Series comparison

-[PULL 00/16] target-arm queue
+[PULL 00/28] target-arm queue
-Patches for rc1: nothing major, just some minor bugfixes and
+Just flushing my target-arm queue since I won't be working next week :-)
 code cleanups.
 -- PMM
-The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
+The following changes since commit b3cd3b5a66f0dddfe3d5ba2bef13cd4f5b89cde9:
-  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
+  Merge tag 'pull-riscv-to-apply-20220610' of github.com:alistair23/qemu into staging (2022-06-09 22:08:27 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220610
-for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
+for you to fetch changes up to 90c072e063737e9e8f431489bbd334452f89056e:
-  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
+  semihosting/config: Merge --semihosting-config option groups (2022-06-10 14:32:36 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+ * refactor exception routing code
- * hw/arm/Kconfig: ARM_V7M depends on PTIMER
+ * fix SCR_EL3 RAO/RAZ bits
- * Minor coding style fixes
+ * gdbstub: Don't use GDB syscalls if no GDB is attached
- * docs: add some notes on the sbsa-ref machine
+ * semihosting/config: Merge --semihosting-config option groups
- * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+ * tests/qtest: Reduce npcm7xx_sdhci test image size
  * target/arm: Fix neon VTBL/VTBX for len > 1
  * hw/arm/armsse: Correct expansion MPC interrupt lines
  * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Alex Bennée (1):
+Hao Wu (1):
-      docs: add some notes on the sbsa-ref machine
+      tests/qtest: Reduce npcm7xx_sdhci test image size
 AlexChen (1):
       ssi: Fix bad printf format specifiers
 Andrew Jones (1):
       hw/arm/Kconfig: ARM_V7M depends on PTIMER
 Havard Skinnemoen (1):
       tests/qtest/npcm7xx_rng-test: count runs properly
 Peter Maydell (2):
-      hw/arm/nseries: Check return value from load_image_targphys()
+      gdbstub: Don't use GDB syscalls if no GDB is attached
-      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+      semihosting/config: Merge --semihosting-config option groups
-Philippe Mathieu-Daudé (6):
+Richard Henderson (25):
-      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      target/arm: Mark exception helpers as noreturn
-      hw/arm/armsse: Correct expansion MPC interrupt lines
+      target/arm: Add coproc parameter to syn_fp_access_trap
-      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+      target/arm: Move exception_target_el out of line
-      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      target/arm: Move arm_singlestep_active out of line
-      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+      target/arm: Move arm_generate_debug_exceptions out of line
-      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+      target/arm: Use is_a64 in arm_generate_debug_exceptions
       target/arm: Move exception_bkpt_insn to debug_helper.c
       target/arm: Move arm_debug_exception_fsr to debug_helper.c
       target/arm: Rename helper_exception_with_syndrome
       target/arm: Introduce gen_exception_insn_el_v
       target/arm: Rename gen_exception_insn to gen_exception_insn_el
       target/arm: Introduce gen_exception_insn
       target/arm: Create helper_exception_swstep
       target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
       target/arm: Move gen_exception to translate.c
       target/arm: Rename gen_exception to gen_exception_el
       target/arm: Introduce gen_exception
       target/arm: Introduce gen_exception_el_v
       target/arm: Introduce helper_exception_with_syndrome
       target/arm: Remove default_exception_el
       target/arm: Create raise_exception_debug
       target/arm: Move arm_debug_target_el to debug_helper.c
       target/arm: Fix Secure PL1 tests in fp_exception_el
       target/arm: Adjust format test in scr_write
       target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]
-Richard Henderson (1):
+ target/arm/cpu.h                 | 133 ++---------------------
-      target/arm: Fix neon VTBL/VTBX for len > 1
+ target/arm/helper.h              |   8 +-
+ target/arm/internals.h           |  43 +-------
-Xinhao Zhang (3):
+ target/arm/syndrome.h            |   7 +-
-      target/arm: add spaces around operator
+ target/arm/translate.h           |  43 ++------
-      target/arm: Don't use '#' flag of printf format
+ gdbstub.c                        |  14 ++-
-      target/arm: add space before the open parenthesis '('
+ semihosting/config.c             |   1 +
+ target/arm/debug_helper.c        | 220 +++++++++++++++++++++++++++++++++++++--
- docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ target/arm/helper.c              |  53 ++++------
- docs/system/target-arm.rst         |  1 +
+ target/arm/op_helper.c           |  52 +++++----
- include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/translate-a64.c       |  34 +++---
- target/arm/helper.h                |  2 +-
+ target/arm/translate-m-nocp.c    |  15 ++-
- hw/arm/armsse.c                    |  3 +-
+ target/arm/translate-mve.c       |   3 +-
- hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ target/arm/translate-vfp.c       |  18 +++-
- hw/arm/nseries.c                   | 26 ++++++++----------
+ target/arm/translate.c           | 106 ++++++++++---------
- hw/arm/stm32f205_soc.c             |  1 -
+ tests/qtest/npcm7xx_sdhci-test.c |   2 +-
- hw/misc/stm32f2xx_syscfg.c         |  2 --
+files changed, 390 insertions(+), 362 deletions(-)
  hw/ssi/imx_spi.c                   |  2 +-
  hw/ssi/xilinx_spi.c                |  2 +-
  target/arm/arch_dump.c             |  8 +++---
  target/arm/arm-semi.c              |  8 +++---
  target/arm/helper.c                |  2 +-
  target/arm/op_helper.c             | 23 +++++++++-------
  target/arm/translate-a64.c         |  4 +--
  target/arm/translate.c             |  2 +-
  tests/qtest/npcm7xx_rng-test.c     |  2 +-
  hw/arm/Kconfig                     |  3 +-
  target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
 files changed, 123 insertions(+), 98 deletions(-)
  create mode 100644 docs/system/arm/sbsa.rst

-New patch
+[PULL 01/28] target/arm: Mark exception helpers as noreturn
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.h | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+                    i32, i32, i32, i32)
+-DEF_HELPER_2(exception_internal, void, env, i32)
+-DEF_HELPER_4(exception_with_syndrome, void, env, i32, i32, i32)
+-DEF_HELPER_2(exception_bkpt_insn, void, env, i32)
++DEF_HELPER_2(exception_internal, noreturn, env, i32)
++DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
++DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
+ DEF_HELPER_1(setend, void, env)
+ DEF_HELPER_2(wfi, void, env, i32)
+--
+.25.1

-[PULL 04/16] target/arm: Don't use '#' flag of printf format
+[PULL 02/28] target/arm: Add coproc parameter to syn_fp_access_trap
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Fix code style. Don't use '#' flag of printf format ('%#') in
+With ARMv8, this field is always RES0.
-format strings, use '0x' prefix instead
+With ARMv7, targeting EL2 and TA=0, it is always 0xA.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 4 ++--
+ target/arm/syndrome.h      |  7 ++++---
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/translate-a64.c |  3 ++-
  target/arm/translate-vfp.c | 14 ++++++++++++--
 files changed, 18 insertions(+), 6 deletions(-)
+diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/syndrome.h
++++ b/target/arm/syndrome.h
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
+         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
+ }
+-static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
++static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit,
++                                          int coproc)
+ {
+-    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
++    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 */
+     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
+         | (is_16bit ? 0 : ARM_EL_IL)
+-        | (cv << 24) | (cond << 20) | 0xa;
++        | (cv << 24) | (cond << 20) | coproc;
+ }
+ static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
-                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
+         s->fp_access_checked = true;
-                 break;
-             default:
+         gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
--                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
-+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
++                           syn_fp_access_trap(1, 0xe, false, 0),
-                         __func__, insn, fpopcode, s->pc_curr);
++                           s->fp_excp_el);
-                 g_assert_not_reached();
+         return false;
              }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      case 0x7f: /* FSQRT (vector) */
          break;
      default:
 -        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
 +        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
+     s->fp_access_checked = true;
+diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c
++++ b/target/arm/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
+ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
+ {
+     if (s->fp_excp_el) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
++        /*
++         * The full syndrome is only used for HSR when HCPTR traps:
++         * For v8, when TA==0, coproc is RES0.
++         * For v7, any use of a Floating-point instruction or access
++         * to a Floating-point Extension register that is trapped to
++         * Hyp mode because of a trap configured in the HCPTR sets
++         * this field to 0xA.
++         */
++        int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
++        uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
++
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+         return false;
+     }
 --
-.20.1
+.25.1

-New patch
+[PULL 03/28] target/arm: Move exception_target_el out of line
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the function to op_helper.c, near raise_exception.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/internals.h | 16 +---------------
+ target/arm/op_helper.c | 15 +++++++++++++++
+files changed, 16 insertions(+), 15 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
+ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
+-static inline int exception_target_el(CPUARMState *env)
+-{
+-    int target_el = MAX(1, arm_current_el(env));
+-
+-    /*
+-     * No such thing as secure EL1 if EL3 is aarch32,
+-     * so update the target EL to EL3 in this case.
+-     */
+-    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
+-        target_el = 3;
+-    }
+-
+-    return target_el;
+-}
+-
+ /* Determine if allocation tags are available.  */
+ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+                                                  uint64_t sctlr)
+@@ -XXX,XX +XXX,XX @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
+ bool el_is_in_host(CPUARMState *env, int el);
+ void aa32_max_features(ARMCPU *cpu);
++int exception_target_el(CPUARMState *env);
+ /* Powers of 2 for sve_vq_map et al. */
+ #define SVE_VQ_POW2_MAP                                 \
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #define SIGNBIT (uint32_t)0x80000000
+ #define SIGNBIT64 ((uint64_t)1 << 63)
++int exception_target_el(CPUARMState *env)
++{
++    int target_el = MAX(1, arm_current_el(env));
++
++    /*
++     * No such thing as secure EL1 if EL3 is aarch32,
++     * so update the target EL to EL3 in this case.
++     */
++    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
++        target_el = 3;
++    }
++
++    return target_el;
++}
++
+ void raise_exception(CPUARMState *env, uint32_t excp,
+                      uint32_t syndrome, uint32_t target_el)
+ {
+--
+.25.1

-New patch
+[PULL 04/28] target/arm: Move arm_singlestep_active out of line
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the function to debug_helper.c, and the
+declaration to internals.h.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-5-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h          | 10 ----------
+ target/arm/internals.h    |  1 +
+ target/arm/debug_helper.c | 12 ++++++++++++
+files changed, 13 insertions(+), 10 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_generate_debug_exceptions(CPUARMState *env)
+     }
+ }
+-/* Is single-stepping active? (Note that the "is EL_D AArch64?" check
+- * implicitly means this always returns false in pre-v8 CPUs.)
+- */
+-static inline bool arm_singlestep_active(CPUARMState *env)
+-{
+-    return extract32(env->cp15.mdscr_el1, 0, 1)
+-        && arm_el_is_aa64(env, arm_debug_target_el(env))
+-        && arm_generate_debug_exceptions(env);
+-}
+-
+ static inline bool arm_sctlr_b(CPUARMState *env)
+ {
+     return
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
+ void aa32_max_features(ARMCPU *cpu);
+ int exception_target_el(CPUARMState *env);
++bool arm_singlestep_active(CPUARMState *env);
+ /* Powers of 2 for sve_vq_map et al. */
+ #define SVE_VQ_POW2_MAP                                 \
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/exec-all.h"
+ #include "exec/helper-proto.h"
++
++/*
++ * Is single-stepping active? (Note that the "is EL_D AArch64?" check
++ * implicitly means this always returns false in pre-v8 CPUs.)
++ */
++bool arm_singlestep_active(CPUARMState *env)
++{
++    return extract32(env->cp15.mdscr_el1, 0, 1)
++        && arm_el_is_aa64(env, arm_debug_target_el(env))
++        && arm_generate_debug_exceptions(env);
++}
++
+ /* Return true if the linked breakpoint entry lbn passes its checks */
+ static bool linked_bp_matches(ARMCPU *cpu, int lbn)
+ {
+--
+.25.1

-New patch
+[PULL 05/28] target/arm: Move arm_generate_debug_exceptions out of line
+From: Richard Henderson <richard.henderson@linaro.org>
+Move arm_generate_debug_exceptions and its two subroutines,
+{aa32,aa64}_generate_debug_exceptions into debug_helper.c,
+and the one interface declaration to internals.h.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-6-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h          | 91 -------------------------------------
+ target/arm/internals.h    |  1 +
+ target/arm/debug_helper.c | 94 +++++++++++++++++++++++++++++++++++++++
+files changed, 95 insertions(+), 91 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
+     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
+ }
+-/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
+-static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
+-{
+-    int cur_el = arm_current_el(env);
+-    int debug_el;
+-
+-    if (cur_el == 3) {
+-        return false;
+-    }
+-
+-    /* MDCR_EL3.SDD disables debug events from Secure state */
+-    if (arm_is_secure_below_el3(env)
+-        && extract32(env->cp15.mdcr_el3, 16, 1)) {
+-        return false;
+-    }
+-
+-    /*
+-     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
+-     * while not masking the (D)ebug bit in DAIF.
+-     */
+-    debug_el = arm_debug_target_el(env);
+-
+-    if (cur_el == debug_el) {
+-        return extract32(env->cp15.mdscr_el1, 13, 1)
+-            && !(env->daif & PSTATE_D);
+-    }
+-
+-    /* Otherwise the debug target needs to be a higher EL */
+-    return debug_el > cur_el;
+-}
+-
+-static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
+-{
+-    int el = arm_current_el(env);
+-
+-    if (el == 0 && arm_el_is_aa64(env, 1)) {
+-        return aa64_generate_debug_exceptions(env);
+-    }
+-
+-    if (arm_is_secure(env)) {
+-        int spd;
+-
+-        if (el == 0 && (env->cp15.sder & 1)) {
+-            /* SDER.SUIDEN means debug exceptions from Secure EL0
+-             * are always enabled. Otherwise they are controlled by
+-             * SDCR.SPD like those from other Secure ELs.
+-             */
+-            return true;
+-        }
+-
+-        spd = extract32(env->cp15.mdcr_el3, 14, 2);
+-        switch (spd) {
+-        case 1:
+-            /* SPD == 0b01 is reserved, but behaves as 0b00. */
+-        case 0:
+-            /* For 0b00 we return true if external secure invasive debug
+-             * is enabled. On real hardware this is controlled by external
+-             * signals to the core. QEMU always permits debug, and behaves
+-             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
+-             */
+-            return true;
+-        case 2:
+-            return false;
+-        case 3:
+-            return true;
+-        }
+-    }
+-
+-    return el != 2;
+-}
+-
+-/* Return true if debugging exceptions are currently enabled.
+- * This corresponds to what in ARM ARM pseudocode would be
+- *    if UsingAArch32() then
+- *        return AArch32.GenerateDebugExceptions()
+- *    else
+- *        return AArch64.GenerateDebugExceptions()
+- * We choose to push the if() down into this function for clarity,
+- * since the pseudocode has it at all callsites except for the one in
+- * CheckSoftwareStep(), where it is elided because both branches would
+- * always return the same value.
+- */
+-static inline bool arm_generate_debug_exceptions(CPUARMState *env)
+-{
+-    if (env->aarch64) {
+-        return aa64_generate_debug_exceptions(env);
+-    } else {
+-        return aa32_generate_debug_exceptions(env);
+-    }
+-}
+-
+ static inline bool arm_sctlr_b(CPUARMState *env)
+ {
+     return
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
+ void aa32_max_features(ARMCPU *cpu);
+ int exception_target_el(CPUARMState *env);
+ bool arm_singlestep_active(CPUARMState *env);
++bool arm_generate_debug_exceptions(CPUARMState *env);
+ /* Powers of 2 for sve_vq_map et al. */
+ #define SVE_VQ_POW2_MAP                                 \
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-proto.h"
++/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
++static bool aa64_generate_debug_exceptions(CPUARMState *env)
++{
++    int cur_el = arm_current_el(env);
++    int debug_el;
++
++    if (cur_el == 3) {
++        return false;
++    }
++
++    /* MDCR_EL3.SDD disables debug events from Secure state */
++    if (arm_is_secure_below_el3(env)
++        && extract32(env->cp15.mdcr_el3, 16, 1)) {
++        return false;
++    }
++
++    /*
++     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
++     * while not masking the (D)ebug bit in DAIF.
++     */
++    debug_el = arm_debug_target_el(env);
++
++    if (cur_el == debug_el) {
++        return extract32(env->cp15.mdscr_el1, 13, 1)
++            && !(env->daif & PSTATE_D);
++    }
++
++    /* Otherwise the debug target needs to be a higher EL */
++    return debug_el > cur_el;
++}
++
++static bool aa32_generate_debug_exceptions(CPUARMState *env)
++{
++    int el = arm_current_el(env);
++
++    if (el == 0 && arm_el_is_aa64(env, 1)) {
++        return aa64_generate_debug_exceptions(env);
++    }
++
++    if (arm_is_secure(env)) {
++        int spd;
++
++        if (el == 0 && (env->cp15.sder & 1)) {
++            /*
++             * SDER.SUIDEN means debug exceptions from Secure EL0
++             * are always enabled. Otherwise they are controlled by
++             * SDCR.SPD like those from other Secure ELs.
++             */
++            return true;
++        }
++
++        spd = extract32(env->cp15.mdcr_el3, 14, 2);
++        switch (spd) {
++        case 1:
++            /* SPD == 0b01 is reserved, but behaves as 0b00. */
++        case 0:
++            /*
++             * For 0b00 we return true if external secure invasive debug
++             * is enabled. On real hardware this is controlled by external
++             * signals to the core. QEMU always permits debug, and behaves
++             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
++             */
++            return true;
++        case 2:
++            return false;
++        case 3:
++            return true;
++        }
++    }
++
++    return el != 2;
++}
++
++/*
++ * Return true if debugging exceptions are currently enabled.
++ * This corresponds to what in ARM ARM pseudocode would be
++ *    if UsingAArch32() then
++ *        return AArch32.GenerateDebugExceptions()
++ *    else
++ *        return AArch64.GenerateDebugExceptions()
++ * We choose to push the if() down into this function for clarity,
++ * since the pseudocode has it at all callsites except for the one in
++ * CheckSoftwareStep(), where it is elided because both branches would
++ * always return the same value.
++ */
++bool arm_generate_debug_exceptions(CPUARMState *env)
++{
++    if (env->aarch64) {
++        return aa64_generate_debug_exceptions(env);
++    } else {
++        return aa32_generate_debug_exceptions(env);
++    }
++}
++
+ /*
+  * Is single-stepping active? (Note that the "is EL_D AArch64?" check
+  * implicitly means this always returns false in pre-v8 CPUs.)
+--
+.25.1

-New patch
+[PULL 06/28] target/arm: Use is_a64 in arm_generate_debug_exceptions
+From: Richard Henderson <richard.henderson@linaro.org>
+Use the accessor rather than the raw structure member.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-7-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/debug_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
+  */
+ bool arm_generate_debug_exceptions(CPUARMState *env)
+ {
+-    if (env->aarch64) {
++    if (is_a64(env)) {
+         return aa64_generate_debug_exceptions(env);
+     } else {
+         return aa32_generate_debug_exceptions(env);
+--
+.25.1

-New patch
+[PULL 07/28] target/arm: Move exception_bkpt_insn to debug_helper.c
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-8-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/debug_helper.c | 31 +++++++++++++++++++++++++++++++
+ target/arm/op_helper.c    | 29 -----------------------------
+files changed, 31 insertions(+), 29 deletions(-)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
+     }
+ }
++/*
++ * Raise an EXCP_BKPT with the specified syndrome register value,
++ * targeting the correct exception level for debug exceptions.
++ */
++void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
++{
++    int debug_el = arm_debug_target_el(env);
++    int cur_el = arm_current_el(env);
++
++    /* FSR will only be used if the debug target EL is AArch32. */
++    env->exception.fsr = arm_debug_exception_fsr(env);
++    /*
++     * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
++     * values to the guest that it shouldn't be able to see at its
++     * exception/security level.
++     */
++    env->exception.vaddress = 0;
++    /*
++     * Other kinds of architectural debug exception are ignored if
++     * they target an exception level below the current one (in QEMU
++     * this is checked by arm_generate_debug_exceptions()). Breakpoint
++     * instructions are special because they always generate an exception
++     * to somewhere: if they can't go to the configured debug exception
++     * level they are taken to the current exception level.
++     */
++    if (debug_el < cur_el) {
++        debug_el = cur_el;
++    }
++    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
++}
++
+ #if !defined(CONFIG_USER_ONLY)
+ vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
+     raise_exception(env, excp, syndrome, target_el);
+ }
+-/* Raise an EXCP_BKPT with the specified syndrome register value,
+- * targeting the correct exception level for debug exceptions.
+- */
+-void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+-{
+-    int debug_el = arm_debug_target_el(env);
+-    int cur_el = arm_current_el(env);
+-
+-    /* FSR will only be used if the debug target EL is AArch32. */
+-    env->exception.fsr = arm_debug_exception_fsr(env);
+-    /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
+-     * values to the guest that it shouldn't be able to see at its
+-     * exception/security level.
+-     */
+-    env->exception.vaddress = 0;
+-    /*
+-     * Other kinds of architectural debug exception are ignored if
+-     * they target an exception level below the current one (in QEMU
+-     * this is checked by arm_generate_debug_exceptions()). Breakpoint
+-     * instructions are special because they always generate an exception
+-     * to somewhere: if they can't go to the configured debug exception
+-     * level they are taken to the current exception level.
+-     */
+-    if (debug_el < cur_el) {
+-        debug_el = cur_el;
+-    }
+-    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+-}
+-
+ uint32_t HELPER(cpsr_read)(CPUARMState *env)
+ {
+     return cpsr_read(env) & ~CPSR_EXEC;
+--
+.25.1

-New patch
+[PULL 08/28] target/arm: Move arm_debug_exception_fsr to debug_helper.c
+From: Richard Henderson <richard.henderson@linaro.org>
+This function now now only used in debug_helper.c, so there is
+no reason to have a declaration in a header.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-9-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/internals.h    | 25 -------------------------
+ target/arm/debug_helper.c | 26 ++++++++++++++++++++++++++
+files changed, 26 insertions(+), 25 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
+     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
+ }
+-/* Return the FSR value for a debug exception (watchpoint, hardware
+- * breakpoint or BKPT insn) targeting the specified exception level.
+- */
+-static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
+-{
+-    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
+-    int target_el = arm_debug_target_el(env);
+-    bool using_lpae = false;
+-
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
+-        using_lpae = true;
+-    } else {
+-        if (arm_feature(env, ARM_FEATURE_LPAE) &&
+-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
+-            using_lpae = true;
+-        }
+-    }
+-
+-    if (using_lpae) {
+-        return arm_fi_to_lfsc(&fi);
+-    } else {
+-        return arm_fi_to_sfsc(&fi);
+-    }
+-}
+-
+ /**
+  * arm_num_brps: Return number of implemented breakpoints.
+  * Note that the ID register BRPS field is "number of bps - 1",
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
+     return check_watchpoints(cpu);
+ }
++/*
++ * Return the FSR value for a debug exception (watchpoint, hardware
++ * breakpoint or BKPT insn) targeting the specified exception level.
++ */
++static uint32_t arm_debug_exception_fsr(CPUARMState *env)
++{
++    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
++    int target_el = arm_debug_target_el(env);
++    bool using_lpae = false;
++
++    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
++        using_lpae = true;
++    } else {
++        if (arm_feature(env, ARM_FEATURE_LPAE) &&
++            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
++            using_lpae = true;
++        }
++    }
++
++    if (using_lpae) {
++        return arm_fi_to_lfsc(&fi);
++    } else {
++        return arm_fi_to_sfsc(&fi);
++    }
++}
++
+ void arm_debug_excp_handler(CPUState *cs)
+ {
+     /*
+--
+.25.1

-[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
+[PULL 09/28] target/arm: Rename helper_exception_with_syndrome
 From: Richard Henderson <richard.henderson@linaro.org>
-The helper function did not get updated when we reorganized
+Rename to helper_exception_with_syndrome_el, to emphasize
-the vector register file for SVE.  Since then, the neon dregs
+that the target el is a parameter.
 are non-sequential and cannot be simply indexed.
-At the same time, make the helper function operate on 64-bit
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 quantities so that we do not have to call it twice.
 Fixes: c39c2b9043e
 Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-[PMM: use aa32_vfp_dreg() rather than opencoding]
+Message-id: 20220609202901.1177572-10-richard.henderson@linaro.org
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h             |  2 +-
+ target/arm/helper.h    | 2 +-
- target/arm/op_helper.c          | 23 +++++++++--------
+ target/arm/translate.h | 6 +++---
- target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
+ target/arm/op_helper.c | 6 +++---
-files changed, 29 insertions(+), 40 deletions(-)
+ target/arm/translate.c | 6 +++---
 files changed, 10 insertions(+), 10 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
- DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+                    i32, i32, i32, i32)
- DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
--DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+-DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
-+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
++DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
- DEF_HELPER_3(shl_cc, i32, env, i32, i32)
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
- DEF_HELPER_3(shr_cc, i32, env, i32, i32)
+ DEF_HELPER_1(setend, void, env)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
  static inline void gen_exception(int excp, uint32_t syndrome,
                                   uint32_t target_el)
  {
 -    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
 -                                       tcg_constant_i32(syndrome),
 -                                       tcg_constant_i32(target_el));
 +    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
 +                                          tcg_constant_i32(syndrome),
 +                                          tcg_constant_i32(target_el));
  }
  /* Generate an architectural singlestep exception */
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+@@ -XXX,XX +XXX,XX @@ void HELPER(yield)(CPUARMState *env)
-     cpu_loop_exit_restore(cs, ra);
+  * those EXCP values which are special cases for QEMU to interrupt
   * execution and not to be used for exceptions which are passed to
   * the guest (those must all have syndrome information and thus should
 - * use exception_with_syndrome).
 + * use exception_with_syndrome*).
   */
  void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
  {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
  }
--uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
+ /* Raise an exception with the specified syndrome register value */
--                          uint32_t maxindex)
+-void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
-+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+-                                     uint32_t syndrome, uint32_t target_el)
-+                          uint64_t ireg, uint64_t def)
++void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
 +                                        uint32_t syndrome, uint32_t target_el)
  {
--    uint32_t val, shift;
+     raise_exception(env, excp, syndrome, target_el);
 -    uint64_t *table = vn;
 +    uint64_t tmp, val = 0;
 +    uint32_t maxindex = ((desc & 3) + 1) * 8;
 +    uint32_t base_reg = desc >> 2;
 +    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
      return val;
  }
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
+--- a/target/arm/translate.c
-+++ b/target/arm/translate-neon.c.inc
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
--    int n;
+     gen_set_condexec(s);
--    TCGv_i32 tmp, tmp2, tmp3, tmp4;
+     gen_set_pc_im(s, s->pc_curr);
--    TCGv_ptr ptr1;
+-    gen_helper_exception_with_syndrome(cpu_env,
-+    TCGv_i64 val, def;
+-                                       tcg_constant_i32(excp),
-+    TCGv_i32 desc;
+-                                       tcg_constant_i32(syn), tcg_el);
++    gen_helper_exception_with_syndrome_el(cpu_env,
-     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
++                                          tcg_constant_i32(excp),
-         return false;
++                                          tcg_constant_i32(syn), tcg_el);
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+     s->base.is_jmp = DISAS_NORETURN;
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
 +    tcg_temp_free_i64(def);
 +    tcg_temp_free_i64(val);
 +    tcg_temp_free_i32(desc);
      return true;
  }
 --
-.20.1
+.25.1

-New patch
+[PULL 10/28] target/arm: Introduce gen_exception_insn_el_v
+From: Richard Henderson <richard.henderson@linaro.org>
+Create a function below gen_exception_insn that takes
+the target_el as a TCGv_i32, replacing gen_exception_el.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-11-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 27 ++++++++++++---------------
+file changed, 12 insertions(+), 15 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el)
++static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
++                                    uint32_t syn, TCGv_i32 tcg_el)
+ {
+     if (s->aarch64) {
+         gen_a64_set_pc_im(pc);
+@@ -XXX,XX +XXX,XX @@ void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+         gen_set_condexec(s);
+         gen_set_pc_im(s, pc);
+     }
+-    gen_exception(excp, syn, target_el);
++    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
++                                          tcg_constant_i32(syn), tcg_el);
+     s->base.is_jmp = DISAS_NORETURN;
+ }
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
++                        uint32_t syn, uint32_t target_el)
++{
++    gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
++}
++
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ {
+     gen_set_condexec(s);
+@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s)
+                        default_exception_el(s));
+ }
+-static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
+-                             TCGv_i32 tcg_el)
+-{
+-    gen_set_condexec(s);
+-    gen_set_pc_im(s, s->pc_curr);
+-    gen_helper_exception_with_syndrome_el(cpu_env,
+-                                          tcg_constant_i32(excp),
+-                                          tcg_constant_i32(syn), tcg_el);
+-    s->base.is_jmp = DISAS_NORETURN;
+-}
+-
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+ void gen_lookup_tb(DisasContext *s)
+ {
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+                 tcg_el = tcg_constant_i32(3);
+             }
+-            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
++            gen_exception_insn_el_v(s, s->pc_curr, EXCP_UDEF,
++                                    syn_uncategorized(), tcg_el);
+             tcg_temp_free_i32(tcg_el);
+             return false;
+         }
+--
+.25.1

-New patch
+[PULL 11/28] target/arm: Rename gen_exception_insn to gen_exception_insn_el
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h        |  4 ++--
+ target/arm/translate-a64.c    | 36 ++++++++++++++++----------------
+ target/arm/translate-m-nocp.c | 16 +++++++-------
+ target/arm/translate-mve.c    |  4 ++--
+ target/arm/translate-vfp.c    |  6 +++---
+ target/arm/translate.c        | 39 ++++++++++++++++++-----------------
+files changed, 53 insertions(+), 52 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
+ void arm_gen_test_cc(int cc, TCGLabel *label);
+ MemOp pow2_align(unsigned i);
+ void unallocated_encoding(DisasContext *s);
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el);
++void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
++                           uint32_t syn, uint32_t target_el);
+ /* Return state of Alternate Half-precision flag, caller frees result */
+ static inline TCGv_i32 get_ahp_flag(void)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
+         assert(!s->fp_access_checked);
+         s->fp_access_checked = true;
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_fp_access_trap(1, 0xe, false, 0),
+-                           s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_fp_access_trap(1, 0xe, false, 0),
++                              s->fp_excp_el);
+         return false;
+     }
+     s->fp_access_checked = true;
+@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
+         assert(!s->sve_access_checked);
+         s->sve_access_checked = true;
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_sve_access_trap(), s->sve_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_sve_access_trap(), s->sve_excp_el);
+         return false;
+     }
+     s->sve_access_checked = true;
+@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
+     } else {
+         syndrome = syn_uncategorized();
+     }
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome,
+-                       default_exception_el(s));
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
++                          default_exception_el(s));
+ }
+ /* MRS - move from system register
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+         switch (op2_ll) {
+         case 1:                                                     /* SVC */
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
+-                               syn_aa64_svc(imm16), default_exception_el(s));
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
++                                  syn_aa64_svc(imm16), default_exception_el(s));
+             break;
+         case 2:                                                     /* HVC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+             gen_a64_set_pc_im(s->pc_curr);
+             gen_helper_pre_hvc(cpu_env);
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
+-                               syn_aa64_hvc(imm16), 2);
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_HVC,
++                                  syn_aa64_hvc(imm16), 2);
+             break;
+         case 3:                                                     /* SMC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+             gen_a64_set_pc_im(s->pc_curr);
+             gen_helper_pre_smc(cpu_env, tcg_constant_i32(syn_aa64_smc(imm16)));
+             gen_ss_advance(s);
+-            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
+-                               syn_aa64_smc(imm16), 3);
++            gen_exception_insn_el(s, s->base.pc_next, EXCP_SMC,
++                                  syn_aa64_smc(imm16), 3);
+             break;
+         default:
+             unallocated_encoding(s);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+             if (s->btype != 0
+                 && s->guarded_page
+                 && !btype_destination_ok(insn, s->bt, s->btype)) {
+-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                                   syn_btitrap(s->btype),
+-                                   default_exception_el(s));
++                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                                      syn_btitrap(s->btype),
++                                      default_exception_el(s));
+                 return;
+             }
+         } else {
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-m-nocp.c
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+     tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+     if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return true;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
+         if (!vfp_access_check_m(s, true)) {
+             /*
+              * This was only a conditional exception, so override
+-             * gen_exception_insn()'s default to DISAS_NORETURN
++             * gen_exception_insn_el()'s default to DISAS_NORETURN
+              */
+             s->base.is_jmp = DISAS_NEXT;
+             break;
+@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+         if (!vfp_access_check_m(s, true)) {
+             /*
+              * This was only a conditional exception, so override
+-             * gen_exception_insn()'s default to DISAS_NORETURN
++             * gen_exception_insn_el()'s default to DISAS_NORETURN
+              */
+             s->base.is_jmp = DISAS_NEXT;
+             break;
+@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+     }
+     if (a->cp != 10) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), default_exception_el(s));
+         return true;
+     }
+     if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return true;
+     }
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
+         return true;
+     default:
+         /* Reserved value: INVSTATE UsageFault */
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         return false;
+     }
+ }
+diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c
++++ b/target/arm/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
+         int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
+         uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+         return false;
+     }
+@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
+          * the encoding space handled by the patterns in m-nocp.decode,
+          * and for them we may need to raise NOCP here.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                              syn_uncategorized(), s->fp_excp_el);
+         return false;
+     }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+-                        uint32_t syn, uint32_t target_el)
++void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
++                           uint32_t syn, uint32_t target_el)
+ {
+     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ void unallocated_encoding(DisasContext *s)
+ {
+     /* Unallocated and reserved encodings are uncategorized */
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+-                       default_exception_el(s));
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
++                          default_exception_el(s));
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+ undef:
+     /* If we get here then some access check did not pass */
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                       syn_uncategorized(), exc_target);
++    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                          syn_uncategorized(), exc_target);
+     return false;
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
+      * For the UNPREDICTABLE cases we choose to UNDEF.
+      */
+     if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_uncategorized(), 3);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
+          * Do the check-and-raise-exception by hand.
+          */
+         if (s->fp_excp_el) {
+-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                               syn_uncategorized(), s->fp_excp_el);
++            gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
++                                  syn_uncategorized(), s->fp_excp_el);
+             return true;
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
+         tmp = load_cpu_field(v7m.ltpsize);
+         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
+         tcg_temp_free_i32(tmp);
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         gen_set_label(skipexc);
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+      * UsageFault exception.
+      */
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(s));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+-                           syn_illegalstate(), default_exception_el(dc));
++        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
++                              syn_illegalstate(), default_exception_el(dc));
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          */
+         tcg_remove_ops_after(dc->insn_eci_rewind);
+         dc->condjmp = 0;
+-        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                           default_exception_el(dc));
++        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
++                              default_exception_el(dc));
+     }
+     arm_post_translate_insn(dc);
+--
+.25.1

-New patch
+[PULL 12/28] target/arm: Introduce gen_exception_insn
+From: Richard Henderson <richard.henderson@linaro.org>
+Create a new wrapper function that passes the default
+exception target to gen_exception_insn_el.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-13-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.h        |  1 +
+ target/arm/translate-a64.c    | 15 ++++++---------
+ target/arm/translate-m-nocp.c |  3 +--
+ target/arm/translate-mve.c    |  3 +--
+ target/arm/translate.c        | 29 +++++++++++++----------------
+files changed, 22 insertions(+), 29 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ MemOp pow2_align(unsigned i);
+ void unallocated_encoding(DisasContext *s);
+ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                            uint32_t syn, uint32_t target_el);
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn);
+ /* Return state of Alternate Half-precision flag, caller frees result */
+ static inline TCGv_i32 get_ahp_flag(void)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
+     } else {
+         syndrome = syn_uncategorized();
+     }
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
+-                          default_exception_el(s));
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome);
+ }
+ /* MRS - move from system register
+@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
+         switch (op2_ll) {
+         case 1:                                                     /* SVC */
+             gen_ss_advance(s);
+-            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
+-                                  syn_aa64_svc(imm16), default_exception_el(s));
++            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
++                               syn_aa64_svc(imm16));
+             break;
+         case 2:                                                     /* HVC */
+             if (s->current_el == 0) {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+             if (s->btype != 0
+                 && s->guarded_page
+                 && !btype_destination_ok(insn, s->bt, s->btype)) {
+-                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                                      syn_btitrap(s->btype),
+-                                      default_exception_el(s));
++                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
++                                   syn_btitrap(s->btype));
+                 return;
+             }
+         } else {
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-m-nocp.c
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+     }
+     if (a->cp != 10) {
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+-                              syn_uncategorized(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized());
+         return true;
+     }
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
+         return true;
+     default:
+         /* Reserved value: INVSTATE UsageFault */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         return false;
+     }
+ }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+ }
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
++{
++    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
++}
++
+ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ {
+     gen_set_condexec(s);
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
+ void unallocated_encoding(DisasContext *s)
+ {
+     /* Unallocated and reserved encodings are uncategorized */
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+-                          default_exception_el(s));
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+      * an exception and return false. Otherwise it will return true,
+      * and set *tgtmode and *regno appropriately.
+      */
+-    int exc_target = default_exception_el(s);
+-
+     /* These instructions are present only in ARMv8, or in ARMv7 with the
+      * Virtualization Extensions.
+      */
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+ undef:
+     /* If we get here then some access check did not pass */
+-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                          syn_uncategorized(), exc_target);
++    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
+     return false;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
+         tmp = load_cpu_field(v7m.ltpsize);
+         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
+         tcg_temp_free_i32(tmp);
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         gen_set_label(skipexc);
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+      * UsageFault exception.
+      */
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(s));
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          * Illegal execution state. This has priority over BTI
+          * exceptions, but comes after instruction abort exceptions.
+          */
+-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
+-                              syn_illegalstate(), default_exception_el(dc));
++        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF, syn_illegalstate());
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+          */
+         tcg_remove_ops_after(dc->insn_eci_rewind);
+         dc->condjmp = 0;
+-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+-                              default_exception_el(dc));
++        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE,
++                           syn_uncategorized());
+     }
+     arm_post_translate_insn(dc);
+--
+.25.1

-New patch
+[PULL 13/28] target/arm: Create helper_exception_swstep
+From: Richard Henderson <richard.henderson@linaro.org>
+Move the computation from gen_swstep_exception into a helper.
+This fixes a bug when:
+  - MDSCR_EL1.KDE == 1 to enable debug exceptions within EL_D itself
+  - we singlestep an ERET from EL_D to some lower EL
+Previously we were computing 'same el' based on the EL which
+executed the ERET instruction, whereas it ought to be computed
+based on the EL to which ERET returned.  This happens naturally
+with the new helper, which runs after EL has been changed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-14-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.h       |  1 +
+ target/arm/translate.h    | 12 +++---------
+ target/arm/debug_helper.c | 16 ++++++++++++++++
+files changed, 20 insertions(+), 9 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
+ DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
++DEF_HELPER_2(exception_swstep, noreturn, env, i32)
+ DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
+ DEF_HELPER_1(setend, void, env)
+ DEF_HELPER_2(wfi, void, env, i32)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
+ /* Generate an architectural singlestep exception */
+ static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
+ {
+-    bool same_el = (s->debug_target_el == s->current_el);
+-
+-    /*
+-     * If singlestep is targeting a lower EL than the current one,
+-     * then s->ss_active must be false and we can never get here.
+-     */
+-    assert(s->debug_target_el >= s->current_el);
+-
+-    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
++    /* Fill in the same_el field of the syndrome in the helper. */
++    uint32_t syn = syn_swstep(false, isv, ex);
++    gen_helper_exception_swstep(cpu_env, tcg_constant_i32(syn));
+ }
+ /*
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+ }
++void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
++{
++    int debug_el = arm_debug_target_el(env);
++    int cur_el = arm_current_el(env);
++
++    /*
++     * If singlestep is targeting a lower EL than the current one, then
++     * DisasContext.ss_active must be false and we can never get here.
++     */
++    assert(debug_el >= cur_el);
++    if (debug_el == cur_el) {
++        syndrome |= 1 << ARM_EL_EC_SHIFT;
++    }
++    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
++}
++
+ #if !defined(CONFIG_USER_ONLY)
+ vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+--
+.25.1

-New patch
+[PULL 14/28] target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
+From: Richard Henderson <richard.henderson@linaro.org>
+We no longer need this value during translation,
+as it is now handled within the helpers.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-15-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           |  6 ++----
+ target/arm/translate.h     |  2 --
+ target/arm/helper.c        | 12 ++----------
+ target/arm/translate-a64.c |  1 -
+ target/arm/translate.c     |  1 -
+files changed, 4 insertions(+), 18 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, BE_DATA, 3, 1)
+ FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
+ /* Target EL if we take a floating-point-disabled exception */
+ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
+-/* For A-profile only, target EL for debug exceptions.  */
+-FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
+ /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
+-FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+-FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
++FIELD(TBFLAG_ANY, ALIGN_MEM, 10, 1)
++FIELD(TBFLAG_ANY, PSTATE__IL, 11, 1)
+ /*
+  * Bit usage when in AArch32 state, both A- and M-profile.
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+      */
+     uint32_t svc_imm;
+     int current_el;
+-    /* Debug target exception level for single-step exceptions */
+-    int debug_target_el;
+     GHashTable *cp_regs;
+     uint64_t features; /* CPU features bits */
+     bool aarch64;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
+     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+ }
+-static CPUARMTBFlags rebuild_hflags_aprofile(CPUARMState *env)
+-{
+-    CPUARMTBFlags flags = {};
+-
+-    DP_TBFLAG_ANY(flags, DEBUG_TARGET_EL, arm_debug_target_el(env));
+-    return flags;
+-}
+-
+ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+                                         ARMMMUIdx mmu_idx)
+ {
+-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
++    CPUARMTBFlags flags = {};
+     int el = arm_current_el(env);
+     if (arm_sctlr(env, el) & SCTLR_A) {
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+                                         ARMMMUIdx mmu_idx)
+ {
+-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
++    CPUARMTBFlags flags = {};
+     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
+     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+     uint64_t sctlr;
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->ss_active = EX_TBFLAG_ANY(tb_flags, SS_ACTIVE);
+     dc->pstate_ss = EX_TBFLAG_ANY(tb_flags, PSTATE__SS);
+     dc->is_ldex = false;
+-    dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
+     /* Bound the number of insns to execute to those left on the page.  */
+     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+         dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
+         dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
+     } else {
+-        dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
+         dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
+         dc->hstr_active = EX_TBFLAG_A32(tb_flags, HSTR_ACTIVE);
+         dc->ns = EX_TBFLAG_A32(tb_flags, NS);
+--
+.25.1

-[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+[PULL 15/28] target/arm: Move gen_exception to translate.c
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We don't need to fill the full pic[] array if we only use
+This function is not required by any other translation file.
 few of the interrupt lines. Directly call qdev_get_gpio_in()
 when necessary.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-6-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-16-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/musicpal.c | 25 +++++++++++++------------
+ target/arm/translate.h | 8 --------
-file changed, 13 insertions(+), 12 deletions(-)
+ target/arm/translate.c | 7 +++++++
 files changed, 7 insertions(+), 8 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
+--- a/target/arm/translate.h
-+++ b/hw/arm/musicpal.c
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
+@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
- static void musicpal_init(MachineState *machine)
+     }
  }
 -static inline void gen_exception(int excp, uint32_t syndrome,
 -                                 uint32_t target_el)
 -{
 -    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
 -                                          tcg_constant_i32(syndrome),
 -                                          tcg_constant_i32(target_el));
 -}
 -
  /* Generate an architectural singlestep exception */
  static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
  {
-     ARMCPU *cpu;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
--    qemu_irq pic[32];
+index XXXXXXX..XXXXXXX 100644
-     DeviceState *dev;
+--- a/target/arm/translate.c
-+    DeviceState *pic;
++++ b/target/arm/translate.c
-     DeviceState *uart_orgate;
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
-     DeviceState *i2c_dev;
+     s->base.is_jmp = DISAS_NORETURN;
-     DeviceState *lcd_dev;
+ }
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                            &error_fatal);
++static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
-     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
++{
++    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
--    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
++                                          tcg_constant_i32(syndrome),
-+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
++                                          tcg_constant_i32(target_el));
-                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
++}
--    for (i = 0; i < 32; i++) {
++
--        pic[i] = qdev_get_gpio_in(dev, i);
+ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
--    }
+                                     uint32_t syn, TCGv_i32 tcg_el)
--    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+ {
 -                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
 -                          pic[MP_TIMER4_IRQ], NULL);
 +    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
 +                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
      /* Logically OR both UART IRQs together */
      uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
      object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
      qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 -    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
 +                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
      serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                     qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               OBJECT(get_system_memory()), &error_fatal);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
-.20.1
+.25.1

-[PULL 05/16] target/arm: add space before the open parenthesis '('
+[PULL 16/28] target/arm: Rename gen_exception to gen_exception_el
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Fix code style. Space required before the open parenthesis '('.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 2 +-
+ target/arm/translate.c | 18 +++++++++---------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 9 insertions(+), 9 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
++static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
+ {
+     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                           tcg_constant_i32(syndrome),
 @@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-             - Hardware watchpoints.
+         switch (dc->base.is_jmp) {
-            Hardware breakpoints have already been handled and skip this code.
+         case DISAS_SWI:
-          */
+             gen_ss_advance(dc);
--        switch(dc->base.is_jmp) {
+-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-+        switch (dc->base.is_jmp) {
+-                          default_exception_el(dc));
 +            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
 +                             default_exception_el(dc));
              break;
          case DISAS_HVC:
              gen_ss_advance(dc);
 -            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
 +            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
              break;
          case DISAS_SMC:
              gen_ss_advance(dc);
 -            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
 +            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
              break;
          case DISAS_NEXT:
          case DISAS_TOO_MANY:
-             gen_goto_tb(dc, 1, dc->base.pc_next);
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
              gen_helper_yield(cpu_env);
              break;
          case DISAS_SWI:
 -            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
 -                          default_exception_el(dc));
 +            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
 +                             default_exception_el(dc));
              break;
          case DISAS_HVC:
 -            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
 +            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
              break;
          case DISAS_SMC:
 -            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
 +            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
              break;
          }
      }
 --
-.20.1
+.25.1

-[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+[PULL 17/28] target/arm: Introduce gen_exception
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The MusicPal board code connects both of the IRQ outputs of the UART
+Create a new wrapper function that passes the default
-to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
+exception target to gen_exception_el.
 to the same input is not valid as it produces subtly wrong behaviour
 (for instance if both the IRQ lines are high, and then one goes
 low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-This kind of wiring needs an explicitly created OR gate; add one.
-Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-18-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/musicpal.c | 17 +++++++++++++----
+ target/arm/translate.c | 11 +++++++----
- hw/arm/Kconfig    |  1 +
+file changed, 7 insertions(+), 4 deletions(-)
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/musicpal.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
- #include "ui/console.h"
+                                           tcg_constant_i32(target_el));
- #include "hw/i2c/i2c.h"
+ }
- #include "hw/irq.h"
-+#include "hw/or-irq.h"
++static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
- #include "hw/audio/wm8750.h"
++{
- #include "sysemu/block-backend.h"
++    gen_exception_el(excp, syndrome, default_exception_el(s));
- #include "sysemu/runstate.h"
++}
@@ -XXX,XX +XXX,XX @@
  #define MP_TIMER4_IRQ           7
  #define MP_EHCI_IRQ             8
  #define MP_ETH_IRQ              9
 -#define MP_UART1_IRQ            11
 -#define MP_UART2_IRQ            11
 +#define MP_UART_SHARED_IRQ      11
  #define MP_GPIO_IRQ             12
  #define MP_RTC_IRQ              28
  #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
      ARMCPU *cpu;
      qemu_irq pic[32];
      DeviceState *dev;
 +    DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
-+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
-+                   qdev_get_gpio_in(uart_orgate, 0),
+                                     uint32_t syn, TCGv_i32 tcg_el)
-                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
+ {
--    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+         switch (dc->base.is_jmp) {
-+                   qdev_get_gpio_in(uart_orgate, 1),
+         case DISAS_SWI:
-                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
+             gen_ss_advance(dc);
+-            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-     /* Register flash */
+-                             default_exception_el(dc));
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
++            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
-index XXXXXXX..XXXXXXX 100644
+             break;
---- a/hw/arm/Kconfig
+         case DISAS_HVC:
-+++ b/hw/arm/Kconfig
+             gen_ss_advance(dc);
-@@ -XXX,XX +XXX,XX @@ config MUSCA
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+             gen_helper_yield(cpu_env);
- config MUSICPAL
+             break;
-     bool
+         case DISAS_SWI:
-+    select OR_IRQ
+-            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-     select BITBANG_I2C
+-                             default_exception_el(dc));
-     select MARVELL_88W8618
++            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
-     select PTIMER
+             break;
          case DISAS_HVC:
              gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
 --
-.20.1
+.25.1

-[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+[PULL 18/28] target/arm: Introduce gen_exception_el_v
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The system configuration controller (SYSCFG) doesn't have
+Split out a common helper function for gen_exception_el
-any output IRQ (and the INTC input #71 belongs to the UART6).
+and gen_exception_insn_el_v.
 Remove the invalid code.
-Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-19-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/stm32f2xx_syscfg.h | 2 --
+ target/arm/translate.c | 13 ++++++++-----
- hw/arm/stm32f205_soc.c             | 1 -
+file changed, 8 insertions(+), 5 deletions(-)
  hw/misc/stm32f2xx_syscfg.c         | 2 --
 files changed, 5 deletions(-)
-diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/stm32f2xx_syscfg.h
+--- a/target/arm/translate.c
-+++ b/include/hw/misc/stm32f2xx_syscfg.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
-     uint32_t syscfg_exticr3;
+     s->base.is_jmp = DISAS_NORETURN;
-     uint32_t syscfg_exticr4;
+ }
-     uint32_t syscfg_cmpcr;
--
+-static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
--    qemu_irq irq;
++static void gen_exception_el_v(int excp, uint32_t syndrome, TCGv_i32 tcg_el)
- };
+ {
+     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
- #endif /* HW_STM32F2XX_SYSCFG_H */
+-                                          tcg_constant_i32(syndrome),
-diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+-                                          tcg_constant_i32(target_el));
-index XXXXXXX..XXXXXXX 100644
++                                          tcg_constant_i32(syndrome), tcg_el);
---- a/hw/arm/stm32f205_soc.c
++}
-+++ b/hw/arm/stm32f205_soc.c
++
-@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
++static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
 +{
 +    gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
  }
  static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
          gen_set_condexec(s);
          gen_set_pc_im(s, pc);
      }
-     busdev = SYS_BUS_DEVICE(dev);
+-    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
-     sysbus_mmio_map(busdev, 0, 0x40013800);
+-                                          tcg_constant_i32(syn), tcg_el);
--    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
++    gen_exception_el_v(excp, syn, tcg_el);
+     s->base.is_jmp = DISAS_NORETURN;
-     /* Attach UART (uses USART registers) and USART controllers */
+ }
-     for (i = 0; i < STM_NUM_USARTS; i++) {
 diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32f2xx_syscfg.c
 +++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
  {
      STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 -    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 -
      memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                            TYPE_STM32F2XX_SYSCFG, 0x400);
      sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 --
-.20.1
+.25.1

-[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+[PULL 19/28] target/arm: Introduce helper_exception_with_syndrome
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We can use one MPC per SRAM bank, but we currently only wire the
+With the helper we can use exception_target_el at runtime,
-IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+instead of default_exception_el at translate time.
 While we're at it, remove the DisasContext parameter from
 gen_exception, as it is no longer used.
-Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-2-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/armsse.c | 3 ++-
+ target/arm/helper.h    |  1 +
-file changed, 2 insertions(+), 1 deletion(-)
+ target/arm/op_helper.c | 10 ++++++++++
  target/arm/translate.c | 18 +++++++++++++-----
 files changed, 24 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armsse.c
+--- a/target/arm/helper.h
-+++ b/hw/arm/armsse.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-                                         qdev_get_gpio_in(dev_splitter, 0));
+ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
-             qdev_connect_gpio_out(dev_splitter, 0,
+                    i32, i32, i32, i32)
-                                   qdev_get_gpio_in_named(dev_secctl,
+ DEF_HELPER_2(exception_internal, noreturn, env, i32)
--                                                         "mpc_status", 0));
++DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
-+                                                         "mpc_status",
+ DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
-+                                                         i - IOTS_NUM_EXP_MPC));
+ DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
-         }
+ DEF_HELPER_2(exception_swstep, noreturn, env, i32)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-         qdev_connect_gpio_out(dev_splitter, 1,
+index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
      raise_exception(env, excp, syndrome, target_el);
  }
 +/*
 + * Raise an exception with the specified syndrome register value
 + * to the default target el.
 + */
 +void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 +                                     uint32_t syndrome)
 +{
 +    raise_exception(env, excp, syndrome, exception_target_el(env));
 +}
 +
  uint32_t HELPER(cpsr_read)(CPUARMState *env)
  {
      return cpsr_read(env) & ~CPSR_EXEC;
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
      gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
  }
 -static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
 +static void gen_exception(int excp, uint32_t syndrome)
  {
 -    gen_exception_el(excp, syndrome, default_exception_el(s));
 +    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
 +                                       tcg_constant_i32(syndrome));
  }
  static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
  void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
  {
 -    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
 +    if (s->aarch64) {
 +        gen_a64_set_pc_im(pc);
 +    } else {
 +        gen_set_condexec(s);
 +        gen_set_pc_im(s, pc);
 +    }
 +    gen_exception(excp, syn);
 +    s->base.is_jmp = DISAS_NORETURN;
  }
  static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          switch (dc->base.is_jmp) {
          case DISAS_SWI:
              gen_ss_advance(dc);
 -            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
 +            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
              break;
          case DISAS_HVC:
              gen_ss_advance(dc);
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
              gen_helper_yield(cpu_env);
              break;
          case DISAS_SWI:
 -            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
 +            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
              break;
          case DISAS_HVC:
              gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
 --
-.20.1
+.25.1

-[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+[PULL 20/28] target/arm: Remove default_exception_el
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
+This function is no longer used.  At the same time, remove
-OMAP2 chip support") takes care of creating the 3 UARTs.
+DisasContext.secure_routed_to_el3, as it in turn becomes unused.
-Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
-extensions and attach to n8x0's UART") added n8x0_uart_setup()
-which create the UART and connects it to an IRQ output,
-overwritting the existing peripheral and its IRQ connection.
-This is incorrect.
-Fortunately we don't need to fix this, because commit 6da68df7f9b
-("hw/arm/nseries: Replace the bluetooth chardev with a "null"
-chardev") removed the use of this peripheral. We can simply
-remove the code.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-21-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/nseries.c | 11 -----------
+ target/arm/translate.h     | 16 ----------------
-file changed, 11 deletions(-)
+ target/arm/translate-a64.c |  5 -----
  target/arm/translate.c     |  5 -----
 files changed, 26 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/target/arm/translate.h
-+++ b/hw/arm/nseries.c
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
+     int fp_excp_el; /* FP exception EL or 0 if enabled */
      int sve_excp_el; /* SVE exception EL or 0 if enabled */
      int vl;          /* current vector length in bytes */
 -    /* Flag indicating that exceptions from secure mode are routed to EL3. */
 -    bool secure_routed_to_el3;
      bool vfp_enabled; /* FP enabled via FPSCR.EN */
      int vec_len;
      int vec_stride;
@@ -XXX,XX +XXX,XX @@ static inline int get_mem_index(DisasContext *s)
      return arm_to_core_mmu_idx(s->mmu_idx);
  }
--static void n8x0_uart_setup(struct n800_s *s)
+-/* Function used to determine the target exception EL when otherwise not known
 - * or default.
 - */
 -static inline int default_exception_el(DisasContext *s)
 -{
--    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
+-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
--    /*
+-     * there is no secure EL1, so we route exceptions to EL3.  Otherwise,
--     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
+-     * exceptions can only be routed to ELs above 1, so we target the higher of
--     * here, but this code has been removed with the bluetooth backend.
+-     * 1 or the current EL.
 -     */
--    omap_uart_attach(s->mpu->uart[BT_UART], radio);
+-    return (s->mmu_idx == ARMMMUIdx_SE10_0 && s->secure_routed_to_el3)
 -            ? 3 : MAX(1, s->current_el);
 -}
 -
- static void n8x0_usb_setup(struct n800_s *s)
+ static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
  {
-     SysBusDevice *dev;
+     /* We don't need to save all of the syndrome so we mask and shift
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-     n8x0_spi_setup(s);
+index XXXXXXX..XXXXXXX 100644
-     n8x0_dss_setup(s);
+--- a/target/arm/translate-a64.c
-     n8x0_cbus_setup(s);
++++ b/target/arm/translate-a64.c
--    n8x0_uart_setup(s);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
-     if (machine_usb(machine)) {
+     dc->condjmp = 0;
-         n8x0_usb_setup(s);
-     }
+     dc->aarch64 = true;
 -    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
 -     * there is no secure EL1, so we route exceptions to EL3.
 -     */
 -    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
 -                               !arm_el_is_aa64(env, 3);
      dc->thumb = false;
      dc->sctlr_b = 0;
      dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      dc->condjmp = 0;
      dc->aarch64 = false;
 -    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
 -     * there is no secure EL1, so we route exceptions to EL3.
 -     */
 -    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
 -                               !arm_el_is_aa64(env, 3);
      dc->thumb = EX_TBFLAG_AM32(tb_flags, THUMB);
      dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
      condexec = EX_TBFLAG_AM32(tb_flags, CONDEXEC);
 --
-.20.1
+.25.1

-[PULL 02/16] ssi: Fix bad printf format specifiers
+[PULL 21/28] target/arm: Create raise_exception_debug
-From: AlexChen <alex.chen@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We should use printf format specifier "%u" instead of "%d" for
+Handle the debug vs current el exception test in one place.
-argument of type "unsigned int".
+Leave EXCP_BKPT alone, since that treats debug < current differently.
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20220609202901.1177572-22-richard.henderson@linaro.org
 Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/imx_spi.c    | 2 +-
+ target/arm/debug_helper.c | 44 +++++++++++++++++++++------------------
- hw/ssi/xilinx_spi.c | 2 +-
+file changed, 24 insertions(+), 20 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/imx_spi.c
+--- a/target/arm/debug_helper.c
-+++ b/hw/ssi/imx_spi.c
++++ b/target/arm/debug_helper.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@
-     case ECSPI_MSGDATA:
+ #include "exec/helper-proto.h"
-         return  "ECSPI_MSGDATA";
-     default:
--        sprintf(unknown, "%d ?", reg);
++/*
-+        sprintf(unknown, "%u ?", reg);
++ * Raise an exception to the debug target el.
-         return unknown;
++ * Modify syndrome to indicate when origin and target EL are the same.
 + */
 +G_NORETURN static void
 +raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
 +{
 +    int debug_el = arm_debug_target_el(env);
 +    int cur_el = arm_current_el(env);
 +
 +    /*
 +     * If singlestep is targeting a lower EL than the current one, then
 +     * DisasContext.ss_active must be false and we can never get here.
 +     * Similarly for watchpoint and breakpoint matches.
 +     */
 +    assert(debug_el >= cur_el);
 +    syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
 +    raise_exception(env, excp, syndrome, debug_el);
 +}
 +
  /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
  static bool aa64_generate_debug_exceptions(CPUARMState *env)
  {
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
      if (wp_hit) {
          if (wp_hit->flags & BP_CPU) {
              bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 -            bool same_el = arm_debug_target_el(env) == arm_current_el(env);
              cs->watchpoint_hit = NULL;
              env->exception.fsr = arm_debug_exception_fsr(env);
              env->exception.vaddress = wp_hit->hitaddr;
 -            raise_exception(env, EXCP_DATA_ABORT,
 -                    syn_watchpoint(same_el, 0, wnr),
 -                    arm_debug_target_el(env));
 +            raise_exception_debug(env, EXCP_DATA_ABORT,
 +                                  syn_watchpoint(0, 0, wnr));
          }
      } else {
          uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 -        bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
          /*
           * (1) GDB breakpoints should be handled first.
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
           * exception/security level.
           */
          env->exception.vaddress = 0;
 -        raise_exception(env, EXCP_PREFETCH_ABORT,
 -                        syn_breakpoint(same_el),
 -                        arm_debug_target_el(env));
 +        raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
      }
  }
-diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
---- a/hw/ssi/xilinx_spi.c
-+++ b/hw/ssi/xilinx_spi.c
+ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
-@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
+ {
-        irq chain unless things really changed.  */
+-    int debug_el = arm_debug_target_el(env);
-     if (pending != s->irqline) {
+-    int cur_el = arm_current_el(env);
-         s->irqline = pending;
+-
--        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+-    /*
-+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
+-     * If singlestep is targeting a lower EL than the current one, then
-                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+-     * DisasContext.ss_active must be false and we can never get here.
-         qemu_set_irq(s->irq, pending);
+-     */
-     }
+-    assert(debug_el >= cur_el);
 -    if (debug_el == cur_el) {
 -        syndrome |= 1 << ARM_EL_EC_SHIFT;
 -    }
 -    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
 +    raise_exception_debug(env, EXCP_UDEF, syndrome);
  }
  #if !defined(CONFIG_USER_ONLY)
 --
-.20.1
+.25.1

-[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+[PULL 22/28] target/arm: Move arm_debug_target_el to debug_helper.c
-Checks for UNDEF cases should go before the "is VFP enabled?" access
+From: Richard Henderson <richard.henderson@linaro.org>
 check, except in special cases. Move a stray UNDEF check in the VTBL
 trans function up above the access check.
+This function is no longer used outside debug_helper.c.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220609202901.1177572-23-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 ---
- target/arm/translate-neon.c.inc | 8 ++++----
+ target/arm/cpu.h          | 21 ---------------------
-file changed, 4 insertions(+), 4 deletions(-)
+ target/arm/debug_helper.c | 21 +++++++++++++++++++++
 files changed, 21 insertions(+), 21 deletions(-)
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
+--- a/target/arm/cpu.h
-+++ b/target/arm/translate-neon.c.inc
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
-         return false;
+     ARMASIdx_TagS = 3,
-     }
+ } ARMASIdx;
--    if (!vfp_access_check(s)) {
+-/* Return the Exception Level targeted by debug exceptions. */
--        return true;
+-static inline int arm_debug_target_el(CPUARMState *env)
 -{
 -    bool secure = arm_is_secure(env);
 -    bool route_to_el2 = false;
 -
 -    if (arm_is_el2_enabled(env)) {
 -        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
 -                       env->cp15.mdcr_el2 & MDCR_TDE;
 -    }
 -
-     if ((a->vn + a->len + 1) > 32) {
+-    if (route_to_el2) {
-         /*
+-        return 2;
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
+-    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+-               !arm_el_is_aa64(env, 3) && secure) {
-         return false;
+-        return 3;
-     }
+-    } else {
+-        return 1;
-+    if (!vfp_access_check(s)) {
+-    }
-+        return true;
+-}
 -
  static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
  {
      /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
 diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/debug_helper.c
 +++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
 +/* Return the Exception Level targeted by debug exceptions. */
 +static int arm_debug_target_el(CPUARMState *env)
 +{
 +    bool secure = arm_is_secure(env);
 +    bool route_to_el2 = false;
 +
 +    if (arm_is_el2_enabled(env)) {
 +        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
 +                       env->cp15.mdcr_el2 & MDCR_TDE;
 +    }
 +
-     desc = tcg_const_i32((a->vn << 2) | a->len);
++    if (route_to_el2) {
-     def = tcg_temp_new_i64();
++        return 2;
-     if (a->op) {
++    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
 +               !arm_el_is_aa64(env, 3) && secure) {
 +        return 3;
 +    } else {
 +        return 1;
 +    }
 +}
 +
  /*
   * Raise an exception to the debug target el.
   * Modify syndrome to indicate when origin and target EL are the same.
 --
-.20.1
+.25.1

-[PULL 06/16] docs: add some notes on the sbsa-ref machine
+[PULL 23/28] target/arm: Fix Secure PL1 tests in fp_exception_el
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We should at least document what this machine is about.
+We were using arm_is_secure and is_a64, which are
 tests against the current EL, as opposed to
 arm_el_is_aa64 and arm_is_secure_below_el3, which
 can be applied to a different EL than current.
 Consolidate the two tests.
-Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
+Message-id: 20220609202901.1177572-24-richard.henderson@linaro.org
 Cc: Leif Lindholm <leif@nuviainc.com>
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 23 +++++++++--------------
- docs/system/target-arm.rst |  1 +
+file changed, 9 insertions(+), 14 deletions(-)
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
 +Arm Server Base System Architecture Reference board (``sbsa-ref``)
 +==================================================================
 +
 +While the `virt` board is a generic board platform that doesn't match
 +any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-arm.rst
+--- a/target/arm/helper.c
-+++ b/docs/system/target-arm.rst
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
-    arm/mps2
+         int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN);
-    arm/musca
-    arm/realview
+         switch (fpen) {
-+   arm/sbsa
++        case 1:
-    arm/versatile
++            if (cur_el != 0) {
-    arm/vexpress
++                break;
-    arm/aspeed
++            }
 +            /* fall through */
          case 0:
          case 2:
 -            if (cur_el == 0 || cur_el == 1) {
 -                /* Trap to PL1, which might be EL1 or EL3 */
 -                if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 -                    return 3;
 -                }
 -                return 1;
 -            }
 -            if (cur_el == 3 && !is_a64(env)) {
 -                /* Secure PL1 running at EL3 */
 +            /* Trap from Secure PL0 or PL1 to Secure PL1. */
 +            if (!arm_el_is_aa64(env, 3)
 +                && (cur_el == 3 || arm_is_secure_below_el3(env))) {
                  return 3;
              }
 -            break;
 -        case 1:
 -            if (cur_el == 0) {
 +            if (cur_el <= 1) {
                  return 1;
              }
              break;
 -        case 3:
 -            break;
          }
      }
 --
-.20.1
+.25.1

-[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
+[PULL 24/28] tests/qtest: Reduce npcm7xx_sdhci test image size
-From: Havard Skinnemoen <hskinnemoen@google.com>
+From: Hao Wu <wuhaotsh@google.com>
-The number of runs is equal to the number of 0-1 and 1-0 transitions,
+Creating 1GB image for a simple qtest is unnecessary
-plus one. Currently, it's counting the number of times these transitions
+and could lead to failures. We reduce the image size
-do _not_ happen, plus one.
+to 1MB to reduce the test overhead.
-Source:
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
+Message-id: 20220609214125.4192212-1-wuhaotsh@google.com
 section 2.3.4 point (3).
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/npcm7xx_rng-test.c | 2 +-
+ tests/qtest/npcm7xx_sdhci-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
+diff --git a/tests/qtest/npcm7xx_sdhci-test.c b/tests/qtest/npcm7xx_sdhci-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_rng-test.c
+--- a/tests/qtest/npcm7xx_sdhci-test.c
-+++ b/tests/qtest/npcm7xx_rng-test.c
++++ b/tests/qtest/npcm7xx_sdhci-test.c
-@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+@@ -XXX,XX +XXX,XX @@
-     pi = (double)nr_ones / nr_bits;
+ #define NPCM7XX_REG_SIZE 0x100
+ #define NPCM7XX_MMC_BA 0xF0842000
-     for (k = 0; k < nr_bits - 1; k++) {
+ #define NPCM7XX_BLK_SIZE 512
--        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+-#define NPCM7XX_TEST_IMAGE_SIZE (1 << 30)
-+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
++#define NPCM7XX_TEST_IMAGE_SIZE (1 << 20)
-     }
-     vn_obs += 1;
+ char *sd_path;
 --
-.20.1
+.25.1

-[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+[PULL 25/28] target/arm: Adjust format test in scr_write
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-When using a Cortex-A15, the Virt machine does not use any
+Because reset always initializes the AA64 version, SCR_EL3,
-MPCore peripherals. Remove the dependency.
+test the mode of EL3 instead of the type of the cpreg.
-Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Message-id: 20220609214657.1217913-2-richard.henderson@linaro.org
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201107114852.271922-1-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 -
+ target/arm/helper.c | 14 ++++++++------
-file changed, 1 deletion(-)
+file changed, 8 insertions(+), 6 deletions(-)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
+--- a/target/arm/helper.c
-+++ b/hw/arm/Kconfig
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-     imply VFIO_PLATFORM
+     uint32_t valid_mask = 0x3fff;
-     imply VFIO_XGMAC
+     ARMCPU *cpu = env_archcpu(env);
-     imply TPM_TIS_SYSBUS
--    select A15MPCORE
+-    if (ri->state == ARM_CP_STATE_AA64) {
-     select ACPI
+-        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
-     select ARM_SMMUV3
+-            !cpu_isar_feature(aa64_aa32_el1, cpu)) {
-     select GPIO_KEY
+-                value |= SCR_FW | SCR_AW;   /* these two bits are RES1.  */
 -        }
 -        valid_mask &= ~SCR_NET;
 +    /*
 +     * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
 +     * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
 +     * Instead, choose the format based on the mode of EL3.
 +     */
 +    if (arm_el_is_aa64(env, 3)) {
 +        value |= SCR_FW | SCR_AW;      /* RES1 */
 +        valid_mask &= ~SCR_NET;        /* RES0 */
          if (cpu_isar_feature(aa64_ras, cpu)) {
              valid_mask |= SCR_TERR;
 --
-.20.1
+.25.1

-[PULL 03/16] target/arm: add spaces around operator
+[PULL 26/28] target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Fix code style. Operator needs spaces both sides.
+Since DDI0487F.a, the RW bit is RAO/WI.  When specifically
 targeting such a cpu, e.g. cortex-a76, it is legitimate to
 ignore the bit within the secure monitor.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1062
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Message-id: 20220609214657.1217913-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arch_dump.c | 8 ++++----
+ target/arm/cpu.h    | 5 +++++
- target/arm/arm-semi.c  | 8 ++++----
+ target/arm/helper.c | 4 ++++
- target/arm/helper.c    | 2 +-
+files changed, 9 insertions(+)
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
+--- a/target/arm/cpu.h
-+++ b/target/arm/arch_dump.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
-     for (i = 0; i < 32; ++i) {
+ }
-         uint64_t *q = aa64_vfp_qreg(env, i);
--        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
++static inline bool isar_feature_aa64_aa32_el2(const ARMISARegisters *id)
--        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++{
-+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL2) >= 2;
-+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
++}
-     }
++
+ static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
+ {
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
           */
          for (i = 0; i < 32; ++i) {
              uint64_t tmp = note.vfp.vregs[2*i];
 -            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
 -            note.vfp.vregs[2*i+1] = tmp;
 +            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
 +            note.vfp.vregs[2 * i + 1] = tmp;
          }
      }
 diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-semi.c
 +++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          if (use_gdb_syscalls()) {
              arm_semi_open_guestfd = guestfd;
              ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
 -                                  (int)arg2+1, gdb_open_modeflags[arg1]);
 +                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
 -                                  arg0, (int)arg1+1);
 +                                  arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-     uint32_t sum;
+         value |= SCR_FW | SCR_AW;      /* RES1 */
-     sum = do_usad(a, b);
+         valid_mask &= ~SCR_NET;        /* RES0 */
-     sum += do_usad(a >> 8, b >> 8);
--    sum += do_usad(a >> 16, b >>16);
++        if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
-+    sum += do_usad(a >> 16, b >> 16);
++            !cpu_isar_feature(aa64_aa32_el2, cpu)) {
-     sum += do_usad(a >> 24, b >> 24);
++            value |= SCR_RW;           /* RAO/WI */
-     return sum;
++        }
- }
+         if (cpu_isar_feature(aa64_ras, cpu)) {
              valid_mask |= SCR_TERR;
          }
 --
-.20.1
+.25.1

-[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+[PULL 27/28] gdbstub: Don't use GDB syscalls if no GDB is attached
-The nseries machines have a codepath that allows them to load a
+In two places in gdbstub.c we look at gdbserver_state.init to decide
-secondary bootloader.  This code wasn't checking that the
+whether we're going to do a semihosting syscall via the gdb remote
-load_image_targphys() succeeded.  Check the return value and report
+protocol:
-the error to the user.
+ * when setting up, if the user didn't explicitly select either
    native semihosting or gdb semihosting, we autoselect, with the
    intended behaviour "use gdb if gdb is connected"
  * when the semihosting layer attempts to do a syscall via gdb, we
    silently ignore it if the gdbstub wasn't actually set up
-While we're in the vicinity, fix the comment style of the
+However, if the user's commandline sets up the gdbstub but tells QEMU
-comment documenting what this image load is doing.
+to start rather than waiting for a GDB to connect (eg using '-s' but
 not '-S'), then we will have gdbserver_state.init true but no actual
 connection; an attempt to use gdb syscalls will then crash because we
 try to use gdbserver_state.c_cpu when it hasn't been set up:
-Fixes: Coverity CID 1192904
+#0  0x00007ffff6803ba8 in qemu_cpu_kick (cpu=0x0) at ../../softmmu/cpus.c:457
 #1  0x00007ffff6c03913 in gdb_do_syscallv (cb=0x7ffff6c19944 <common_semi_cb>,
     fmt=0x7ffff7573b7e "", va=0x7ffff56294c0) at ../../gdbstub.c:2946
 #2  0x00007ffff6c19c3a in common_semi_gdb_syscall (cs=0x7ffff83fe060,
     cb=0x7ffff6c19944 <common_semi_cb>, fmt=0x7ffff7573b75 "isatty,%x")
     at ../../semihosting/arm-compat-semi.c:494
 #3  0x00007ffff6c1a064 in gdb_isattyfn (cs=0x7ffff83fe060, gf=0x7ffff86a3690)
     at ../../semihosting/arm-compat-semi.c:636
 #4  0x00007ffff6c1b20f in do_common_semihosting (cs=0x7ffff83fe060)
     at ../../semihosting/arm-compat-semi.c:967
 #5  0x00007ffff693a037 in handle_semihosting (cs=0x7ffff83fe060)
     at ../../target/arm/helper.c:10316
 You can probably also get into this state via some odd
 corner cases involving connecting a GDB and then telling it
 to detach from all the vCPUs.
 Abstract out the test into a new gdb_attached() function
 which returns true only if there's actually a GDB connected
 to the debug stub and attached to at least one vCPU.
 Reported-by: Liviu Ionescu <ilg@livius.net>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20220526190053.521505-2-peter.maydell@linaro.org
 ---
- hw/arm/nseries.c | 15 +++++++++++----
+ gdbstub.c | 14 +++++++++++---
-file changed, 11 insertions(+), 4 deletions(-)
+file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/gdbstub.c b/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/gdbstub.c
-+++ b/hw/arm/nseries.c
++++ b/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static int get_char(void)
-         /* No, wait, better start at the ROM.  */
+ }
-         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+ #endif
--        /* This is intended for loading the `secondary.bin' program from
++/*
-+        /*
++ * Return true if there is a GDB currently connected to the stub
-+         * This is intended for loading the `secondary.bin' program from
++ * and attached to a CPU
-          * Nokia images (the NOLO bootloader).  The entry point seems
++ */
-          * to be at OMAP2_Q2_BASE + 0x400000.
++static bool gdb_attached(void)
-          *
++{
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
++    return gdbserver_state.init && gdbserver_state.c_cpu;
-          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
++}
-          *
++
-          * The code above is for loading the `zImage' file from Nokia
+ static enum {
--         * images.  */
+     GDB_SYS_UNKNOWN,
--        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
+     GDB_SYS_ENABLED,
--                            machine->ram_size - 0x400000);
+@@ -XXX,XX +XXX,XX @@ int use_gdb_syscalls(void)
-+         * images.
+     /* -semihosting-config target=auto */
-+         */
+     /* On the first call check if gdb is connected and remember. */
-+        if (load_image_targphys(option_rom[0].name,
+     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
-+                                OMAP2_Q2_BASE + 0x400000,
+-        gdb_syscall_mode = gdbserver_state.init ?
-+                                machine->ram_size - 0x400000) < 0) {
+-            GDB_SYS_ENABLED : GDB_SYS_DISABLED;
-+            error_report("Failed to load secondary bootloader %s",
++        gdb_syscall_mode = gdb_attached() ? GDB_SYS_ENABLED : GDB_SYS_DISABLED;
-+                         option_rom[0].name);
+     }
-+            exit(EXIT_FAILURE);
+     return gdb_syscall_mode == GDB_SYS_ENABLED;
-+        }
+ }
+@@ -XXX,XX +XXX,XX @@ void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
-         n800_setup_nolo_tags(nolo_tags);
+     target_ulong addr;
-         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
+     uint64_t i64;
 -    if (!gdbserver_state.init) {
 +    if (!gdb_attached()) {
          return;
      }
 --
-.20.1
+.25.1

-[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+[PULL 28/28] semihosting/config: Merge --semihosting-config option groups
-From: Andrew Jones <drjones@redhat.com>
+Currently we mishandle the --semihosting-config option if the
 user specifies it on the command line more than once. For
 example with:
  --semihosting-config target=gdb --semihosting-config arg=foo,arg=bar
-commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+the function qemu_semihosting_config_options() is called twice, once
-changed armv7m_systick to build on ptimers. Make sure we have ptimers
+for each argument.  But that function expects to be called only once,
-in the build when building armv7m_systick.
+and it always unconditionally sets the semihosting.enabled,
 semihost_chardev and semihosting.target variables.  This means that
 if any of those options were set anywhere except the last
 --semihosting-config option on the command line, those settings are
 ignored.  In the example above, 'target=gdb' in the first option is
 overridden by an implied default 'target=auto' in the second.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+The QemuOptsList machinery has a flag for handling this kind of
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+"option group is setting global state": by setting
-Message-id: 20201104103343.30392-1-drjones@redhat.com
+ .merge_lists = true;
 we make the machinery merge all the --semihosting-config arguments
 the user passes into a single set of options and call our
 qemu_semihosting_config_options() just once.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Message-id: 20220526190053.521505-3-peter.maydell@linaro.org
 ---
- hw/arm/Kconfig | 1 +
+ semihosting/config.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/semihosting/config.c b/semihosting/config.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
+--- a/semihosting/config.c
-+++ b/hw/arm/Kconfig
++++ b/semihosting/config.c
-@@ -XXX,XX +XXX,XX @@ config ZYNQ
+@@ -XXX,XX +XXX,XX @@
- config ARM_V7M
+ QemuOptsList qemu_semihosting_config_opts = {
-     bool
+     .name = "semihosting-config",
-+    select PTIMER
++    .merge_lists = true,
+     .implied_opt_name = "enable",
- config ALLWINNER_A10
+     .head = QTAILQ_HEAD_INITIALIZER(qemu_semihosting_config_opts.head),
-     bool
+     .desc = {
 --
-.20.1
+.25.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1

Just flushing my target-arm queue since I won't be working next week :-)

-- PMM

The following changes since commit b3cd3b5a66f0dddfe3d5ba2bef13cd4f5b89cde9:

Merge tag 'pull-riscv-to-apply-20220610' of github.com:alistair23/qemu into staging (2022-06-09 22:08:27 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220610

for you to fetch changes up to 90c072e063737e9e8f431489bbd334452f89056e:

semihosting/config: Merge --semihosting-config option groups (2022-06-10 14:32:36 +0100)

----------------------------------------------------------------
 * refactor exception routing code
 * fix SCR_EL3 RAO/RAZ bits
 * gdbstub: Don't use GDB syscalls if no GDB is attached
 * semihosting/config: Merge --semihosting-config option groups
 * tests/qtest: Reduce npcm7xx_sdhci test image size

----------------------------------------------------------------
Hao Wu (1):
      tests/qtest: Reduce npcm7xx_sdhci test image size

Peter Maydell (2):
      gdbstub: Don't use GDB syscalls if no GDB is attached
      semihosting/config: Merge --semihosting-config option groups

Richard Henderson (25):
      target/arm: Mark exception helpers as noreturn
      target/arm: Add coproc parameter to syn_fp_access_trap
      target/arm: Move exception_target_el out of line
      target/arm: Move arm_singlestep_active out of line
      target/arm: Move arm_generate_debug_exceptions out of line
      target/arm: Use is_a64 in arm_generate_debug_exceptions
      target/arm: Move exception_bkpt_insn to debug_helper.c
      target/arm: Move arm_debug_exception_fsr to debug_helper.c
      target/arm: Rename helper_exception_with_syndrome
      target/arm: Introduce gen_exception_insn_el_v
      target/arm: Rename gen_exception_insn to gen_exception_insn_el
      target/arm: Introduce gen_exception_insn
      target/arm: Create helper_exception_swstep
      target/arm: Remove TBFLAG_ANY.DEBUG_TARGET_EL
      target/arm: Move gen_exception to translate.c
      target/arm: Rename gen_exception to gen_exception_el
      target/arm: Introduce gen_exception
      target/arm: Introduce gen_exception_el_v
      target/arm: Introduce helper_exception_with_syndrome
      target/arm: Remove default_exception_el
      target/arm: Create raise_exception_debug
      target/arm: Move arm_debug_target_el to debug_helper.c
      target/arm: Fix Secure PL1 tests in fp_exception_el
      target/arm: Adjust format test in scr_write
      target/arm: SCR_EL3.RW is RAO/WI without AArch32 EL[12]

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

With ARMv8, this field is always RES0.
With ARMv7, targeting EL2 and TA=0, it is always 0xA.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h      |  7 ++++---
 target/arm/translate-a64.c |  3 ++-
 target/arm/translate-vfp.c | 14 ++++++++++++--
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
 }
 
-static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
+static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit,
+                                          int coproc)
 {
-    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
+    /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 */
     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
         | (is_16bit ? 0 : ARM_EL_IL)
-        | (cv << 24) | (cond << 20) | 0xa;
+        | (cv << 24) | (cond << 20) | coproc;
 }
 
 static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
         s->fp_access_checked = true;
 
         gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+                           syn_fp_access_trap(1, 0xe, false, 0),
+                           s->fp_excp_el);
         return false;
     }
     s->fp_access_checked = true;
diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
 static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
 {
     if (s->fp_excp_el) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
+        /*
+         * The full syndrome is only used for HSR when HCPTR traps:
+         * For v8, when TA==0, coproc is RES0.
+         * For v7, any use of a Floating-point instruction or access
+         * to a Floating-point Extension register that is trapped to
+         * Hyp mode because of a trap configured in the HCPTR sets
+         * this field to 0xA.
+         */
+        int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
+        uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
+
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
         return false;
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the function to op_helper.c, near raise_exception.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 16 +---------------
 target/arm/op_helper.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
 
-static inline int exception_target_el(CPUARMState *env)
-{
-    int target_el = MAX(1, arm_current_el(env));
-
-    /*
-     * No such thing as secure EL1 if EL3 is aarch32,
-     * so update the target EL to EL3 in this case.
-     */
-    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
-        target_el = 3;
-    }
-
-    return target_el;
-}
-
 /* Determine if allocation tags are available.  */
 static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
                                                  uint64_t sctlr)
@@ -XXX,XX +XXX,XX @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
 bool el_is_in_host(CPUARMState *env, int el);
 
 void aa32_max_features(ARMCPU *cpu);
+int exception_target_el(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
+int exception_target_el(CPUARMState *env)
+{
+    int target_el = MAX(1, arm_current_el(env));
+
+    /*
+     * No such thing as secure EL1 if EL3 is aarch32,
+     * so update the target EL to EL3 in this case.
+     */
+    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
+        target_el = 3;
+    }
+
+    return target_el;
+}
+
 void raise_exception(CPUARMState *env, uint32_t excp,
                      uint32_t syndrome, uint32_t target_el)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the function to debug_helper.c, and the
declaration to internals.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 10 ----------
 target/arm/internals.h    |  1 +
 target/arm/debug_helper.c | 12 ++++++++++++
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_generate_debug_exceptions(CPUARMState *env)
     }
 }
 
-/* Is single-stepping active? (Note that the "is EL_D AArch64?" check
- * implicitly means this always returns false in pre-v8 CPUs.)
- */
-static inline bool arm_singlestep_active(CPUARMState *env)
-{
-    return extract32(env->cp15.mdscr_el1, 0, 1)
-        && arm_el_is_aa64(env, arm_debug_target_el(env))
-        && arm_generate_debug_exceptions(env);
-}
-
 static inline bool arm_sctlr_b(CPUARMState *env)
 {
     return
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
 
 void aa32_max_features(ARMCPU *cpu);
 int exception_target_el(CPUARMState *env);
+bool arm_singlestep_active(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
+
+/*
+ * Is single-stepping active? (Note that the "is EL_D AArch64?" check
+ * implicitly means this always returns false in pre-v8 CPUs.)
+ */
+bool arm_singlestep_active(CPUARMState *env)
+{
+    return extract32(env->cp15.mdscr_el1, 0, 1)
+        && arm_el_is_aa64(env, arm_debug_target_el(env))
+        && arm_generate_debug_exceptions(env);
+}
+
 /* Return true if the linked breakpoint entry lbn passes its checks */
 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move arm_generate_debug_exceptions and its two subroutines,
{aa32,aa64}_generate_debug_exceptions into debug_helper.c,
and the one interface declaration to internals.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 91 -------------------------------------
 target/arm/internals.h    |  1 +
 target/arm/debug_helper.c | 94 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 91 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
 }
 
-/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
-static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
-{
-    int cur_el = arm_current_el(env);
-    int debug_el;
-
-    if (cur_el == 3) {
-        return false;
-    }
-
-    /* MDCR_EL3.SDD disables debug events from Secure state */
-    if (arm_is_secure_below_el3(env)
-        && extract32(env->cp15.mdcr_el3, 16, 1)) {
-        return false;
-    }
-
-    /*
-     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
-     * while not masking the (D)ebug bit in DAIF.
-     */
-    debug_el = arm_debug_target_el(env);
-
-    if (cur_el == debug_el) {
-        return extract32(env->cp15.mdscr_el1, 13, 1)
-            && !(env->daif & PSTATE_D);
-    }
-
-    /* Otherwise the debug target needs to be a higher EL */
-    return debug_el > cur_el;
-}
-
-static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
-{
-    int el = arm_current_el(env);
-
-    if (el == 0 && arm_el_is_aa64(env, 1)) {
-        return aa64_generate_debug_exceptions(env);
-    }
-
-    if (arm_is_secure(env)) {
-        int spd;
-
-        if (el == 0 && (env->cp15.sder & 1)) {
-            /* SDER.SUIDEN means debug exceptions from Secure EL0
-             * are always enabled. Otherwise they are controlled by
-             * SDCR.SPD like those from other Secure ELs.
-             */
-            return true;
-        }
-
-        spd = extract32(env->cp15.mdcr_el3, 14, 2);
-        switch (spd) {
-        case 1:
-            /* SPD == 0b01 is reserved, but behaves as 0b00. */
-        case 0:
-            /* For 0b00 we return true if external secure invasive debug
-             * is enabled. On real hardware this is controlled by external
-             * signals to the core. QEMU always permits debug, and behaves
-             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
-             */
-            return true;
-        case 2:
-            return false;
-        case 3:
-            return true;
-        }
-    }
-
-    return el != 2;
-}
-
-/* Return true if debugging exceptions are currently enabled.
- * This corresponds to what in ARM ARM pseudocode would be
- *    if UsingAArch32() then
- *        return AArch32.GenerateDebugExceptions()
- *    else
- *        return AArch64.GenerateDebugExceptions()
- * We choose to push the if() down into this function for clarity,
- * since the pseudocode has it at all callsites except for the one in
- * CheckSoftwareStep(), where it is elided because both branches would
- * always return the same value.
- */
-static inline bool arm_generate_debug_exceptions(CPUARMState *env)
-{
-    if (env->aarch64) {
-        return aa64_generate_debug_exceptions(env);
-    } else {
-        return aa32_generate_debug_exceptions(env);
-    }
-}
-
 static inline bool arm_sctlr_b(CPUARMState *env)
 {
     return
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool el_is_in_host(CPUARMState *env, int el);
 void aa32_max_features(ARMCPU *cpu);
 int exception_target_el(CPUARMState *env);
 bool arm_singlestep_active(CPUARMState *env);
+bool arm_generate_debug_exceptions(CPUARMState *env);
 
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
+static bool aa64_generate_debug_exceptions(CPUARMState *env)
+{
+    int cur_el = arm_current_el(env);
+    int debug_el;
+
+    if (cur_el == 3) {
+        return false;
+    }
+
+    /* MDCR_EL3.SDD disables debug events from Secure state */
+    if (arm_is_secure_below_el3(env)
+        && extract32(env->cp15.mdcr_el3, 16, 1)) {
+        return false;
+    }
+
+    /*
+     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
+     * while not masking the (D)ebug bit in DAIF.
+     */
+    debug_el = arm_debug_target_el(env);
+
+    if (cur_el == debug_el) {
+        return extract32(env->cp15.mdscr_el1, 13, 1)
+            && !(env->daif & PSTATE_D);
+    }
+
+    /* Otherwise the debug target needs to be a higher EL */
+    return debug_el > cur_el;
+}
+
+static bool aa32_generate_debug_exceptions(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+
+    if (el == 0 && arm_el_is_aa64(env, 1)) {
+        return aa64_generate_debug_exceptions(env);
+    }
+
+    if (arm_is_secure(env)) {
+        int spd;
+
+        if (el == 0 && (env->cp15.sder & 1)) {
+            /*
+             * SDER.SUIDEN means debug exceptions from Secure EL0
+             * are always enabled. Otherwise they are controlled by
+             * SDCR.SPD like those from other Secure ELs.
+             */
+            return true;
+        }
+
+        spd = extract32(env->cp15.mdcr_el3, 14, 2);
+        switch (spd) {
+        case 1:
+            /* SPD == 0b01 is reserved, but behaves as 0b00. */
+        case 0:
+            /*
+             * For 0b00 we return true if external secure invasive debug
+             * is enabled. On real hardware this is controlled by external
+             * signals to the core. QEMU always permits debug, and behaves
+             * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
+             */
+            return true;
+        case 2:
+            return false;
+        case 3:
+            return true;
+        }
+    }
+
+    return el != 2;
+}
+
+/*
+ * Return true if debugging exceptions are currently enabled.
+ * This corresponds to what in ARM ARM pseudocode would be
+ *    if UsingAArch32() then
+ *        return AArch32.GenerateDebugExceptions()
+ *    else
+ *        return AArch64.GenerateDebugExceptions()
+ * We choose to push the if() down into this function for clarity,
+ * since the pseudocode has it at all callsites except for the one in
+ * CheckSoftwareStep(), where it is elided because both branches would
+ * always return the same value.
+ */
+bool arm_generate_debug_exceptions(CPUARMState *env)
+{
+    if (env->aarch64) {
+        return aa64_generate_debug_exceptions(env);
+    } else {
+        return aa32_generate_debug_exceptions(env);
+    }
+}
+
 /*
  * Is single-stepping active? (Note that the "is EL_D AArch64?" check
  * implicitly means this always returns false in pre-v8 CPUs.)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 31 +++++++++++++++++++++++++++++++
 target/arm/op_helper.c    | 29 -----------------------------
 2 files changed, 31 insertions(+), 29 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
     }
 }
 
+/*
+ * Raise an EXCP_BKPT with the specified syndrome register value,
+ * targeting the correct exception level for debug exceptions.
+ */
+void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /* FSR will only be used if the debug target EL is AArch32. */
+    env->exception.fsr = arm_debug_exception_fsr(env);
+    /*
+     * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
+     * values to the guest that it shouldn't be able to see at its
+     * exception/security level.
+     */
+    env->exception.vaddress = 0;
+    /*
+     * Other kinds of architectural debug exception are ignored if
+     * they target an exception level below the current one (in QEMU
+     * this is checked by arm_generate_debug_exceptions()). Breakpoint
+     * instructions are special because they always generate an exception
+     * to somewhere: if they can't go to the configured debug exception
+     * level they are taken to the current exception level.
+     */
+    if (debug_el < cur_el) {
+        debug_el = cur_el;
+    }
+    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
     raise_exception(env, excp, syndrome, target_el);
 }
 
-/* Raise an EXCP_BKPT with the specified syndrome register value,
- * targeting the correct exception level for debug exceptions.
- */
-void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
-{
-    int debug_el = arm_debug_target_el(env);
-    int cur_el = arm_current_el(env);
-
-    /* FSR will only be used if the debug target EL is AArch32. */
-    env->exception.fsr = arm_debug_exception_fsr(env);
-    /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
-     * values to the guest that it shouldn't be able to see at its
-     * exception/security level.
-     */
-    env->exception.vaddress = 0;
-    /*
-     * Other kinds of architectural debug exception are ignored if
-     * they target an exception level below the current one (in QEMU
-     * this is checked by arm_generate_debug_exceptions()). Breakpoint
-     * instructions are special because they always generate an exception
-     * to somewhere: if they can't go to the configured debug exception
-     * level they are taken to the current exception level.
-     */
-    if (debug_el < cur_el) {
-        debug_el = cur_el;
-    }
-    raise_exception(env, EXCP_BKPT, syndrome, debug_el);
-}
-
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 {
     return cpsr_read(env) & ~CPSR_EXEC;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function now now only used in debug_helper.c, so there is
no reason to have a declaration in a header.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 25 -------------------------
 target/arm/debug_helper.c | 26 ++++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
-/* Return the FSR value for a debug exception (watchpoint, hardware
- * breakpoint or BKPT insn) targeting the specified exception level.
- */
-static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
-{
-    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
-    int target_el = arm_debug_target_el(env);
-    bool using_lpae = false;
-
-    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
-        using_lpae = true;
-    } else {
-        if (arm_feature(env, ARM_FEATURE_LPAE) &&
-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
-            using_lpae = true;
-        }
-    }
-
-    if (using_lpae) {
-        return arm_fi_to_lfsc(&fi);
-    } else {
-        return arm_fi_to_sfsc(&fi);
-    }
-}
-
 /**
  * arm_num_brps: Return number of implemented breakpoints.
  * Note that the ID register BRPS field is "number of bps - 1",
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return check_watchpoints(cpu);
 }
 
+/*
+ * Return the FSR value for a debug exception (watchpoint, hardware
+ * breakpoint or BKPT insn) targeting the specified exception level.
+ */
+static uint32_t arm_debug_exception_fsr(CPUARMState *env)
+{
+    ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
+    int target_el = arm_debug_target_el(env);
+    bool using_lpae = false;
+
+    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
+        using_lpae = true;
+    } else {
+        if (arm_feature(env, ARM_FEATURE_LPAE) &&
+            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
+            using_lpae = true;
+        }
+    }
+
+    if (using_lpae) {
+        return arm_fi_to_lfsc(&fi);
+    } else {
+        return arm_fi_to_sfsc(&fi);
+    }
+}
+
 void arm_debug_excp_handler(CPUState *cs)
 {
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename to helper_exception_with_syndrome_el, to emphasize
that the target el is a parameter.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    | 2 +-
 target/arm/translate.h | 6 +++---
 target/arm/op_helper.c | 6 +++---
 target/arm/translate.c | 6 +++---
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
                    i32, i32, i32, i32)
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
-DEF_HELPER_4(exception_with_syndrome, noreturn, env, i32, i32, i32)
+DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
 DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
 DEF_HELPER_1(setend, void, env)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
 static inline void gen_exception(int excp, uint32_t syndrome,
                                  uint32_t target_el)
 {
-    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
-                                       tcg_constant_i32(syndrome),
-                                       tcg_constant_i32(target_el));
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syndrome),
+                                          tcg_constant_i32(target_el));
 }
 
 /* Generate an architectural singlestep exception */
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(yield)(CPUARMState *env)
  * those EXCP values which are special cases for QEMU to interrupt
  * execution and not to be used for exceptions which are passed to
  * the guest (those must all have syndrome information and thus should
- * use exception_with_syndrome).
+ * use exception_with_syndrome*).
  */
 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 }
 
 /* Raise an exception with the specified syndrome register value */
-void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
-                                     uint32_t syndrome, uint32_t target_el)
+void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
+                                        uint32_t syndrome, uint32_t target_el)
 {
     raise_exception(env, excp, syndrome, target_el);
 }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
 {
     gen_set_condexec(s);
     gen_set_pc_im(s, s->pc_curr);
-    gen_helper_exception_with_syndrome(cpu_env,
-                                       tcg_constant_i32(excp),
-                                       tcg_constant_i32(syn), tcg_el);
+    gen_helper_exception_with_syndrome_el(cpu_env,
+                                          tcg_constant_i32(excp),
+                                          tcg_constant_i32(syn), tcg_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a function below gen_exception_insn that takes
the target_el as a TCGv_i32, replacing gen_exception_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el)
+static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
+                                    uint32_t syn, TCGv_i32 tcg_el)
 {
     if (s->aarch64) {
         gen_a64_set_pc_im(pc);
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
         gen_set_condexec(s);
         gen_set_pc_im(s, pc);
     }
-    gen_exception(excp, syn, target_el);
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syn), tcg_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el)
+{
+    gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
+}
+
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 {
     gen_set_condexec(s);
@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s)
                        default_exception_el(s));
 }
 
-static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
-                             TCGv_i32 tcg_el)
-{
-    gen_set_condexec(s);
-    gen_set_pc_im(s, s->pc_curr);
-    gen_helper_exception_with_syndrome_el(cpu_env,
-                                          tcg_constant_i32(excp),
-                                          tcg_constant_i32(syn), tcg_el);
-    s->base.is_jmp = DISAS_NORETURN;
-}
-
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 void gen_lookup_tb(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
                 tcg_el = tcg_constant_i32(3);
             }
 
-            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
+            gen_exception_insn_el_v(s, s->pc_curr, EXCP_UDEF,
+                                    syn_uncategorized(), tcg_el);
             tcg_temp_free_i32(tcg_el);
             return false;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h        |  4 ++--
 target/arm/translate-a64.c    | 36 ++++++++++++++++----------------
 target/arm/translate-m-nocp.c | 16 +++++++-------
 target/arm/translate-mve.c    |  4 ++--
 target/arm/translate-vfp.c    |  6 +++---
 target/arm/translate.c        | 39 ++++++++++++++++++-----------------
 6 files changed, 53 insertions(+), 52 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el);
+void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                           uint32_t syn, uint32_t target_el);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check(DisasContext *s)
         assert(!s->fp_access_checked);
         s->fp_access_checked = true;
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_fp_access_trap(1, 0xe, false, 0),
-                           s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_fp_access_trap(1, 0xe, false, 0),
+                              s->fp_excp_el);
         return false;
     }
     s->fp_access_checked = true;
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
         assert(!s->sve_access_checked);
         s->sve_access_checked = true;
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_sve_access_trap(), s->sve_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_sve_access_trap(), s->sve_excp_el);
         return false;
     }
     s->sve_access_checked = true;
@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     } else {
         syndrome = syn_uncategorized();
     }
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome,
-                       default_exception_el(s));
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
+                          default_exception_el(s));
 }
 
 /* MRS - move from system register
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
         switch (op2_ll) {
         case 1:                                                     /* SVC */
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
-                               syn_aa64_svc(imm16), default_exception_el(s));
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
+                                  syn_aa64_svc(imm16), default_exception_el(s));
             break;
         case 2:                                                     /* HVC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_hvc(cpu_env);
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
-                               syn_aa64_hvc(imm16), 2);
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_HVC,
+                                  syn_aa64_hvc(imm16), 2);
             break;
         case 3:                                                     /* SMC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
             gen_a64_set_pc_im(s->pc_curr);
             gen_helper_pre_smc(cpu_env, tcg_constant_i32(syn_aa64_smc(imm16)));
             gen_ss_advance(s);
-            gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
-                               syn_aa64_smc(imm16), 3);
+            gen_exception_insn_el(s, s->base.pc_next, EXCP_SMC,
+                                  syn_aa64_smc(imm16), 3);
             break;
         default:
             unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
             if (s->btype != 0
                 && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                                   syn_btitrap(s->btype),
-                                   default_exception_el(s));
+                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                                      syn_btitrap(s->btype),
+                                      default_exception_el(s));
                 return;
             }
         } else {
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-m-nocp.c
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
     tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
 
     if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         if (!vfp_access_check_m(s, true)) {
             /*
              * This was only a conditional exception, so override
-             * gen_exception_insn()'s default to DISAS_NORETURN
+             * gen_exception_insn_el()'s default to DISAS_NORETURN
              */
             s->base.is_jmp = DISAS_NEXT;
             break;
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
         if (!vfp_access_check_m(s, true)) {
             /*
              * This was only a conditional exception, so override
-             * gen_exception_insn()'s default to DISAS_NORETURN
+             * gen_exception_insn_el()'s default to DISAS_NORETURN
              */
             s->base.is_jmp = DISAS_NEXT;
             break;
@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
     }
 
     if (a->cp != 10) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), default_exception_el(s));
         return true;
     }
 
     if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return true;
     }
 
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
         return true;
     default:
         /* Reserved value: INVSTATE UsageFault */
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         return false;
     }
 }
diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static bool vfp_access_check_a(DisasContext *s, bool ignore_vfp_enabled)
         int coproc = arm_dc_feature(s, ARM_FEATURE_V8) ? 0 : 0xa;
         uint32_t syn = syn_fp_access_trap(1, 0xe, false, coproc);
 
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn, s->fp_excp_el);
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
          * the encoding space handled by the patterns in m-nocp.decode,
          * and for them we may need to raise NOCP here.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                              syn_uncategorized(), s->fp_excp_el);
         return false;
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                        uint32_t syn, uint32_t target_el)
+void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
+                           uint32_t syn, uint32_t target_el)
 {
     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
+                          default_exception_el(s));
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
 
 undef:
     /* If we get here then some access check did not pass */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                       syn_uncategorized(), exc_target);
+    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                          syn_uncategorized(), exc_target);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
      * For the UNPREDICTABLE cases we choose to UNDEF.
      */
     if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_uncategorized(), 3);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
          * Do the check-and-raise-exception by hand.
          */
         if (s->fp_excp_el) {
-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                               syn_uncategorized(), s->fp_excp_el);
+            gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
+                                  syn_uncategorized(), s->fp_excp_el);
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
         tmp = load_cpu_field(v7m.ltpsize);
         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
         tcg_temp_free_i32(tmp);
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         gen_set_label(skipexc);
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
      * UsageFault exception.
      */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(s));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(dc));
+        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
+                              syn_illegalstate(), default_exception_el(dc));
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          */
         tcg_remove_ops_after(dc->insn_eci_rewind);
         dc->condjmp = 0;
-        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                           default_exception_el(dc));
+        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
+                              default_exception_el(dc));
     }
 
     arm_post_translate_insn(dc);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a new wrapper function that passes the default
exception target to gen_exception_insn_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h        |  1 +
 target/arm/translate-a64.c    | 15 ++++++---------
 target/arm/translate-m-nocp.c |  3 +--
 target/arm/translate-mve.c    |  3 +--
 target/arm/translate.c        | 29 +++++++++++++----------------
 5 files changed, 22 insertions(+), 29 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
 void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
                            uint32_t syn, uint32_t target_el);
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     } else {
         syndrome = syn_uncategorized();
     }
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syndrome,
-                          default_exception_el(s));
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syndrome);
 }
 
 /* MRS - move from system register
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
         switch (op2_ll) {
         case 1:                                                     /* SVC */
             gen_ss_advance(s);
-            gen_exception_insn_el(s, s->base.pc_next, EXCP_SWI,
-                                  syn_aa64_svc(imm16), default_exception_el(s));
+            gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
+                               syn_aa64_svc(imm16));
             break;
         case 2:                                                     /* HVC */
             if (s->current_el == 0) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
             if (s->btype != 0
                 && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                                      syn_btitrap(s->btype),
-                                      default_exception_el(s));
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype));
                 return;
             }
         } else {
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-m-nocp.c
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_NOCP(DisasContext *s, arg_nocp *a)
     }
 
     if (a->cp != 10) {
-        gen_exception_insn_el(s, s->pc_curr, EXCP_NOCP,
-                              syn_uncategorized(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized());
         return true;
     }
 
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ bool mve_eci_check(DisasContext *s)
         return true;
     default:
         /* Reserved value: INVSTATE UsageFault */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         return false;
     }
 }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
     gen_exception_insn_el_v(s, pc, excp, syn, tcg_constant_i32(target_el));
 }
 
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
+{
+    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
+}
+
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 {
     gen_set_condexec(s);
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                          default_exception_el(s));
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
      * an exception and return false. Otherwise it will return true,
      * and set *tgtmode and *regno appropriately.
      */
-    int exc_target = default_exception_el(s);
-
     /* These instructions are present only in ARMv8, or in ARMv7 with the
      * Virtualization Extensions.
      */
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
 
 undef:
     /* If we get here then some access check did not pass */
-    gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                          syn_uncategorized(), exc_target);
+    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized());
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_LE(DisasContext *s, arg_LE *a)
         tmp = load_cpu_field(v7m.ltpsize);
         tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc);
         tcg_temp_free_i32(tmp);
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         gen_set_label(skipexc);
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
      * UsageFault exception.
      */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        gen_exception_insn_el(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(s));
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * Illegal execution state. This has priority over BTI
          * exceptions, but comes after instruction abort exceptions.
          */
-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_UDEF,
-                              syn_illegalstate(), default_exception_el(dc));
+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF, syn_illegalstate());
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          */
         tcg_remove_ops_after(dc->insn_eci_rewind);
         dc->condjmp = 0;
-        gen_exception_insn_el(dc, dc->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
-                              default_exception_el(dc));
+        gen_exception_insn(dc, dc->pc_curr, EXCP_INVSTATE,
+                           syn_uncategorized());
     }
 
     arm_post_translate_insn(dc);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the computation from gen_swstep_exception into a helper.

This fixes a bug when:
  - MDSCR_EL1.KDE == 1 to enable debug exceptions within EL_D itself
  - we singlestep an ERET from EL_D to some lower EL

Previously we were computing 'same el' based on the EL which
executed the ERET instruction, whereas it ought to be computed
based on the EL to which ERET returned.  This happens naturally
with the new helper, which runs after EL has been changed.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h       |  1 +
 target/arm/translate.h    | 12 +++---------
 target/arm/debug_helper.c | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
 DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
+DEF_HELPER_2(exception_swstep, noreturn, env, i32)
 DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
 DEF_HELPER_1(setend, void, env)
 DEF_HELPER_2(wfi, void, env, i32)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
 /* Generate an architectural singlestep exception */
 static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 {
-    bool same_el = (s->debug_target_el == s->current_el);
-
-    /*
-     * If singlestep is targeting a lower EL than the current one,
-     * then s->ss_active must be false and we can never get here.
-     */
-    assert(s->debug_target_el >= s->current_el);
-
-    gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
+    /* Fill in the same_el field of the syndrome in the helper. */
+    uint32_t syn = syn_swstep(false, isv, ex);
+    gen_helper_exception_swstep(cpu_env, tcg_constant_i32(syn));
 }
 
 /*
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
 }
 
+void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /*
+     * If singlestep is targeting a lower EL than the current one, then
+     * DisasContext.ss_active must be false and we can never get here.
+     */
+    assert(debug_el >= cur_el);
+    if (debug_el == cur_el) {
+        syndrome |= 1 << ARM_EL_EC_SHIFT;
+    }
+    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We no longer need this value during translation,
as it is now handled within the helpers.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  6 ++----
 target/arm/translate.h     |  2 --
 target/arm/helper.c        | 12 ++----------
 target/arm/translate-a64.c |  1 -
 target/arm/translate.c     |  1 -
 5 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, BE_DATA, 3, 1)
 FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
 /* Target EL if we take a floating-point-disabled exception */
 FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
-/* For A-profile only, target EL for debug exceptions.  */
-FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
-FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
-FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
+FIELD(TBFLAG_ANY, ALIGN_MEM, 10, 1)
+FIELD(TBFLAG_ANY, PSTATE__IL, 11, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      */
     uint32_t svc_imm;
     int current_el;
-    /* Debug target exception level for single-step exceptions */
-    int debug_target_el;
     GHashTable *cp_regs;
     uint64_t features; /* CPU features bits */
     bool aarch64;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
-static CPUARMTBFlags rebuild_hflags_aprofile(CPUARMState *env)
-{
-    CPUARMTBFlags flags = {};
-
-    DP_TBFLAG_ANY(flags, DEBUG_TARGET_EL, arm_debug_target_el(env));
-    return flags;
-}
-
 static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
                                         ARMMMUIdx mmu_idx)
 {
-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
+    CPUARMTBFlags flags = {};
     int el = arm_current_el(env);
 
     if (arm_sctlr(env, el) & SCTLR_A) {
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
 static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
                                         ARMMMUIdx mmu_idx)
 {
-    CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
+    CPUARMTBFlags flags = {};
     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
     uint64_t sctlr;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->ss_active = EX_TBFLAG_ANY(tb_flags, SS_ACTIVE);
     dc->pstate_ss = EX_TBFLAG_ANY(tb_flags, PSTATE__SS);
     dc->is_ldex = false;
-    dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
 
     /* Bound the number of insns to execute to those left on the page.  */
     bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
         dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
     } else {
-        dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
         dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
         dc->hstr_active = EX_TBFLAG_A32(tb_flags, HSTR_ACTIVE);
         dc->ns = EX_TBFLAG_A32(tb_flags, NS);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is not required by any other translation file.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h | 8 --------
 target/arm/translate.c | 7 +++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
-static inline void gen_exception(int excp, uint32_t syndrome,
-                                 uint32_t target_el)
-{
-    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
-                                          tcg_constant_i32(syndrome),
-                                          tcg_constant_i32(target_el));
-}
-
 /* Generate an architectural singlestep exception */
 static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
+{
+    gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
+                                          tcg_constant_i32(syndrome),
+                                          tcg_constant_i32(target_el));
+}
+
 static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
                                     uint32_t syn, TCGv_i32 tcg_el)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
+static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
 {
     gen_helper_exception_with_syndrome_el(cpu_env, tcg_constant_i32(excp),
                                           tcg_constant_i32(syndrome),
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
             gen_ss_advance(dc);
-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-                          default_exception_el(dc));
+            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+                             default_exception_el(dc));
             break;
         case DISAS_HVC:
             gen_ss_advance(dc);
-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
             break;
         case DISAS_SMC:
             gen_ss_advance(dc);
-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
+            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
             break;
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             gen_helper_yield(cpu_env);
             break;
         case DISAS_SWI:
-            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
-                          default_exception_el(dc));
+            gen_exception_el(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb),
+                             default_exception_el(dc));
             break;
         case DISAS_HVC:
-            gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
+            gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
             break;
         case DISAS_SMC:
-            gen_exception(EXCP_SMC, syn_aa32_smc(), 3);
+            gen_exception_el(EXCP_SMC, syn_aa32_smc(), 3);
             break;
         }
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a new wrapper function that passes the default
exception target to gen_exception_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Split out a common helper function for gen_exception_el
and gen_exception_insn_el_v.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

With the helper we can use exception_target_el at runtime,
instead of default_exception_el at translate time.
While we're at it, remove the DisasContext parameter from
gen_exception, as it is no longer used.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    |  1 +
 target/arm/op_helper.c | 10 ++++++++++
 target/arm/translate.c | 18 +++++++++++++-----
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
                    i32, i32, i32, i32)
 DEF_HELPER_2(exception_internal, noreturn, env, i32)
+DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
 DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
 DEF_HELPER_2(exception_swstep, noreturn, env, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
     raise_exception(env, excp, syndrome, target_el);
 }
 
+/*
+ * Raise an exception with the specified syndrome register value
+ * to the default target el.
+ */
+void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
+                                     uint32_t syndrome)
+{
+    raise_exception(env, excp, syndrome, exception_target_el(env));
+}
+
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 {
     return cpsr_read(env) & ~CPSR_EXEC;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(int excp, uint32_t syndrome, uint32_t target_el)
     gen_exception_el_v(excp, syndrome, tcg_constant_i32(target_el));
 }
 
-static void gen_exception(DisasContext *s, int excp, uint32_t syndrome)
+static void gen_exception(int excp, uint32_t syndrome)
 {
-    gen_exception_el(excp, syndrome, default_exception_el(s));
+    gen_helper_exception_with_syndrome(cpu_env, tcg_constant_i32(excp),
+                                       tcg_constant_i32(syndrome));
 }
 
 static void gen_exception_insn_el_v(DisasContext *s, uint64_t pc, int excp,
@@ -XXX,XX +XXX,XX @@ void gen_exception_insn_el(DisasContext *s, uint64_t pc, int excp,
 
 void gen_exception_insn(DisasContext *s, uint64_t pc, int excp, uint32_t syn)
 {
-    gen_exception_insn_el(s, pc, excp, syn, default_exception_el(s));
+    if (s->aarch64) {
+        gen_a64_set_pc_im(pc);
+    } else {
+        gen_set_condexec(s);
+        gen_set_pc_im(s, pc);
+    }
+    gen_exception(excp, syn);
+    s->base.is_jmp = DISAS_NORETURN;
 }
 
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
             gen_ss_advance(dc);
-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
             break;
         case DISAS_HVC:
             gen_ss_advance(dc);
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             gen_helper_yield(cpu_env);
             break;
         case DISAS_SWI:
-            gen_exception(dc, EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
+            gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
             break;
         case DISAS_HVC:
             gen_exception_el(EXCP_HVC, syn_aa32_hvc(dc->svc_imm), 2);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is no longer used.  At the same time, remove
DisasContext.secure_routed_to_el3, as it in turn becomes unused.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h     | 16 ----------------
 target/arm/translate-a64.c |  5 -----
 target/arm/translate.c     |  5 -----
 3 files changed, 26 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
-    /* Flag indicating that exceptions from secure mode are routed to EL3. */
-    bool secure_routed_to_el3;
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
     int vec_stride;
@@ -XXX,XX +XXX,XX @@ static inline int get_mem_index(DisasContext *s)
     return arm_to_core_mmu_idx(s->mmu_idx);
 }
 
-/* Function used to determine the target exception EL when otherwise not known
- * or default.
- */
-static inline int default_exception_el(DisasContext *s)
-{
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.  Otherwise,
-     * exceptions can only be routed to ELs above 1, so we target the higher of
-     * 1 or the current EL.
-     */
-    return (s->mmu_idx == ARMMMUIdx_SE10_0 && s->secure_routed_to_el3)
-            ? 3 : MAX(1, s->current_el);
-}
-
 static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
 {
     /* We don't need to save all of the syndrome so we mask and shift
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->condjmp = 0;
 
     dc->aarch64 = true;
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.
-     */
-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
-                               !arm_el_is_aa64(env, 3);
     dc->thumb = false;
     dc->sctlr_b = 0;
     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->condjmp = 0;
 
     dc->aarch64 = false;
-    /* If we are coming from secure EL0 in a system with a 32-bit EL3, then
-     * there is no secure EL1, so we route exceptions to EL3.
-     */
-    dc->secure_routed_to_el3 = arm_feature(env, ARM_FEATURE_EL3) &&
-                               !arm_el_is_aa64(env, 3);
     dc->thumb = EX_TBFLAG_AM32(tb_flags, THUMB);
     dc->be_data = EX_TBFLAG_ANY(tb_flags, BE_DATA) ? MO_BE : MO_LE;
     condexec = EX_TBFLAG_AM32(tb_flags, CONDEXEC);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle the debug vs current el exception test in one place.
Leave EXCP_BKPT alone, since that treats debug < current differently.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 44 +++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 20 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/*
+ * Raise an exception to the debug target el.
+ * Modify syndrome to indicate when origin and target EL are the same.
+ */
+G_NORETURN static void
+raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
+{
+    int debug_el = arm_debug_target_el(env);
+    int cur_el = arm_current_el(env);
+
+    /*
+     * If singlestep is targeting a lower EL than the current one, then
+     * DisasContext.ss_active must be false and we can never get here.
+     * Similarly for watchpoint and breakpoint matches.
+     */
+    assert(debug_el >= cur_el);
+    syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
+    raise_exception(env, excp, syndrome, debug_el);
+}
+
 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
 static bool aa64_generate_debug_exceptions(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
     if (wp_hit) {
         if (wp_hit->flags & BP_CPU) {
             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
-            bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 
             cs->watchpoint_hit = NULL;
 
             env->exception.fsr = arm_debug_exception_fsr(env);
             env->exception.vaddress = wp_hit->hitaddr;
-            raise_exception(env, EXCP_DATA_ABORT,
-                    syn_watchpoint(same_el, 0, wnr),
-                    arm_debug_target_el(env));
+            raise_exception_debug(env, EXCP_DATA_ABORT,
+                                  syn_watchpoint(0, 0, wnr));
         }
     } else {
         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
-        bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 
         /*
          * (1) GDB breakpoints should be handled first.
@@ -XXX,XX +XXX,XX @@ void arm_debug_excp_handler(CPUState *cs)
          * exception/security level.
          */
         env->exception.vaddress = 0;
-        raise_exception(env, EXCP_PREFETCH_ABORT,
-                        syn_breakpoint(same_el),
-                        arm_debug_target_el(env));
+        raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
 
 void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
 {
-    int debug_el = arm_debug_target_el(env);
-    int cur_el = arm_current_el(env);
-
-    /*
-     * If singlestep is targeting a lower EL than the current one, then
-     * DisasContext.ss_active must be false and we can never get here.
-     */
-    assert(debug_el >= cur_el);
-    if (debug_el == cur_el) {
-        syndrome |= 1 << ARM_EL_EC_SHIFT;
-    }
-    raise_exception(env, EXCP_UDEF, syndrome, debug_el);
+    raise_exception_debug(env, EXCP_UDEF, syndrome);
 }
 
 #if !defined(CONFIG_USER_ONLY)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is no longer used outside debug_helper.c.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 21 ---------------------
 target/arm/debug_helper.c | 21 +++++++++++++++++++++
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
     ARMASIdx_TagS = 3,
 } ARMASIdx;
 
-/* Return the Exception Level targeted by debug exceptions. */
-static inline int arm_debug_target_el(CPUARMState *env)
-{
-    bool secure = arm_is_secure(env);
-    bool route_to_el2 = false;
-
-    if (arm_is_el2_enabled(env)) {
-        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
-                       env->cp15.mdcr_el2 & MDCR_TDE;
-    }
-
-    if (route_to_el2) {
-        return 2;
-    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
-               !arm_el_is_aa64(env, 3) && secure) {
-        return 3;
-    } else {
-        return 1;
-    }
-}
-
 static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
 {
     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
+/* Return the Exception Level targeted by debug exceptions. */
+static int arm_debug_target_el(CPUARMState *env)
+{
+    bool secure = arm_is_secure(env);
+    bool route_to_el2 = false;
+
+    if (arm_is_el2_enabled(env)) {
+        route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
+                       env->cp15.mdcr_el2 & MDCR_TDE;
+    }
+
+    if (route_to_el2) {
+        return 2;
+    } else if (arm_feature(env, ARM_FEATURE_EL3) &&
+               !arm_el_is_aa64(env, 3) && secure) {
+        return 3;
+    } else {
+        return 1;
+    }
+}
+
 /*
  * Raise an exception to the debug target el.
  * Modify syndrome to indicate when origin and target EL are the same.
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We were using arm_is_secure and is_a64, which are
tests against the current EL, as opposed to
arm_el_is_aa64 and arm_is_secure_below_el3, which
can be applied to a different EL than current.
Consolidate the two tests.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609202901.1177572-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
         int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN);
 
         switch (fpen) {
+        case 1:
+            if (cur_el != 0) {
+                break;
+            }
+            /* fall through */
         case 0:
         case 2:
-            if (cur_el == 0 || cur_el == 1) {
-                /* Trap to PL1, which might be EL1 or EL3 */
-                if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-                    return 3;
-                }
-                return 1;
-            }
-            if (cur_el == 3 && !is_a64(env)) {
-                /* Secure PL1 running at EL3 */
+            /* Trap from Secure PL0 or PL1 to Secure PL1. */
+            if (!arm_el_is_aa64(env, 3)
+                && (cur_el == 3 || arm_is_secure_below_el3(env))) {
                 return 3;
             }
-            break;
-        case 1:
-            if (cur_el == 0) {
+            if (cur_el <= 1) {
                 return 1;
             }
             break;
-        case 3:
-            break;
         }
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Because reset always initializes the AA64 version, SCR_EL3,
test the mode of EL3 instead of the type of the cpreg.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609214657.1217913-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     uint32_t valid_mask = 0x3fff;
     ARMCPU *cpu = env_archcpu(env);
 
-    if (ri->state == ARM_CP_STATE_AA64) {
-        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
-            !cpu_isar_feature(aa64_aa32_el1, cpu)) {
-                value |= SCR_FW | SCR_AW;   /* these two bits are RES1.  */
-        }
-        valid_mask &= ~SCR_NET;
+    /*
+     * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
+     * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
+     * Instead, choose the format based on the mode of EL3.
+     */
+    if (arm_el_is_aa64(env, 3)) {
+        value |= SCR_FW | SCR_AW;      /* RES1 */
+        valid_mask &= ~SCR_NET;        /* RES0 */
 
         if (cpu_isar_feature(aa64_ras, cpu)) {
             valid_mask |= SCR_TERR;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Since DDI0487F.a, the RW bit is RAO/WI.  When specifically
targeting such a cpu, e.g. cortex-a76, it is legitimate to
ignore the bit within the secure monitor.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1062
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220609214657.1217913-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 5 +++++
 target/arm/helper.c | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
 }
 
+static inline bool isar_feature_aa64_aa32_el2(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL2) >= 2;
+}
+
 static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         value |= SCR_FW | SCR_AW;      /* RES1 */
         valid_mask &= ~SCR_NET;        /* RES0 */
 
+        if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
+            !cpu_isar_feature(aa64_aa32_el2, cpu)) {
+            value |= SCR_RW;           /* RAO/WI */
+        }
         if (cpu_isar_feature(aa64_ras, cpu)) {
             valid_mask |= SCR_TERR;
         }
-- 
2.25.1

In two places in gdbstub.c we look at gdbserver_state.init to decide
whether we're going to do a semihosting syscall via the gdb remote
protocol:
 * when setting up, if the user didn't explicitly select either
   native semihosting or gdb semihosting, we autoselect, with the
   intended behaviour "use gdb if gdb is connected"
 * when the semihosting layer attempts to do a syscall via gdb, we
   silently ignore it if the gdbstub wasn't actually set up

However, if the user's commandline sets up the gdbstub but tells QEMU
to start rather than waiting for a GDB to connect (eg using '-s' but
not '-S'), then we will have gdbserver_state.init true but no actual
connection; an attempt to use gdb syscalls will then crash because we
try to use gdbserver_state.c_cpu when it hasn't been set up:

#0  0x00007ffff6803ba8 in qemu_cpu_kick (cpu=0x0) at ../../softmmu/cpus.c:457
#1  0x00007ffff6c03913 in gdb_do_syscallv (cb=0x7ffff6c19944 <common_semi_cb>,
    fmt=0x7ffff7573b7e "", va=0x7ffff56294c0) at ../../gdbstub.c:2946
#2  0x00007ffff6c19c3a in common_semi_gdb_syscall (cs=0x7ffff83fe060,
    cb=0x7ffff6c19944 <common_semi_cb>, fmt=0x7ffff7573b75 "isatty,%x")
    at ../../semihosting/arm-compat-semi.c:494
#3  0x00007ffff6c1a064 in gdb_isattyfn (cs=0x7ffff83fe060, gf=0x7ffff86a3690)
    at ../../semihosting/arm-compat-semi.c:636
#4  0x00007ffff6c1b20f in do_common_semihosting (cs=0x7ffff83fe060)
    at ../../semihosting/arm-compat-semi.c:967
#5  0x00007ffff693a037 in handle_semihosting (cs=0x7ffff83fe060)
    at ../../target/arm/helper.c:10316

You can probably also get into this state via some odd
corner cases involving connecting a GDB and then telling it
to detach from all the vCPUs.

Abstract out the test into a new gdb_attached() function
which returns true only if there's actually a GDB connected
to the debug stub and attached to at least one vCPU.

Reported-by: Liviu Ionescu <ilg@livius.net>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220526190053.521505-2-peter.maydell@linaro.org
---
 gdbstub.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/gdbstub.c b/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int get_char(void)
 }
 #endif
 
+/*
+ * Return true if there is a GDB currently connected to the stub
+ * and attached to a CPU
+ */
+static bool gdb_attached(void)
+{
+    return gdbserver_state.init && gdbserver_state.c_cpu;
+}
+
 static enum {
     GDB_SYS_UNKNOWN,
     GDB_SYS_ENABLED,
@@ -XXX,XX +XXX,XX @@ int use_gdb_syscalls(void)
     /* -semihosting-config target=auto */
     /* On the first call check if gdb is connected and remember. */
     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
-        gdb_syscall_mode = gdbserver_state.init ?
-            GDB_SYS_ENABLED : GDB_SYS_DISABLED;
+        gdb_syscall_mode = gdb_attached() ? GDB_SYS_ENABLED : GDB_SYS_DISABLED;
     }
     return gdb_syscall_mode == GDB_SYS_ENABLED;
 }
@@ -XXX,XX +XXX,XX @@ void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
     target_ulong addr;
     uint64_t i64;
 
-    if (!gdbserver_state.init) {
+    if (!gdb_attached()) {
         return;
     }
 
-- 
2.25.1

Currently we mishandle the --semihosting-config option if the
user specifies it on the command line more than once. For
example with:
 --semihosting-config target=gdb --semihosting-config arg=foo,arg=bar

the function qemu_semihosting_config_options() is called twice, once
for each argument.  But that function expects to be called only once,
and it always unconditionally sets the semihosting.enabled,
semihost_chardev and semihosting.target variables.  This means that
if any of those options were set anywhere except the last
--semihosting-config option on the command line, those settings are
ignored.  In the example above, 'target=gdb' in the first option is
overridden by an implied default 'target=auto' in the second.

The QemuOptsList machinery has a flag for handling this kind of
"option group is setting global state": by setting
 .merge_lists = true;
we make the machinery merge all the --semihosting-config arguments
the user passes into a single set of options and call our
qemu_semihosting_config_options() just once.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220526190053.521505-3-peter.maydell@linaro.org
---
 semihosting/config.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/semihosting/config.c b/semihosting/config.c
index XXXXXXX..XXXXXXX 100644
--- a/semihosting/config.c
+++ b/semihosting/config.c
@@ -XXX,XX +XXX,XX @@
 
 QemuOptsList qemu_semihosting_config_opts = {
     .name = "semihosting-config",
+    .merge_lists = true,
     .implied_opt_name = "enable",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_semihosting_config_opts.head),
     .desc = {
-- 
2.25.1