Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 00/28] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+Just flushing my target-arm queue since I won't be working next week :-)
 as well put them in to rc0...
-thanks
 -- PMM
-The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
+The following changes since commit b3cd3b5a66f0dddfe3d5ba2bef13cd4f5b89cde9:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
+  Merge tag 'pull-riscv-to-apply-20220610' of github.com:alistair23/qemu into staging (2022-06-09 22:08:27 -0700)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220610
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 90c072e063737e9e8f431489bbd334452f89056e:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  semihosting/config: Merge --semihosting-config option groups (2022-06-10 14:32:36 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+ * refactor exception routing code
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * fix SCR_EL3 RAO/RAZ bits
- * dump: Update correct kdump phys_base field for AArch64
+ * gdbstub: Don't use GDB syscalls if no GDB is attached
- * char: i.MX: Add support for "TX complete" interrupt
+ * semihosting/config: Merge --semihosting-config option groups
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * tests/qtest: Reduce npcm7xx_sdhci test image size
    to boot a Debian Linux kernel on raspi3
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Hao Wu (1):
-      char: i.MX: Simplify imx_update()
+      tests/qtest: Reduce npcm7xx_sdhci test image size
       char: i.MX: Add support for "TX complete" interrupt
-Guenter Roeck (1):
+Peter Maydell (2):
-      fsl-imx6: Swap Ethernet interrupt defines
+      gdbstub: Don't use GDB syscalls if no GDB is attached
       semihosting/config: Merge --semihosting-config option groups
-Peter Maydell (9):
+Richard Henderson (25):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      target/arm: Mark exception helpers as noreturn
-      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+      target/arm: Add coproc parameter to syn_fp_access_trap
-      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+      target/arm: Move exception_target_el out of line
-      hw/arm/bcm2386: Fix parent type of bcm2386
+      target/arm: Move arm_singlestep_active out of line
-      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+      target/arm: Move arm_generate_debug_exceptions out of line
-      hw/arm/bcm2836: Create proper bcm2837 device
+      target/arm: Use is_a64 in arm_generate_debug_exceptions
-      hw/arm/bcm2836: Use correct affinity values for BCM2837
+      target/arm: Move exception_bkpt_insn to debug_helper.c
-      hw/arm/bcm2836: Hardcode correct CPU type
+      target/arm: Move arm_debug_exception_fsr to debug_helper.c
-      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+      target/arm: Rename helper_exception_with_syndrome
       target/arm: Introduce gen_exception_insn_el_v
       target/arm: Rename gen_exception_insn to gen_exception_insn_el
       target/arm: Introduce gen_exception_insn
       target/arm: Create helper_exception_swstep
       target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
       target/arm: Move gen_exception to translate.c
       target/arm: Rename gen_exception to gen_exception_el
       target/arm: Introduce gen_exception
       target/arm: Introduce gen_exception_el_v
       target/arm: Introduce helper_exception_with_syndrome
       target/arm: Remove default_exception_el
       target/arm: Create raise_exception_debug
       target/arm: Move arm_debug_target_el to debug_helper.c
       target/arm: Fix Secure PL1 tests in fp_exception_el
       target/arm: Adjust format test in scr_write
       target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]
-Wei Huang (1):
+ target/arm/cpu.h                 | 133 ++---------------------
-      dump: Update correct kdump phys_base field for AArch64
+ target/arm/helper.h              |   8 +-
+ target/arm/internals.h           |  43 +-------
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+ target/arm/syndrome.h            |   7 +-
- include/hw/arm/fsl-imx6.h    |  4 +-
+ target/arm/translate.h           |  43 ++------
- include/hw/char/imx_serial.h |  3 ++
+ gdbstub.c                        |  14 ++-
- dump.c                       | 14 +++++--
+ semihosting/config.c             |   1 +
- hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
+ target/arm/debug_helper.c        | 220 +++++++++++++++++++++++++++++++++++++--
- hw/arm/boot.c                | 12 ++++++
+ target/arm/helper.c              |  53 ++++------
- hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
+ target/arm/op_helper.c           |  52 +++++----
- hw/char/imx_serial.c         | 44 ++++++++++++++++------
+ target/arm/translate-a64.c       |  34 +++---
- hw/net/imx_fec.c             | 28 +++++++++++++-
+ target/arm/translate-m-nocp.c    |  15 ++-
-files changed, 237 insertions(+), 63 deletions(-)
+ target/arm/translate-mve.c       |   3 +-
+ target/arm/translate-vfp.c       |  18 +++-
  target/arm/translate.c           | 106 ++++++++++---------
  tests/qtest/npcm7xx_sdhci-test.c |   2 +-
 files changed, 390 insertions(+), 362 deletions(-)

-New patch
+[PULL 01/28] target/arm: Mark exception helpers as noreturn
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.h | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+                    i32, i32, i32, i32)
+-DEF_HELPER_2(exception_internal, void, env, i32)
+-DEF_HELPER_4(exception_with_syndrome, void, env, i32, i32, i32)
+-DEF_HELPER_2(exception_bkpt_insn, void, env, i32)
++DEF_HELPER_2(exception_internal, noreturn, env, i32)
++DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
++DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
+ DEF_HELPER_1(setend, void, env)
+ DEF_HELPER_2(wfi, void, env, i32)
+--
+.25.1

-New patch
+[PULL 02/28] target/arm: Add coproc parameter to syn_fp_access_trap
+From: Richard Henderson <richard.henderson@linaro.org>
+With ARMv8, this field is always RES0.
+With ARMv7, targeting EL2 and TA=0, it is always 0xA.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-3-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/syndrome.h      |  7 ++++---
+ target/arm/translate-a64.c |  3 ++-
+ target/arm/translate-vfp.c | 14 ++++++++++++--
+files changed, 18 insertions(+), 6 deletions(-)
+diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/syndrome.h
++++ b/target/arm/syndrome.h
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
+         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
+ }
+-static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
++static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit,
++                                          int coproc)
+ {
+-    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
++    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 */
+     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
+         | (is_16bit ? 0 : ARM_EL_IL)
+-        | (cv << 24) | (cond << 20) | 0xa;
++        | (cv << 24) | (cond << 20) | coproc;
+ }
+ static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
+         s->fp_access_checked = true;
+         gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
++                           syn_fp_access_trap(1, 0xe, false, 0),
++                           s->fp_excp_el);
+         return false;
+     }
+     s->fp_access_checked = true;
+diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c
++++ b/target/arm/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
+ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
+ {
+     if (s->fp_excp_el) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
++        /*
++         * The full syndrome is only used for HSR when HCPTR traps:
++         * For v8, when TA==0, coproc is RES0.
++         * For v7, any use of a Floating-point instruction or access
++         * to a Floating-point Extension register that is trapped to
++         * Hyp mode because of a trap configured in the HCPTR sets
++         * this field to 0xA.
++         */
++        int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
++        uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
++
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+         return false;
+     }
+--
+.25.1

-New patch
+[PULL 03/28] target/arm: Move exception_target_el out of line
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the function to op_helper.c, near raise_exception.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/internals.h | 16 +---------------
+ target/arm/op_helper.c | 15 +++++++++++++++
+files changed, 16 insertions(+), 15 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
+ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
+-static inline int exception_target_el(CPUARMState *env)
+-{
+-    int target_el = MAX(1, arm_current_el(env));
+-
+-    /*
+-     * No such thing as secure EL1 if EL3 is aarch32,
+-     * so update the target EL to EL3 in this case.
+-     */
+-    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
+-        target_el = 3;
+-    }
+-
+-    return target_el;
+-}
+-
+ /* Determine if allocation tags are available.  */
+ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+                                                  uint64_t sctlr)
+@@ -XXX,XX +XXX,XX @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
+ bool el_is_in_host(CPUARMState *env, int el);
+ void aa32_max_features(ARMCPU *cpu);
++int exception_target_el(CPUARMState *env);
+ /* Powers of 2 for sve_vq_map et al. */
+ #define SVE_VQ_POW2_MAP                                 \
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #define SIGNBIT (uint32_t)0x80000000
+ #define SIGNBIT64 ((uint64_t)1 << 63)
++int exception_target_el(CPUARMState *env)
++{
++    int target_el = MAX(1, arm_current_el(env));
++
++    /*
++     * No such thing as secure EL1 if EL3 is aarch32,
++     * so update the target EL to EL3 in this case.
++     */
++    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
++        target_el = 3;
++    }
++
++    return target_el;
++}
++
+ void raise_exception(CPUARMState *env, uint32_t excp,
+                      uint32_t syndrome, uint32_t target_el)
+ {
+--
+.25.1

-New patch
+[PULL 04/28] target/arm: Move arm_singlestep_active out of line
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the function to debug_helper.c, and the
+declaration to internals.h.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-5-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h          | 10 ----------
+ target/arm/internals.h    |  1 +
+ target/arm/debug_helper.c | 12 ++++++++++++
+files changed, 13 insertions(+), 10 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_generate_debug_exceptions(CPUARMState *env)
+     }
+ }
+-/* Is single-stepping active? (Note that the "is EL_D AArch64?" check
+- * implicitly means this always returns false in pre-v8 CPUs.)
+- */
+-static inline bool arm_singlestep_active(CPUARMState *env)
+-{
+-    return extract32(env->cp15.mdscr_el1, 0, 1)
+-        && arm_el_is_aa64(env, arm_debug_target_el(env))
+-        && arm_generate_debug_exceptions(env);
+-}
+-
+ static inline bool arm_sctlr_b(CPUARMState *env)
+ {
+     return
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
+ void aa32_max_features(ARMCPU *cpu);
+ int exception_target_el(CPUARMState *env);
++bool arm_singlestep_active(CPUARMState *env);
+ /* Powers of 2 for sve_vq_map et al. */
+ #define SVE_VQ_POW2_MAP                                 \
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/exec-all.h"
+ #include "exec/helper-proto.h"
++
++/*
++ * Is single-stepping active? (Note that the "is EL_D AArch64?" check
++ * implicitly means this always returns false in pre-v8 CPUs.)
++ */
++bool arm_singlestep_active(CPUARMState *env)
++{
++    return extract32(env->cp15.mdscr_el1, 0, 1)
++        && arm_el_is_aa64(env, arm_debug_target_el(env))
++        && arm_generate_debug_exceptions(env);
++}
++
+ /* Return true if the linked breakpoint entry lbn passes its checks */
+ static bool linked_bp_matches(ARMCPU *cpu, int lbn)
+ {
+--
+.25.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+[PULL 05/28] target/arm: Move arm_generate_debug_exceptions out of line
-From: Wei Huang <wei@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-For guest kernel that supports KASLR, the load address can change every
+Move arm_generate_debug_exceptions and its two subroutines,
-time when guest VM runs. To find the physical base address correctly,
+{aa32,aa64}_generate_debug_exceptions into debug_helper.c,
-current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
+and the one interface declaration to internals.h.
 However this string pattern is only available on x86_64. AArch64 uses a
 different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
 QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
+Message-id: 20220609202901.1177572-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- dump.c | 14 +++++++++++---
+ target/arm/cpu.h          | 91 -------------------------------------
-file changed, 11 insertions(+), 3 deletions(-)
+ target/arm/internals.h    |  1 +
  target/arm/debug_helper.c | 94 +++++++++++++++++++++++++++++++++++++++
 files changed, 95 insertions(+), 91 deletions(-)
-diff --git a/dump.c b/dump.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/dump.c
+--- a/target/arm/cpu.h
-+++ b/dump.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
+     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
-     lines = g_strsplit((char *)vmci, "\n", -1);
+ }
-     for (i = 0; lines[i]; i++) {
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
+-/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+-static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
-+        const char *prefix = NULL;
+-{
-+
+-    int cur_el = arm_current_el(env);
-+        if (s->dump_info.d_machine == EM_X86_64) {
+-    int debug_el;
-+            prefix = "NUMBER(phys_base)=";
+-
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+-    if (cur_el == 3) {
-+            prefix = "NUMBER(PHYS_OFFSET)=";
+-        return false;
 -    }
 -
 -    /* MDCR_EL3.SDD disables debug events from Secure state */
 -    if (arm_is_secure_below_el3(env)
 -        && extract32(env->cp15.mdcr_el3, 16, 1)) {
 -        return false;
 -    }
 -
 -    /*
 -     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
 -     * while not masking the (D)ebug bit in DAIF.
 -     */
 -    debug_el = arm_debug_target_el(env);
 -
 -    if (cur_el == debug_el) {
 -        return extract32(env->cp15.mdscr_el1, 13, 1)
 -            && !(env->daif & PSTATE_D);
 -    }
 -
 -    /* Otherwise the debug target needs to be a higher EL */
 -    return debug_el > cur_el;
 -}
 -
 -static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
 -{
 -    int el = arm_current_el(env);
 -
 -    if (el == 0 && arm_el_is_aa64(env, 1)) {
 -        return aa64_generate_debug_exceptions(env);
 -    }
 -
 -    if (arm_is_secure(env)) {
 -        int spd;
 -
 -        if (el == 0 && (env->cp15.sder & 1)) {
 -            /* SDER.SUIDEN means debug exceptions from Secure EL0
 -             * are always enabled. Otherwise they are controlled by
 -             * SDCR.SPD like those from other Secure ELs.
 -             */
 -            return true;
 -        }
 -
 -        spd = extract32(env->cp15.mdcr_el3, 14, 2);
 -        switch (spd) {
 -        case 1:
 -            /* SPD == 0b01 is reserved, but behaves as 0b00. */
 -        case 0:
 -            /* For 0b00 we return true if external secure invasive debug
 -             * is enabled. On real hardware this is controlled by external
 -             * signals to the core. QEMU always permits debug, and behaves
 -             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
 -             */
 -            return true;
 -        case 2:
 -            return false;
 -        case 3:
 -            return true;
 -        }
 -    }
 -
 -    return el != 2;
 -}
 -
 -/* Return true if debugging exceptions are currently enabled.
 - * This corresponds to what in ARM ARM pseudocode would be
 - *    if UsingAArch32() then
 - *        return AArch32.GenerateDebugExceptions()
 - *    else
 - *        return AArch64.GenerateDebugExceptions()
 - * We choose to push the if() down into this function for clarity,
 - * since the pseudocode has it at all callsites except for the one in
 - * CheckSoftwareStep(), where it is elided because both branches would
 - * always return the same value.
 - */
 -static inline bool arm_generate_debug_exceptions(CPUARMState *env)
 -{
 -    if (env->aarch64) {
 -        return aa64_generate_debug_exceptions(env);
 -    } else {
 -        return aa32_generate_debug_exceptions(env);
 -    }
 -}
 -
  static inline bool arm_sctlr_b(CPUARMState *env)
  {
      return
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
  void aa32_max_features(ARMCPU *cpu);
  int exception_target_el(CPUARMState *env);
  bool arm_singlestep_active(CPUARMState *env);
 +bool arm_generate_debug_exceptions(CPUARMState *env);
  /* Powers of 2 for sve_vq_map et al. */
  #define SVE_VQ_POW2_MAP                                 \
 diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/debug_helper.c
 +++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
 +/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
 +static bool aa64_generate_debug_exceptions(CPUARMState *env)
 +{
 +    int cur_el = arm_current_el(env);
 +    int debug_el;
 +
 +    if (cur_el == 3) {
 +        return false;
 +    }
 +
 +    /* MDCR_EL3.SDD disables debug events from Secure state */
 +    if (arm_is_secure_below_el3(env)
 +        && extract32(env->cp15.mdcr_el3, 16, 1)) {
 +        return false;
 +    }
 +
 +    /*
 +     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
 +     * while not masking the (D)ebug bit in DAIF.
 +     */
 +    debug_el = arm_debug_target_el(env);
 +
 +    if (cur_el == debug_el) {
 +        return extract32(env->cp15.mdscr_el1, 13, 1)
 +            && !(env->daif & PSTATE_D);
 +    }
 +
 +    /* Otherwise the debug target needs to be a higher EL */
 +    return debug_el > cur_el;
 +}
 +
 +static bool aa32_generate_debug_exceptions(CPUARMState *env)
 +{
 +    int el = arm_current_el(env);
 +
 +    if (el == 0 && arm_el_is_aa64(env, 1)) {
 +        return aa64_generate_debug_exceptions(env);
 +    }
 +
 +    if (arm_is_secure(env)) {
 +        int spd;
 +
 +        if (el == 0 && (env->cp15.sder & 1)) {
 +            /*
 +             * SDER.SUIDEN means debug exceptions from Secure EL0
 +             * are always enabled. Otherwise they are controlled by
 +             * SDCR.SPD like those from other Secure ELs.
 +             */
 +            return true;
 +        }
 +
-+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
++        spd = extract32(env->cp15.mdcr_el3, 14, 2);
-+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
++        switch (spd) {
-                               &phys_base) < 0) {
++        case 1:
--                warn_report("Failed to read NUMBER(phys_base)=");
++            /* SPD == 0b01 is reserved, but behaves as 0b00. */
-+                warn_report("Failed to read %s", prefix);
++        case 0:
-             } else {
++            /*
-                 s->dump_info.phys_base = phys_base;
++             * For 0b00 we return true if external secure invasive debug
-             }
++             * is enabled. On real hardware this is controlled by external
 +             * signals to the core. QEMU always permits debug, and behaves
 +             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
 +             */
 +            return true;
 +        case 2:
 +            return false;
 +        case 3:
 +            return true;
 +        }
 +    }
 +
 +    return el != 2;
 +}
 +
 +/*
 + * Return true if debugging exceptions are currently enabled.
 + * This corresponds to what in ARM ARM pseudocode would be
 + *    if UsingAArch32() then
 + *        return AArch32.GenerateDebugExceptions()
 + *    else
 + *        return AArch64.GenerateDebugExceptions()
 + * We choose to push the if() down into this function for clarity,
 + * since the pseudocode has it at all callsites except for the one in
 + * CheckSoftwareStep(), where it is elided because both branches would
 + * always return the same value.
 + */
 +bool arm_generate_debug_exceptions(CPUARMState *env)
 +{
 +    if (env->aarch64) {
 +        return aa64_generate_debug_exceptions(env);
 +    } else {
 +        return aa32_generate_debug_exceptions(env);
 +    }
 +}
 +
  /*
   * Is single-stepping active? (Note that the "is EL_D AArch64?" check
   * implicitly means this always returns false in pre-v8 CPUs.)
 --
-.16.2
+.25.1

-New patch
+[PULL 06/28] target/arm: Use is_a64 in arm_generate_debug_exceptions
+From: Richard Henderson <richard.henderson@linaro.org>
+Use the accessor rather than the raw structure member.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-7-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/debug_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
+  */
+ bool arm_generate_debug_exceptions(CPUARMState *env)
+ {
+-    if (env->aarch64) {
++    if (is_a64(env)) {
+         return aa64_generate_debug_exceptions(env);
+     } else {
+         return aa32_generate_debug_exceptions(env);
+--
+.25.1

-New patch
+[PULL 07/28] target/arm: Move exception_bkpt_insn to debug_helper.c
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-8-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/debug_helper.c | 31 +++++++++++++++++++++++++++++++
+ target/arm/op_helper.c    | 29 -----------------------------
+files changed, 31 insertions(+), 29 deletions(-)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
+     }
+ }
++/*
++ * Raise an EXCP_BKPT with the specified syndrome register value,
++ * targeting the correct exception level for debug exceptions.
++ */
++void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
++{
++    int debug_el = arm_debug_target_el(env);
++    int cur_el = arm_current_el(env);
++
++    /* FSR will only be used if the debug target EL is AArch32. */
++    env->exception.fsr = arm_debug_exception_fsr(env);
++    /*
++     * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
++     * values to the guest that it shouldn't be able to see at its
++     * exception/security level.
++     */
++    env->exception.vaddress = 0;
++    /*
++     * Other kinds of architectural debug exception are ignored if
++     * they target an exception level below the current one (in QEMU
++     * this is checked by arm_generate_debug_exceptions()). Breakpoint
++     * instructions are special because they always generate an exception
++     * to somewhere: if they can't go to the configured debug exception
++     * level they are taken to the current exception level.
++     */
++    if (debug_el < cur_el) {
++        debug_el = cur_el;
++    }
++    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
++}
++
+ #if !defined(CONFIG_USER_ONLY)
+ vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
+     raise_exception(env, excp, syndrome, target_el);
+ }
+-/* Raise an EXCP_BKPT with the specified syndrome register value,
+- * targeting the correct exception level for debug exceptions.
+- */
+-void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+-{
+-    int debug_el = arm_debug_target_el(env);
+-    int cur_el = arm_current_el(env);
+-
+-    /* FSR will only be used if the debug target EL is AArch32. */
+-    env->exception.fsr = arm_debug_exception_fsr(env);
+-    /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
+-     * values to the guest that it shouldn't be able to see at its
+-     * exception/security level.
+-     */
+-    env->exception.vaddress = 0;
+-    /*
+-     * Other kinds of architectural debug exception are ignored if
+-     * they target an exception level below the current one (in QEMU
+-     * this is checked by arm_generate_debug_exceptions()). Breakpoint
+-     * instructions are special because they always generate an exception
+-     * to somewhere: if they can't go to the configured debug exception
+-     * level they are taken to the current exception level.
+-     */
+-    if (debug_el < cur_el) {
+-        debug_el = cur_el;
+-    }
+-    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+-}
+-
+ uint32_t HELPER(cpsr_read)(CPUARMState *env)
+ {
+     return cpsr_read(env) & ~CPSR_EXEC;
+--
+.25.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 08/28] target/arm: Move arm_debug_exception_fsr to debug_helper.c
-Now we have separate types for BCM2386 and BCM2387, we might as well
+From: Richard Henderson <richard.henderson@linaro.org>
 just hard-code the CPU type they use rather than having it passed
 through as an object property. This then lets us put the initialization
 of the CPU object in init rather than realize.
-Note that this change means that it's no longer possible on
+This function now now only used in debug_helper.c, so there is
-the command line to use -cpu to ask for a different kind of
+no reason to have a declaration in a header.
 CPU than the SoC supports. This was never a supported thing to
 do anyway; we were just not sanity-checking the command line.
-This does require us to only build the bcm2837 object on
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-TARGET_AARCH64 configs, since otherwise it won't instantiate
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-due to the missing cortex-a53 device and "make check" will fail.
+Message-id: 20220609202901.1177572-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/internals.h    | 25 -------------------------
  target/arm/debug_helper.c | 26 ++++++++++++++++++++++++++
 files changed, 26 insertions(+), 25 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
 ---
  hw/arm/bcm2836.c | 24 +++++++++++++++---------
  hw/arm/raspi.c   |  2 --
 files changed, 15 insertions(+), 11 deletions(-)
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/internals.h
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
+     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
- struct BCM283XInfo {
+ }
-     const char *name;
-+    const char *cpu_type;
+-/* Return the FSR value for a debug exception (watchpoint, hardware
-     int clusterid;
+- * breakpoint or BKPT insn) targeting the specified exception level.
- };
+- */
+-static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
- static const BCM283XInfo bcm283x_socs[] = {
+-{
-     {
+-    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
-         .name = TYPE_BCM2836,
+-    int target_el = arm_debug_target_el(env);
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
+-    bool using_lpae = false;
-         .clusterid = 0xf,
+-
-     },
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
-+#ifdef TARGET_AARCH64
+-        using_lpae = true;
-     {
+-    } else {
-         .name = TYPE_BCM2837,
+-        if (arm_feature(env, ARM_FEATURE_LPAE) &&
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
+-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
-         .clusterid = 0x0,
+-            using_lpae = true;
-     },
+-        }
 +#endif
  };
  static void bcm2836_init(Object *obj)
  {
      BCM283XState *s = BCM283X(obj);
 +    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
 +    const BCM283XInfo *info = bc->info;
 +    int n;
 +
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
 +        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 +                          info->cpu_type);
 +        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 +                                  &error_abort);
 +    }
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
 -    obj = OBJECT(dev);
 -    for (n = 0; n < BCM283X_NCPUS; n++) {
 -        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 -                          s->cpu_type);
 -        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 -                                  &error_abort);
 -    }
 -
-     obj = object_property_get_link(OBJECT(dev), "ram", &err);
+-    if (using_lpae) {
-     if (obj == NULL) {
+-        return arm_fi_to_lfsc(&fi);
-         error_setg(errp, "%s: required ram link not found: %s",
+-    } else {
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+-        return arm_fi_to_sfsc(&fi);
 -    }
 -}
 -
  /**
   * arm_num_brps: Return number of implemented breakpoints.
   * Note that the ID register BRPS field is "number of bps - 1",
 diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/debug_helper.c
 +++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      return check_watchpoints(cpu);
  }
- static Property bcm2836_props[] = {
++/*
--    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
++ * Return the FSR value for a debug exception (watchpoint, hardware
-     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
++ * breakpoint or BKPT insn) targeting the specified exception level.
-                        BCM283X_NCPUS),
++ */
-     DEFINE_PROP_END_OF_LIST()
++static uint32_t arm_debug_exception_fsr(CPUARMState *env)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
++{
-index XXXXXXX..XXXXXXX 100644
++    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
---- a/hw/arm/raspi.c
++    int target_el = arm_debug_target_el(env);
-+++ b/hw/arm/raspi.c
++    bool using_lpae = false;
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
++
-     /* Setup the SOC */
++    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
-     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
++        using_lpae = true;
-                                    &error_abort);
++    } else {
--    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
++        if (arm_feature(env, ARM_FEATURE_LPAE) &&
--                            &error_abort);
++            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
-     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
++            using_lpae = true;
-                             &error_abort);
++        }
-     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
++    }
 +
 +    if (using_lpae) {
 +        return arm_fi_to_lfsc(&fi);
 +    } else {
 +        return arm_fi_to_sfsc(&fi);
 +    }
 +}
 +
  void arm_debug_excp_handler(CPUState *cs)
  {
      /*
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 09/28] target/arm: Rename helper_exception_with_syndrome
-The bcm2837 is pretty similar to the bcm2836, but it does have
+From: Richard Henderson <richard.henderson@linaro.org>
 some differences. Notably, the MPIDR affinity aff1 values it
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
-Rather than trying to have one device with properties that
+Rename to helper_exception_with_syndrome_el, to emphasize
-configure it differently for the two cases, create two
+that the target el is a parameter.
 separate QOM devices for the two SoCs. We use the same approach
 as hw/arm/aspeed_soc.c and share code and have a data table
 that might differ per-SoC. For the moment the two types don't
 actually have different behaviour.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ target/arm/helper.h    | 2 +-
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+ target/arm/translate.h | 6 +++---
- hw/arm/raspi.c           |  3 ++-
+ target/arm/op_helper.c | 6 +++---
-files changed, 53 insertions(+), 6 deletions(-)
+ target/arm/translate.c | 6 +++---
 files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/helper.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
- #define BCM283X_NCPUS 4
+                    i32, i32, i32, i32)
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
-+/* These type names are for specific SoCs; other than instantiating
+-DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
-+ * them, code using these devices should always handle them via the
++DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
-+ */
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
-+#define TYPE_BCM2836 "bcm2836"
+ DEF_HELPER_1(setend, void, env)
-+#define TYPE_BCM2837 "bcm2837"
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 +
  typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
      BCM2835PeripheralState peripherals;
  } BCM283XState;
 +typedef struct BCM283XInfo BCM283XInfo;
 +
 +typedef struct BCM283XClass {
 +    DeviceClass parent_class;
 +    const BCM283XInfo *info;
 +} BCM283XClass;
 +
 +#define BCM283X_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
 +#define BCM283X_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 +
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/translate.h
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
- /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
+ static inline void gen_exception(int excp, uint32_t syndrome,
- #define BCM2836_CONTROL_BASE    0x40000000
+                                  uint32_t target_el)
 +struct BCM283XInfo {
 +    const char *name;
 +};
 +
 +static const BCM283XInfo bcm283x_socs[] = {
 +    {
 +        .name = TYPE_BCM2836,
 +    },
 +    {
 +        .name = TYPE_BCM2837,
 +    },
 +};
 +
  static void bcm2836_init(Object *obj)
  {
-     BCM283XState *s = BCM283X(obj);
+-    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
-@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
+-                                       tcg_constant_i32(syndrome),
-     DEFINE_PROP_END_OF_LIST()
+-                                       tcg_constant_i32(target_el));
- };
++    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
++                                          tcg_constant_i32(syndrome),
--static void bcm2836_class_init(ObjectClass *oc, void *data)
++                                          tcg_constant_i32(target_el));
-+static void bcm283x_class_init(ObjectClass *oc, void *data)
+ }
  /* Generate an architectural singlestep exception */
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(yield)(CPUARMState *env)
   * those EXCP values which are special cases for QEMU to interrupt
   * execution and not to be used for exceptions which are passed to
   * the guest (those must all have syndrome information and thus should
 - * use exception_with_syndrome).
 + * use exception_with_syndrome*).
   */
  void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
  {
-     DeviceClass *dc = DEVICE_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 +    BCM283XClass *bc = BCM283X_CLASS(oc);
 -    dc->props = bcm2836_props;
 +    bc->info = data;
      dc->realize = bcm2836_realize;
 +    dc->props = bcm2836_props;
  }
--static const TypeInfo bcm2836_type_info = {
+ /* Raise an exception with the specified syndrome register value */
-+static const TypeInfo bcm283x_type_info = {
+-void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
-     .name = TYPE_BCM283X,
+-                                     uint32_t syndrome, uint32_t target_el)
-     .parent = TYPE_DEVICE,
++void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
-     .instance_size = sizeof(BCM283XState),
++                                        uint32_t syndrome, uint32_t target_el)
      .instance_init = bcm2836_init,
 -    .class_init = bcm2836_class_init,
 +    .class_size = sizeof(BCM283XClass),
 +    .abstract = true,
  };
  static void bcm2836_register_types(void)
  {
--    type_register_static(&bcm2836_type_info);
+     raise_exception(env, excp, syndrome, target_el);
 +    int i;
 +
 +    type_register_static(&bcm283x_type_info);
 +    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
 +        TypeInfo ti = {
 +            .name = bcm283x_socs[i].name,
 +            .parent = TYPE_BCM283X,
 +            .class_init = bcm283x_class_init,
 +            .class_data = (void *) &bcm283x_socs[i],
 +        };
 +        type_register(&ti);
 +    }
  }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
  type_init(bcm2836_register_types)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
-     BusState *bus;
+ {
-     DeviceState *carddev;
+     gen_set_condexec(s);
+     gen_set_pc_im(s, s->pc_curr);
--    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+-    gen_helper_exception_with_syndrome(cpu_env,
-+    object_initialize(&s->soc, sizeof(s->soc),
+-                                       tcg_constant_i32(excp),
-+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
+-                                       tcg_constant_i32(syn), tcg_el);
-     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
++    gen_helper_exception_with_syndrome_el(cpu_env,
-                               &error_abort);
++                                          tcg_constant_i32(excp),
 +                                          tcg_constant_i32(syn), tcg_el);
      s->base.is_jmp = DISAS_NORETURN;
  }
 --
-.16.2
+.25.1

-New patch
+[PULL 10/28] target/arm: Introduce gen_exception_insn_el_v
+From: Richard Henderson <richard.henderson@linaro.org>
+Create a function below gen_exception_insn that takes
+the target_el as a TCGv_i32, replacing gen_exception_el.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-11-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 27 ++++++++++++---------------
+file changed, 12 insertions(+), 15 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el)
++static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
++                                    uint32_t syn, TCGv_i32 tcg_el)
+ {
+     if (s->aarch64) {
+         gen_a64_set_pc_im(pc);
+@@ -XXX,XX +XXX,XX @@ void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+         gen_set_condexec(s);
+         gen_set_pc_im(s, pc);
+     }
+-    gen_exception(excp, syn, target_el);
++    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
++                                          tcg_constant_i32(syn), tcg_el);
+     s->base.is_jmp = DISAS_NORETURN;
+ }
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
++                        uint32_t syn, uint32_t target_el)
++{
++    gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
++}
++
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ {
+     gen_set_condexec(s);
+@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s)
+                        default_exception_el(s));
+ }
+-static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
+-                             TCGv_i32 tcg_el)
+-{
+-    gen_set_condexec(s);
+-    gen_set_pc_im(s, s->pc_curr);
+-    gen_helper_exception_with_syndrome_el(cpu_env,
+-                                          tcg_constant_i32(excp),
+-                                          tcg_constant_i32(syn), tcg_el);
+-    s->base.is_jmp = DISAS_NORETURN;
+-}
+-
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+ void gen_lookup_tb(DisasContext *s)
+ {
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+                 tcg_el = tcg_constant_i32(3);
+             }
+-            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
++            gen_exception_insn_el_v(s, s->pc_curr, EXCP_UDEF,
++                                    syn_uncategorized(), tcg_el);
+             tcg_temp_free_i32(tcg_el);
+             return false;
+         }
+--
+.25.1

-New patch
+[PULL 11/28] target/arm: Rename gen_exception_insn to gen_exception_insn_el
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h        |  4 ++--
+ target/arm/translate-a64.c    | 36 ++++++++++++++++----------------
+ target/arm/translate-m-nocp.c | 16 +++++++-------
+ target/arm/translate-mve.c    |  4 ++--
+ target/arm/translate-vfp.c    |  6 +++---
+ target/arm/translate.c        | 39 ++++++++++++++++++-----------------
+files changed, 53 insertions(+), 52 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
+ void arm_gen_test_cc(int cc, TCGLabel *label);
+ MemOp pow2_align(unsigned i);
+ void unallocated_encoding(DisasContext *s);
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el);
++void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
++                           uint32_t syn, uint32_t target_el);
+ /* Return state of Alternate Half-precision flag, caller frees result */
+ static inline TCGv_i32 get_ahp_flag(void)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
+         assert(!s->fp_access_checked);
+         s->fp_access_checked = true;
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_fp_access_trap(1, 0xe, false, 0),
+-                           s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_fp_access_trap(1, 0xe, false, 0),
++                              s->fp_excp_el);
+         return false;
+     }
+     s->fp_access_checked = true;
+@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
+         assert(!s->sve_access_checked);
+         s->sve_access_checked = true;
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_sve_access_trap(), s->sve_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_sve_access_trap(), s->sve_excp_el);
+         return false;
+     }
+     s->sve_access_checked = true;
+@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
+     } else {
+         syndrome = syn_uncategorized();
+     }
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome,
+-                       default_exception_el(s));
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
++                          default_exception_el(s));
+ }
+ /* MRS - move from system register
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+         switch (op2_ll) {
+         case 1:                                                     /* SVC */
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
+-                               syn_aa64_svc(imm16), default_exception_el(s));
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
++                                  syn_aa64_svc(imm16), default_exception_el(s));
+             break;
+         case 2:                                                     /* HVC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+             gen_a64_set_pc_im(s->pc_curr);
+             gen_helper_pre_hvc(cpu_env);
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
+-                               syn_aa64_hvc(imm16), 2);
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_HVC,
++                                  syn_aa64_hvc(imm16), 2);
+             break;
+         case 3:                                                     /* SMC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+             gen_a64_set_pc_im(s->pc_curr);
+             gen_helper_pre_smc(cpu_env, tcg_constant_i32(syn_aa64_smc(imm16)));
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
+-                               syn_aa64_smc(imm16), 3);
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_SMC,
++                                  syn_aa64_smc(imm16), 3);
+             break;
+         default:
+             unallocated_encoding(s);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+             if (s->btype != 0
+                 && s->guarded_page
+                 && !btype_destination_ok(insn, s->bt, s->btype)) {
+-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                                   syn_btitrap(s->btype),
+-                                   default_exception_el(s));
++                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                                      syn_btitrap(s->btype),
++                                      default_exception_el(s));
+                 return;
+             }
+         } else {
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-m-nocp.c
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+     tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+     if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return true;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
+         if (!vfp_access_check_m(s, true)) {
+             /*
+              * This was only a conditional exception, so override
+-             * gen_exception_insn()'s default to DISAS_NORETURN
++             * gen_exception_insn_el()'s default to DISAS_NORETURN
+              */
+             s->base.is_jmp = DISAS_NEXT;
+             break;
+@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+         if (!vfp_access_check_m(s, true)) {
+             /*
+              * This was only a conditional exception, so override
+-             * gen_exception_insn()'s default to DISAS_NORETURN
++             * gen_exception_insn_el()'s default to DISAS_NORETURN
+              */
+             s->base.is_jmp = DISAS_NEXT;
+             break;
+@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+     }
+     if (a->cp != 10) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), default_exception_el(s));
+         return true;
+     }
+     if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return true;
+     }
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
+         return true;
+     default:
+         /* Reserved value: INVSTATE UsageFault */
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         return false;
+     }
+ }
+diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c
++++ b/target/arm/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
+         int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
+         uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+         return false;
+     }
+@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
+          * the encoding space handled by the patterns in m-nocp.decode,
+          * and for them we may need to raise NOCP here.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return false;
+     }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el)
++void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
++                           uint32_t syn, uint32_t target_el)
+ {
+     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ void unallocated_encoding(DisasContext *s)
+ {
+     /* Unallocated and reserved encodings are uncategorized */
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+-                       default_exception_el(s));
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
++                          default_exception_el(s));
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+ undef:
+     /* If we get here then some access check did not pass */
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                       syn_uncategorized(), exc_target);
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                          syn_uncategorized(), exc_target);
+     return false;
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
+      * For the UNPREDICTABLE cases we choose to UNDEF.
+      */
+     if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_uncategorized(), 3);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
+          * Do the check-and-raise-exception by hand.
+          */
+         if (s->fp_excp_el) {
+-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                               syn_uncategorized(), s->fp_excp_el);
++            gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                                  syn_uncategorized(), s->fp_excp_el);
+             return true;
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
+         tmp = load_cpu_field(v7m.ltpsize);
+         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
+         tcg_temp_free_i32(tmp);
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         gen_set_label(skipexc);
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+      * UsageFault exception.
+      */
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(dc));
++        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(dc));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          */
+         tcg_remove_ops_after(dc->insn_eci_rewind);
+         dc->condjmp = 0;
+-        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(dc));
++        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(dc));
+     }
+     arm_post_translate_insn(dc);
+--
+.25.1

-New patch
+[PULL 12/28] target/arm: Introduce gen_exception_insn
+From: Richard Henderson <richard.henderson@linaro.org>
+Create a new wrapper function that passes the default
+exception target to gen_exception_insn_el.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-13-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h        |  1 +
+ target/arm/translate-a64.c    | 15 ++++++---------
+ target/arm/translate-m-nocp.c |  3 +--
+ target/arm/translate-mve.c    |  3 +--
+ target/arm/translate.c        | 29 +++++++++++++----------------
+files changed, 22 insertions(+), 29 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ MemOp pow2_align(unsigned i);
+ void unallocated_encoding(DisasContext *s);
+ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                            uint32_t syn, uint32_t target_el);
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn);
+ /* Return state of Alternate Half-precision flag, caller frees result */
+ static inline TCGv_i32 get_ahp_flag(void)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
+     } else {
+         syndrome = syn_uncategorized();
+     }
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
+-                          default_exception_el(s));
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome);
+ }
+ /* MRS - move from system register
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+         switch (op2_ll) {
+         case 1:                                                     /* SVC */
+             gen_ss_advance(s);
+-            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
+-                                  syn_aa64_svc(imm16), default_exception_el(s));
++            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
++                               syn_aa64_svc(imm16));
+             break;
+         case 2:                                                     /* HVC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+             if (s->btype != 0
+                 && s->guarded_page
+                 && !btype_destination_ok(insn, s->bt, s->btype)) {
+-                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                                      syn_btitrap(s->btype),
+-                                      default_exception_el(s));
++                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
++                                   syn_btitrap(s->btype));
+                 return;
+             }
+         } else {
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-m-nocp.c
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+     }
+     if (a->cp != 10) {
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+-                              syn_uncategorized(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized());
+         return true;
+     }
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
+         return true;
+     default:
+         /* Reserved value: INVSTATE UsageFault */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         return false;
+     }
+ }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+ }
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
++{
++    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
++}
++
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ {
+     gen_set_condexec(s);
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ void unallocated_encoding(DisasContext *s)
+ {
+     /* Unallocated and reserved encodings are uncategorized */
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+-                          default_exception_el(s));
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+      * an exception and return false. Otherwise it will return true,
+      * and set *tgtmode and *regno appropriately.
+      */
+-    int exc_target = default_exception_el(s);
+-
+     /* These instructions are present only in ARMv8, or in ARMv7 with the
+      * Virtualization Extensions.
+      */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+ undef:
+     /* If we get here then some access check did not pass */
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                          syn_uncategorized(), exc_target);
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
+     return false;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
+         tmp = load_cpu_field(v7m.ltpsize);
+         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
+         tcg_temp_free_i32(tmp);
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         gen_set_label(skipexc);
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+      * UsageFault exception.
+      */
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(dc));
++        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          */
+         tcg_remove_ops_after(dc->insn_eci_rewind);
+         dc->condjmp = 0;
+-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(dc));
++        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE,
++                           syn_uncategorized());
+     }
+     arm_post_translate_insn(dc);
+--
+.25.1

-New patch
+[PULL 13/28] target/arm: Create helper_exception_swstep
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the computation from gen_swstep_exception into a helper.
+This fixes a bug when:
+  - MDSCR_EL1.KDE == 1 to enable debug exceptions within EL_D itself
+  - we singlestep an ERET from EL_D to some lower EL
+Previously we were computing 'same el' based on the EL which
+executed the ERET instruction, whereas it ought to be computed
+based on the EL to which ERET returned.  This happens naturally
+with the new helper, which runs after EL has been changed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-14-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.h       |  1 +
+ target/arm/translate.h    | 12 +++---------
+ target/arm/debug_helper.c | 16 ++++++++++++++++
+files changed, 20 insertions(+), 9 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
+ DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
++DEF_HELPER_2(exception_swstep, noreturn, env, i32)
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
+ DEF_HELPER_1(setend, void, env)
+ DEF_HELPER_2(wfi, void, env, i32)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
+ /* Generate an architectural singlestep exception */
+ static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
+ {
+-    bool same_el = (s->debug_target_el == s->current_el);
+-
+-    /*
+-     * If singlestep is targeting a lower EL than the current one,
+-     * then s->ss_active must be false and we can never get here.
+-     */
+-    assert(s->debug_target_el >= s->current_el);
+-
+-    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
++    /* Fill in the same_el field of the syndrome in the helper. */
++    uint32_t syn = syn_swstep(false, isv, ex);
++    gen_helper_exception_swstep(cpu_env, tcg_constant_i32(syn));
+ }
+ /*
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+ }
++void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
++{
++    int debug_el = arm_debug_target_el(env);
++    int cur_el = arm_current_el(env);
++
++    /*
++     * If singlestep is targeting a lower EL than the current one, then
++     * DisasContext.ss_active must be false and we can never get here.
++     */
++    assert(debug_el >= cur_el);
++    if (debug_el == cur_el) {
++        syndrome |= 1 << ARM_EL_EC_SHIFT;
++    }
++    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
++}
++
+ #if !defined(CONFIG_USER_ONLY)
+ vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+--
+.25.1

-New patch
+[PULL 14/28] target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
+From: Richard Henderson <richard.henderson@linaro.org>
+We no longer need this value during translation,
+as it is now handled within the helpers.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-15-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           |  6 ++----
+ target/arm/translate.h     |  2 --
+ target/arm/helper.c        | 12 ++----------
+ target/arm/translate-a64.c |  1 -
+ target/arm/translate.c     |  1 -
+files changed, 4 insertions(+), 18 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, BE_DATA, 3, 1)
+ FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
+ /* Target EL if we take a floating-point-disabled exception */
+ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
+-/* For A-profile only, target EL for debug exceptions.  */
+-FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
+ /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
+-FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+-FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
++FIELD(TBFLAG_ANY, ALIGN_MEM, 10, 1)
++FIELD(TBFLAG_ANY, PSTATE__IL, 11, 1)
+ /*
+  * Bit usage when in AArch32 state, both A- and M-profile.
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+      */
+     uint32_t svc_imm;
+     int current_el;
+-    /* Debug target exception level for single-step exceptions */
+-    int debug_target_el;
+     GHashTable *cp_regs;
+     uint64_t features; /* CPU features bits */
+     bool aarch64;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
+     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+ }
+-static CPUARMTBFlags rebuild_hflags_aprofile(CPUARMState *env)
+-{
+-    CPUARMTBFlags flags = {};
+-
+-    DP_TBFLAG_ANY(flags, DEBUG_TARGET_EL, arm_debug_target_el(env));
+-    return flags;
+-}
+-
+ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+                                         ARMMMUIdx mmu_idx)
+ {
+-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
++    CPUARMTBFlags flags = {};
+     int el = arm_current_el(env);
+     if (arm_sctlr(env, el) & SCTLR_A) {
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+                                         ARMMMUIdx mmu_idx)
+ {
+-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
++    CPUARMTBFlags flags = {};
+     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
+     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+     uint64_t sctlr;
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->ss_active = EX_TBFLAG_ANY(tb_flags, SS_ACTIVE);
+     dc->pstate_ss = EX_TBFLAG_ANY(tb_flags, PSTATE__SS);
+     dc->is_ldex = false;
+-    dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
+     /* Bound the number of insns to execute to those left on the page.  */
+     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+         dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
+         dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
+     } else {
+-        dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
+         dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
+         dc->hstr_active = EX_TBFLAG_A32(tb_flags, HSTR_ACTIVE);
+         dc->ns = EX_TBFLAG_A32(tb_flags, NS);
+--
+.25.1

-New patch
+[PULL 15/28] target/arm: Move gen_exception to translate.c
+From: Richard Henderson <richard.henderson@linaro.org>
+This function is not required by any other translation file.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-16-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h | 8 --------
+ target/arm/translate.c | 7 +++++++
+files changed, 7 insertions(+), 8 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
+     }
+ }
+-static inline void gen_exception(int excp, uint32_t syndrome,
+-                                 uint32_t target_el)
+-{
+-    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+-                                          tcg_constant_i32(syndrome),
+-                                          tcg_constant_i32(target_el));
+-}
+-
+ /* Generate an architectural singlestep exception */
+ static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
+ {
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
++static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
++{
++    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
++                                          tcg_constant_i32(syndrome),
++                                          tcg_constant_i32(target_el));
++}
++
+ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+                                     uint32_t syn, TCGv_i32 tcg_el)
+ {
+--
+.25.1

-New patch
+[PULL 16/28] target/arm: Rename gen_exception to gen_exception_el
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-17-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 18 +++++++++---------
+file changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
++static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
+ {
+     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                           tcg_constant_i32(syndrome),
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+         switch (dc->base.is_jmp) {
+         case DISAS_SWI:
+             gen_ss_advance(dc);
+-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+-                          default_exception_el(dc));
++            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
++                             default_exception_el(dc));
+             break;
+         case DISAS_HVC:
+             gen_ss_advance(dc);
+-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
++            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+             break;
+         case DISAS_SMC:
+             gen_ss_advance(dc);
+-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
++            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
+             break;
+         case DISAS_NEXT:
+         case DISAS_TOO_MANY:
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+             gen_helper_yield(cpu_env);
+             break;
+         case DISAS_SWI:
+-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+-                          default_exception_el(dc));
++            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
++                             default_exception_el(dc));
+             break;
+         case DISAS_HVC:
+-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
++            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+             break;
+         case DISAS_SMC:
+-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
++            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
+             break;
+         }
+     }
+--
+.25.1

-New patch
+[PULL 17/28] target/arm: Introduce gen_exception
+From: Richard Henderson <richard.henderson@linaro.org>
+Create a new wrapper function that passes the default
+exception target to gen_exception_el.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-18-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 11 +++++++----
+file changed, 7 insertions(+), 4 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
+                                           tcg_constant_i32(target_el));
+ }
++static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
++{
++    gen_exception_el(excp, syndrome, default_exception_el(s));
++}
++
+ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+                                     uint32_t syn, TCGv_i32 tcg_el)
+ {
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+         switch (dc->base.is_jmp) {
+         case DISAS_SWI:
+             gen_ss_advance(dc);
+-            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+-                             default_exception_el(dc));
++            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+             break;
+         case DISAS_HVC:
+             gen_ss_advance(dc);
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+             gen_helper_yield(cpu_env);
+             break;
+         case DISAS_SWI:
+-            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+-                             default_exception_el(dc));
++            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+             break;
+         case DISAS_HVC:
+             gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+--
+.25.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 18/28] target/arm: Introduce gen_exception_el_v
-The raspi3 has AArch64 CPUs, which means that our smpboot
+From: Richard Henderson <richard.henderson@linaro.org>
 code for keeping the secondary CPUs in a pen needs to have
 a version for A64 as well as A32. Without this, the
 secondary CPUs go into an infinite loop of taking undefined
 instruction exceptions.
+Split out a common helper function for gen_exception_el
+and gen_exception_insn_el_v.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-19-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ target/arm/translate.c | 13 ++++++++-----
-file changed, 40 insertions(+), 1 deletion(-)
+file changed, 8 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+     s->base.is_jmp = DISAS_NORETURN;
  #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
  #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 +#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
  /* Table of Linux board IDs for different Pi versions */
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                         info->smp_loader_start);
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+-static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
-+{
++static void gen_exception_el_v(int excp, uint32_t syndrome, TCGv_i32 tcg_el)
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+ {
-+     * The mechanism for doing the spin-table is also entirely different.
+     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
-+     * We must have four 64-bit fields at absolute addresses
+-                                          tcg_constant_i32(syndrome),
-+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+-                                          tcg_constant_i32(target_el));
-+     * our CPUs, and which we must ensure are zero initialized before
++                                          tcg_constant_i32(syndrome), tcg_el);
 +     * the primary CPU goes into the kernel. We put these variables inside
 +     * a rom blob, so that the reset for ROM contents zeroes them for us.
 +     */
 +    static const uint32_t smpboot[] = {
 +        0xd2801b05, /*        mov     x5, 0xd8 */
 +        0xd53800a6, /*        mrs     x6, mpidr_el1 */
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
 +    static const uint64_t spintables[] = {
 +        0, 0, 0, 0
 +    };
 +
 +    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
 +                       info->smp_loader_start);
 +    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
 +                       SPINTABLE_ADDR);
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
++static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
- {
++{
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
++    gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+ }
-     /* Pi2 and Pi3 requires SMP setup */
-     if (version >= 2) {
+ static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
-         binfo.smp_loader_start = SMPBOOT_ADDR;
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
--        binfo.write_secondary_boot = write_smpboot;
+         gen_set_condexec(s);
-+        if (version == 2) {
+         gen_set_pc_im(s, pc);
 +            binfo.write_secondary_boot = write_smpboot;
 +        } else {
 +            binfo.write_secondary_boot = write_smpboot64;
 +        }
          binfo.secondary_cpu_reset_hook = reset_secondary;
      }
+-    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+-                                          tcg_constant_i32(syn), tcg_el);
++    gen_exception_el_v(excp, syn, tcg_el);
+     s->base.is_jmp = DISAS_NORETURN;
+ }
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+[PULL 19/28] target/arm: Introduce helper_exception_with_syndrome
-Our BCM2836 type is really a generic one that can be any of
+From: Richard Henderson <richard.henderson@linaro.org>
 the bcm283x family. Rename it accordingly. We change only
 the names which are visible via the header file to the
 rest of the QEMU code, leaving private function names
 in bcm2836.c as they are.
-This is a preliminary to making bcm283x be an abstract
+With the helper we can use exception_target_el at runtime,
-parent class to specific types for the bcm2836 and bcm2837.
+instead of default_exception_el at translate time.
 While we're at it, remove the DisasContext parameter from
 gen_exception, as it is no longer used.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 12 ++++++------
+ target/arm/helper.h    |  1 +
- hw/arm/bcm2836.c         | 17 +++++++++--------
+ target/arm/op_helper.c | 10 ++++++++++
- hw/arm/raspi.c           | 16 ++++++++--------
+ target/arm/translate.c | 18 +++++++++++++-----
-files changed, 23 insertions(+), 22 deletions(-)
+files changed, 24 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/helper.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
- #include "hw/arm/bcm2835_peripherals.h"
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
- #include "hw/intc/bcm2836_control.h"
+                    i32, i32, i32, i32)
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
--#define TYPE_BCM2836 "bcm2836"
++DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
--#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+ DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
-+#define TYPE_BCM283X "bcm283x"
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
-+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
+ DEF_HELPER_2(exception_swstep, noreturn, env, i32)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 -#define BCM2836_NCPUS 4
 +#define BCM283X_NCPUS 4
 -typedef struct BCM2836State {
 +typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
      /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
      char *cpu_type;
      uint32_t enabled_cpus;
 -    ARMCPU cpus[BCM2836_NCPUS];
 +    ARMCPU cpus[BCM283X_NCPUS];
      BCM2836ControlState control;
      BCM2835PeripheralState peripherals;
 -} BCM2836State;
 +} BCM283XState;
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/op_helper.c
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
+     raise_exception(env, excp, syndrome, target_el);
- static void bcm2836_init(Object *obj)
+ }
 +/*
 + * Raise an exception with the specified syndrome register value
 + * to the default target el.
 + */
 +void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 +                                     uint32_t syndrome)
 +{
 +    raise_exception(env, excp, syndrome, exception_target_el(env));
 +}
 +
  uint32_t HELPER(cpsr_read)(CPUARMState *env)
  {
--    BCM2836State *s = BCM2836(obj);
+     return cpsr_read(env) & ~CPSR_EXEC;
-+    BCM283XState *s = BCM283X(obj);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
+--- a/target/arm/translate.c
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
+     gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
- static void bcm2836_realize(DeviceState *dev, Error **errp)
+ }
 -static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
 +static void gen_exception(int excp, uint32_t syndrome)
  {
--    BCM2836State *s = BCM2836(dev);
+-    gen_exception_el(excp, syndrome, default_exception_el(s));
-+    BCM283XState *s = BCM283X(dev);
++    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
-     Object *obj;
++                                       tcg_constant_i32(syndrome));
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
      obj = OBJECT(dev);
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                            s->cpu_type);
          object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          /* Mirror bcm2836, which has clusterid set to 0xf
           * TODO: this should be converted to a property of ARM_CPU
           */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
- static Property bcm2836_props[] = {
+ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
--    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
+@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
--    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
-+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+ void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
-+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+ {
-+                       BCM283X_NCPUS),
+-    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
-     DEFINE_PROP_END_OF_LIST()
++    if (s->aarch64) {
- };
++        gen_a64_set_pc_im(pc);
++    } else {
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
++        gen_set_condexec(s);
 +        gen_set_pc_im(s, pc);
 +    }
 +    gen_exception(excp, syn);
 +    s->base.is_jmp = DISAS_NORETURN;
  }
- static const TypeInfo bcm2836_type_info = {
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
--    .name = TYPE_BCM2836,
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-+    .name = TYPE_BCM283X,
+         switch (dc->base.is_jmp) {
-     .parent = TYPE_DEVICE,
+         case DISAS_SWI:
--    .instance_size = sizeof(BCM2836State),
+             gen_ss_advance(dc);
-+    .instance_size = sizeof(BCM283XState),
+-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
-     .instance_init = bcm2836_init,
++            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
-     .class_init = bcm2836_class_init,
+             break;
- };
+         case DISAS_HVC:
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+             gen_ss_advance(dc);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
---- a/hw/arm/raspi.c
+             gen_helper_yield(cpu_env);
-+++ b/hw/arm/raspi.c
+             break;
-@@ -XXX,XX +XXX,XX @@
+         case DISAS_SWI:
- static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
+-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
++            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
- typedef struct RasPiState {
+             break;
--    BCM2836State soc;
+         case DISAS_HVC:
-+    BCM283XState soc;
+             gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
      MemoryRegion ram;
  } RasPiState;
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
  }
  DEFINE_MACHINE("raspi3", raspi3_machine_init)
 --
-.16.2
+.25.1

-New patch
+[PULL 20/28] target/arm: Remove default_exception_el
+From: Richard Henderson <richard.henderson@linaro.org>
+This function is no longer used.  At the same time, remove
+DisasContext.secure_routed_to_el3, as it in turn becomes unused.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-21-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h     | 16 ----------------
+ target/arm/translate-a64.c |  5 -----
+ target/arm/translate.c     |  5 -----
+files changed, 26 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     int fp_excp_el; /* FP exception EL or 0 if enabled */
+     int sve_excp_el; /* SVE exception EL or 0 if enabled */
+     int vl;          /* current vector length in bytes */
+-    /* Flag indicating that exceptions from secure mode are routed to EL3. */
+-    bool secure_routed_to_el3;
+     bool vfp_enabled; /* FP enabled via FPSCR.EN */
+     int vec_len;
+     int vec_stride;
+@@ -XXX,XX +XXX,XX @@ static inline int get_mem_index(DisasContext *s)
+     return arm_to_core_mmu_idx(s->mmu_idx);
+ }
+-/* Function used to determine the target exception EL when otherwise not known
+- * or default.
+- */
+-static inline int default_exception_el(DisasContext *s)
+-{
+-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
+-     * there is no secure EL1, so we route exceptions to EL3.  Otherwise,
+-     * exceptions can only be routed to ELs above 1, so we target the higher of
+-     * 1 or the current EL.
+-     */
+-    return (s->mmu_idx == ARMMMUIdx_SE10_0 && s->secure_routed_to_el3)
+-            ? 3 : MAX(1, s->current_el);
+-}
+-
+ static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+ {
+     /* We don't need to save all of the syndrome so we mask and shift
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->condjmp = 0;
+     dc->aarch64 = true;
+-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
+-     * there is no secure EL1, so we route exceptions to EL3.
+-     */
+-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
+-                               !arm_el_is_aa64(env, 3);
+     dc->thumb = false;
+     dc->sctlr_b = 0;
+     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+     dc->condjmp = 0;
+     dc->aarch64 = false;
+-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
+-     * there is no secure EL1, so we route exceptions to EL3.
+-     */
+-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
+-                               !arm_el_is_aa64(env, 3);
+     dc->thumb = EX_TBFLAG_AM32(tb_flags, THUMB);
+     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
+     condexec = EX_TBFLAG_AM32(tb_flags, CONDEXEC);
+--
+.25.1

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 21/28] target/arm: Create raise_exception_debug
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Code of imx_update() is slightly confusing since the "flags" variable
+Handle the debug vs current el exception test in one place.
-doesn't really corespond to anything in real hardware and server as a
+Leave EXCP_BKPT alone, since that treats debug < current differently.
 kitchensink accumulating events normally reported via USR1 and USR2
 registers.
-Change the code to explicitly evaluate state of interrupts reported
-via USR1 and USR2 against corresponding masking bits and use the to
-detemine if IRQ line should be asserted or not.
-NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
-reasons:
-. Emulation code implements a single character FIFO, so this flag
-       will always be set since characters are trasmitted as a part of
-       the code emulating "push" into the FIFO
-. imx_update() is really just a function doing ORing and maksing
-       of reported events, so checking for UTS1_TXEMPTY should happen,
-       if it's ever really needed should probably happen outside of
-       it.
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: Bill Paul <wpaul@windriver.com>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-22-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/imx_serial.c | 24 ++++++++++++++++--------
+ target/arm/debug_helper.c | 44 +++++++++++++++++++++------------------
-file changed, 16 insertions(+), 8 deletions(-)
+file changed, 24 insertions(+), 20 deletions(-)
-diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/target/arm/debug_helper.c
-+++ b/hw/char/imx_serial.c
++++ b/target/arm/debug_helper.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-proto.h"
- static void imx_update(IMXSerialState *s)
 +/*
 + * Raise an exception to the debug target el.
 + * Modify syndrome to indicate when origin and target EL are the same.
 + */
 +G_NORETURN static void
 +raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
 +{
 +    int debug_el = arm_debug_target_el(env);
 +    int cur_el = arm_current_el(env);
 +
 +    /*
 +     * If singlestep is targeting a lower EL than the current one, then
 +     * DisasContext.ss_active must be false and we can never get here.
 +     * Similarly for watchpoint and breakpoint matches.
 +     */
 +    assert(debug_el >= cur_el);
 +    syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
 +    raise_exception(env, excp, syndrome, debug_el);
 +}
 +
  /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
  static bool aa64_generate_debug_exceptions(CPUARMState *env)
  {
--    uint32_t flags;
+@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
-+    uint32_t usr1;
+     if (wp_hit) {
-+    uint32_t usr2;
+         if (wp_hit->flags & BP_CPU) {
-+    uint32_t mask;
+             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
+-            bool same_el = arm_debug_target_el(env) == arm_current_el(env);
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
--    if (s->ucr1 & UCR1_TXMPTYEN) {
+             cs->watchpoint_hit = NULL;
--        flags |= (s->uts1 & UTS1_TXEMPTY);
--    } else {
+             env->exception.fsr = arm_debug_exception_fsr(env);
--        flags &= ~USR1_TRDY;
+             env->exception.vaddress = wp_hit->hitaddr;
 -            raise_exception(env, EXCP_DATA_ABORT,
 -                    syn_watchpoint(same_el, 0, wnr),
 -                    arm_debug_target_el(env));
 +            raise_exception_debug(env, EXCP_DATA_ABORT,
 +                                  syn_watchpoint(0, 0, wnr));
          }
      } else {
          uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 -        bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
          /*
           * (1) GDB breakpoints should be handled first.
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
           * exception/security level.
           */
          env->exception.vaddress = 0;
 -        raise_exception(env, EXCP_PREFETCH_ABORT,
 -                        syn_breakpoint(same_el),
 -                        arm_debug_target_el(env));
 +        raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
      }
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
  void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
  {
 -    int debug_el = arm_debug_target_el(env);
 -    int cur_el = arm_current_el(env);
 -
 -    /*
 -     * If singlestep is targeting a lower EL than the current one, then
 -     * DisasContext.ss_active must be false and we can never get here.
 -     */
 -    assert(debug_el >= cur_el);
 -    if (debug_el == cur_el) {
 -        syndrome |= 1 << ARM_EL_EC_SHIFT;
 -    }
-+    /*
+-    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
++    raise_exception_debug(env, EXCP_UDEF, syndrome);
 +     * UCR1, so we can get away with something as simple as the
 +     * following:
 +     */
 +    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
 +    /*
 +     * Bits that we want in USR2 are not as conveniently laid out,
 +     * unfortunately.
 +     */
 +    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    usr2 = s->usr2 & mask;
 -    qemu_set_irq(s->irq, !!flags);
 +    qemu_set_irq(s->irq, usr1 || usr2);
  }
- static void imx_serial_reset(IMXSerialState *s)
+ #if !defined(CONFIG_USER_ONLY)
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+[PULL 22/28] target/arm: Move arm_debug_target_el to debug_helper.c
-If we're directly booting a Linux kernel and the CPU supports both
+From: Richard Henderson <richard.henderson@linaro.org>
 EL3 and EL2, we start the kernel in EL2, as it expects. We must also
 set the SCR_EL3.HCE bit in this situation, so that the HVC
 instruction is enabled rather than UNDEFing. Otherwise at least some
 kernels will panic when trying to initialize KVM in the guest.
+This function is no longer used outside debug_helper.c.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-23-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 5 +++++
+ target/arm/cpu.h          | 21 ---------------------
-file changed, 5 insertions(+)
+ target/arm/debug_helper.c | 21 +++++++++++++++++++++
 files changed, 21 insertions(+), 21 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/boot.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
-                     assert(!info->secure_board_setup);
+     ARMASIdx_TagS = 3,
-                 }
+ } ARMASIdx;
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+-/* Return the Exception Level targeted by debug exceptions. */
-+                    /* If we have EL2 then Linux expects the HVC insn to work */
+-static inline int arm_debug_target_el(CPUARMState *env)
-+                    env->cp15.scr_el3 |= SCR_HCE;
+-{
-+                }
+-    bool secure = arm_is_secure(env);
 -    bool route_to_el2 = false;
 -
 -    if (arm_is_el2_enabled(env)) {
 -        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
 -                       env->cp15.mdcr_el2 & MDCR_TDE;
 -    }
 -
 -    if (route_to_el2) {
 -        return 2;
 -    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
 -               !arm_el_is_aa64(env, 3) && secure) {
 -        return 3;
 -    } else {
 -        return 1;
 -    }
 -}
 -
  static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
  {
      /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
 diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/debug_helper.c
 +++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
 +/* Return the Exception Level targeted by debug exceptions. */
 +static int arm_debug_target_el(CPUARMState *env)
 +{
 +    bool secure = arm_is_secure(env);
 +    bool route_to_el2 = false;
 +
-                 /* Set to non-secure if not a secure boot */
++    if (arm_is_el2_enabled(env)) {
-                 if (!info->secure_boot &&
++        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
-                     (cs != first_cpu || !info->secure_board_setup)) {
++                       env->cp15.mdcr_el2 & MDCR_TDE;
 +    }
 +
 +    if (route_to_el2) {
 +        return 2;
 +    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
 +               !arm_el_is_aa64(env, 3) && secure) {
 +        return 3;
 +    } else {
 +        return 1;
 +    }
 +}
 +
  /*
   * Raise an exception to the debug target el.
   * Modify syndrome to indicate when origin and target EL are the same.
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+[PULL 23/28] target/arm: Fix Secure PL1 tests in fp_exception_el
-For the rpi1 and 2 we want to boot the Linux kernel via some
+From: Richard Henderson <richard.henderson@linaro.org>
 custom setup code that makes sure that the SMC instruction
 acts as a no-op, because it's used for cache maintenance.
 The rpi3 boots AArch64 kernels, which don't need SMC for
 cache maintenance and always expect to be booted non-secure.
 Don't fill in the aarch32-specific parts of the binfo struct.
+We were using arm_is_secure and is_a64, which are
+tests against the current EL, as opposed to
+arm_el_is_aa64 and arm_is_secure_below_el3, which
+can be applied to a different EL than current.
+Consolidate the two tests.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-24-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 17 +++++++++++++----
+ target/arm/helper.c | 23 +++++++++--------------
-file changed, 13 insertions(+), 4 deletions(-)
+file changed, 9 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
-     binfo.board_id = raspi_boardid[version];
+         int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN);
-     binfo.ram_size = ram_size;
-     binfo.nb_cpus = smp_cpus;
+         switch (fpen) {
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
++        case 1:
--    binfo.write_board_setup = write_board_setup;
++            if (cur_el != 0) {
--    binfo.secure_board_setup = true;
++                break;
--    binfo.secure_boot = true;
++            }
-+
++            /* fall through */
-+    if (version <= 2) {
+         case 0:
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         case 2:
-+         * mode before booting a kernel (to set up the SMC vectors so
+-            if (cur_el == 0 || cur_el == 1) {
-+         * that we get a no-op SMC; this is used by Linux to call the
+-                /* Trap to PL1, which might be EL1 or EL3 */
-+         * firmware for some cache maintenance operations.
+-                if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-+         * The rpi3 doesn't need this.
+-                    return 3;
-+         */
+-                }
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+-                return 1;
-+        binfo.write_board_setup = write_board_setup;
+-            }
-+        binfo.secure_board_setup = true;
+-            if (cur_el == 3 && !is_a64(env)) {
-+        binfo.secure_boot = true;
+-                /* Secure PL1 running at EL3 */
-+    }
++            /* Trap from Secure PL0 or PL1 to Secure PL1. */
++            if (!arm_el_is_aa64(env, 3)
-     /* Pi2 and Pi3 requires SMP setup */
++                && (cur_el == 3 || arm_is_secure_below_el3(env))) {
-     if (version >= 2) {
+                 return 3;
              }
 -            break;
 -        case 1:
 -            if (cur_el == 0) {
 +            if (cur_el <= 1) {
                  return 1;
              }
              break;
 -        case 3:
 -            break;
          }
      }
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+[PULL 24/28] tests/qtest: Reduce npcm7xx_sdhci test image size
-The TypeInfo and state struct for bcm2386 disagree about what the
+From: Hao Wu <wuhaotsh@google.com>
 parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
 but the BCM2386State struct only defines the parent_obj field
 as DeviceState. This would have caused problems if anything
 actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
 Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
 need any of the additional functionality TYPE_SYS_BUS_DEVICE
 provides.
+Creating 1GB image for a simple qtest is unnecessary
+and could lead to failures. We reduce the image size
+to 1MB to reduce the test overhead.
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
+Message-id: 20220609214125.4192212-1-wuhaotsh@google.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 2 +-
+ tests/qtest/npcm7xx_sdhci-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/tests/qtest/npcm7xx_sdhci-test.c b/tests/qtest/npcm7xx_sdhci-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/tests/qtest/npcm7xx_sdhci-test.c
-+++ b/hw/arm/bcm2836.c
++++ b/tests/qtest/npcm7xx_sdhci-test.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
+ #define NPCM7XX_REG_SIZE 0x100
- static const TypeInfo bcm2836_type_info = {
+ #define NPCM7XX_MMC_BA 0xF0842000
-     .name = TYPE_BCM2836,
+ #define NPCM7XX_BLK_SIZE 512
--    .parent = TYPE_SYS_BUS_DEVICE,
+-#define NPCM7XX_TEST_IMAGE_SIZE (1 << 30)
-+    .parent = TYPE_DEVICE,
++#define NPCM7XX_TEST_IMAGE_SIZE (1 << 20)
-     .instance_size = sizeof(BCM2836State),
-     .instance_init = bcm2836_init,
+ char *sd_path;
-     .class_init = bcm2836_class_init,
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 25/28] target/arm: Adjust format test in scr_write
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+Because reset always initializes the AA64 version, SCR_EL3,
-it is needed to support guests other than Linux.
+test the mode of EL3 instead of the type of the cpreg.
-Based on the patch by Bill Paul as found here:
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-https://bugs.launchpad.net/qemu/+bug/1753314
+Message-id: 20220609214657.1217913-2-richard.henderson@linaro.org
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Bill Paul <wpaul@windriver.com>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/char/imx_serial.h |  3 +++
+ target/arm/helper.c | 14 ++++++++------
- hw/char/imx_serial.c         | 20 +++++++++++++++++---
+file changed, 8 insertions(+), 6 deletions(-)
 files changed, 20 insertions(+), 3 deletions(-)
-diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/target/arm/helper.c
-+++ b/include/hw/char/imx_serial.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
- #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+     uint32_t valid_mask = 0x3fff;
- #define UCR2_SRST       (1<<0)    /* Reset complete */
+     ARMCPU *cpu = env_archcpu(env);
-+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+-    if (ri->state == ARM_CP_STATE_AA64) {
-+
+-        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
- #define UTS1_TXEMPTY    (1<<6)
+-            !cpu_isar_feature(aa64_aa32_el1, cpu)) {
- #define UTS1_RXEMPTY    (1<<5)
+-                value |= SCR_FW | SCR_AW;   /* these two bits are RES1.  */
- #define UTS1_TXFULL     (1<<4)
+-        }
-@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
+-        valid_mask &= ~SCR_NET;
      uint32_t ubmr;
      uint32_t ubrc;
      uint32_t ucr3;
 +    uint32_t ucr4;
      qemu_irq irq;
      CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
  static const VMStateDescription vmstate_imx_serial = {
      .name = TYPE_IMX_SERIAL,
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_INT32(readbuff, IMXSerialState),
          VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
-+     * TCEN and TXDC are both bit 3
++     * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
 +     * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
 +     * Instead, choose the format based on the mode of EL3.
 +     */
-+    mask |= s->ucr4 & UCR4_TCEN;
++    if (arm_el_is_aa64(env, 3)) {
-+
++        value |= SCR_FW | SCR_AW;      /* RES1 */
-     usr2 = s->usr2 & mask;
++        valid_mask &= ~SCR_NET;        /* RES0 */
-     qemu_set_irq(s->irq, usr1 || usr2);
+         if (cpu_isar_feature(aa64_ras, cpu)) {
-@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
+             valid_mask |= SCR_TERR;
          return s->ucr3;
      case 0x23: /* UCR4 */
 +        return s->ucr4;
 +
      case 0x29: /* BRM Incremental */
          return 0x0; /* TODO */
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
              s->usr1 &= ~USR1_TRDY;
 +            s->usr2 &= ~USR2_TXDC;
              imx_update(s);
              s->usr1 |= USR1_TRDY;
 +            s->usr2 |= USR2_TXDC;
              imx_update(s);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
          s->ucr3 = value & 0xffff;
          break;
 -    case 0x2d: /* UTS1 */
      case 0x23: /* UCR4 */
 +        s->ucr4 = value & 0xffff;
 +        imx_update(s);
 +        break;
 +
 +    case 0x2d: /* UTS1 */
          qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                        HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
          /* TODO */
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 26/28] target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-The sabrelite machine model used by qemu-system-arm is based on the
+Since DDI0487F.a, the RW bit is RAO/WI.  When specifically
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+targeting such a cpu, e.g. cortex-a76, it is legitimate to
-controller which is supported in QEMU using the imx_fec.c module
+ignore the bit within the secure monitor.
 (actually called imx.enet for this model.)
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1062
-imx.enet device like this:
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609214657.1217913-3-richard.henderson@linaro.org
  #define FSL_IMX6_ENET_MAC_1588_IRQ 118
  #define FSL_IMX6_ENET_MAC_IRQ 119
 According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
 page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
 interrupts are as follows.
 ENET MAC 0 IRQ
 ENET MAC 0 1588 Timer interrupt
 where
 - 32 == 118
 - 32 == 119
 In other words, the vector definitions in the fsl-imx6.h file are reversed.
 Fixing the interrupts alone causes problems with older Linux kernels:
 The Ethernet interface will fail to probe with Linux v4.9 and earlier.
 Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
 error handling. This is a Linux kernel problem, not a qemu problem:
 the Linux kernel only worked by accident since it requested both interrupts.
 For backward compatibility, generate the Ethernet interrupt on both interrupt
 lines. This was shown to work from all Linux kernel releases starting with
 v3.16.
 Link: https://bugs.launchpad.net/qemu/+bug/1753309
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ target/arm/cpu.h    | 5 +++++
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+ target/arm/helper.c | 4 ++++
-files changed, 29 insertions(+), 3 deletions(-)
+files changed, 9 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+ }
- #define FSL_IMX6_MLB150_LOW_IRQ 117
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
++static inline bool isar_feature_aa64_aa32_el2(const ARMISARegisters *id)
--#define FSL_IMX6_ENET_MAC_IRQ 119
++{
-+#define FSL_IMX6_ENET_MAC_IRQ 118
++    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL2) >= 2;
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
++}
- #define FSL_IMX6_PCIE1_IRQ 120
++
- #define FSL_IMX6_PCIE2_IRQ 121
+ static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
- #define FSL_IMX6_PCIE3_IRQ 122
+ {
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/target/arm/helper.c
-+++ b/hw/net/imx_fec.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+         value |= SCR_FW | SCR_AW;      /* RES1 */
- static void imx_eth_update(IMXFECState *s)
+         valid_mask &= ~SCR_NET;        /* RES0 */
- {
--    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
++        if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
-+    /*
++            !cpu_isar_feature(aa64_aa32_el2, cpu)) {
-+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
++            value |= SCR_RW;           /* RAO/WI */
-+     * interrupts swapped. This worked with older versions of Linux (4.14
++        }
-+     * and older) since Linux associated both interrupt lines with Ethernet
+         if (cpu_isar_feature(aa64_ras, cpu)) {
-+     * MAC interrupts. Specifically,
+             valid_mask |= SCR_TERR;
-+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+         }
 +     *   timer interrupts. Those versions of Linux fail with versions of QEMU
 +     *   with swapped interrupt assignments.
 +     * - In linux 4.14, both interrupt lines were registered with the Ethernet
 +     *   MAC interrupt handler. As a result, all versions of qemu happen to
 +     *   work, though that is accidental.
 +     * - In Linux 4.9 and older, the timer interrupt was registered directly
 +     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
 +     *   redirected to a GPIO interrupt to work around erratum ERR006687.
 +     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
 +     *   interrupt never fired since IOMUX is currently not supported in qemu.
 +     *   Linux instead received MAC interrupts on the timer interrupt.
 +     *   As a result, qemu versions with the swapped interrupt assignment work,
 +     *   albeit accidentally, but qemu versions with the correct interrupt
 +     *   assignment fail.
 +     *
 +     * To ensure that all versions of Linux work, generate ENET_INT_MAC
 +     * interrrupts on both interrupt lines. This should be changed if and when
 +     * qemu supports IOMUX.
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 27/28] gdbstub: Don't use GDB syscalls if no GDB is attached
-Add some assertions that if we're about to boot an AArch64 kernel,
+In two places in gdbstub.c we look at gdbserver_state.init to decide
-the board code has not mistakenly set either secure_boot or
+whether we're going to do a semihosting syscall via the gdb remote
-secure_board_setup. It doesn't make sense to set secure_boot,
+protocol:
-because all AArch64 kernels must be booted in non-secure mode.
+ * when setting up, if the user didn't explicitly select either
    native semihosting or gdb semihosting, we autoselect, with the
    intended behaviour "use gdb if gdb is connected"
  * when the semihosting layer attempts to do a syscall via gdb, we
    silently ignore it if the gdbstub wasn't actually set up
-It might in theory make sense to set secure_board_setup, but
+However, if the user's commandline sets up the gdbstub but tells QEMU
-we don't currently support that, because only the AArch32
+to start rather than waiting for a GDB to connect (eg using '-s' but
-bootloader[] code calls this hook; bootloader_aarch64[] does not.
+not '-S'), then we will have gdbserver_state.init true but no actual
-Since we don't have a current need for this functionality, just
+connection; an attempt to use gdb syscalls will then crash because we
-assert that we don't try to use it. If it's needed we'll add
+try to use gdbserver_state.c_cpu when it hasn't been set up:
 it later.
+#0  0x00007ffff6803ba8 in qemu_cpu_kick (cpu=0x0) at ../../softmmu/cpus.c:457
+#1  0x00007ffff6c03913 in gdb_do_syscallv (cb=0x7ffff6c19944 <common_semi_cb>,
+    fmt=0x7ffff7573b7e "", va=0x7ffff56294c0) at ../../gdbstub.c:2946
+#2  0x00007ffff6c19c3a in common_semi_gdb_syscall (cs=0x7ffff83fe060,
+    cb=0x7ffff6c19944 <common_semi_cb>, fmt=0x7ffff7573b75 "isatty,%x")
+    at ../../semihosting/arm-compat-semi.c:494
+#3  0x00007ffff6c1a064 in gdb_isattyfn (cs=0x7ffff83fe060, gf=0x7ffff86a3690)
+    at ../../semihosting/arm-compat-semi.c:636
+#4  0x00007ffff6c1b20f in do_common_semihosting (cs=0x7ffff83fe060)
+    at ../../semihosting/arm-compat-semi.c:967
+#5  0x00007ffff693a037 in handle_semihosting (cs=0x7ffff83fe060)
+    at ../../target/arm/helper.c:10316
+You can probably also get into this state via some odd
+corner cases involving connecting a GDB and then telling it
+to detach from all the vCPUs.
+Abstract out the test into a new gdb_attached() function
+which returns true only if there's actually a GDB connected
+to the debug stub and attached to at least one vCPU.
+Reported-by: Liviu Ionescu <ilg@livius.net>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20220526190053.521505-2-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ gdbstub.c | 14 +++++++++++---
-file changed, 7 insertions(+)
+file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/gdbstub.c b/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/gdbstub.c
-+++ b/hw/arm/boot.c
++++ b/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static int get_char(void)
-                     } else {
+ }
-                         env->pstate = PSTATE_MODE_EL1h;
+ #endif
-                     }
-+                    /* AArch64 kernels never boot in secure mode */
++/*
-+                    assert(!info->secure_boot);
++ * Return true if there is a GDB currently connected to the stub
-+                    /* This hook is only supported for AArch32 currently:
++ * and attached to a CPU
-+                     * bootloader_aarch64[] will not call the hook, and
++ */
-+                     * the code above has already dropped us into EL2 or EL1.
++static bool gdb_attached(void)
-+                     */
++{
-+                    assert(!info->secure_board_setup);
++    return gdbserver_state.init && gdbserver_state.c_cpu;
-                 }
++}
++
-                 /* Set to non-secure if not a secure boot */
+ static enum {
      GDB_SYS_UNKNOWN,
      GDB_SYS_ENABLED,
@@ -XXX,XX +XXX,XX @@ int use_gdb_syscalls(void)
      /* -semihosting-config target=auto */
      /* On the first call check if gdb is connected and remember. */
      if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 -        gdb_syscall_mode = gdbserver_state.init ?
 -            GDB_SYS_ENABLED : GDB_SYS_DISABLED;
 +        gdb_syscall_mode = gdb_attached() ? GDB_SYS_ENABLED : GDB_SYS_DISABLED;
      }
      return gdb_syscall_mode == GDB_SYS_ENABLED;
  }
@@ -XXX,XX +XXX,XX @@ void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
      target_ulong addr;
      uint64_t i64;
 -    if (!gdbserver_state.init) {
 +    if (!gdb_attached()) {
          return;
      }
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 28/28] semihosting/config: Merge --semihosting-config option groups
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+Currently we mishandle the --semihosting-config option if the
-CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
+user specifies it on the command line more than once. For
-is required for Linux to boot.
+example with:
  --semihosting-config target=gdb --semihosting-config arg=foo,arg=bar
 the function qemu_semihosting_config_options() is called twice, once
 for each argument.  But that function expects to be called only once,
 and it always unconditionally sets the semihosting.enabled,
 semihost_chardev and semihosting.target variables.  This means that
 if any of those options were set anywhere except the last
 --semihosting-config option on the command line, those settings are
 ignored.  In the example above, 'target=gdb' in the first option is
 overridden by an implied default 'target=auto' in the second.
 The QemuOptsList machinery has a flag for handling this kind of
 "option group is setting global state": by setting
  .merge_lists = true;
 we make the machinery merge all the --semihosting-config arguments
 the user passes into a single set of options and call our
 qemu_semihosting_config_options() just once.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20220526190053.521505-3-peter.maydell@linaro.org
 Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ semihosting/config.c | 1 +
-file changed, 7 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/semihosting/config.c b/semihosting/config.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/semihosting/config.c
-+++ b/hw/arm/bcm2836.c
++++ b/semihosting/config.c
 @@ -XXX,XX +XXX,XX @@
- struct BCM283XInfo {
+ QemuOptsList qemu_semihosting_config_opts = {
-     const char *name;
+     .name = "semihosting-config",
-+    int clusterid;
++    .merge_lists = true,
- };
+     .implied_opt_name = "enable",
+     .head = QTAILQ_HEAD_INITIALIZER(qemu_semihosting_config_opts.head),
- static const BCM283XInfo bcm283x_socs[] = {
+     .desc = {
      {
          .name = TYPE_BCM2836,
 +        .clusterid = 0xf,
      },
      {
          .name = TYPE_BCM2837,
 +        .clusterid = 0x0,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
  static void bcm2836_realize(DeviceState *dev, Error **errp)
  {
      BCM283XState *s = BCM283X(dev);
 +    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
 +    const BCM283XInfo *info = bc->info;
      Object *obj;
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
      for (n = 0; n < BCM283X_NCPUS; n++) {
 -        /* Mirror bcm2836, which has clusterid set to 0xf
 -         * TODO: this should be converted to a property of ARM_CPU
 -         */
 -        s->cpus[n].mp_affinity = 0xF00 | n;
 +        /* TODO: this should be converted to a property of ARM_CPU */
 +        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
          /* set periphbase/CBAR value for CPU-local registers */
          object_property_set_int(OBJECT(&s->cpus[n]),
 --
-.16.2
+.25.1

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

Just flushing my target-arm queue since I won't be working next week :-)

-- PMM

The following changes since commit b3cd3b5a66f0dddfe3d5ba2bef13cd4f5b89cde9:

Merge tag 'pull-riscv-to-apply-20220610' of github.com:alistair23/qemu into staging (2022-06-09 22:08:27 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220610

for you to fetch changes up to 90c072e063737e9e8f431489bbd334452f89056e:

semihosting/config: Merge --semihosting-config option groups (2022-06-10 14:32:36 +0100)

----------------------------------------------------------------
 * refactor exception routing code
 * fix SCR_EL3 RAO/RAZ bits
 * gdbstub: Don't use GDB syscalls if no GDB is attached
 * semihosting/config: Merge --semihosting-config option groups
 * tests/qtest: Reduce npcm7xx_sdhci test image size

----------------------------------------------------------------
Hao Wu (1):
      tests/qtest: Reduce npcm7xx_sdhci test image size

Peter Maydell (2):
      gdbstub: Don't use GDB syscalls if no GDB is attached
      semihosting/config: Merge --semihosting-config option groups

Richard Henderson (25):
      target/arm: Mark exception helpers as noreturn
      target/arm: Add coproc parameter to syn_fp_access_trap
      target/arm: Move exception_target_el out of line
      target/arm: Move arm_singlestep_active out of line
      target/arm: Move arm_generate_debug_exceptions out of line
      target/arm: Use is_a64 in arm_generate_debug_exceptions
      target/arm: Move exception_bkpt_insn to debug_helper.c
      target/arm: Move arm_debug_exception_fsr to debug_helper.c
      target/arm: Rename helper_exception_with_syndrome
      target/arm: Introduce gen_exception_insn_el_v
      target/arm: Rename gen_exception_insn to gen_exception_insn_el
      target/arm: Introduce gen_exception_insn
      target/arm: Create helper_exception_swstep
      target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
      target/arm: Move gen_exception to translate.c
      target/arm: Rename gen_exception to gen_exception_el
      target/arm: Introduce gen_exception
      target/arm: Introduce gen_exception_el_v
      target/arm: Introduce helper_exception_with_syndrome
      target/arm: Remove default_exception_el
      target/arm: Create raise_exception_debug
      target/arm: Move arm_debug_target_el to debug_helper.c
      target/arm: Fix Secure PL1 tests in fp_exception_el
      target/arm: Adjust format test in scr_write
      target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

With ARMv8, this field is always RES0.
With ARMv7, targeting EL2 and TA=0, it is always 0xA.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h      |  7 ++++---
 target/arm/translate-a64.c |  3 ++-
 target/arm/translate-vfp.c | 14 ++++++++++++--
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
 }
 
-static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
+static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit,
+                                          int coproc)
 {
-    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
+    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 */
     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
         | (is_16bit ? 0 : ARM_EL_IL)
-        | (cv << 24) | (cond << 20) | 0xa;
+        | (cv << 24) | (cond << 20) | coproc;
 }
 
 static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
         s->fp_access_checked = true;
 
         gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+                           syn_fp_access_trap(1, 0xe, false, 0),
+                           s->fp_excp_el);
         return false;
     }
     s->fp_access_checked = true;
diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
 static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
 {
     if (s->fp_excp_el) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+        /*
+         * The full syndrome is only used for HSR when HCPTR traps:
+         * For v8, when TA==0, coproc is RES0.
+         * For v7, any use of a Floating-point instruction or access
+         * to a Floating-point Extension register that is trapped to
+         * Hyp mode because of a trap configured in the HCPTR sets
+         * this field to 0xA.
+         */
+        int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
+        uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
+
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
         return false;
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the function to op_helper.c, near raise_exception.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 16 +---------------
 target/arm/op_helper.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
 
-static inline int exception_target_el(CPUARMState *env)
-{
-    int target_el = MAX(1, arm_current_el(env));
-
-    /*
-     * No such thing as secure EL1 if EL3 is aarch32,
-     * so update the target EL to EL3 in this case.
-     */
-    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
-        target_el = 3;
-    }
-
-    return target_el;
-}
-
 /* Determine if allocation tags are available.  */
 static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
                                                  uint64_t sctlr)
@@ -XXX,XX +XXX,XX @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
 bool el_is_in_host(CPUARMState *env, int el);
 
 void aa32_max_features(ARMCPU *cpu);
+int exception_target_el(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
+int exception_target_el(CPUARMState *env)
+{
+    int target_el = MAX(1, arm_current_el(env));
+
+    /*
+     * No such thing as secure EL1 if EL3 is aarch32,
+     * so update the target EL to EL3 in this case.
+     */
+    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
+        target_el = 3;
+    }
+
+    return target_el;
+}
+
 void raise_exception(CPUARMState *env, uint32_t excp,
                      uint32_t syndrome, uint32_t target_el)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the function to debug_helper.c, and the
declaration to internals.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 10 ----------
 target/arm/internals.h    |  1 +
 target/arm/debug_helper.c | 12 ++++++++++++
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_generate_debug_exceptions(CPUARMState *env)
     }
 }
 
-/* Is single-stepping active? (Note that the "is EL_D AArch64?" check
- * implicitly means this always returns false in pre-v8 CPUs.)
- */
-static inline bool arm_singlestep_active(CPUARMState *env)
-{
-    return extract32(env->cp15.mdscr_el1, 0, 1)
-        && arm_el_is_aa64(env, arm_debug_target_el(env))
-        && arm_generate_debug_exceptions(env);
-}
-
 static inline bool arm_sctlr_b(CPUARMState *env)
 {
     return
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
 
 void aa32_max_features(ARMCPU *cpu);
 int exception_target_el(CPUARMState *env);
+bool arm_singlestep_active(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
+
+/*
+ * Is single-stepping active? (Note that the "is EL_D AArch64?" check
+ * implicitly means this always returns false in pre-v8 CPUs.)
+ */
+bool arm_singlestep_active(CPUARMState *env)
+{
+    return extract32(env->cp15.mdscr_el1, 0, 1)
+        && arm_el_is_aa64(env, arm_debug_target_el(env))
+        && arm_generate_debug_exceptions(env);
+}
+
 /* Return true if the linked breakpoint entry lbn passes its checks */
 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move arm_generate_debug_exceptions and its two subroutines,
{aa32,aa64}_generate_debug_exceptions into debug_helper.c,
and the one interface declaration to internals.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 91 -------------------------------------
 target/arm/internals.h    |  1 +
 target/arm/debug_helper.c | 94 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 91 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
 }
 
-/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
-static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
-{
-    int cur_el = arm_current_el(env);
-    int debug_el;
-
-    if (cur_el == 3) {
-        return false;
-    }
-
-    /* MDCR_EL3.SDD disables debug events from Secure state */
-    if (arm_is_secure_below_el3(env)
-        && extract32(env->cp15.mdcr_el3, 16, 1)) {
-        return false;
-    }
-
-    /*
-     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
-     * while not masking the (D)ebug bit in DAIF.
-     */
-    debug_el = arm_debug_target_el(env);
-
-    if (cur_el == debug_el) {
-        return extract32(env->cp15.mdscr_el1, 13, 1)
-            && !(env->daif & PSTATE_D);
-    }
-
-    /* Otherwise the debug target needs to be a higher EL */
-    return debug_el > cur_el;
-}
-
-static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
-{
-    int el = arm_current_el(env);
-
-    if (el == 0 && arm_el_is_aa64(env, 1)) {
-        return aa64_generate_debug_exceptions(env);
-    }
-
-    if (arm_is_secure(env)) {
-        int spd;
-
-        if (el == 0 && (env->cp15.sder & 1)) {
-            /* SDER.SUIDEN means debug exceptions from Secure EL0
-             * are always enabled. Otherwise they are controlled by
-             * SDCR.SPD like those from other Secure ELs.
-             */
-            return true;
-        }
-
-        spd = extract32(env->cp15.mdcr_el3, 14, 2);
-        switch (spd) {
-        case 1:
-            /* SPD == 0b01 is reserved, but behaves as 0b00. */
-        case 0:
-            /* For 0b00 we return true if external secure invasive debug
-             * is enabled. On real hardware this is controlled by external
-             * signals to the core. QEMU always permits debug, and behaves
-             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
-             */
-            return true;
-        case 2:
-            return false;
-        case 3:
-            return true;
-        }
-    }
-
-    return el != 2;
-}
-
-/* Return true if debugging exceptions are currently enabled.
- * This corresponds to what in ARM ARM pseudocode would be
- *    if UsingAArch32() then
- *        return AArch32.GenerateDebugExceptions()
- *    else
- *        return AArch64.GenerateDebugExceptions()
- * We choose to push the if() down into this function for clarity,
- * since the pseudocode has it at all callsites except for the one in
- * CheckSoftwareStep(), where it is elided because both branches would
- * always return the same value.
- */
-static inline bool arm_generate_debug_exceptions(CPUARMState *env)
-{
-    if (env->aarch64) {
-        return aa64_generate_debug_exceptions(env);
-    } else {
-        return aa32_generate_debug_exceptions(env);
-    }
-}
-
 static inline bool arm_sctlr_b(CPUARMState *env)
 {
     return
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
 void aa32_max_features(ARMCPU *cpu);
 int exception_target_el(CPUARMState *env);
 bool arm_singlestep_active(CPUARMState *env);
+bool arm_generate_debug_exceptions(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
+static bool aa64_generate_debug_exceptions(CPUARMState *env)
+{
+    int cur_el = arm_current_el(env);
+    int debug_el;
+
+    if (cur_el == 3) {
+        return false;
+    }
+
+    /* MDCR_EL3.SDD disables debug events from Secure state */
+    if (arm_is_secure_below_el3(env)
+        && extract32(env->cp15.mdcr_el3, 16, 1)) {
+        return false;
+    }
+
+    /*
+     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
+     * while not masking the (D)ebug bit in DAIF.
+     */
+    debug_el = arm_debug_target_el(env);
+
+    if (cur_el == debug_el) {
+        return extract32(env->cp15.mdscr_el1, 13, 1)
+            && !(env->daif & PSTATE_D);
+    }
+
+    /* Otherwise the debug target needs to be a higher EL */
+    return debug_el > cur_el;
+}
+
+static bool aa32_generate_debug_exceptions(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+
+    if (el == 0 && arm_el_is_aa64(env, 1)) {
+        return aa64_generate_debug_exceptions(env);
+    }
+
+    if (arm_is_secure(env)) {
+        int spd;
+
+        if (el == 0 && (env->cp15.sder & 1)) {
+            /*
+             * SDER.SUIDEN means debug exceptions from Secure EL0
+             * are always enabled. Otherwise they are controlled by
+             * SDCR.SPD like those from other Secure ELs.
+             */
+            return true;
+        }
+
+        spd = extract32(env->cp15.mdcr_el3, 14, 2);
+        switch (spd) {
+        case 1:
+            /* SPD == 0b01 is reserved, but behaves as 0b00. */
+        case 0:
+            /*
+             * For 0b00 we return true if external secure invasive debug
+             * is enabled. On real hardware this is controlled by external
+             * signals to the core. QEMU always permits debug, and behaves
+             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
+             */
+            return true;
+        case 2:
+            return false;
+        case 3:
+            return true;
+        }
+    }
+
+    return el != 2;
+}
+
+/*
+ * Return true if debugging exceptions are currently enabled.
+ * This corresponds to what in ARM ARM pseudocode would be
+ *    if UsingAArch32() then
+ *        return AArch32.GenerateDebugExceptions()
+ *    else
+ *        return AArch64.GenerateDebugExceptions()
+ * We choose to push the if() down into this function for clarity,
+ * since the pseudocode has it at all callsites except for the one in
+ * CheckSoftwareStep(), where it is elided because both branches would
+ * always return the same value.
+ */
+bool arm_generate_debug_exceptions(CPUARMState *env)
+{
+    if (env->aarch64) {
+        return aa64_generate_debug_exceptions(env);
+    } else {
+        return aa32_generate_debug_exceptions(env);
+    }
+}
+
 /*
  * Is single-stepping active? (Note that the "is EL_D AArch64?" check
  * implicitly means this always returns false in pre-v8 CPUs.)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 31 +++++++++++++++++++++++++++++++
 target/arm/op_helper.c    | 29 -----------------------------
 2 files changed, 31 insertions(+), 29 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
     }
 }
 
+/*
+ * Raise an EXCP_BKPT with the specified syndrome register value,
+ * targeting the correct exception level for debug exceptions.
+ */
+void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /* FSR will only be used if the debug target EL is AArch32. */
+    env->exception.fsr = arm_debug_exception_fsr(env);
+    /*
+     * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
+     * values to the guest that it shouldn't be able to see at its
+     * exception/security level.
+     */
+    env->exception.vaddress = 0;
+    /*
+     * Other kinds of architectural debug exception are ignored if
+     * they target an exception level below the current one (in QEMU
+     * this is checked by arm_generate_debug_exceptions()). Breakpoint
+     * instructions are special because they always generate an exception
+     * to somewhere: if they can't go to the configured debug exception
+     * level they are taken to the current exception level.
+     */
+    if (debug_el < cur_el) {
+        debug_el = cur_el;
+    }
+    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
     raise_exception(env, excp, syndrome, target_el);
 }
 
-/* Raise an EXCP_BKPT with the specified syndrome register value,
- * targeting the correct exception level for debug exceptions.
- */
-void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
-{
-    int debug_el = arm_debug_target_el(env);
-    int cur_el = arm_current_el(env);
-
-    /* FSR will only be used if the debug target EL is AArch32. */
-    env->exception.fsr = arm_debug_exception_fsr(env);
-    /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
-     * values to the guest that it shouldn't be able to see at its
-     * exception/security level.
-     */
-    env->exception.vaddress = 0;
-    /*
-     * Other kinds of architectural debug exception are ignored if
-     * they target an exception level below the current one (in QEMU
-     * this is checked by arm_generate_debug_exceptions()). Breakpoint
-     * instructions are special because they always generate an exception
-     * to somewhere: if they can't go to the configured debug exception
-     * level they are taken to the current exception level.
-     */
-    if (debug_el < cur_el) {
-        debug_el = cur_el;
-    }
-    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
-}
-
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 {
     return cpsr_read(env) & ~CPSR_EXEC;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function now now only used in debug_helper.c, so there is
no reason to have a declaration in a header.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 25 -------------------------
 target/arm/debug_helper.c | 26 ++++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
-/* Return the FSR value for a debug exception (watchpoint, hardware
- * breakpoint or BKPT insn) targeting the specified exception level.
- */
-static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
-{
-    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
-    int target_el = arm_debug_target_el(env);
-    bool using_lpae = false;
-
-    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
-        using_lpae = true;
-    } else {
-        if (arm_feature(env, ARM_FEATURE_LPAE) &&
-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
-            using_lpae = true;
-        }
-    }
-
-    if (using_lpae) {
-        return arm_fi_to_lfsc(&fi);
-    } else {
-        return arm_fi_to_sfsc(&fi);
-    }
-}
-
 /**
  * arm_num_brps: Return number of implemented breakpoints.
  * Note that the ID register BRPS field is "number of bps - 1",
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return check_watchpoints(cpu);
 }
 
+/*
+ * Return the FSR value for a debug exception (watchpoint, hardware
+ * breakpoint or BKPT insn) targeting the specified exception level.
+ */
+static uint32_t arm_debug_exception_fsr(CPUARMState *env)
+{
+    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
+    int target_el = arm_debug_target_el(env);
+    bool using_lpae = false;
+
+    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
+        using_lpae = true;
+    } else {
+        if (arm_feature(env, ARM_FEATURE_LPAE) &&
+            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
+            using_lpae = true;
+        }
+    }
+
+    if (using_lpae) {
+        return arm_fi_to_lfsc(&fi);
+    } else {
+        return arm_fi_to_sfsc(&fi);
+    }
+}
+
 void arm_debug_excp_handler(CPUState *cs)
 {
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename to helper_exception_with_syndrome_el, to emphasize
that the target el is a parameter.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    | 2 +-
 target/arm/translate.h | 6 +++---
 target/arm/op_helper.c | 6 +++---
 target/arm/translate.c | 6 +++---
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
                    i32, i32, i32, i32)
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
-DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
+DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
 DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
 DEF_HELPER_1(setend, void, env)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
 static inline void gen_exception(int excp, uint32_t syndrome,
                                  uint32_t target_el)
 {
-    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
-                                       tcg_constant_i32(syndrome),
-                                       tcg_constant_i32(target_el));
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syndrome),
+                                          tcg_constant_i32(target_el));
 }
 
 /* Generate an architectural singlestep exception */
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(yield)(CPUARMState *env)
  * those EXCP values which are special cases for QEMU to interrupt
  * execution and not to be used for exceptions which are passed to
  * the guest (those must all have syndrome information and thus should
- * use exception_with_syndrome).
+ * use exception_with_syndrome*).
  */
 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 }
 
 /* Raise an exception with the specified syndrome register value */
-void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
-                                     uint32_t syndrome, uint32_t target_el)
+void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
+                                        uint32_t syndrome, uint32_t target_el)
 {
     raise_exception(env, excp, syndrome, target_el);
 }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
 {
     gen_set_condexec(s);
     gen_set_pc_im(s, s->pc_curr);
-    gen_helper_exception_with_syndrome(cpu_env,
-                                       tcg_constant_i32(excp),
-                                       tcg_constant_i32(syn), tcg_el);
+    gen_helper_exception_with_syndrome_el(cpu_env,
+                                          tcg_constant_i32(excp),
+                                          tcg_constant_i32(syn), tcg_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a function below gen_exception_insn that takes
the target_el as a TCGv_i32, replacing gen_exception_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el)
+static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+                                    uint32_t syn, TCGv_i32 tcg_el)
 {
     if (s->aarch64) {
         gen_a64_set_pc_im(pc);
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
         gen_set_condexec(s);
         gen_set_pc_im(s, pc);
     }
-    gen_exception(excp, syn, target_el);
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syn), tcg_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el)
+{
+    gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+}
+
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 {
     gen_set_condexec(s);
@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s)
                        default_exception_el(s));
 }
 
-static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
-                             TCGv_i32 tcg_el)
-{
-    gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc_curr);
-    gen_helper_exception_with_syndrome_el(cpu_env,
-                                          tcg_constant_i32(excp),
-                                          tcg_constant_i32(syn), tcg_el);
-    s->base.is_jmp = DISAS_NORETURN;
-}
-
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 void gen_lookup_tb(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
                 tcg_el = tcg_constant_i32(3);
             }
 
-            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
+            gen_exception_insn_el_v(s, s->pc_curr, EXCP_UDEF,
+                                    syn_uncategorized(), tcg_el);
             tcg_temp_free_i32(tcg_el);
             return false;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h        |  4 ++--
 target/arm/translate-a64.c    | 36 ++++++++++++++++----------------
 target/arm/translate-m-nocp.c | 16 +++++++-------
 target/arm/translate-mve.c    |  4 ++--
 target/arm/translate-vfp.c    |  6 +++---
 target/arm/translate.c        | 39 ++++++++++++++++++-----------------
 6 files changed, 53 insertions(+), 52 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el);
+void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                           uint32_t syn, uint32_t target_el);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
         assert(!s->fp_access_checked);
         s->fp_access_checked = true;
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false, 0),
-                           s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_fp_access_trap(1, 0xe, false, 0),
+                              s->fp_excp_el);
         return false;
     }
     s->fp_access_checked = true;
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
         assert(!s->sve_access_checked);
         s->sve_access_checked = true;
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_sve_access_trap(), s->sve_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_sve_access_trap(), s->sve_excp_el);
         return false;
     }
     s->sve_access_checked = true;
@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     } else {
         syndrome = syn_uncategorized();
     }
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome,
-                       default_exception_el(s));
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
+                          default_exception_el(s));
 }
 
 /* MRS - move from system register
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
         switch (op2_ll) {
         case 1:                                                     /* SVC */
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
-                               syn_aa64_svc(imm16), default_exception_el(s));
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
+                                  syn_aa64_svc(imm16), default_exception_el(s));
             break;
         case 2:                                                     /* HVC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_hvc(cpu_env);
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
-                               syn_aa64_hvc(imm16), 2);
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_HVC,
+                                  syn_aa64_hvc(imm16), 2);
             break;
         case 3:                                                     /* SMC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_smc(cpu_env, tcg_constant_i32(syn_aa64_smc(imm16)));
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
-                               syn_aa64_smc(imm16), 3);
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_SMC,
+                                  syn_aa64_smc(imm16), 3);
             break;
         default:
             unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
             if (s->btype != 0
                 && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                                   syn_btitrap(s->btype),
-                                   default_exception_el(s));
+                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                                      syn_btitrap(s->btype),
+                                      default_exception_el(s));
                 return;
             }
         } else {
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-m-nocp.c
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
     tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
 
     if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         if (!vfp_access_check_m(s, true)) {
             /*
              * This was only a conditional exception, so override
-             * gen_exception_insn()'s default to DISAS_NORETURN
+             * gen_exception_insn_el()'s default to DISAS_NORETURN
              */
             s->base.is_jmp = DISAS_NEXT;
             break;
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
         if (!vfp_access_check_m(s, true)) {
             /*
              * This was only a conditional exception, so override
-             * gen_exception_insn()'s default to DISAS_NORETURN
+             * gen_exception_insn_el()'s default to DISAS_NORETURN
              */
             s->base.is_jmp = DISAS_NEXT;
             break;
@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
     }
 
     if (a->cp != 10) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), default_exception_el(s));
         return true;
     }
 
     if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return true;
     }
 
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
         return true;
     default:
         /* Reserved value: INVSTATE UsageFault */
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         return false;
     }
 }
diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
         int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
         uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
          * the encoding space handled by the patterns in m-nocp.decode,
          * and for them we may need to raise NOCP here.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return false;
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el)
+void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                           uint32_t syn, uint32_t target_el)
 {
     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+                          default_exception_el(s));
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
 
 undef:
     /* If we get here then some access check did not pass */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                       syn_uncategorized(), exc_target);
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                          syn_uncategorized(), exc_target);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
      * For the UNPREDICTABLE cases we choose to UNDEF.
      */
     if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_uncategorized(), 3);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
          * Do the check-and-raise-exception by hand.
          */
         if (s->fp_excp_el) {
-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                               syn_uncategorized(), s->fp_excp_el);
+            gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                                  syn_uncategorized(), s->fp_excp_el);
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
         tmp = load_cpu_field(v7m.ltpsize);
         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
         tcg_temp_free_i32(tmp);
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         gen_set_label(skipexc);
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
      * UsageFault exception.
      */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(dc));
+        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(dc));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          */
         tcg_remove_ops_after(dc->insn_eci_rewind);
         dc->condjmp = 0;
-        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(dc));
+        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(dc));
     }
 
     arm_post_translate_insn(dc);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a new wrapper function that passes the default
exception target to gen_exception_insn_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h        |  1 +
 target/arm/translate-a64.c    | 15 ++++++---------
 target/arm/translate-m-nocp.c |  3 +--
 target/arm/translate-mve.c    |  3 +--
 target/arm/translate.c        | 29 +++++++++++++----------------
 5 files changed, 22 insertions(+), 29 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
 void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
                            uint32_t syn, uint32_t target_el);
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     } else {
         syndrome = syn_uncategorized();
     }
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
-                          default_exception_el(s));
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome);
 }
 
 /* MRS - move from system register
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
         switch (op2_ll) {
         case 1:                                                     /* SVC */
             gen_ss_advance(s);
-            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
-                                  syn_aa64_svc(imm16), default_exception_el(s));
+            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
+                               syn_aa64_svc(imm16));
             break;
         case 2:                                                     /* HVC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
             if (s->btype != 0
                 && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                                      syn_btitrap(s->btype),
-                                      default_exception_el(s));
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype));
                 return;
             }
         } else {
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-m-nocp.c
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
     }
 
     if (a->cp != 10) {
-        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
-                              syn_uncategorized(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized());
         return true;
     }
 
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
         return true;
     default:
         /* Reserved value: INVSTATE UsageFault */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         return false;
     }
 }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
 }
 
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
+{
+    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
+}
+
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 {
     gen_set_condexec(s);
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                          default_exception_el(s));
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
      * an exception and return false. Otherwise it will return true,
      * and set *tgtmode and *regno appropriately.
      */
-    int exc_target = default_exception_el(s);
-
     /* These instructions are present only in ARMv8, or in ARMv7 with the
      * Virtualization Extensions.
      */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
 
 undef:
     /* If we get here then some access check did not pass */
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                          syn_uncategorized(), exc_target);
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
         tmp = load_cpu_field(v7m.ltpsize);
         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
         tcg_temp_free_i32(tmp);
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         gen_set_label(skipexc);
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
      * UsageFault exception.
      */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(dc));
+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          */
         tcg_remove_ops_after(dc->insn_eci_rewind);
         dc->condjmp = 0;
-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(dc));
+        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE,
+                           syn_uncategorized());
     }
 
     arm_post_translate_insn(dc);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the computation from gen_swstep_exception into a helper.

This fixes a bug when:
  - MDSCR_EL1.KDE == 1 to enable debug exceptions within EL_D itself
  - we singlestep an ERET from EL_D to some lower EL

Previously we were computing 'same el' based on the EL which
executed the ERET instruction, whereas it ought to be computed
based on the EL to which ERET returned.  This happens naturally
with the new helper, which runs after EL has been changed.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h       |  1 +
 target/arm/translate.h    | 12 +++---------
 target/arm/debug_helper.c | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
 DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
+DEF_HELPER_2(exception_swstep, noreturn, env, i32)
 DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
 DEF_HELPER_1(setend, void, env)
 DEF_HELPER_2(wfi, void, env, i32)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
 /* Generate an architectural singlestep exception */
 static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 {
-    bool same_el = (s->debug_target_el == s->current_el);
-
-    /*
-     * If singlestep is targeting a lower EL than the current one,
-     * then s->ss_active must be false and we can never get here.
-     */
-    assert(s->debug_target_el >= s->current_el);
-
-    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
+    /* Fill in the same_el field of the syndrome in the helper. */
+    uint32_t syn = syn_swstep(false, isv, ex);
+    gen_helper_exception_swstep(cpu_env, tcg_constant_i32(syn));
 }
 
 /*
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
 }
 
+void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /*
+     * If singlestep is targeting a lower EL than the current one, then
+     * DisasContext.ss_active must be false and we can never get here.
+     */
+    assert(debug_el >= cur_el);
+    if (debug_el == cur_el) {
+        syndrome |= 1 << ARM_EL_EC_SHIFT;
+    }
+    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We no longer need this value during translation,
as it is now handled within the helpers.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  6 ++----
 target/arm/translate.h     |  2 --
 target/arm/helper.c        | 12 ++----------
 target/arm/translate-a64.c |  1 -
 target/arm/translate.c     |  1 -
 5 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, BE_DATA, 3, 1)
 FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
 /* Target EL if we take a floating-point-disabled exception */
 FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
-/* For A-profile only, target EL for debug exceptions.  */
-FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
-FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
-FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
+FIELD(TBFLAG_ANY, ALIGN_MEM, 10, 1)
+FIELD(TBFLAG_ANY, PSTATE__IL, 11, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      */
     uint32_t svc_imm;
     int current_el;
-    /* Debug target exception level for single-step exceptions */
-    int debug_target_el;
     GHashTable *cp_regs;
     uint64_t features; /* CPU features bits */
     bool aarch64;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
-static CPUARMTBFlags rebuild_hflags_aprofile(CPUARMState *env)
-{
-    CPUARMTBFlags flags = {};
-
-    DP_TBFLAG_ANY(flags, DEBUG_TARGET_EL, arm_debug_target_el(env));
-    return flags;
-}
-
 static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
                                         ARMMMUIdx mmu_idx)
 {
-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
+    CPUARMTBFlags flags = {};
     int el = arm_current_el(env);
 
     if (arm_sctlr(env, el) & SCTLR_A) {
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
 static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
                                         ARMMMUIdx mmu_idx)
 {
-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
+    CPUARMTBFlags flags = {};
     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
     uint64_t sctlr;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->ss_active = EX_TBFLAG_ANY(tb_flags, SS_ACTIVE);
     dc->pstate_ss = EX_TBFLAG_ANY(tb_flags, PSTATE__SS);
     dc->is_ldex = false;
-    dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
 
     /* Bound the number of insns to execute to those left on the page.  */
     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
         dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
     } else {
-        dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
         dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
         dc->hstr_active = EX_TBFLAG_A32(tb_flags, HSTR_ACTIVE);
         dc->ns = EX_TBFLAG_A32(tb_flags, NS);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is not required by any other translation file.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h | 8 --------
 target/arm/translate.c | 7 +++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
-static inline void gen_exception(int excp, uint32_t syndrome,
-                                 uint32_t target_el)
-{
-    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
-                                          tcg_constant_i32(syndrome),
-                                          tcg_constant_i32(target_el));
-}
-
 /* Generate an architectural singlestep exception */
 static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
+{
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syndrome),
+                                          tcg_constant_i32(target_el));
+}
+
 static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
                                     uint32_t syn, TCGv_i32 tcg_el)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
+static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
 {
     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
                                           tcg_constant_i32(syndrome),
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
             gen_ss_advance(dc);
-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-                          default_exception_el(dc));
+            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+                             default_exception_el(dc));
             break;
         case DISAS_HVC:
             gen_ss_advance(dc);
-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
             break;
         case DISAS_SMC:
             gen_ss_advance(dc);
-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
+            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
             break;
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             gen_helper_yield(cpu_env);
             break;
         case DISAS_SWI:
-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-                          default_exception_el(dc));
+            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+                             default_exception_el(dc));
             break;
         case DISAS_HVC:
-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
             break;
         case DISAS_SMC:
-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
+            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
             break;
         }
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a new wrapper function that passes the default
exception target to gen_exception_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Split out a common helper function for gen_exception_el
and gen_exception_insn_el_v.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

With the helper we can use exception_target_el at runtime,
instead of default_exception_el at translate time.
While we're at it, remove the DisasContext parameter from
gen_exception, as it is no longer used.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    |  1 +
 target/arm/op_helper.c | 10 ++++++++++
 target/arm/translate.c | 18 +++++++++++++-----
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
                    i32, i32, i32, i32)
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
+DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
 DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
 DEF_HELPER_2(exception_swstep, noreturn, env, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
     raise_exception(env, excp, syndrome, target_el);
 }
 
+/*
+ * Raise an exception with the specified syndrome register value
+ * to the default target el.
+ */
+void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
+                                     uint32_t syndrome)
+{
+    raise_exception(env, excp, syndrome, exception_target_el(env));
+}
+
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 {
     return cpsr_read(env) & ~CPSR_EXEC;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
     gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
 }
 
-static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
+static void gen_exception(int excp, uint32_t syndrome)
 {
-    gen_exception_el(excp, syndrome, default_exception_el(s));
+    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
+                                       tcg_constant_i32(syndrome));
 }
 
 static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
 
 void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
 {
-    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
+    if (s->aarch64) {
+        gen_a64_set_pc_im(pc);
+    } else {
+        gen_set_condexec(s);
+        gen_set_pc_im(s, pc);
+    }
+    gen_exception(excp, syn);
+    s->base.is_jmp = DISAS_NORETURN;
 }
 
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
             gen_ss_advance(dc);
-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
             break;
         case DISAS_HVC:
             gen_ss_advance(dc);
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             gen_helper_yield(cpu_env);
             break;
         case DISAS_SWI:
-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
             break;
         case DISAS_HVC:
             gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is no longer used.  At the same time, remove
DisasContext.secure_routed_to_el3, as it in turn becomes unused.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h     | 16 ----------------
 target/arm/translate-a64.c |  5 -----
 target/arm/translate.c     |  5 -----
 3 files changed, 26 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
-    /* Flag indicating that exceptions from secure mode are routed to EL3. */
-    bool secure_routed_to_el3;
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
     int vec_stride;
@@ -XXX,XX +XXX,XX @@ static inline int get_mem_index(DisasContext *s)
     return arm_to_core_mmu_idx(s->mmu_idx);
 }
 
-/* Function used to determine the target exception EL when otherwise not known
- * or default.
- */
-static inline int default_exception_el(DisasContext *s)
-{
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.  Otherwise,
-     * exceptions can only be routed to ELs above 1, so we target the higher of
-     * 1 or the current EL.
-     */
-    return (s->mmu_idx == ARMMMUIdx_SE10_0 && s->secure_routed_to_el3)
-            ? 3 : MAX(1, s->current_el);
-}
-
 static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
 {
     /* We don't need to save all of the syndrome so we mask and shift
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->condjmp = 0;
 
     dc->aarch64 = true;
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.
-     */
-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
-                               !arm_el_is_aa64(env, 3);
     dc->thumb = false;
     dc->sctlr_b = 0;
     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->condjmp = 0;
 
     dc->aarch64 = false;
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.
-     */
-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
-                               !arm_el_is_aa64(env, 3);
     dc->thumb = EX_TBFLAG_AM32(tb_flags, THUMB);
     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
     condexec = EX_TBFLAG_AM32(tb_flags, CONDEXEC);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle the debug vs current el exception test in one place.
Leave EXCP_BKPT alone, since that treats debug < current differently.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 44 +++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 20 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/*
+ * Raise an exception to the debug target el.
+ * Modify syndrome to indicate when origin and target EL are the same.
+ */
+G_NORETURN static void
+raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /*
+     * If singlestep is targeting a lower EL than the current one, then
+     * DisasContext.ss_active must be false and we can never get here.
+     * Similarly for watchpoint and breakpoint matches.
+     */
+    assert(debug_el >= cur_el);
+    syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
+    raise_exception(env, excp, syndrome, debug_el);
+}
+
 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
 static bool aa64_generate_debug_exceptions(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
     if (wp_hit) {
         if (wp_hit->flags & BP_CPU) {
             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
-            bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 
             cs->watchpoint_hit = NULL;
 
             env->exception.fsr = arm_debug_exception_fsr(env);
             env->exception.vaddress = wp_hit->hitaddr;
-            raise_exception(env, EXCP_DATA_ABORT,
-                    syn_watchpoint(same_el, 0, wnr),
-                    arm_debug_target_el(env));
+            raise_exception_debug(env, EXCP_DATA_ABORT,
+                                  syn_watchpoint(0, 0, wnr));
         }
     } else {
         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
-        bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 
         /*
          * (1) GDB breakpoints should be handled first.
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
          * exception/security level.
          */
         env->exception.vaddress = 0;
-        raise_exception(env, EXCP_PREFETCH_ABORT,
-                        syn_breakpoint(same_el),
-                        arm_debug_target_el(env));
+        raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
 
 void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
 {
-    int debug_el = arm_debug_target_el(env);
-    int cur_el = arm_current_el(env);
-
-    /*
-     * If singlestep is targeting a lower EL than the current one, then
-     * DisasContext.ss_active must be false and we can never get here.
-     */
-    assert(debug_el >= cur_el);
-    if (debug_el == cur_el) {
-        syndrome |= 1 << ARM_EL_EC_SHIFT;
-    }
-    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
+    raise_exception_debug(env, EXCP_UDEF, syndrome);
 }
 
 #if !defined(CONFIG_USER_ONLY)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is no longer used outside debug_helper.c.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 21 ---------------------
 target/arm/debug_helper.c | 21 +++++++++++++++++++++
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
     ARMASIdx_TagS = 3,
 } ARMASIdx;
 
-/* Return the Exception Level targeted by debug exceptions. */
-static inline int arm_debug_target_el(CPUARMState *env)
-{
-    bool secure = arm_is_secure(env);
-    bool route_to_el2 = false;
-
-    if (arm_is_el2_enabled(env)) {
-        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
-                       env->cp15.mdcr_el2 & MDCR_TDE;
-    }
-
-    if (route_to_el2) {
-        return 2;
-    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
-               !arm_el_is_aa64(env, 3) && secure) {
-        return 3;
-    } else {
-        return 1;
-    }
-}
-
 static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
 {
     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/* Return the Exception Level targeted by debug exceptions. */
+static int arm_debug_target_el(CPUARMState *env)
+{
+    bool secure = arm_is_secure(env);
+    bool route_to_el2 = false;
+
+    if (arm_is_el2_enabled(env)) {
+        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
+                       env->cp15.mdcr_el2 & MDCR_TDE;
+    }
+
+    if (route_to_el2) {
+        return 2;
+    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
+               !arm_el_is_aa64(env, 3) && secure) {
+        return 3;
+    } else {
+        return 1;
+    }
+}
+
 /*
  * Raise an exception to the debug target el.
  * Modify syndrome to indicate when origin and target EL are the same.
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We were using arm_is_secure and is_a64, which are
tests against the current EL, as opposed to
arm_el_is_aa64 and arm_is_secure_below_el3, which
can be applied to a different EL than current.
Consolidate the two tests.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
         int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN);
 
         switch (fpen) {
+        case 1:
+            if (cur_el != 0) {
+                break;
+            }
+            /* fall through */
         case 0:
         case 2:
-            if (cur_el == 0 || cur_el == 1) {
-                /* Trap to PL1, which might be EL1 or EL3 */
-                if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-                    return 3;
-                }
-                return 1;
-            }
-            if (cur_el == 3 && !is_a64(env)) {
-                /* Secure PL1 running at EL3 */
+            /* Trap from Secure PL0 or PL1 to Secure PL1. */
+            if (!arm_el_is_aa64(env, 3)
+                && (cur_el == 3 || arm_is_secure_below_el3(env))) {
                 return 3;
             }
-            break;
-        case 1:
-            if (cur_el == 0) {
+            if (cur_el <= 1) {
                 return 1;
             }
             break;
-        case 3:
-            break;
         }
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Because reset always initializes the AA64 version, SCR_EL3,
test the mode of EL3 instead of the type of the cpreg.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609214657.1217913-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     uint32_t valid_mask = 0x3fff;
     ARMCPU *cpu = env_archcpu(env);
 
-    if (ri->state == ARM_CP_STATE_AA64) {
-        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
-            !cpu_isar_feature(aa64_aa32_el1, cpu)) {
-                value |= SCR_FW | SCR_AW;   /* these two bits are RES1.  */
-        }
-        valid_mask &= ~SCR_NET;
+    /*
+     * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
+     * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
+     * Instead, choose the format based on the mode of EL3.
+     */
+    if (arm_el_is_aa64(env, 3)) {
+        value |= SCR_FW | SCR_AW;      /* RES1 */
+        valid_mask &= ~SCR_NET;        /* RES0 */
 
         if (cpu_isar_feature(aa64_ras, cpu)) {
             valid_mask |= SCR_TERR;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Since DDI0487F.a, the RW bit is RAO/WI.  When specifically
targeting such a cpu, e.g. cortex-a76, it is legitimate to
ignore the bit within the secure monitor.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1062
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609214657.1217913-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 5 +++++
 target/arm/helper.c | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
 }
 
+static inline bool isar_feature_aa64_aa32_el2(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL2) >= 2;
+}
+
 static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         value |= SCR_FW | SCR_AW;      /* RES1 */
         valid_mask &= ~SCR_NET;        /* RES0 */
 
+        if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
+            !cpu_isar_feature(aa64_aa32_el2, cpu)) {
+            value |= SCR_RW;           /* RAO/WI */
+        }
         if (cpu_isar_feature(aa64_ras, cpu)) {
             valid_mask |= SCR_TERR;
         }
-- 
2.25.1

In two places in gdbstub.c we look at gdbserver_state.init to decide
whether we're going to do a semihosting syscall via the gdb remote
protocol:
 * when setting up, if the user didn't explicitly select either
   native semihosting or gdb semihosting, we autoselect, with the
   intended behaviour "use gdb if gdb is connected"
 * when the semihosting layer attempts to do a syscall via gdb, we
   silently ignore it if the gdbstub wasn't actually set up

However, if the user's commandline sets up the gdbstub but tells QEMU
to start rather than waiting for a GDB to connect (eg using '-s' but
not '-S'), then we will have gdbserver_state.init true but no actual
connection; an attempt to use gdb syscalls will then crash because we
try to use gdbserver_state.c_cpu when it hasn't been set up:

#0  0x00007ffff6803ba8 in qemu_cpu_kick (cpu=0x0) at ../../softmmu/cpus.c:457
#1  0x00007ffff6c03913 in gdb_do_syscallv (cb=0x7ffff6c19944 <common_semi_cb>,
    fmt=0x7ffff7573b7e "", va=0x7ffff56294c0) at ../../gdbstub.c:2946
#2  0x00007ffff6c19c3a in common_semi_gdb_syscall (cs=0x7ffff83fe060,
    cb=0x7ffff6c19944 <common_semi_cb>, fmt=0x7ffff7573b75 "isatty,%x")
    at ../../semihosting/arm-compat-semi.c:494
#3  0x00007ffff6c1a064 in gdb_isattyfn (cs=0x7ffff83fe060, gf=0x7ffff86a3690)
    at ../../semihosting/arm-compat-semi.c:636
#4  0x00007ffff6c1b20f in do_common_semihosting (cs=0x7ffff83fe060)
    at ../../semihosting/arm-compat-semi.c:967
#5  0x00007ffff693a037 in handle_semihosting (cs=0x7ffff83fe060)
    at ../../target/arm/helper.c:10316

You can probably also get into this state via some odd
corner cases involving connecting a GDB and then telling it
to detach from all the vCPUs.

Abstract out the test into a new gdb_attached() function
which returns true only if there's actually a GDB connected
to the debug stub and attached to at least one vCPU.

Reported-by: Liviu Ionescu <ilg@livius.net>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220526190053.521505-2-peter.maydell@linaro.org
---
 gdbstub.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/gdbstub.c b/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int get_char(void)
 }
 #endif
 
+/*
+ * Return true if there is a GDB currently connected to the stub
+ * and attached to a CPU
+ */
+static bool gdb_attached(void)
+{
+    return gdbserver_state.init && gdbserver_state.c_cpu;
+}
+
 static enum {
     GDB_SYS_UNKNOWN,
     GDB_SYS_ENABLED,
@@ -XXX,XX +XXX,XX @@ int use_gdb_syscalls(void)
     /* -semihosting-config target=auto */
     /* On the first call check if gdb is connected and remember. */
     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
-        gdb_syscall_mode = gdbserver_state.init ?
-            GDB_SYS_ENABLED : GDB_SYS_DISABLED;
+        gdb_syscall_mode = gdb_attached() ? GDB_SYS_ENABLED : GDB_SYS_DISABLED;
     }
     return gdb_syscall_mode == GDB_SYS_ENABLED;
 }
@@ -XXX,XX +XXX,XX @@ void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
     target_ulong addr;
     uint64_t i64;
 
-    if (!gdbserver_state.init) {
+    if (!gdb_attached()) {
         return;
     }
 
-- 
2.25.1

Currently we mishandle the --semihosting-config option if the
user specifies it on the command line more than once. For
example with:
 --semihosting-config target=gdb --semihosting-config arg=foo,arg=bar

the function qemu_semihosting_config_options() is called twice, once
for each argument.  But that function expects to be called only once,
and it always unconditionally sets the semihosting.enabled,
semihost_chardev and semihosting.target variables.  This means that
if any of those options were set anywhere except the last
--semihosting-config option on the command line, those settings are
ignored.  In the example above, 'target=gdb' in the first option is
overridden by an implied default 'target=auto' in the second.

The QemuOptsList machinery has a flag for handling this kind of
"option group is setting global state": by setting
 .merge_lists = true;
we make the machinery merge all the --semihosting-config arguments
the user passes into a single set of options and call our
qemu_semihosting_config_options() just once.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220526190053.521505-3-peter.maydell@linaro.org
---
 semihosting/config.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/semihosting/config.c b/semihosting/config.c
index XXXXXXX..XXXXXXX 100644
--- a/semihosting/config.c
+++ b/semihosting/config.c
@@ -XXX,XX +XXX,XX @@
 
 QemuOptsList qemu_semihosting_config_opts = {
     .name = "semihosting-config",
+    .merge_lists = true,
     .implied_opt_name = "enable",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_semihosting_config_opts.head),
     .desc = {
-- 
2.25.1