xF00 | n;
++    object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
-+        /* TODO: this should be converted to a property of ARM_CPU */
++    object_class_property_set_description(oc, "remap",
-+        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
++                                          "Set memory mapping. Valid values "
++                                          "are BRAM (default) and QSPI.");
-         /* set periphbase/CBAR value for CPU-local registers */
+ }
-         object_property_set_int(OBJECT(&s->cpus[n]),
  static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 26/26] hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
 From: Guenter Roeck <linux@roeck-us.net>
-The sabrelite machine model used by qemu-system-arm is based on the
+Commit dfc388797cc4 ("hw/arm: xlnx: Set all boards' GEM 'phy-addr'
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+property value to 23") configured the PHY address for xilinx-zynq-a9
-controller which is supported in QEMU using the imx_fec.c module
+to 23. When trying to boot xilinx-zynq-a9 with zynq-zc702.dtb or
-(actually called imx.enet for this model.)
+zynq-zc706.dtb, this results in the following error message when
 trying to use the Ethernet interface.
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
+macb e000b000.ethernet eth0: Could not attach PHY (-19)
 imx.enet device like this:
- #define FSL_IMX6_ENET_MAC_1588_IRQ 118
+The devicetree files for ZC702 and ZC706 configure PHY address 7. The
- #define FSL_IMX6_ENET_MAC_IRQ 119
+documentation for the ZC702 and ZC706 evaluation boards suggest that the
 PHY address is 7, not 23. Other boards use PHY address 0, 1, 3, or 7.
 I was unable to find a documentation or a devicetree file suggesting
 or using PHY address 23. The Ethernet interface starts working with
 zynq-zc702.dtb and zynq-zc706.dtb when setting the PHY address to 7,
 so let's use it.
-According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
+Cc: Bin Meng <bin.meng@windriver.com>
 page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
 interrupts are as follows.
 ENET MAC 0 IRQ
 ENET MAC 0 1588 Timer interrupt
 where
 - 32 == 118
 - 32 == 119
 In other words, the vector definitions in the fsl-imx6.h file are reversed.
 Fixing the interrupts alone causes problems with older Linux kernels:
 The Ethernet interface will fail to probe with Linux v4.9 and earlier.
 Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
 error handling. This is a Linux kernel problem, not a qemu problem:
 the Linux kernel only worked by accident since it requested both interrupts.
 For backward compatibility, generate the Ethernet interrupt on both interrupt
 lines. This was shown to work from all Linux kernel releases starting with
 v3.16.
 Link: https://bugs.launchpad.net/qemu/+bug/1753309
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20210504124140.1100346-1-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ hw/arm/xilinx_zynq.c | 2 +-
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 29 insertions(+), 3 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/hw/arm/xilinx_zynq.c
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/hw/arm/xilinx_zynq.c
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+         qdev_set_nic_properties(dev, nd);
- #define FSL_IMX6_MLB150_LOW_IRQ 117
+     }
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
+-    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
--#define FSL_IMX6_ENET_MAC_IRQ 119
++    object_property_set_int(OBJECT(dev), "phy-addr", 7, &error_abort);
-+#define FSL_IMX6_ENET_MAC_IRQ 118
+     s = SYS_BUS_DEVICE(dev);
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
+     sysbus_realize_and_unref(s, &error_fatal);
- #define FSL_IMX6_PCIE1_IRQ 120
+     sysbus_mmio_map(s, 0, base);
  #define FSL_IMX6_PCIE2_IRQ 121
  #define FSL_IMX6_PCIE3_IRQ 122
 diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/imx_fec.c
 +++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
  static void imx_eth_update(IMXFECState *s)
  {
 -    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
 +    /*
 +     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
 +     * interrupts swapped. This worked with older versions of Linux (4.14
 +     * and older) since Linux associated both interrupt lines with Ethernet
 +     * MAC interrupts. Specifically,
 +     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
 +     *   timer interrupts. Those versions of Linux fail with versions of QEMU
 +     *   with swapped interrupt assignments.
 +     * - In linux 4.14, both interrupt lines were registered with the Ethernet
 +     *   MAC interrupt handler. As a result, all versions of qemu happen to
 +     *   work, though that is accidental.
 +     * - In Linux 4.9 and older, the timer interrupt was registered directly
 +     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
 +     *   redirected to a GPIO interrupt to work around erratum ERR006687.
 +     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
 +     *   interrupt never fired since IOMUX is currently not supported in qemu.
 +     *   Linux instead received MAC interrupts on the timer interrupt.
 +     *   As a result, qemu versions with the swapped interrupt assignment work,
 +     *   albeit accidentally, but qemu versions with the correct interrupt
 +     *   assignment fail.
 +     *
 +     * To ensure that all versions of Linux work, generate ENET_INT_MAC
 +     * interrrupts on both interrupt lines. This should be changed if and when
 +     * qemu supports IOMUX.
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.20.1

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

The following changes since commit 4cc10cae64c51e17844dc4358481c393d7bf1ed4:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-05-06 18:56:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210510

for you to fetch changes up to 8f96812baa53005f32aece3e30b140826c20aa19:

hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 (2021-05-10 13:24:09 +0100)

----------------------------------------------------------------
target-arm queue:
 * docs: fix link in sbsa description
 * linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
 * target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
 * target/arm: Split neon and vfp translation to their own
   compilation units
 * target/arm: Make WFI a NOP for userspace emulators
 * hw/sd/omap_mmc: Use device_cold_reset() instead of
   device_legacy_reset()
 * include: More fixes for 'extern "C"' block use
 * hw/arm/imx25_pdk: Fix error message for invalid RAM size
 * hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
 * hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9

----------------------------------------------------------------
Alex Bennée (1):
      docs: fix link in sbsa description

Guenter Roeck (1):
      hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9

Peter Maydell (22):
      target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
      target/arm: Move constant expanders to translate.h
      target/arm: Share unallocated_encoding() and gen_exception_insn()
      target/arm: Make functions used by m-nocp global
      target/arm: Split m-nocp trans functions into their own file
      target/arm: Move gen_aa32 functions to translate-a32.h
      target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
      target/arm: Make functions used by translate-vfp global
      target/arm: Make translate-vfp.c.inc its own compilation unit
      target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
      target/arm: Delete unused typedef
      target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
      target/arm: Make functions used by translate-neon global
      target/arm: Make translate-neon.c.inc its own compilation unit
      target/arm: Make WFI a NOP for userspace emulators
      hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
      osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
      include/qemu/bswap.h: Handle being included outside extern "C" block
      include/disas/dis-asm.h: Handle being included outside 'extern "C"'
      hw/misc/mps2-scc: Add "QEMU interface" comment
      hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
      hw/arm/mps2-tz: Implement AN524 memory remapping via machine property

Philippe Mathieu-Daudé (1):
      hw/arm/imx25_pdk: Fix error message for invalid RAM size

Richard Henderson (1):
      linux-user/aarch64: Enable hwcap for RND, BTI, and MTE

docs/system/arm/mps2.rst                           |  10 +
 docs/system/arm/sbsa.rst                           |   2 +-
 include/disas/dis-asm.h                            |  12 +-
 include/hw/misc/mps2-scc.h                         |  21 ++
 include/qemu/bswap.h                               |  26 ++-
 include/qemu/osdep.h                               |   8 +-
 include/sysemu/os-posix.h                          |   8 +
 include/sysemu/os-win32.h                          |   8 +
 target/arm/translate-a32.h                         | 144 +++++++++++++
 target/arm/translate-a64.h                         |   2 -
 target/arm/translate.h                             |  29 +++
 hw/arm/imx25_pdk.c                                 |   5 +-
 hw/arm/mps2-tz.c                                   | 108 +++++++++-
 hw/arm/xilinx_zynq.c                               |   2 +-
 hw/misc/mps2-scc.c                                 |  13 +-
 hw/sd/omap_mmc.c                                   |   2 +-
 linux-user/elfload.c                               |  13 ++
 target/arm/helper.c                                |   2 +-
 target/arm/op_helper.c                             |  12 ++
 target/arm/translate-a64.c                         |  15 --
 target/arm/translate-m-nocp.c                      | 221 ++++++++++++++++++++
 .../arm/{translate-neon.c.inc => translate-neon.c} |  19 +-
 .../arm/{translate-vfp.c.inc => translate-vfp.c}   | 230 +++------------------
 target/arm/translate.c                             | 200 ++++--------------
 disas/arm-a64.cc                                   |   2 -
 disas/nanomips.cpp                                 |   2 -
 target/arm/meson.build                             |  15 +-
 27 files changed, 718 insertions(+), 413 deletions(-)
 create mode 100644 target/arm/translate-a32.h
 create mode 100644 target/arm/translate-m-nocp.c
 rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
 rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (94%)

From: Alex Bennée <alex.bennee@linaro.org>

A trailing _ makes all the difference to the rendered link.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20210428131316.31390-1-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@ Arm Server Base System Architecture Reference board (``sbsa-ref``)
 While the `virt` board is a generic board platform that doesn't match
 any real hardware the `sbsa-ref` board intends to look like real
 hardware. The `Server Base System Architecture
-<https://developer.arm.com/documentation/den0029/latest>` defines a
+<https://developer.arm.com/documentation/den0029/latest>`_ defines a
 minimum base line of hardware support and importantly how the firmware
 reports that to any operating system. It is a static system that
 reports a very minimal DT to the firmware for non-discoverable
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

These three features are already enabled by TCG, but are missing
their hwcap bits.  Update HWCAP2 from linux v5.12.

Cc: qemu-stable@nongnu.org (for 6.0.1)
Buglink: https://bugs.launchpad.net/bugs/1926044
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210427214108.88503-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/elfload.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
     ARM_HWCAP2_A64_FRINT        = 1 << 8,
+    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
+    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
+    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
+    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
+    ARM_HWCAP2_A64_I8MM         = 1 << 13,
+    ARM_HWCAP2_A64_BF16         = 1 << 14,
+    ARM_HWCAP2_A64_DGH          = 1 << 15,
+    ARM_HWCAP2_A64_RNG          = 1 << 16,
+    ARM_HWCAP2_A64_BTI          = 1 << 17,
+    ARM_HWCAP2_A64_MTE          = 1 << 18,
 };
 
 #define ELF_HWCAP   get_elf_hwcap()
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap2(void)
     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
+    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
+    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
+    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
 
     return hwcaps;
 }
-- 
2.20.1

In tlbi_aa64_vae2is_write() the calculation
  bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
                            pageaddr)

has the two arms of the ?: expression reversed. Fix the bug.

Fixes: b6ad6062f1e5
Reported-by: Rebecca Cran <rebecca@nuviainc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Rebecca Cran <rebecca@nuviainc.com>
Message-id: 20210420123106.10861-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
     bool secure = arm_is_secure_below_el3(env);
     int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
-    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
+    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
                                   pageaddr);
 
     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
-- 
2.20.1

Some of the constant expanders defined in translate.c are generically
useful and will be used by the separate C files for VFP and Neon once
they are created; move the expander definitions to translate.h.

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
 extern TCGv_i64 cpu_exclusive_addr;
 extern TCGv_i64 cpu_exclusive_val;
 
+/*
+ * Constant expanders for the decoders.
+ */
+
+static inline int negate(DisasContext *s, int x)
+{
+    return -x;
+}
+
+static inline int plus_2(DisasContext *s, int x)
+{
+    return x + 2;
+}
+
+static inline int times_2(DisasContext *s, int x)
+{
+    return x * 2;
+}
+
+static inline int times_4(DisasContext *s, int x)
+{
+    return x * 4;
+}
+
 static inline int arm_dc_feature(DisasContext *dc, int feature)
 {
     return (dc->features & (1ULL << feature)) != 0;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
     }
 }
 
-/*
- * Constant expanders for the decoders.
- */
-
-static int negate(DisasContext *s, int x)
-{
-    return -x;
-}
-
-static int plus_2(DisasContext *s, int x)
-{
-    return x + 2;
-}
-
-static int times_2(DisasContext *s, int x)
-{
-    return x * 2;
-}
-
-static int times_4(DisasContext *s, int x)
-{
-    return x * 4;
-}
-
 /* Flags for the disas_set_da_iss info argument:
  * lower bits hold the Rt register number, higher bits are flags.
  */
-- 
2.20.1

The unallocated_encoding() function is the same in both
translate-a64.c and translate.c; make the translate.c function global
and drop the translate-a64.c version.  To do this we need to also
share gen_exception_insn(), which currently exists in two slightly
different versions for A32 and A64: merge those into a single
function that can work for both.

This will be useful for splitting up translate.c, which will require
unallocated_encoding() to no longer be file-local.  It's also
hopefully less confusing to have only one version of the function
rather than two.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-3-peter.maydell@linaro.org
---
 target/arm/translate-a64.h |  2 --
 target/arm/translate.h     |  3 +++
 target/arm/translate-a64.c | 15 ---------------
 target/arm/translate.c     | 14 +++++++++-----
 4 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_TRANSLATE_A64_H
 #define TARGET_ARM_TRANSLATE_A64_H
 
-void unallocated_encoding(DisasContext *s);
-
 #define unsupported_encoding(s, insn)                                    \
     do {                                                                 \
         qemu_log_mask(LOG_UNIMP,                                         \
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void arm_free_cc(DisasCompare *cmp);
 void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
+void unallocated_encoding(DisasContext *s);
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                               uint32_t syndrome, uint32_t target_el)
-{
-    gen_a64_set_pc_im(pc);
-    gen_exception(excp, syndrome, target_el);
-    s->base.is_jmp = DISAS_NORETURN;
-}
-
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
 {
     TCGv_i32 tcg_syn;
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
     }
 }
 
-void unallocated_encoding(DisasContext *s)
-{
-    /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
-}
-
 static void init_tmp_a64_array(DisasContext *s)
 {
 #ifdef CONFIG_DEBUG_TCG
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
-                               int syn, uint32_t target_el)
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el)
 {
-    gen_set_condexec(s);
-    gen_set_pc_im(s, pc);
+    if (s->aarch64) {
+        gen_a64_set_pc_im(pc);
+    } else {
+        gen_set_condexec(s);
+        gen_set_pc_im(s, pc);
+    }
     gen_exception(excp, syn, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void unallocated_encoding(DisasContext *s)
+void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
     gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-- 
2.20.1

We want to split out the .c.inc files which are currently included
into translate.c so they are separate compilation units.  To do this
we need to make some functions which are currently file-local to
translate.c have global scope; create a translate-a32.h paralleling
the existing translate-a64.h as a place for these declarations to
live, so that code moved into the new compilation units can call
them.

The functions made global here are those required by the
m-nocp.decode functions, except that I have converted the whole
family of {read,write}_neon_element* and also both the load_cpu and
store_cpu functions for consistency, even though m-nocp only wants a
few functions from each.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-4-peter.maydell@linaro.org
---
 target/arm/translate-a32.h     | 57 ++++++++++++++++++++++++++++++++++
 target/arm/translate.c         | 39 +++++------------------
 target/arm/translate-vfp.c.inc |  2 +-
 3 files changed, 65 insertions(+), 33 deletions(-)
 create mode 100644 target/arm/translate-a32.h

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  AArch32 translation, common definitions.
+ *
+ * Copyright (c) 2021 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_ARM_TRANSLATE_A64_H
+#define TARGET_ARM_TRANSLATE_A64_H
+
+void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
+void arm_gen_condlabel(DisasContext *s);
+bool vfp_access_check(DisasContext *s);
+void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
+void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
+void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
+void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
+
+static inline TCGv_i32 load_cpu_offset(int offset)
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_ld_i32(tmp, cpu_env, offset);
+    return tmp;
+}
+
+#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
+
+static inline void store_cpu_offset(TCGv_i32 var, int offset)
+{
+    tcg_gen_st_i32(var, cpu_env, offset);
+    tcg_temp_free_i32(var);
+}
+
+#define store_cpu_field(var, name) \
+    store_cpu_offset(var, offsetof(CPUARMState, name))
+
+/* Create a new temporary and set it to the value of a CPU register.  */
+static inline TCGv_i32 load_reg(DisasContext *s, int reg)
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    load_reg_var(s, tmp, reg);
+    return tmp;
+}
+
+#endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
 
 #include "translate.h"
+#include "translate-a32.h"
 
 #if defined(CONFIG_USER_ONLY)
 #define IS_USER(s) 1
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
 }
 
 /* Generate a label used for skipping this instruction */
-static void arm_gen_condlabel(DisasContext *s)
+void arm_gen_condlabel(DisasContext *s)
 {
     if (!s->condjmp) {
         s->condlabel = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
     }
 }
 
-static inline TCGv_i32 load_cpu_offset(int offset)
-{
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    tcg_gen_ld_i32(tmp, cpu_env, offset);
-    return tmp;
-}
-
-#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
-
-static inline void store_cpu_offset(TCGv_i32 var, int offset)
-{
-    tcg_gen_st_i32(var, cpu_env, offset);
-    tcg_temp_free_i32(var);
-}
-
-#define store_cpu_field(var, name) \
-    store_cpu_offset(var, offsetof(CPUARMState, name))
-
 /* The architectural value of PC.  */
 static uint32_t read_pc(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t read_pc(DisasContext *s)
 }
 
 /* Set a variable to the value of a CPU register.  */
-static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
+void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 {
     if (reg == 15) {
         tcg_gen_movi_i32(var, read_pc(s));
@@ -XXX,XX +XXX,XX @@ static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
     }
 }
 
-/* Create a new temporary and set it to the value of a CPU register.  */
-static inline TCGv_i32 load_reg(DisasContext *s, int reg)
-{
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    load_reg_var(s, tmp, reg);
-    return tmp;
-}
-
 /*
  * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
  * This is used for load/store for which use of PC implies (literal),
@@ -XXX,XX +XXX,XX @@ static inline void vfp_store_reg32(TCGv_i32 var, int reg)
     tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
 }
 
-static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
+void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
     }
 }
 
-static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
+void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
     }
 }
 
-static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
+void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
     }
 }
 
-static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
+void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
  * The most usual kind of VFP access check, for everything except
  * FMXR/FMRX to the always-available special registers.
  */
-static bool vfp_access_check(DisasContext *s)
+bool vfp_access_check(DisasContext *s)
 {
     return full_vfp_access_check(s, false);
 }
-- 
2.20.1

Currently the trans functions for m-nocp.decode all live in
translate-vfp.inc.c; move them out into their own translation unit,
translate-m-nocp.c.

The trans_* functions here are pure code motion with no changes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-5-peter.maydell@linaro.org
---
 target/arm/translate-a32.h     |   3 +
 target/arm/translate-m-nocp.c  | 221 +++++++++++++++++++++++++++++++++
 target/arm/translate.c         |   1 -
 target/arm/translate-vfp.c.inc | 196 -----------------------------
 target/arm/meson.build         |   3 +-
 5 files changed, 226 insertions(+), 198 deletions(-)
 create mode 100644 target/arm/translate-m-nocp.c

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_TRANSLATE_A64_H
 #define TARGET_ARM_TRANSLATE_A64_H
 
+/* Prototypes for autogenerated disassembler functions */
+bool disas_m_nocp(DisasContext *dc, uint32_t insn);
+
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
 bool vfp_access_check(DisasContext *s);
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ARM translation: M-profile NOCP special-case instructions
+ *
+ *  Copyright (c) 2020 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "translate.h"
+#include "translate-a32.h"
+
+#include "decode-m-nocp.c.inc"
+
+/*
+ * Decode VLLDM and VLSTM are nonstandard because:
+ *  * if there is no FPU then these insns must NOP in
+ *    Secure state and UNDEF in Nonsecure state
+ *  * if there is an FPU then these insns do not have
+ *    the usual behaviour that vfp_access_check() provides of
+ *    being controlled by CPACR/NSACR enable bits or the
+ *    lazy-stacking logic.
+ */
+static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+{
+    TCGv_i32 fptr;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+        return false;
+    }
+
+    if (a->op) {
+        /*
+         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
+         * to take the IMPDEF option to make memory accesses to the stack
+         * slots that correspond to the D16-D31 registers (discarding
+         * read data and writing UNKNOWN values), so for us the T2
+         * encoding behaves identically to the T1 encoding.
+         */
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+    } else {
+        /*
+         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
+         * This is currently architecturally impossible, but we add the
+         * check to stay in line with the pseudocode. Note that we must
+         * emit code for the UNDEF so it takes precedence over the NOCP.
+         */
+        if (dc_isar_feature(aa32_simd_r32, s)) {
+            unallocated_encoding(s);
+            return true;
+        }
+    }
+
+    /*
+     * If not secure, UNDEF. We must emit code for this
+     * rather than returning false so that this takes
+     * precedence over the m-nocp.decode NOCP fallback.
+     */
+    if (!s->v8m_secure) {
+        unallocated_encoding(s);
+        return true;
+    }
+    /* If no fpu, NOP. */
+    if (!dc_isar_feature(aa32_vfp, s)) {
+        return true;
+    }
+
+    fptr = load_reg(s, a->rn);
+    if (a->l) {
+        gen_helper_v7m_vlldm(cpu_env, fptr);
+    } else {
+        gen_helper_v7m_vlstm(cpu_env, fptr);
+    }
+    tcg_temp_free_i32(fptr);
+
+    /* End the TB, because we have updated FP control bits */
+    s->base.is_jmp = DISAS_UPDATE_EXIT;
+    return true;
+}
+
+static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+{
+    int btmreg, topreg;
+    TCGv_i64 zero;
+    TCGv_i32 aspen, sfpa;
+
+    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+        /* Before v8.1M, fall through in decode to NOCP check */
+        return false;
+    }
+
+    /* Explicitly UNDEF because this takes precedence over NOCP */
+    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
+        unallocated_encoding(s);
+        return true;
+    }
+
+    if (!dc_isar_feature(aa32_vfp_simd, s)) {
+        /* NOP if we have neither FP nor MVE */
+        return true;
+    }
+
+    /*
+     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
+     * active floating point context so we must NOP (without doing
+     * any lazy state preservation or the NOCP check).
+     */
+    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
+    sfpa = load_cpu_field(v7m.control[M_REG_S]);
+    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
+    tcg_gen_or_i32(sfpa, sfpa, aspen);
+    arm_gen_condlabel(s);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+
+    if (s->fp_excp_el != 0) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), s->fp_excp_el);
+        return true;
+    }
+
+    topreg = a->vd + a->imm - 1;
+    btmreg = a->vd;
+
+    /* Convert to Sreg numbers if the insn specified in Dregs */
+    if (a->size == 3) {
+        topreg = topreg * 2 + 1;
+        btmreg *= 2;
+    }
+
+    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
+        /* UNPREDICTABLE: we choose to undef */
+        unallocated_encoding(s);
+        return true;
+    }
+
+    /* Silently ignore requests to clear D16-D31 if they don't exist */
+    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
+        topreg = 31;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    /* Zero the Sregs from btmreg to topreg inclusive. */
+    zero = tcg_const_i64(0);
+    if (btmreg & 1) {
+        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
+        btmreg++;
+    }
+    for (; btmreg + 1 <= topreg; btmreg += 2) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
+    }
+    if (btmreg == topreg) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
+        btmreg++;
+    }
+    assert(btmreg == topreg + 1);
+    /* TODO: when MVE is implemented, zero VPR here */
+    return true;
+}
+
+static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+{
+    /*
+     * Handle M-profile early check for disabled coprocessor:
+     * all we need to do here is emit the NOCP exception if
+     * the coprocessor is disabled. Otherwise we return false
+     * and the real VFP/etc decode will handle the insn.
+     */
+    assert(arm_dc_feature(s, ARM_FEATURE_M));
+
+    if (a->cp == 11) {
+        a->cp = 10;
+    }
+    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
+        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
+        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
+        a->cp = 10;
+    }
+
+    if (a->cp != 10) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), default_exception_el(s));
+        return true;
+    }
+
+    if (s->fp_excp_el != 0) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), s->fp_excp_el);
+        return true;
+    }
+
+    return false;
+}
+
+static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
+{
+    /* This range needs a coprocessor check for v8.1M and later only */
+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+        return false;
+    }
+    return trans_NOCP(s, a);
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP and Neon decoders */
-#include "decode-m-nocp.c.inc"
 #include "translate-vfp.c.inc"
 #include "translate-neon.c.inc"
 
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     return true;
 }
 
-/*
- * Decode VLLDM and VLSTM are nonstandard because:
- *  * if there is no FPU then these insns must NOP in
- *    Secure state and UNDEF in Nonsecure state
- *  * if there is an FPU then these insns do not have
- *    the usual behaviour that vfp_access_check() provides of
- *    being controlled by CPACR/NSACR enable bits or the
- *    lazy-stacking logic.
- */
-static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
-{
-    TCGv_i32 fptr;
-
-    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
-        !arm_dc_feature(s, ARM_FEATURE_V8)) {
-        return false;
-    }
-
-    if (a->op) {
-        /*
-         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
-         * to take the IMPDEF option to make memory accesses to the stack
-         * slots that correspond to the D16-D31 registers (discarding
-         * read data and writing UNKNOWN values), so for us the T2
-         * encoding behaves identically to the T1 encoding.
-         */
-        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
-            return false;
-        }
-    } else {
-        /*
-         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
-         * This is currently architecturally impossible, but we add the
-         * check to stay in line with the pseudocode. Note that we must
-         * emit code for the UNDEF so it takes precedence over the NOCP.
-         */
-        if (dc_isar_feature(aa32_simd_r32, s)) {
-            unallocated_encoding(s);
-            return true;
-        }
-    }
-
-    /*
-     * If not secure, UNDEF. We must emit code for this
-     * rather than returning false so that this takes
-     * precedence over the m-nocp.decode NOCP fallback.
-     */
-    if (!s->v8m_secure) {
-        unallocated_encoding(s);
-        return true;
-    }
-    /* If no fpu, NOP. */
-    if (!dc_isar_feature(aa32_vfp, s)) {
-        return true;
-    }
-
-    fptr = load_reg(s, a->rn);
-    if (a->l) {
-        gen_helper_v7m_vlldm(cpu_env, fptr);
-    } else {
-        gen_helper_v7m_vlstm(cpu_env, fptr);
-    }
-    tcg_temp_free_i32(fptr);
-
-    /* End the TB, because we have updated FP control bits */
-    s->base.is_jmp = DISAS_UPDATE_EXIT;
-    return true;
-}
-
-static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
-{
-    int btmreg, topreg;
-    TCGv_i64 zero;
-    TCGv_i32 aspen, sfpa;
-
-    if (!dc_isar_feature(aa32_m_sec_state, s)) {
-        /* Before v8.1M, fall through in decode to NOCP check */
-        return false;
-    }
-
-    /* Explicitly UNDEF because this takes precedence over NOCP */
-    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
-        unallocated_encoding(s);
-        return true;
-    }
-
-    if (!dc_isar_feature(aa32_vfp_simd, s)) {
-        /* NOP if we have neither FP nor MVE */
-        return true;
-    }
-
-    /*
-     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
-     * active floating point context so we must NOP (without doing
-     * any lazy state preservation or the NOCP check).
-     */
-    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
-    sfpa = load_cpu_field(v7m.control[M_REG_S]);
-    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
-    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
-    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
-    tcg_gen_or_i32(sfpa, sfpa, aspen);
-    arm_gen_condlabel(s);
-    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
-
-    if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
-        return true;
-    }
-
-    topreg = a->vd + a->imm - 1;
-    btmreg = a->vd;
-
-    /* Convert to Sreg numbers if the insn specified in Dregs */
-    if (a->size == 3) {
-        topreg = topreg * 2 + 1;
-        btmreg *= 2;
-    }
-
-    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
-        /* UNPREDICTABLE: we choose to undef */
-        unallocated_encoding(s);
-        return true;
-    }
-
-    /* Silently ignore requests to clear D16-D31 if they don't exist */
-    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
-        topreg = 31;
-    }
-
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
-    /* Zero the Sregs from btmreg to topreg inclusive. */
-    zero = tcg_const_i64(0);
-    if (btmreg & 1) {
-        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
-        btmreg++;
-    }
-    for (; btmreg + 1 <= topreg; btmreg += 2) {
-        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
-    }
-    if (btmreg == topreg) {
-        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
-        btmreg++;
-    }
-    assert(btmreg == topreg + 1);
-    /* TODO: when MVE is implemented, zero VPR here */
-    return true;
-}
-
-static bool trans_NOCP(DisasContext *s, arg_nocp *a)
-{
-    /*
-     * Handle M-profile early check for disabled coprocessor:
-     * all we need to do here is emit the NOCP exception if
-     * the coprocessor is disabled. Otherwise we return false
-     * and the real VFP/etc decode will handle the insn.
-     */
-    assert(arm_dc_feature(s, ARM_FEATURE_M));
-
-    if (a->cp == 11) {
-        a->cp = 10;
-    }
-    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
-        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
-        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
-        a->cp = 10;
-    }
-
-    if (a->cp != 10) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), default_exception_el(s));
-        return true;
-    }
-
-    if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
-        return true;
-    }
-
-    return false;
-}
-
-static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
-{
-    /* This range needs a coprocessor check for v8.1M and later only */
-    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
-        return false;
-    }
-    return trans_NOCP(s, a);
-}
-
 static bool trans_VINS(DisasContext *s, arg_VINS *a)
 {
     TCGv_i32 rd, rm;
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
   decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
   decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
-  decodetree.process('m-nocp.decode', extra_args: '--static-decode=disas_m_nocp'),
+  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
   decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'op_helper.c',
   'tlb_helper.c',
   'translate.c',
+  'translate-m-nocp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
-- 
2.20.1

Move the various gen_aa32* functions and macros out of translate.c
and into translate-a32.h.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
     return tmp;
 }
 
+void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+
+#define DO_GEN_LD(SUFF, OPC)                                            \
+    static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
+                                         TCGv_i32 a32, int index)       \
+    {                                                                   \
+        gen_aa32_ld_i32(s, val, a32, index, OPC);                       \
+    }
+
+#define DO_GEN_ST(SUFF, OPC)                                            \
+    static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val, \
+                                         TCGv_i32 a32, int index)       \
+    {                                                                   \
+        gen_aa32_st_i32(s, val, a32, index, OPC);                       \
+    }
+
+static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
+                                 TCGv_i32 a32, int index)
+{
+    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
+}
+
+static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
+                                 TCGv_i32 a32, int index)
+{
+    gen_aa32_st_i64(s, val, a32, index, MO_Q);
+}
+
+DO_GEN_LD(8u, MO_UB)
+DO_GEN_LD(16u, MO_UW)
+DO_GEN_LD(32u, MO_UL)
+DO_GEN_ST(8, MO_UB)
+DO_GEN_ST(16, MO_UW)
+DO_GEN_ST(32, MO_UL)
+
+#undef DO_GEN_LD
+#undef DO_GEN_ST
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
  * Internal routines are used for NEON cases where the endianness
  * and/or alignment has already been taken into account and manipulated.
  */
-static void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
     tcg_gen_qemu_ld_i32(val, addr, index, opc);
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
     tcg_gen_qemu_st_i32(val, addr, index, opc);
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
 
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
 
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_ld_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_ld_internal_i64(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_st_internal_i64(s, val, a32, index, finalize_memop(s, opc));
 }
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
         gen_aa32_st_i32(s, val, a32, index, OPC);                       \
     }
 
-static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
-                                 TCGv_i32 a32, int index)
-{
-    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
-}
-
-static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
-                                 TCGv_i32 a32, int index)
-{
-    gen_aa32_st_i64(s, val, a32, index, MO_Q);
-}
-
-DO_GEN_LD(8u, MO_UB)
-DO_GEN_LD(16u, MO_UW)
-DO_GEN_LD(32u, MO_UL)
-DO_GEN_ST(8, MO_UB)
-DO_GEN_ST(16, MO_UW)
-DO_GEN_ST(32, MO_UL)
-
 static inline void gen_hvc(DisasContext *s, int imm16)
 {
     /* The pre HVC helper handles cases when HVC gets trapped
-- 
2.20.1

The functions vfp_load_reg32(), vfp_load_reg64(), vfp_store_reg32()
and vfp_store_reg64() are used only in translate-vfp.c.inc. Move
them to that file.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static long vfp_reg_offset(bool dp, unsigned reg)
     }
 }
 
-static inline void vfp_load_reg64(TCGv_i64 var, int reg)
-{
-    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
-}
-
-static inline void vfp_store_reg64(TCGv_i64 var, int reg)
-{
-    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
-}
-
-static inline void vfp_load_reg32(TCGv_i32 var, int reg)
-{
-    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
-}
-
-static inline void vfp_store_reg32(TCGv_i32 var, int reg)
-{
-    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
-}
-
 void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.c.inc"
 #include "decode-vfp-uncond.c.inc"
 
+static inline void vfp_load_reg64(TCGv_i64 var, int reg)
+{
+    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
+}
+
+static inline void vfp_store_reg64(TCGv_i64 var, int reg)
+{
+    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
+}
+
+static inline void vfp_load_reg32(TCGv_i32 var, int reg)
+{
+    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
+}
+
+static inline void vfp_store_reg32(TCGv_i32 var, int reg)
+{
+    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
+}
+
 /*
  * The imm8 encodes the sign bit, enough bits to represent an exponent in
  * the range 01....1xx to 10....0xx, and the most significant 4 bits of
-- 
2.20.1

Make the remaining functions which are needed by translate-vfp.c.inc
global.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
 void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
 void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
 void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
+TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs);
+void gen_set_cpsr(TCGv_i32 var, uint32_t mask);
+void gen_set_condexec(DisasContext *s);
+void gen_set_pc_im(DisasContext *s, target_ulong val);
+void gen_lookup_tb(DisasContext *s);
+long vfp_reg_offset(bool dp, unsigned reg);
+long neon_full_reg_offset(unsigned reg);
 
 static inline TCGv_i32 load_cpu_offset(int offset)
 {
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
     return tmp;
 }
 
+void store_reg(DisasContext *s, int reg, TCGv_i32 var);
+
 void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
                               TCGv_i32 a32, int index, MemOp opc);
 void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
 #undef DO_GEN_LD
 #undef DO_GEN_ST
 
+#if defined(CONFIG_USER_ONLY)
+#define IS_USER(s) 1
+#else
+#define IS_USER(s) (s->user)
+#endif
+
+/* Set NZCV flags from the high 4 bits of var.  */
+#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "translate.h"
 #include "translate-a32.h"
 
-#if defined(CONFIG_USER_ONLY)
-#define IS_USER(s) 1
-#else
-#define IS_USER(s) (s->user)
-#endif
-
 /* These are TCG temporaries used only by the legacy iwMMXt decoder */
 static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
 /* These are TCG globals which alias CPUARMState fields */
@@ -XXX,XX +XXX,XX @@ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
  * This is used for load/store for which use of PC implies (literal),
  * or ADD that implies ADR.
  */
-static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
 
 /* Set a CPU register.  The source must be a temporary and will be
    marked as dead.  */
-static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 {
     if (reg == 15) {
         /* In Thumb mode, we must ignore bit 0.
@@ -XXX,XX +XXX,XX @@ static void store_sp_checked(DisasContext *s, TCGv_i32 var)
 #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
 #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
 
-
-static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
+void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
 {
     TCGv_i32 tmp_mask = tcg_const_i32(mask);
     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
     tcg_temp_free_i32(tmp_mask);
 }
-/* Set NZCV flags from the high 4 bits of var.  */
-#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 
 static void gen_exception_internal(int excp)
 {
@@ -XXX,XX +XXX,XX @@ void arm_gen_test_cc(int cc, TCGLabel *label)
     arm_free_cc(&cmp);
 }
 
-static inline void gen_set_condexec(DisasContext *s)
+void gen_set_condexec(DisasContext *s)
 {
     if (s->condexec_mask) {
         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_set_condexec(DisasContext *s)
     }
 }
 
-static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
+void gen_set_pc_im(DisasContext *s, target_ulong val)
 {
     tcg_gen_movi_i32(cpu_R[15], val);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
-static inline void gen_lookup_tb(DisasContext *s)
+void gen_lookup_tb(DisasContext *s)
 {
     tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
     s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
 /*
  * Return the offset of a "full" NEON Dreg.
  */
-static long neon_full_reg_offset(unsigned reg)
+long neon_full_reg_offset(unsigned reg)
 {
     return offsetof(CPUARMState, vfp.zregs[reg >> 1].d[reg & 1]);
 }
@@ -XXX,XX +XXX,XX @@ static long neon_element_offset(int reg, int element, MemOp memop)
 }
 
 /* Return the offset of a VFP Dreg (dp = true) or VFP Sreg (dp = false). */
-static long vfp_reg_offset(bool dp, unsigned reg)
+long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
         return neon_element_offset(reg, 0, MO_64);
-- 
2.20.1

Switch translate-vfp.c.inc from being #included into translate.c
to being its own compilation unit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-9-peter.maydell@linaro.org
---
 target/arm/translate-a32.h                          |  2 ++
 target/arm/{translate-vfp.c.inc => translate-vfp.c} | 12 +++++++-----
 target/arm/translate.c                              |  3 +--
 target/arm/meson.build                              |  5 +++--
 4 files changed, 13 insertions(+), 9 deletions(-)
 rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (99%)

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 
 /* Prototypes for autogenerated disassembler functions */
 bool disas_m_nocp(DisasContext *dc, uint32_t insn);
+bool disas_vfp(DisasContext *s, uint32_t insn);
+bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
 
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c
similarity index 99%
rename from target/arm/translate-vfp.c.inc
rename to target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * This file is intended to be included from translate.c; it uses
- * some macros and definitions provided by that file.
- * It might be possible to convert it to a standalone .c file eventually.
- */
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "tcg/tcg-op-gvec.h"
+#include "exec/exec-all.h"
+#include "exec/gen-icount.h"
+#include "translate.h"
+#include "translate-a32.h"
 
 /* Include the generated VFP decoder */
 #include "decode-vfp.c.inc"
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 
 #define ARM_CP_RW_BIT   (1 << 20)
 
-/* Include the VFP and Neon decoders */
-#include "translate-vfp.c.inc"
+/* Include the Neon decoder */
 #include "translate-neon.c.inc"
 
 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
   decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
   decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
-  decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
-  decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
+  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
+  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
   decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'tlb_helper.c',
   'translate.c',
   'translate-m-nocp.c',
+  'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
-- 
2.20.1

The function vfp_reg_ptr() is used only in translate-neon.c.inc;
move it there.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
     }
 }
 
-static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-{
-    TCGv_ptr ret = tcg_temp_new_ptr();
-    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
-    return ret;
-}
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the Neon decoder */
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static inline int neon_3same_fp_size(DisasContext *s, int x)
 #include "decode-neon-ls.c.inc"
 #include "decode-neon-shared.c.inc"
 
+static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
+    return ret;
+}
+
 static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
 {
     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
-- 
2.20.1

Move the NeonGenThreeOpEnvFn typedef to translate.h together
with the other similar typedefs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210430132740.10391-12-peter.maydell@linaro.org
---
 target/arm/translate.h | 2 ++
 target/arm/translate.c | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i32, TCGv_i32);
 typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
 typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
 typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
+typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                 TCGv_i32, TCGv_i32);
 typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
 typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
 typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
 
-/* Function prototypes for gen_ functions calling Neon helpers.  */
-typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
-                                 TCGv_i32, TCGv_i32);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
-- 
2.20.1

Make the remaining functions needed by the translate-neon code
global.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ void gen_set_pc_im(DisasContext *s, target_ulong val);
 void gen_lookup_tb(DisasContext *s);
 long vfp_reg_offset(bool dp, unsigned reg);
 long neon_full_reg_offset(unsigned reg);
+long neon_element_offset(int reg, int element, MemOp memop);
+void gen_rev16(TCGv_i32 dest, TCGv_i32 var);
 
 static inline TCGv_i32 load_cpu_offset(int offset)
 {
@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
 /* Set NZCV flags from the high 4 bits of var.  */
 #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 
+/* Swap low and high halfwords.  */
+static inline void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
+{
+    tcg_gen_rotri_i32(dest, var, 16);
+}
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
 }
 
 /* Byteswap each halfword.  */
-static void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
     TCGv_i32 mask = tcg_const_i32(0x00ff00ff);
@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
     tcg_gen_ext16s_i32(dest, var);
 }
 
-/* Swap low and high halfwords.  */
-static void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
-{
-    tcg_gen_rotri_i32(dest, var, 16);
-}
-
 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
     tmp = (t0 ^ t1) & 0x8000;
     t0 &= ~0x8000;
@@ -XXX,XX +XXX,XX @@ long neon_full_reg_offset(unsigned reg)
  * Return the offset of a 2**SIZE piece of a NEON register, at index ELE,
  * where 0 is the least significant end of the register.
  */
-static long neon_element_offset(int reg, int element, MemOp memop)
+long neon_element_offset(int reg, int element, MemOp memop)
 {
     int element_size = 1 << (memop & MO_SIZE);
     int ofs = element * element_size;
-- 
2.20.1

Switch translate-neon.c.inc from being #included into translate.c
to being its own compilation unit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-14-peter.maydell@linaro.org
---
 target/arm/translate-a32.h                           |  3 +++
 .../arm/{translate-neon.c.inc => translate-neon.c}   | 12 +++++++-----
 target/arm/translate.c                               |  3 ---
 target/arm/meson.build                               |  7 ++++---
 4 files changed, 14 insertions(+), 11 deletions(-)
 rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 bool disas_m_nocp(DisasContext *dc, uint32_t insn);
 bool disas_vfp(DisasContext *s, uint32_t insn);
 bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
+bool disas_neon_dp(DisasContext *s, uint32_t insn);
+bool disas_neon_ls(DisasContext *s, uint32_t insn);
+bool disas_neon_shared(DisasContext *s, uint32_t insn);
 
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c
similarity index 99%
rename from target/arm/translate-neon.c.inc
rename to target/arm/translate-neon.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * This file is intended to be included from translate.c; it uses
- * some macros and definitions provided by that file.
- * It might be possible to convert it to a standalone .c file eventually.
- */
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "tcg/tcg-op-gvec.h"
+#include "exec/exec-all.h"
+#include "exec/gen-icount.h"
+#include "translate.h"
+#include "translate-a32.h"
 
 static inline int plus1(DisasContext *s, int x)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 
 #define ARM_CP_RW_BIT   (1 << 20)
 
-/* Include the Neon decoder */
-#include "translate-neon.c.inc"
-
 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
 {
     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
 gen = [
   decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
-  decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
-  decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
-  decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
+  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
+  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
+  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
   decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
   decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
   decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'tlb_helper.c',
   'translate.c',
   'translate-m-nocp.c',
+  'translate-neon.c',
   'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
-- 
2.20.1

The WFI insn is not system-mode only, though it doesn't usually make
a huge amount of sense for userspace code to execute it.  Currently
if you try it in qemu-arm then the helper function will raise an
EXCP_HLT exception, which is not covered by the switch in cpu_loop()
and results in an abort:

qemu: unhandled CPU exception 0x10001 - aborting
R00=00000001 R01=408003e4 R02=408003ec R03=000102ec
R04=00010a28 R05=00010158 R06=00087460 R07=00010158
R08=00000000 R09=00000000 R10=00085b7c R11=408002a4
R12=408002b8 R13=408002a0 R14=0001057c R15=000102f8
PSR=60000010 -ZC- A usr32
qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fcbfa4f0a12

Make the WFI helper function return immediately in the usermode
emulator. This turns WFI into a NOP, which is OK because:
 * architecturally "WFI is a NOP" is a permitted implementation
 * aarch64 Linux kernels use the SCTLR_EL1.nTWI bit to trap
   userspace WFI and NOP it (though aarch32 kernels currently
   just let WFI do whatever it would do)

We could in theory make the translate.c code special case user-mode
emulation and NOP the insn entirely rather than making the helper
do nothing, but because no real world code will be trying to
execute WFI we don't care about efficiency and the helper provides
a single place where we can make the change rather than having
to touch multiple places in translate.c and translate-a64.c.

Fixes: https://bugs.launchpad.net/qemu/+bug/1926759
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430162212.825-1-peter.maydell@linaro.org
---
 target/arm/op_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
 
 void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
 {
+#ifdef CONFIG_USER_ONLY
+    /*
+     * WFI in the user-mode emulator is technically permitted but not
+     * something any real-world code would do. AArch64 Linux kernels
+     * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP;
+     * AArch32 kernels don't trap it so it will delay a bit.
+     * For QEMU, make it NOP here, because trying to raise EXCP_HLT
+     * would trigger an abort.
+     */
+    return;
+#else
     CPUState *cs = env_cpu(env);
     int target_el = check_wfx_trap(env, false);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
     cs->exception_index = EXCP_HLT;
     cs->halted = 1;
     cpu_loop_exit(cs);
+#endif
 }
 
 void HELPER(wfe)(CPUARMState *env)
-- 
2.20.1

The omap_mmc_reset() function resets its SD card via
device_legacy_reset().  We know that the SD card does not have a qbus
of its own, so the new device_cold_reset() function (which resets
both the device and its child buses) is equivalent here to
device_legacy_reset() and we can just switch to the new API.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210430222348.8514-1-peter.maydell@linaro.org
---
 hw/sd/omap_mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
      * into any bus, and we must reset it manually. When omap_mmc is
      * QOMified this must move into the QOM reset function.
      */
-    device_legacy_reset(DEVICE(host->card));
+    device_cold_reset(DEVICE(host->card));
 }
 
 static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
-- 
2.20.1

Both os-win32.h and os-posix.h include system header files. Instead
of having osdep.h include them inside its 'extern "C"' block, make
these headers handle that themselves, so that we don't include the
system headers inside 'extern "C"'.

This doesn't fix any current problems, but it's conceptually the
right way to handle system headers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/osdep.h      | 8 ++++----
 include/sysemu/os-posix.h | 8 ++++++++
 include/sysemu/os-win32.h | 8 ++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ QEMU_EXTERN_C int daemon(int, int);
  */
 #include "glib-compat.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #ifdef _WIN32
 #include "sysemu/os-win32.h"
 #endif
@@ -XXX,XX +XXX,XX @@ extern "C" {
 #include "sysemu/os-posix.h"
 #endif
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #include "qemu/typedefs.h"
 
 /*
diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-posix.h
+++ b/include/sysemu/os-posix.h
@@ -XXX,XX +XXX,XX @@
 #include <sys/sysmacros.h>
 #endif
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 void os_set_line_buffering(void);
 void os_set_proc_name(const char *s);
 void os_setup_signal_handling(void);
@@ -XXX,XX +XXX,XX @@ static inline void qemu_funlockfile(FILE *f)
     funlockfile(f);
 }
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif
diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@
 #include <windows.h>
 #include <ws2tcpip.h>
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #if defined(_WIN64)
 /* On w64, setjmp is implemented by _setjmp which needs a second parameter.
  * If this parameter is NULL, longjump does no stack unwinding.
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_recv_wrap(int sockfd, void *buf, size_t len, int flags);
 ssize_t qemu_recvfrom_wrap(int sockfd, void *buf, size_t len, int flags,
                            struct sockaddr *addr, socklen_t *addrlen);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif
-- 
2.20.1

Make bswap.h handle being included outside an 'extern "C"' block:
all system headers are included first, then all declarations are
put inside an 'extern "C"' block.

This requires a little rearrangement as currently we have an ifdef
ladder that has some system includes and some local declarations
or definitions, and we need to separate those out.

We want to do this because dis-asm.h includes bswap.h, dis-asm.h
may need to be included from C++ files, and system headers should
not be included within 'extern "C"' blocks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/bswap.h | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
-#include "fpu/softfloat-types.h"
-
 #ifdef CONFIG_MACHINE_BSWAP_H
 # include <sys/endian.h>
 # include <machine/bswap.h>
@@ -XXX,XX +XXX,XX @@
 # include <endian.h>
 #elif defined(CONFIG_BYTESWAP_H)
 # include <byteswap.h>
+#define BSWAP_FROM_BYTESWAP
+# else
+#define BSWAP_FROM_FALLBACKS
+#endif /* ! CONFIG_MACHINE_BSWAP_H */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "fpu/softfloat-types.h"
+
+#ifdef BSWAP_FROM_BYTESWAP
 static inline uint16_t bswap16(uint16_t x)
 {
     return bswap_16(x);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
 {
     return bswap_64(x);
 }
-# else
+#endif
+
+#ifdef BSWAP_FROM_FALLBACKS
 static inline uint16_t bswap16(uint16_t x)
 {
     return (((x & 0x00ff) << 8) |
@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
             ((x & 0x00ff000000000000ULL) >> 40) |
             ((x & 0xff00000000000000ULL) >> 56));
 }
-#endif /* ! CONFIG_MACHINE_BSWAP_H */
+#endif
+
+#undef BSWAP_FROM_BYTESWAP
+#undef BSWAP_FROM_FALLBACKS
 
 static inline void bswap16s(uint16_t *s)
 {
@@ -XXX,XX +XXX,XX @@ DO_STN_LDN_P(be)
 #undef le_bswaps
 #undef be_bswaps
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* BSWAP_H */
-- 
2.20.1

Make dis-asm.h handle being included outside an 'extern "C"' block;
this allows us to remove the 'extern "C"' blocks that our two C++
files that include it are using.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/disas/dis-asm.h | 12 ++++++++++--
 disas/arm-a64.cc        |  2 --
 disas/nanomips.cpp      |  2 --
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/disas/dis-asm.h b/include/disas/dis-asm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/disas/dis-asm.h
+++ b/include/disas/dis-asm.h
@@ -XXX,XX +XXX,XX @@
 #ifndef DISAS_DIS_ASM_H
 #define DISAS_DIS_ASM_H
 
+#include "qemu/bswap.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 typedef void *PTR;
 typedef uint64_t bfd_vma;
 typedef int64_t bfd_signed_vma;
@@ -XXX,XX +XXX,XX @@ bool cap_disas_plugin(disassemble_info *info, uint64_t pc, size_t size);
 
 /* from libbfd */
 
-#include "qemu/bswap.h"
-
 static inline bfd_vma bfd_getl64(const bfd_byte *addr)
 {
     return ldq_le_p(addr);
@@ -XXX,XX +XXX,XX @@ static inline bfd_vma bfd_getb16(const bfd_byte *addr)
 
 typedef bool bfd_boolean;
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* DISAS_DIS_ASM_H */
diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
index XXXXXXX..XXXXXXX 100644
--- a/disas/arm-a64.cc
+++ b/disas/arm-a64.cc
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-extern "C" {
 #include "disas/dis-asm.h"
-}
 
 #include "vixl/a64/disasm-a64.h"
 
diff --git a/disas/nanomips.cpp b/disas/nanomips.cpp
index XXXXXXX..XXXXXXX 100644
--- a/disas/nanomips.cpp
+++ b/disas/nanomips.cpp
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-extern "C" {
 #include "disas/dis-asm.h"
-}
 
 #include <cstring>
 #include <stdexcept>
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The i.MX25 PDK board has 2 banks for SDRAM, each can
address up to 256 MiB. So the total RAM usable for this
board is 512M. When we ask for more we get a misleading
error message:

$ qemu-system-arm -M imx25-pdk -m 513M
  qemu-system-arm: Invalid RAM size, should be 128 MiB

Update the error message to better match the reality:

$ qemu-system-arm -M imx25-pdk -m 513M
  qemu-system-arm: RAM size more than 512 MiB is not supported

Fixes: bf350daae02 ("arm/imx25_pdk: drop RAM size fixup")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210407225608.1882855-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/imx25_pdk.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/imx25_pdk.c
+++ b/hw/arm/imx25_pdk.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info imx25_pdk_binfo;
 
 static void imx25_pdk_init(MachineState *machine)
 {
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
     IMX25PDK *s = g_new0(IMX25PDK, 1);
     unsigned int ram_size;
     unsigned int alias_offset;
@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
 
     /* We need to initialize our memory */
     if (machine->ram_size > (FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE)) {
-        char *sz = size_to_str(mc->default_ram_size);
-        error_report("Invalid RAM size, should be %s", sz);
+        char *sz = size_to_str(FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE);
+        error_report("RAM size more than %s is not supported", sz);
         g_free(sz);
         exit(EXIT_FAILURE);
     }
-- 
2.20.1

The MPS2 SCC device doesn't have any documentation of its properties;
add a "QEMU interface" format comment describing them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210504120912.23094-2-peter.maydell@linaro.org
---
 include/hw/misc/mps2-scc.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mps2-scc.h
+++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
  *  (at your option) any later version.
  */
 
+/*
+ * This is a model of the Serial Communication Controller (SCC)
+ * block found in most MPS FPGA images.
+ *
+ * QEMU interface:
+ *  + sysbus MMIO region 0: the register bank
+ *  + QOM property "scc-cfg4": value of the read-only CFG4 register
+ *  + QOM property "scc-aid": value of the read-only SCC_AID register
+ *  + QOM property "scc-id": value of the read-only SCC_ID register
+ *  + QOM property array "oscclk": reset values of the OSCCLK registers
+ *    (which are accessed via the SYS_CFG channel provided by this device)
+ */
 #ifndef MPS2_SCC_H
 #define MPS2_SCC_H
 
-- 
2.20.1

On some boards, SCC config register CFG0 bit 0 controls whether
parts of the board memory map are remapped. Support this with:
 * a device property scc-cfg0 so the board can specify the
   initial value of the CFG0 register
 * an outbound GPIO line which tracks bit 0 and which the board
   can wire up to provide the remapping

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210504120912.23094-3-peter.maydell@linaro.org
---
 include/hw/misc/mps2-scc.h |  9 +++++++++
 hw/misc/mps2-scc.c         | 13 ++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mps2-scc.h
+++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
  *  + QOM property "scc-cfg4": value of the read-only CFG4 register
  *  + QOM property "scc-aid": value of the read-only SCC_AID register
  *  + QOM property "scc-id": value of the read-only SCC_ID register
+ *  + QOM property "scc-cfg0": reset value of the CFG0 register
  *  + QOM property array "oscclk": reset values of the OSCCLK registers
  *    (which are accessed via the SYS_CFG channel provided by this device)
+ *  + named GPIO output "remap": this tracks the value of CFG0 register
+ *    bit 0. Boards where this bit controls memory remapping should
+ *    connect this GPIO line to a function performing that mapping.
+ *    Boards where bit 0 has no special function should leave the GPIO
+ *    output disconnected.
  */
 #ifndef MPS2_SCC_H
 #define MPS2_SCC_H
@@ -XXX,XX +XXX,XX @@ struct MPS2SCC {
     uint32_t num_oscclk;
     uint32_t *oscclk;
     uint32_t *oscclk_reset;
+    uint32_t cfg0_reset;
+
+    qemu_irq remap;
 };
 
 #endif
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "trace.h"
 #include "hw/sysbus.h"
+#include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/registerfields.h"
 #include "hw/misc/mps2-scc.h"
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
     switch (offset) {
     case A_CFG0:
         /*
-         * TODO on some boards bit 0 controls RAM remapping;
-         * on others bit 1 is CPU_WAIT.
+         * On some boards bit 0 controls board-specific remapping;
+         * we always reflect bit 0 in the 'remap' GPIO output line,
+         * and let the board wire it up or not as it chooses.
+         * TODO on some boards bit 1 is CPU_WAIT.
          */
         s->cfg0 = value;
+        qemu_set_irq(s->remap, s->cfg0 & 1);
         break;
     case A_CFG1:
         s->cfg1 = value;
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_reset(DeviceState *dev)
     int i;
 
     trace_mps2_scc_reset();
-    s->cfg0 = 0;
+    s->cfg0 = s->cfg0_reset;
     s->cfg1 = 0;
     s->cfg2 = 0;
     s->cfg5 = 0;
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_init(Object *obj)
 
     memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1);
 }
 
 static void mps2_scc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
     DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
     DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
+    /* Reset value for CFG0 register */
+    DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0),
     /*
      * These are the initial settings for the source clocks on the board.
      * In hardware they can be configured via a config file read by the
-- 
2.20.1

The AN524 FPGA image supports two memory maps, which differ in where
the QSPI and BRAM are.  In the default map, the BRAM is at
0x0000_0000, and the QSPI at 0x2800_0000.  In the second map, they
are the other way around.

In hardware, the initial mapping can be selected by the user by
writing either "REMAP: BRAM" (the default) or "REMAP: QSPI" in the
board configuration file.  The board config file is acted on by the
"Motherboard Configuration Controller", which is an entirely separate
microcontroller on the dev board but outside the FPGA.

The guest can also dynamically change the mapping via the SCC
CFG_REG0 register.

Implement this functionality for QEMU, using a machine property
"remap" with valid values "BRAM" and "QSPI" to allow the user to set
the initial mapping, in the same way they can on the FPGA, and
wiring up the bit from the SCC register to also switch the mapping.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210504120912.23094-4-peter.maydell@linaro.org
---
 docs/system/arm/mps2.rst |  10 ++++
 hw/arm/mps2-tz.c         | 108 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 117 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/mps2.rst
+++ b/docs/system/arm/mps2.rst
@@ -XXX,XX +XXX,XX @@ Differences between QEMU and real hardware:
   flash, but only as simple ROM, so attempting to rewrite the flash
   from the guest will fail
 - QEMU does not model the USB controller in MPS3 boards
+
+Machine-specific options
+""""""""""""""""""""""""
+
+The following machine-specific options are supported:
+
+remap
+  Supported for ``mps3-an524`` only.
+  Set ``BRAM``/``QSPI`` to select the initial memory mapping. The
+  default is ``BRAM``.
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/reset.h"
 #include "hw/misc/unimp.h"
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/core/split-irq.h"
 #include "hw/qdev-clock.h"
 #include "qom/object.h"
+#include "hw/irq.h"
 
 #define MPS2TZ_NUMIRQ_MAX 96
 #define MPS2TZ_RAM_MAX 5
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
     Clock *sysclk;
     Clock *s32kclk;
+
+    bool remap;
+    qemu_irq remap_irq;
 };
 
 #define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -XXX,XX +XXX,XX @@ static const RAMInfo an505_raminfo[] = { {
     },
 };
 
+/*
+ * Note that the addresses and MPC numbering here should match up
+ * with those used in remap_memory(), which can swap the BRAM and QSPI.
+ */
 static const RAMInfo an524_raminfo[] = { {
         .name = "bram",
         .base = 0x00000000,
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 
     object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
     sccdev = DEVICE(scc);
+    qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
     qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
     qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
     qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
 }
 
+static hwaddr boot_mem_base(MPS2TZMachineState *mms)
+{
+    /*
+     * Return the canonical address of the block which will be mapped
+     * at address 0x0 (i.e. where the vector table is).
+     * This is usually 0, but if the AN524 alternate memory map is
+     * enabled it will be the base address of the QSPI block.
+     */
+    return mms->remap ? 0x28000000 : 0;
+}
+
+static void remap_memory(MPS2TZMachineState *mms, int map)
+{
+    /*
+     * Remap the memory for the AN524. 'map' is the value of
+     * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
+     * for the "option 1" mapping where QSPI is at address 0.
+     *
+     * Effectively we need to swap around the "upstream" ends of
+     * MPC 0 and MPC 1.
+     */
+    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+    int i;
+
+    if (mmc->fpga_type != FPGA_AN524) {
+        return;
+    }
+
+    memory_region_transaction_begin();
+    for (i = 0; i < 2; i++) {
+        TZMPC *mpc = &mms->mpc[i];
+        MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
+        hwaddr addr = (i ^ map) ? 0x28000000 : 0;
+
+        memory_region_set_address(upstream, addr);
+    }
+    memory_region_transaction_commit();
+}
+
+static void remap_irq_fn(void *opaque, int n, int level)
+{
+    MPS2TZMachineState *mms = opaque;
+
+    remap_memory(mms, level);
+}
+
 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
                               const int *irqs)
@@ -XXX,XX +XXX,XX @@ static uint32_t boot_ram_size(MPS2TZMachineState *mms)
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 
     for (p = mmc->raminfo; p->name; p++) {
-        if (p->base == 0) {
+        if (p->base == boot_mem_base(mms)) {
             return p->size;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
 
     create_non_mpc_ram(mms);
 
+    if (mmc->fpga_type == FPGA_AN524) {
+        /*
+         * Connect the line from the SCC so that we can remap when the
+         * guest updates that register.
+         */
+        mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
+        qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
+                                    mms->remap_irq);
+    }
+
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
                        boot_ram_size(mms));
 }
@@ -XXX,XX +XXX,XX @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
     *iregion = region;
 }
 
+static char *mps2_get_remap(Object *obj, Error **errp)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+    const char *val = mms->remap ? "QSPI" : "BRAM";
+    return g_strdup(val);
+}
+
+static void mps2_set_remap(Object *obj, const char *value, Error **errp)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+
+    if (!strcmp(value, "BRAM")) {
+        mms->remap = false;
+    } else if (!strcmp(value, "QSPI")) {
+        mms->remap = true;
+    } else {
+        error_setg(errp, "Invalid remap value");
+        error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
+    }
+}
+
+static void mps2_machine_reset(MachineState *machine)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
+
+    /*
+     * Set the initial memory mapping before triggering the reset of
+     * the rest of the system, so that the guest image loader and CPU
+     * reset see the correct mapping.
+     */
+    remap_memory(mms, mms->remap);
+    qemu_devices_reset();
+}
+
 static void mps2tz_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
 
     mc->init = mps2tz_common_init;
+    mc->reset = mps2_machine_reset;
     iic->check = mps2_tz_idau_check;
 }
 
@@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
     mmc->raminfo = an524_raminfo;
     mmc->armsse_type = TYPE_SSE200;
     mps2tz_set_default_ram_info(mmc);
+
+    object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
+    object_class_property_set_description(oc, "remap",
+                                          "Set memory mapping. Valid values "
+                                          "are BRAM (default) and QSPI.");
 }
 
 static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Commit dfc388797cc4 ("hw/arm: xlnx: Set all boards' GEM 'phy-addr'
property value to 23") configured the PHY address for xilinx-zynq-a9
to 23. When trying to boot xilinx-zynq-a9 with zynq-zc702.dtb or
zynq-zc706.dtb, this results in the following error message when
trying to use the Ethernet interface.

macb e000b000.ethernet eth0: Could not attach PHY (-19)

The devicetree files for ZC702 and ZC706 configure PHY address 7. The
documentation for the ZC702 and ZC706 evaluation boards suggest that the
PHY address is 7, not 23. Other boards use PHY address 0, 1, 3, or 7.
I was unable to find a documentation or a devicetree file suggesting
or using PHY address 23. The Ethernet interface starts working with
zynq-zc702.dtb and zynq-zc706.dtb when setting the PHY address to 7,
so let's use it.

Cc: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210504124140.1100346-1-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xilinx_zynq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
         qdev_set_nic_properties(dev, nd);
     }
-    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
+    object_property_set_int(OBJECT(dev), "phy-addr", 7, &error_abort);
     s = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, base);
-- 
2.20.1