Series comparison

-[PULL 0/9] target-arm queue
+[PULL 00/26] target-arm queue
-Arm queue; bugfixes only.
+The following changes since commit 4cc10cae64c51e17844dc4358481c393d7bf1ed4:
-thanks
+  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-05-06 18:56:17 +0100)
 -- PMM
 The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
   Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210510
-for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
+for you to fetch changes up to 8f96812baa53005f32aece3e30b140826c20aa19:
-  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
+  hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 (2021-05-10 13:24:09 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/virt: ARM_VIRT must select ARM_GIC
+ * docs: fix link in sbsa description
- * exynos: Fix bad printf format specifiers
+ * linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
- * hw/input/ps2.c: Remove remnants of printf debug
+ * target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
- * target/openrisc: Remove dead code attempting to check "is timer disabled"
+ * target/arm: Split neon and vfp translation to their own
- * register: Remove unnecessary NULL check
+   compilation units
- * util/cutils: Fix Coverity array overrun in freq_to_str()
+ * target/arm: Make WFI a NOP for userspace emulators
- * configure: Make "does libgio work" test pull in some actual functions
+ * hw/sd/omap_mmc: Use device_cold_reset() instead of
- * tmp105: reset the T_low and T_High registers
+   device_legacy_reset()
- * tmp105: Correct handling of temperature limit checks
+ * include: More fixes for 'extern "C"' block use
  * hw/arm/imx25_pdk: Fix error message for invalid RAM size
  * hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
  * hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
 ----------------------------------------------------------------
-Alex Chen (1):
+Alex Bennée (1):
-      exynos: Fix bad printf format specifiers
+      docs: fix link in sbsa description
-Alistair Francis (1):
+Guenter Roeck (1):
-      register: Remove unnecessary NULL check
+      hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
-Andrew Jones (1):
+Peter Maydell (22):
-      hw/arm/virt: ARM_VIRT must select ARM_GIC
+      target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
+      target/arm: Move constant expanders to translate.h
-Peter Maydell (5):
+      target/arm: Share unallocated_encoding() and gen_exception_insn()
-      hw/input/ps2.c: Remove remnants of printf debug
+      target/arm: Make functions used by m-nocp global
-      target/openrisc: Remove dead code attempting to check "is timer disabled"
+      target/arm: Split m-nocp trans functions into their own file
-      configure: Make "does libgio work" test pull in some actual functions
+      target/arm: Move gen_aa32 functions to translate-a32.h
-      hw/misc/tmp105: reset the T_low and T_High registers
+      target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
-      tmp105: Correct handling of temperature limit checks
+      target/arm: Make functions used by translate-vfp global
       target/arm: Make translate-vfp.c.inc its own compilation unit
       target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
       target/arm: Delete unused typedef
       target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
       target/arm: Make functions used by translate-neon global
       target/arm: Make translate-neon.c.inc its own compilation unit
       target/arm: Make WFI a NOP for userspace emulators
       hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
       osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
       include/qemu/bswap.h: Handle being included outside extern "C" block
       include/disas/dis-asm.h: Handle being included outside 'extern "C"'
       hw/misc/mps2-scc: Add "QEMU interface" comment
       hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
       hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
 Philippe Mathieu-Daudé (1):
-      util/cutils: Fix Coverity array overrun in freq_to_str()
+      hw/arm/imx25_pdk: Fix error message for invalid RAM size
- configure                    | 11 +++++--
+Richard Henderson (1):
- hw/misc/tmp105.h             |  7 +++++
+      linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
  hw/core/register.c           |  4 ---
  hw/input/ps2.c               |  9 ------
  hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
  hw/timer/exynos4210_mct.c    |  4 +--
  hw/timer/exynos4210_pwm.c    |  8 ++---
  target/openrisc/sys_helper.c |  3 --
  util/cutils.c                |  3 +-
  hw/arm/Kconfig               |  1 +
 files changed, 89 insertions(+), 34 deletions(-)
+ docs/system/arm/mps2.rst                           |  10 +
+ docs/system/arm/sbsa.rst                           |   2 +-
+ include/disas/dis-asm.h                            |  12 +-
+ include/hw/misc/mps2-scc.h                         |  21 ++
+ include/qemu/bswap.h                               |  26 ++-
+ include/qemu/osdep.h                               |   8 +-
+ include/sysemu/os-posix.h                          |   8 +
+ include/sysemu/os-win32.h                          |   8 +
+ target/arm/translate-a32.h                         | 144 +++++++++++++
+ target/arm/translate-a64.h                         |   2 -
+ target/arm/translate.h                             |  29 +++
+ hw/arm/imx25_pdk.c                                 |   5 +-
+ hw/arm/mps2-tz.c                                   | 108 +++++++++-
+ hw/arm/xilinx_zynq.c                               |   2 +-
+ hw/misc/mps2-scc.c                                 |  13 +-
+ hw/sd/omap_mmc.c                                   |   2 +-
+ linux-user/elfload.c                               |  13 ++
+ target/arm/helper.c                                |   2 +-
+ target/arm/op_helper.c                             |  12 ++
+ target/arm/translate-a64.c                         |  15 --
+ target/arm/translate-m-nocp.c                      | 221 ++++++++++++++++++++
+ .../arm/{translate-neon.c.inc => translate-neon.c} |  19 +-
+ .../arm/{translate-vfp.c.inc => translate-vfp.c}   | 230 +++------------------
+ target/arm/translate.c                             | 200 ++++--------------
+ disas/arm-a64.cc                                   |   2 -
+ disas/nanomips.cpp                                 |   2 -
+ target/arm/meson.build                             |  15 +-
+files changed, 718 insertions(+), 413 deletions(-)
+ create mode 100644 target/arm/translate-a32.h
+ create mode 100644 target/arm/translate-m-nocp.c
+ rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
+ rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (94%)

-[PULL 5/9] register: Remove unnecessary NULL check
+[PULL 01/26] docs: fix link in sbsa description
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-This patch fixes CID 1432800 by removing an unnecessary check.
+A trailing _ makes all the difference to the rendered link.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20210428131316.31390-1-alex.bennee@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/register.c | 4 ----
+ docs/system/arm/sbsa.rst | 2 +-
-file changed, 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/core/register.c b/hw/core/register.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/register.c
+--- a/docs/system/arm/sbsa.rst
-+++ b/hw/core/register.c
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
+@@ -XXX,XX +XXX,XX @@ Arm Server Base System Architecture Reference board (``sbsa-ref``)
-         int index = rae[i].addr / data_size;
+ While the `virt` board is a generic board platform that doesn't match
-         RegisterInfo *r = &ri[index];
+ any real hardware the `sbsa-ref` board intends to look like real
+ hardware. The `Server Base System Architecture
--        if (data + data_size * index == 0 || !&rae[i]) {
+-<https://developer.arm.com/documentation/den0029/latest>` defines a
--            continue;
++<https://developer.arm.com/documentation/den0029/latest>`_ defines a
--        }
+ minimum base line of hardware support and importantly how the firmware
--
+ reports that to any operating system. It is a static system that
-         /* Init the register, this will zero it. */
+ reports a very minimal DT to the firmware for non-discoverable
          object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
 --
 .20.1

-New patch
+[PULL 02/26] linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
+From: Richard Henderson <richard.henderson@linaro.org>
+These three features are already enabled by TCG, but are missing
+their hwcap bits.  Update HWCAP2 from linux v5.12.
+Cc: qemu-stable@nongnu.org (for 6.0.1)
+Buglink: https://bugs.launchpad.net/bugs/1926044
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210427214108.88503-1-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ linux-user/elfload.c | 13 +++++++++++++
+file changed, 13 insertions(+)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -XXX,XX +XXX,XX @@ enum {
+     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
+     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
+     ARM_HWCAP2_A64_FRINT        = 1 << 8,
++    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
++    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
++    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
++    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
++    ARM_HWCAP2_A64_I8MM         = 1 << 13,
++    ARM_HWCAP2_A64_BF16         = 1 << 14,
++    ARM_HWCAP2_A64_DGH          = 1 << 15,
++    ARM_HWCAP2_A64_RNG          = 1 << 16,
++    ARM_HWCAP2_A64_BTI          = 1 << 17,
++    ARM_HWCAP2_A64_MTE          = 1 << 18,
+ };
+ #define ELF_HWCAP   get_elf_hwcap()
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap2(void)
+     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
+     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
+     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
++    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
++    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
++    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
+     return hwcaps;
+ }
+--
+.20.1

-New patch
+[PULL 03/26] target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
+In tlbi_aa64_vae2is_write() the calculation
+  bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
+                            pageaddr)
+has the two arms of the ?: expression reversed. Fix the bug.
+Fixes: b6ad6062f1e5
+Reported-by: Rebecca Cran <rebecca@nuviainc.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Reviewed-by: Rebecca Cran <rebecca@nuviainc.com>
+Message-id: 20210420123106.10861-1-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     uint64_t pageaddr = sextract64(value << 12, 0, 56);
+     bool secure = arm_is_secure_below_el3(env);
+     int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
+-    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
++    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
+                                   pageaddr);
+     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
+--
+.20.1

-New patch
+[PULL 04/26] target/arm: Move constant expanders to translate.h
+Some of the constant expanders defined in translate.c are generically
+useful and will be used by the separate C files for VFP and Neon once
+they are created; move the expander definitions to translate.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-2-peter.maydell@linaro.org
+---
+ target/arm/translate.h | 24 ++++++++++++++++++++++++
+ target/arm/translate.c | 24 ------------------------
+files changed, 24 insertions(+), 24 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
+ extern TCGv_i64 cpu_exclusive_addr;
+ extern TCGv_i64 cpu_exclusive_val;
++/*
++ * Constant expanders for the decoders.
++ */
++
++static inline int negate(DisasContext *s, int x)
++{
++    return -x;
++}
++
++static inline int plus_2(DisasContext *s, int x)
++{
++    return x + 2;
++}
++
++static inline int times_2(DisasContext *s, int x)
++{
++    return x * 2;
++}
++
++static inline int times_4(DisasContext *s, int x)
++{
++    return x * 4;
++}
++
+ static inline int arm_dc_feature(DisasContext *dc, int feature)
+ {
+     return (dc->features & (1ULL << feature)) != 0;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
+     }
+ }
+-/*
+- * Constant expanders for the decoders.
+- */
+-
+-static int negate(DisasContext *s, int x)
+-{
+-    return -x;
+-}
+-
+-static int plus_2(DisasContext *s, int x)
+-{
+-    return x + 2;
+-}
+-
+-static int times_2(DisasContext *s, int x)
+-{
+-    return x * 2;
+-}
+-
+-static int times_4(DisasContext *s, int x)
+-{
+-    return x * 4;
+-}
+-
+ /* Flags for the disas_set_da_iss info argument:
+  * lower bits hold the Rt register number, higher bits are flags.
+  */
+--
+.20.1

-[PULL 2/9] exynos: Fix bad printf format specifiers
+[PULL 05/26] target/arm: Share unallocated_encoding() and gen_exception_insn()
-From: Alex Chen <alex.chen@huawei.com>
+The unallocated_encoding() function is the same in both
 translate-a64.c and translate.c; make the translate.c function global
 and drop the translate-a64.c version.  To do this we need to also
 share gen_exception_insn(), which currently exists in two slightly
 different versions for A32 and A64: merge those into a single
 function that can work for both.
-We should use printf format specifier "%u" instead of "%d" for
+This will be useful for splitting up translate.c, which will require
-argument of type "unsigned int".
+unallocated_encoding() to no longer be file-local.  It's also
 hopefully less confusing to have only one version of the function
 rather than two.
-Reported-by: Euler Robot <euler.robot@huawei.com>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Message-id: 20201111073651.72804-1-alex.chen@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-3-peter.maydell@linaro.org
 ---
- hw/timer/exynos4210_mct.c | 4 ++--
+ target/arm/translate-a64.h |  2 --
- hw/timer/exynos4210_pwm.c | 8 ++++----
+ target/arm/translate.h     |  3 +++
-files changed, 6 insertions(+), 6 deletions(-)
+ target/arm/translate-a64.c | 15 ---------------
  target/arm/translate.c     | 14 +++++++++-----
 files changed, 12 insertions(+), 22 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/target/arm/translate-a64.h
-+++ b/hw/timer/exynos4210_mct.c
++++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
+@@ -XXX,XX +XXX,XX @@
-     /* If CSTAT is pending and IRQ is enabled */
+ #ifndef TARGET_ARM_TRANSLATE_A64_H
-     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
+ #define TARGET_ARM_TRANSLATE_A64_H
-             (s->reg.int_enb & G_INT_ENABLE(id))) {
--        DPRINTF("gcmp timer[%d] IRQ\n", id);
+-void unallocated_encoding(DisasContext *s);
-+        DPRINTF("gcmp timer[%u] IRQ\n", id);
+-
-         qemu_irq_raise(s->irq[id]);
+ #define unsupported_encoding(s, insn)                                    \
      do {                                                                 \
          qemu_log_mask(LOG_UNIMP,                                         \
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void arm_free_cc(DisasCompare *cmp);
  void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
  void arm_gen_test_cc(int cc, TCGLabel *label);
  MemOp pow2_align(unsigned i);
 +void unallocated_encoding(DisasContext *s);
 +void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
 +                        uint32_t syn, uint32_t target_el);
  /* Return state of Alternate Half-precision flag, caller frees result */
  static inline TCGv_i32 get_ahp_flag(void)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
      s->base.is_jmp = DISAS_NORETURN;
  }
 -static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
 -                               uint32_t syndrome, uint32_t target_el)
 -{
 -    gen_a64_set_pc_im(pc);
 -    gen_exception(excp, syndrome, target_el);
 -    s->base.is_jmp = DISAS_NORETURN;
 -}
 -
  static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
  {
      TCGv_i32 tcg_syn;
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
-                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
+-void unallocated_encoding(DisasContext *s)
+-{
-     if (freq != s->freq) {
+-    /* Unallocated and reserved encodings are uncategorized */
--        DPRINTF("freq=%dHz\n", s->freq);
+-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-+        DPRINTF("freq=%uHz\n", s->freq);
+-                       default_exception_el(s));
+-}
-         /* global timer */
+-
-         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
+ static void init_tmp_a64_array(DisasContext *s)
-diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
+ {
  #ifdef CONFIG_DEBUG_TCG
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_pwm.c
+--- a/target/arm/translate.c
-+++ b/hw/timer/exynos4210_pwm.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
+     s->base.is_jmp = DISAS_NORETURN;
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
+-static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
-     uint32_t id = s->id;
+-                               int syn, uint32_t target_el)
-     bool cmp;
++void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
++                        uint32_t syn, uint32_t target_el)
--    DPRINTF("timer %d tick\n", id);
+ {
-+    DPRINTF("timer %u tick\n", id);
+-    gen_set_condexec(s);
+-    gen_set_pc_im(s, pc);
-     /* set irq status */
++    if (s->aarch64) {
-     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
++        gen_a64_set_pc_im(pc);
++    } else {
-     /* raise IRQ */
++        gen_set_condexec(s);
-     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
++        gen_set_pc_im(s, pc);
--        DPRINTF("timer %d IRQ\n", id);
++    }
-+        DPRINTF("timer %u IRQ\n", id);
+     gen_exception(excp, syn, target_el);
-         qemu_irq_raise(p->timer[id].irq);
+     s->base.is_jmp = DISAS_NORETURN;
-     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
+     s->base.is_jmp = DISAS_NORETURN;
-     }
+ }
-     if (cmp) {
+-static void unallocated_encoding(DisasContext *s)
--        DPRINTF("auto reload timer %d count to %x\n", id,
++void unallocated_encoding(DisasContext *s)
-+        DPRINTF("auto reload timer %u count to %x\n", id,
+ {
-                 p->timer[id].reg_tcntb);
+     /* Unallocated and reserved encodings are uncategorized */
-         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
+     gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
          ptimer_run(p->timer[id].ptimer, 1);
 --
 .20.1

-New patch
+[PULL 06/26] target/arm: Make functions used by m-nocp global
+We want to split out the .c.inc files which are currently included
 into translate.c so they are separate compilation units.  To do this
 we need to make some functions which are currently file-local to
 translate.c have global scope; create a translate-a32.h paralleling
 the existing translate-a64.h as a place for these declarations to
 live, so that code moved into the new compilation units can call
 them.
 The functions made global here are those required by the
 m-nocp.decode functions, except that I have converted the whole
 family of {read,write}_neon_element* and also both the load_cpu and
 store_cpu functions for consistency, even though m-nocp only wants a
 few functions from each.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210430132740.10391-4-peter.maydell@linaro.org
 ---
  target/arm/translate-a32.h     | 57 ++++++++++++++++++++++++++++++++++
  target/arm/translate.c         | 39 +++++------------------
  target/arm/translate-vfp.c.inc |  2 +-
 files changed, 65 insertions(+), 33 deletions(-)
  create mode 100644 target/arm/translate-a32.h
 diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  AArch32 translation, common definitions.
 + *
 + * Copyright (c) 2021 Linaro, Ltd.
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef TARGET_ARM_TRANSLATE_A64_H
 +#define TARGET_ARM_TRANSLATE_A64_H
 +
 +void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 +void arm_gen_condlabel(DisasContext *s);
 +bool vfp_access_check(DisasContext *s);
 +void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
 +void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
 +void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
 +void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
 +
 +static inline TCGv_i32 load_cpu_offset(int offset)
 +{
 +    TCGv_i32 tmp = tcg_temp_new_i32();
 +    tcg_gen_ld_i32(tmp, cpu_env, offset);
 +    return tmp;
 +}
 +
 +#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 +
 +static inline void store_cpu_offset(TCGv_i32 var, int offset)
 +{
 +    tcg_gen_st_i32(var, cpu_env, offset);
 +    tcg_temp_free_i32(var);
 +}
 +
 +#define store_cpu_field(var, name) \
 +    store_cpu_offset(var, offsetof(CPUARMState, name))
 +
 +/* Create a new temporary and set it to the value of a CPU register.  */
 +static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 +{
 +    TCGv_i32 tmp = tcg_temp_new_i32();
 +    load_reg_var(s, tmp, reg);
 +    return tmp;
 +}
 +
 +#endif
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
  #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
  #include "translate.h"
 +#include "translate-a32.h"
  #if defined(CONFIG_USER_ONLY)
  #define IS_USER(s) 1
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
  }
  /* Generate a label used for skipping this instruction */
 -static void arm_gen_condlabel(DisasContext *s)
 +void arm_gen_condlabel(DisasContext *s)
  {
      if (!s->condjmp) {
          s->condlabel = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
      }
  }
 -static inline TCGv_i32 load_cpu_offset(int offset)
 -{
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    tcg_gen_ld_i32(tmp, cpu_env, offset);
 -    return tmp;
 -}
 -
 -#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 -
 -static inline void store_cpu_offset(TCGv_i32 var, int offset)
 -{
 -    tcg_gen_st_i32(var, cpu_env, offset);
 -    tcg_temp_free_i32(var);
 -}
 -
 -#define store_cpu_field(var, name) \
 -    store_cpu_offset(var, offsetof(CPUARMState, name))
 -
  /* The architectural value of PC.  */
  static uint32_t read_pc(DisasContext *s)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t read_pc(DisasContext *s)
  }
  /* Set a variable to the value of a CPU register.  */
 -static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 +void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
  {
      if (reg == 15) {
          tcg_gen_movi_i32(var, read_pc(s));
@@ -XXX,XX +XXX,XX @@ static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
      }
  }
 -/* Create a new temporary and set it to the value of a CPU register.  */
 -static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 -{
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    load_reg_var(s, tmp, reg);
 -    return tmp;
 -}
 -
  /*
   * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
   * This is used for load/store for which use of PC implies (literal),
@@ -XXX,XX +XXX,XX @@ static inline void vfp_store_reg32(TCGv_i32 var, int reg)
      tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
  }
 -static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 +void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
      }
  }
 -static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
 +void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
      }
  }
 -static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
 +void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
@@ -XXX,XX +XXX,XX @@ static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
      }
  }
 -static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 +void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
  {
      long off = neon_element_offset(reg, ele, memop);
 diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c.inc
 +++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
   * The most usual kind of VFP access check, for everything except
   * FMXR/FMRX to the always-available special registers.
   */
 -static bool vfp_access_check(DisasContext *s)
 +bool vfp_access_check(DisasContext *s)
  {
      return full_vfp_access_check(s, false);
  }
 --
 .20.1

-New patch
+[PULL 07/26] target/arm: Split m-nocp trans functions into their own file
+Currently the trans functions for m-nocp.decode all live in
+translate-vfp.inc.c; move them out into their own translation unit,
+translate-m-nocp.c.
+The trans_* functions here are pure code motion with no changes.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-5-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h     |   3 +
+ target/arm/translate-m-nocp.c  | 221 +++++++++++++++++++++++++++++++++
+ target/arm/translate.c         |   1 -
+ target/arm/translate-vfp.c.inc | 196 -----------------------------
+ target/arm/meson.build         |   3 +-
+files changed, 226 insertions(+), 198 deletions(-)
+ create mode 100644 target/arm/translate-m-nocp.c
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef TARGET_ARM_TRANSLATE_A64_H
+ #define TARGET_ARM_TRANSLATE_A64_H
++/* Prototypes for autogenerated disassembler functions */
++bool disas_m_nocp(DisasContext *dc, uint32_t insn);
++
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
+ void arm_gen_condlabel(DisasContext *s);
+ bool vfp_access_check(DisasContext *s);
+diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/arm/translate-m-nocp.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ *  ARM translation: M-profile NOCP special-case instructions
++ *
++ *  Copyright (c) 2020 Linaro, Ltd.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "qemu/osdep.h"
++#include "tcg/tcg-op.h"
++#include "translate.h"
++#include "translate-a32.h"
++
++#include "decode-m-nocp.c.inc"
++
++/*
++ * Decode VLLDM and VLSTM are nonstandard because:
++ *  * if there is no FPU then these insns must NOP in
++ *    Secure state and UNDEF in Nonsecure state
++ *  * if there is an FPU then these insns do not have
++ *    the usual behaviour that vfp_access_check() provides of
++ *    being controlled by CPACR/NSACR enable bits or the
++ *    lazy-stacking logic.
++ */
++static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
++{
++    TCGv_i32 fptr;
++
++    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
++        !arm_dc_feature(s, ARM_FEATURE_V8)) {
++        return false;
++    }
++
++    if (a->op) {
++        /*
++         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
++         * to take the IMPDEF option to make memory accesses to the stack
++         * slots that correspond to the D16-D31 registers (discarding
++         * read data and writing UNKNOWN values), so for us the T2
++         * encoding behaves identically to the T1 encoding.
++         */
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++            return false;
++        }
++    } else {
++        /*
++         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
++         * This is currently architecturally impossible, but we add the
++         * check to stay in line with the pseudocode. Note that we must
++         * emit code for the UNDEF so it takes precedence over the NOCP.
++         */
++        if (dc_isar_feature(aa32_simd_r32, s)) {
++            unallocated_encoding(s);
++            return true;
++        }
++    }
++
++    /*
++     * If not secure, UNDEF. We must emit code for this
++     * rather than returning false so that this takes
++     * precedence over the m-nocp.decode NOCP fallback.
++     */
++    if (!s->v8m_secure) {
++        unallocated_encoding(s);
++        return true;
++    }
++    /* If no fpu, NOP. */
++    if (!dc_isar_feature(aa32_vfp, s)) {
++        return true;
++    }
++
++    fptr = load_reg(s, a->rn);
++    if (a->l) {
++        gen_helper_v7m_vlldm(cpu_env, fptr);
++    } else {
++        gen_helper_v7m_vlstm(cpu_env, fptr);
++    }
++    tcg_temp_free_i32(fptr);
++
++    /* End the TB, because we have updated FP control bits */
++    s->base.is_jmp = DISAS_UPDATE_EXIT;
++    return true;
++}
++
++static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
++{
++    int btmreg, topreg;
++    TCGv_i64 zero;
++    TCGv_i32 aspen, sfpa;
++
++    if (!dc_isar_feature(aa32_m_sec_state, s)) {
++        /* Before v8.1M, fall through in decode to NOCP check */
++        return false;
++    }
++
++    /* Explicitly UNDEF because this takes precedence over NOCP */
++    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
++        unallocated_encoding(s);
++        return true;
++    }
++
++    if (!dc_isar_feature(aa32_vfp_simd, s)) {
++        /* NOP if we have neither FP nor MVE */
++        return true;
++    }
++
++    /*
++     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
++     * active floating point context so we must NOP (without doing
++     * any lazy state preservation or the NOCP check).
++     */
++    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
++    sfpa = load_cpu_field(v7m.control[M_REG_S]);
++    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
++    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
++    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
++    tcg_gen_or_i32(sfpa, sfpa, aspen);
++    arm_gen_condlabel(s);
++    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
++
++    if (s->fp_excp_el != 0) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), s->fp_excp_el);
++        return true;
++    }
++
++    topreg = a->vd + a->imm - 1;
++    btmreg = a->vd;
++
++    /* Convert to Sreg numbers if the insn specified in Dregs */
++    if (a->size == 3) {
++        topreg = topreg * 2 + 1;
++        btmreg *= 2;
++    }
++
++    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
++        /* UNPREDICTABLE: we choose to undef */
++        unallocated_encoding(s);
++        return true;
++    }
++
++    /* Silently ignore requests to clear D16-D31 if they don't exist */
++    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
++        topreg = 31;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    /* Zero the Sregs from btmreg to topreg inclusive. */
++    zero = tcg_const_i64(0);
++    if (btmreg & 1) {
++        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
++        btmreg++;
++    }
++    for (; btmreg + 1 <= topreg; btmreg += 2) {
++        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
++    }
++    if (btmreg == topreg) {
++        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
++        btmreg++;
++    }
++    assert(btmreg == topreg + 1);
++    /* TODO: when MVE is implemented, zero VPR here */
++    return true;
++}
++
++static bool trans_NOCP(DisasContext *s, arg_nocp *a)
++{
++    /*
++     * Handle M-profile early check for disabled coprocessor:
++     * all we need to do here is emit the NOCP exception if
++     * the coprocessor is disabled. Otherwise we return false
++     * and the real VFP/etc decode will handle the insn.
++     */
++    assert(arm_dc_feature(s, ARM_FEATURE_M));
++
++    if (a->cp == 11) {
++        a->cp = 10;
++    }
++    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
++        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
++        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
++        a->cp = 10;
++    }
++
++    if (a->cp != 10) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), default_exception_el(s));
++        return true;
++    }
++
++    if (s->fp_excp_el != 0) {
++        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                           syn_uncategorized(), s->fp_excp_el);
++        return true;
++    }
++
++    return false;
++}
++
++static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
++{
++    /* This range needs a coprocessor check for v8.1M and later only */
++    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++        return false;
++    }
++    return trans_NOCP(s, a);
++}
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+ #define ARM_CP_RW_BIT   (1 << 20)
+ /* Include the VFP and Neon decoders */
+-#include "decode-m-nocp.c.inc"
+ #include "translate-vfp.c.inc"
+ #include "translate-neon.c.inc"
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c.inc
++++ b/target/arm/translate-vfp.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+     return true;
+ }
+-/*
+- * Decode VLLDM and VLSTM are nonstandard because:
+- *  * if there is no FPU then these insns must NOP in
+- *    Secure state and UNDEF in Nonsecure state
+- *  * if there is an FPU then these insns do not have
+- *    the usual behaviour that vfp_access_check() provides of
+- *    being controlled by CPACR/NSACR enable bits or the
+- *    lazy-stacking logic.
+- */
+-static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+-{
+-    TCGv_i32 fptr;
+-
+-    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+-        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+-        return false;
+-    }
+-
+-    if (a->op) {
+-        /*
+-         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
+-         * to take the IMPDEF option to make memory accesses to the stack
+-         * slots that correspond to the D16-D31 registers (discarding
+-         * read data and writing UNKNOWN values), so for us the T2
+-         * encoding behaves identically to the T1 encoding.
+-         */
+-        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+-            return false;
+-        }
+-    } else {
+-        /*
+-         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
+-         * This is currently architecturally impossible, but we add the
+-         * check to stay in line with the pseudocode. Note that we must
+-         * emit code for the UNDEF so it takes precedence over the NOCP.
+-         */
+-        if (dc_isar_feature(aa32_simd_r32, s)) {
+-            unallocated_encoding(s);
+-            return true;
+-        }
+-    }
+-
+-    /*
+-     * If not secure, UNDEF. We must emit code for this
+-     * rather than returning false so that this takes
+-     * precedence over the m-nocp.decode NOCP fallback.
+-     */
+-    if (!s->v8m_secure) {
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-    /* If no fpu, NOP. */
+-    if (!dc_isar_feature(aa32_vfp, s)) {
+-        return true;
+-    }
+-
+-    fptr = load_reg(s, a->rn);
+-    if (a->l) {
+-        gen_helper_v7m_vlldm(cpu_env, fptr);
+-    } else {
+-        gen_helper_v7m_vlstm(cpu_env, fptr);
+-    }
+-    tcg_temp_free_i32(fptr);
+-
+-    /* End the TB, because we have updated FP control bits */
+-    s->base.is_jmp = DISAS_UPDATE_EXIT;
+-    return true;
+-}
+-
+-static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+-{
+-    int btmreg, topreg;
+-    TCGv_i64 zero;
+-    TCGv_i32 aspen, sfpa;
+-
+-    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+-        /* Before v8.1M, fall through in decode to NOCP check */
+-        return false;
+-    }
+-
+-    /* Explicitly UNDEF because this takes precedence over NOCP */
+-    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-
+-    if (!dc_isar_feature(aa32_vfp_simd, s)) {
+-        /* NOP if we have neither FP nor MVE */
+-        return true;
+-    }
+-
+-    /*
+-     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
+-     * active floating point context so we must NOP (without doing
+-     * any lazy state preservation or the NOCP check).
+-     */
+-    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
+-    sfpa = load_cpu_field(v7m.control[M_REG_S]);
+-    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+-    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+-    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
+-    tcg_gen_or_i32(sfpa, sfpa, aspen);
+-    arm_gen_condlabel(s);
+-    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+-
+-    if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
+-        return true;
+-    }
+-
+-    topreg = a->vd + a->imm - 1;
+-    btmreg = a->vd;
+-
+-    /* Convert to Sreg numbers if the insn specified in Dregs */
+-    if (a->size == 3) {
+-        topreg = topreg * 2 + 1;
+-        btmreg *= 2;
+-    }
+-
+-    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
+-        /* UNPREDICTABLE: we choose to undef */
+-        unallocated_encoding(s);
+-        return true;
+-    }
+-
+-    /* Silently ignore requests to clear D16-D31 if they don't exist */
+-    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
+-        topreg = 31;
+-    }
+-
+-    if (!vfp_access_check(s)) {
+-        return true;
+-    }
+-
+-    /* Zero the Sregs from btmreg to topreg inclusive. */
+-    zero = tcg_const_i64(0);
+-    if (btmreg & 1) {
+-        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
+-        btmreg++;
+-    }
+-    for (; btmreg + 1 <= topreg; btmreg += 2) {
+-        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
+-    }
+-    if (btmreg == topreg) {
+-        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
+-        btmreg++;
+-    }
+-    assert(btmreg == topreg + 1);
+-    /* TODO: when MVE is implemented, zero VPR here */
+-    return true;
+-}
+-
+-static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+-{
+-    /*
+-     * Handle M-profile early check for disabled coprocessor:
+-     * all we need to do here is emit the NOCP exception if
+-     * the coprocessor is disabled. Otherwise we return false
+-     * and the real VFP/etc decode will handle the insn.
+-     */
+-    assert(arm_dc_feature(s, ARM_FEATURE_M));
+-
+-    if (a->cp == 11) {
+-        a->cp = 10;
+-    }
+-    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
+-        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
+-        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
+-        a->cp = 10;
+-    }
+-
+-    if (a->cp != 10) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), default_exception_el(s));
+-        return true;
+-    }
+-
+-    if (s->fp_excp_el != 0) {
+-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                           syn_uncategorized(), s->fp_excp_el);
+-        return true;
+-    }
+-
+-    return false;
+-}
+-
+-static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
+-{
+-    /* This range needs a coprocessor check for v8.1M and later only */
+-    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+-        return false;
+-    }
+-    return trans_NOCP(s, a);
+-}
+-
+ static bool trans_VINS(DisasContext *s, arg_VINS *a)
+ {
+     TCGv_i32 rd, rm;
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ gen = [
+   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
+   decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
+   decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
+-  decodetree.process('m-nocp.decode', extra_args: '--static-decode=disas_m_nocp'),
++  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
+   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
+   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
+   decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
+   'op_helper.c',
+   'tlb_helper.c',
+   'translate.c',
++  'translate-m-nocp.c',
+   'vec_helper.c',
+   'vfp_helper.c',
+   'cpu_tcg.c',
+--
+.20.1

-New patch
+[PULL 08/26] target/arm: Move gen_aa32 functions to translate-a32.h
+Move the various gen_aa32* functions and macros out of translate.c
+and into translate-a32.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-6-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h | 53 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate.c     | 51 ++++++++++++------------------------
+files changed, 69 insertions(+), 35 deletions(-)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
+     return tmp;
+ }
++void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
++                              TCGv_i32 a32, int index, MemOp opc);
++void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
++                              TCGv_i32 a32, int index, MemOp opc);
++void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
++                              TCGv_i32 a32, int index, MemOp opc);
++void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
++                              TCGv_i32 a32, int index, MemOp opc);
++void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
++                     int index, MemOp opc);
++void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
++                     int index, MemOp opc);
++void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
++                     int index, MemOp opc);
++void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
++                     int index, MemOp opc);
++
++#define DO_GEN_LD(SUFF, OPC)                                            \
++    static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
++                                         TCGv_i32 a32, int index)       \
++    {                                                                   \
++        gen_aa32_ld_i32(s, val, a32, index, OPC);                       \
++    }
++
++#define DO_GEN_ST(SUFF, OPC)                                            \
++    static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val, \
++                                         TCGv_i32 a32, int index)       \
++    {                                                                   \
++        gen_aa32_st_i32(s, val, a32, index, OPC);                       \
++    }
++
++static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
++                                 TCGv_i32 a32, int index)
++{
++    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
++}
++
++static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
++                                 TCGv_i32 a32, int index)
++{
++    gen_aa32_st_i64(s, val, a32, index, MO_Q);
++}
++
++DO_GEN_LD(8u, MO_UB)
++DO_GEN_LD(16u, MO_UW)
++DO_GEN_LD(32u, MO_UL)
++DO_GEN_ST(8, MO_UB)
++DO_GEN_ST(16, MO_UW)
++DO_GEN_ST(32, MO_UL)
++
++#undef DO_GEN_LD
++#undef DO_GEN_ST
++
+ #endif
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
+  * Internal routines are used for NEON cases where the endianness
+  * and/or alignment has already been taken into account and manipulated.
+  */
+-static void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+-                                     TCGv_i32 a32, int index, MemOp opc)
++void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
++                              TCGv_i32 a32, int index, MemOp opc)
+ {
+     TCGv addr = gen_aa32_addr(s, a32, opc);
+     tcg_gen_qemu_ld_i32(val, addr, index, opc);
+     tcg_temp_free(addr);
+ }
+-static void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+-                                     TCGv_i32 a32, int index, MemOp opc)
++void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
++                              TCGv_i32 a32, int index, MemOp opc)
+ {
+     TCGv addr = gen_aa32_addr(s, a32, opc);
+     tcg_gen_qemu_st_i32(val, addr, index, opc);
+     tcg_temp_free(addr);
+ }
+-static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+-                                     TCGv_i32 a32, int index, MemOp opc)
++void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
++                              TCGv_i32 a32, int index, MemOp opc)
+ {
+     TCGv addr = gen_aa32_addr(s, a32, opc);
+@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+     tcg_temp_free(addr);
+ }
+-static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+-                                     TCGv_i32 a32, int index, MemOp opc)
++void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
++                              TCGv_i32 a32, int index, MemOp opc)
+ {
+     TCGv addr = gen_aa32_addr(s, a32, opc);
+@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+     tcg_temp_free(addr);
+ }
+-static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+-                            int index, MemOp opc)
++void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
++                     int index, MemOp opc)
+ {
+     gen_aa32_ld_internal_i32(s, val, a32, index, finalize_memop(s, opc));
+ }
+-static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+-                            int index, MemOp opc)
++void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
++                     int index, MemOp opc)
+ {
+     gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
+ }
+-static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+-                            int index, MemOp opc)
++void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
++                     int index, MemOp opc)
+ {
+     gen_aa32_ld_internal_i64(s, val, a32, index, finalize_memop(s, opc));
+ }
+-static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+-                            int index, MemOp opc)
++void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
++                     int index, MemOp opc)
+ {
+     gen_aa32_st_internal_i64(s, val, a32, index, finalize_memop(s, opc));
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+         gen_aa32_st_i32(s, val, a32, index, OPC);                       \
+     }
+-static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
+-                                 TCGv_i32 a32, int index)
+-{
+-    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
+-}
+-
+-static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
+-                                 TCGv_i32 a32, int index)
+-{
+-    gen_aa32_st_i64(s, val, a32, index, MO_Q);
+-}
+-
+-DO_GEN_LD(8u, MO_UB)
+-DO_GEN_LD(16u, MO_UW)
+-DO_GEN_LD(32u, MO_UL)
+-DO_GEN_ST(8, MO_UB)
+-DO_GEN_ST(16, MO_UW)
+-DO_GEN_ST(32, MO_UL)
+-
+ static inline void gen_hvc(DisasContext *s, int imm16)
+ {
+     /* The pre HVC helper handles cases when HVC gets trapped
+--
+.20.1

-New patch
+[PULL 09/26] target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
+The functions vfp_load_reg32(), vfp_load_reg64(), vfp_store_reg32()
+and vfp_store_reg64() are used only in translate-vfp.c.inc. Move
+them to that file.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-7-peter.maydell@linaro.org
+---
+ target/arm/translate.c         | 20 --------------------
+ target/arm/translate-vfp.c.inc | 20 ++++++++++++++++++++
+files changed, 20 insertions(+), 20 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static long vfp_reg_offset(bool dp, unsigned reg)
+     }
+ }
+-static inline void vfp_load_reg64(TCGv_i64 var, int reg)
+-{
+-    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
+-}
+-
+-static inline void vfp_store_reg64(TCGv_i64 var, int reg)
+-{
+-    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
+-}
+-
+-static inline void vfp_load_reg32(TCGv_i32 var, int reg)
+-{
+-    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
+-}
+-
+-static inline void vfp_store_reg32(TCGv_i32 var, int reg)
+-{
+-    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
+-}
+-
+ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
+ {
+     long off = neon_element_offset(reg, ele, memop);
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.c.inc
++++ b/target/arm/translate-vfp.c.inc
+@@ -XXX,XX +XXX,XX @@
+ #include "decode-vfp.c.inc"
+ #include "decode-vfp-uncond.c.inc"
++static inline void vfp_load_reg64(TCGv_i64 var, int reg)
++{
++    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
++}
++
++static inline void vfp_store_reg64(TCGv_i64 var, int reg)
++{
++    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
++}
++
++static inline void vfp_load_reg32(TCGv_i32 var, int reg)
++{
++    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
++}
++
++static inline void vfp_store_reg32(TCGv_i32 var, int reg)
++{
++    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
++}
++
+ /*
+  * The imm8 encodes the sign bit, enough bits to represent an exponent in
+  * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+--
+.20.1

-New patch
+[PULL 10/26] target/arm: Make functions used by translate-vfp global
+Make the remaining functions which are needed by translate-vfp.c.inc
+global.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-8-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h | 18 ++++++++++++++++++
+ target/arm/translate.c     | 25 ++++++++-----------------
+files changed, 26 insertions(+), 17 deletions(-)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
+ void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
+ void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
+ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
++TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs);
++void gen_set_cpsr(TCGv_i32 var, uint32_t mask);
++void gen_set_condexec(DisasContext *s);
++void gen_set_pc_im(DisasContext *s, target_ulong val);
++void gen_lookup_tb(DisasContext *s);
++long vfp_reg_offset(bool dp, unsigned reg);
++long neon_full_reg_offset(unsigned reg);
+ static inline TCGv_i32 load_cpu_offset(int offset)
+ {
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
+     return tmp;
+ }
++void store_reg(DisasContext *s, int reg, TCGv_i32 var);
++
+ void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                               TCGv_i32 a32, int index, MemOp opc);
+ void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
+ #undef DO_GEN_LD
+ #undef DO_GEN_ST
++#if defined(CONFIG_USER_ONLY)
++#define IS_USER(s) 1
++#else
++#define IS_USER(s) (s->user)
++#endif
++
++/* Set NZCV flags from the high 4 bits of var.  */
++#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
++
+ #endif
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "translate.h"
+ #include "translate-a32.h"
+-#if defined(CONFIG_USER_ONLY)
+-#define IS_USER(s) 1
+-#else
+-#define IS_USER(s) (s->user)
+-#endif
+-
+ /* These are TCG temporaries used only by the legacy iwMMXt decoder */
+ static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
+ /* These are TCG globals which alias CPUARMState fields */
+@@ -XXX,XX +XXX,XX @@ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
+  * This is used for load/store for which use of PC implies (literal),
+  * or ADD that implies ADR.
+  */
+-static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
++TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+ /* Set a CPU register.  The source must be a temporary and will be
+    marked as dead.  */
+-static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
++void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+ {
+     if (reg == 15) {
+         /* In Thumb mode, we must ignore bit 0.
+@@ -XXX,XX +XXX,XX @@ static void store_sp_checked(DisasContext *s, TCGv_i32 var)
+ #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
+ #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
+-
+-static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
++void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
+ {
+     TCGv_i32 tmp_mask = tcg_const_i32(mask);
+     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
+     tcg_temp_free_i32(tmp_mask);
+ }
+-/* Set NZCV flags from the high 4 bits of var.  */
+-#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
+ static void gen_exception_internal(int excp)
+ {
+@@ -XXX,XX +XXX,XX @@ void arm_gen_test_cc(int cc, TCGLabel *label)
+     arm_free_cc(&cmp);
+ }
+-static inline void gen_set_condexec(DisasContext *s)
++void gen_set_condexec(DisasContext *s)
+ {
+     if (s->condexec_mask) {
+         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
+@@ -XXX,XX +XXX,XX @@ static inline void gen_set_condexec(DisasContext *s)
+     }
+ }
+-static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
++void gen_set_pc_im(DisasContext *s, target_ulong val)
+ {
+     tcg_gen_movi_i32(cpu_R[15], val);
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
+ }
+ /* Force a TB lookup after an instruction that changes the CPU state.  */
+-static inline void gen_lookup_tb(DisasContext *s)
++void gen_lookup_tb(DisasContext *s)
+ {
+     tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
+     s->base.is_jmp = DISAS_EXIT;
+@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
+ /*
+  * Return the offset of a "full" NEON Dreg.
+  */
+-static long neon_full_reg_offset(unsigned reg)
++long neon_full_reg_offset(unsigned reg)
+ {
+     return offsetof(CPUARMState, vfp.zregs[reg >> 1].d[reg & 1]);
+ }
+@@ -XXX,XX +XXX,XX @@ static long neon_element_offset(int reg, int element, MemOp memop)
+ }
+ /* Return the offset of a VFP Dreg (dp = true) or VFP Sreg (dp = false). */
+-static long vfp_reg_offset(bool dp, unsigned reg)
++long vfp_reg_offset(bool dp, unsigned reg)
+ {
+     if (dp) {
+         return neon_element_offset(reg, 0, MO_64);
+--
+.20.1

-[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
+[PULL 11/26] target/arm: Make translate-vfp.c.inc its own compilation unit
-In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
+Switch translate-vfp.c.inc from being #included into translate.c
-and mouse emulation. However we didn't remove all the debug-by-printf
+to being its own compilation unit.
 support. In fact there is only one printf() remaining, and it is
 redundant with the trace_ps2_write_mouse() event next to it.
 Remove the printf() and the now-unused DEBUG* macros.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
+Message-id: 20210430132740.10391-9-peter.maydell@linaro.org
 ---
- hw/input/ps2.c | 9 ---------
+ target/arm/translate-a32.h                          |  2 ++
-file changed, 9 deletions(-)
+ target/arm/{translate-vfp.c.inc => translate-vfp.c} | 12 +++++++-----
  target/arm/translate.c                              |  3 +--
  target/arm/meson.build                              |  5 +++--
 files changed, 13 insertions(+), 9 deletions(-)
  rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (99%)
-diff --git a/hw/input/ps2.c b/hw/input/ps2.c
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/input/ps2.c
+--- a/target/arm/translate-a32.h
-+++ b/hw/input/ps2.c
++++ b/target/arm/translate-a32.h
 @@ -XXX,XX +XXX,XX @@
- #include "trace.h"
+ /* Prototypes for autogenerated disassembler functions */
+ bool disas_m_nocp(DisasContext *dc, uint32_t insn);
--/* debug PC keyboard */
++bool disas_vfp(DisasContext *s, uint32_t insn);
--//#define DEBUG_KBD
++bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
--
--/* debug PC keyboard : only mouse */
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
--//#define DEBUG_MOUSE
+ void arm_gen_condlabel(DisasContext *s);
--
+diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c
- /* Keyboard Commands */
+similarity index 99%
- #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
+rename from target/arm/translate-vfp.c.inc
- #define KBD_CMD_ECHO         0xEE
+rename to target/arm/translate-vfp.c
-@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
+index XXXXXXX..XXXXXXX 100644
-     PS2MouseState *s = (PS2MouseState *)opaque;
+--- a/target/arm/translate-vfp.c.inc
++++ b/target/arm/translate-vfp.c
-     trace_ps2_write_mouse(opaque, val);
+@@ -XXX,XX +XXX,XX @@
--#ifdef DEBUG_MOUSE
+  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
--    printf("kbd: write mouse 0x%02x\n", val);
+  */
--#endif
-     switch(s->common.write_cmd) {
+-/*
-     default:
+- * This file is intended to be included from translate.c; it uses
-     case -1:
+- * some macros and definitions provided by that file.
 - * It might be possible to convert it to a standalone .c file eventually.
 - */
 +#include "qemu/osdep.h"
 +#include "tcg/tcg-op.h"
 +#include "tcg/tcg-op-gvec.h"
 +#include "exec/exec-all.h"
 +#include "exec/gen-icount.h"
 +#include "translate.h"
 +#include "translate-a32.h"
  /* Include the generated VFP decoder */
  #include "decode-vfp.c.inc"
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
  #define ARM_CP_RW_BIT   (1 << 20)
 -/* Include the VFP and Neon decoders */
 -#include "translate-vfp.c.inc"
 +/* Include the Neon decoder */
  #include "translate-neon.c.inc"
  static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
    decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
    decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
    decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
 -  decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
 -  decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
 +  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
 +  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
    decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
    decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
    decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'tlb_helper.c',
    'translate.c',
    'translate-m-nocp.c',
 +  'translate-vfp.c',
    'vec_helper.c',
    'vfp_helper.c',
    'cpu_tcg.c',
 --
 .20.1

-New patch
+[PULL 12/26] target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
+The function vfp_reg_ptr() is used only in translate-neon.c.inc;
+move it there.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-10-peter.maydell@linaro.org
+---
+ target/arm/translate.c          | 7 -------
+ target/arm/translate-neon.c.inc | 7 +++++++
+files changed, 7 insertions(+), 7 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
+     }
+ }
+-static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+-{
+-    TCGv_ptr ret = tcg_temp_new_ptr();
+-    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
+-    return ret;
+-}
+-
+ #define ARM_CP_RW_BIT   (1 << 20)
+ /* Include the Neon decoder */
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.c.inc
++++ b/target/arm/translate-neon.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline int neon_3same_fp_size(DisasContext *s, int x)
+ #include "decode-neon-ls.c.inc"
+ #include "decode-neon-shared.c.inc"
++static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
++{
++    TCGv_ptr ret = tcg_temp_new_ptr();
++    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
++    return ret;
++}
++
+ static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
+ {
+     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
+--
+.20.1

-New patch
+[PULL 13/26] target/arm: Delete unused typedef
+The VFPGenFixPointFn typedef is unused; delete it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210430132740.10391-11-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 2 --
+file changed, 2 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+ /* Function prototypes for gen_ functions calling Neon helpers.  */
+ typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                  TCGv_i32, TCGv_i32);
+-/* Function prototypes for gen_ functions for fix point conversions */
+-typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+--
+.20.1

-New patch
+[PULL 14/26] target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
+Move the NeonGenThreeOpEnvFn typedef to translate.h together
+with the other similar typedefs.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210430132740.10391-12-peter.maydell@linaro.org
+---
+ target/arm/translate.h | 2 ++
+ target/arm/translate.c | 3 ---
+files changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i32, TCGv_i32);
+ typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
+ typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
+ typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
++typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
++                                 TCGv_i32, TCGv_i32);
+ typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
+ typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
+ typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
+-/* Function prototypes for gen_ functions calling Neon helpers.  */
+-typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+-                                 TCGv_i32, TCGv_i32);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+--
+.20.1

-New patch
+[PULL 15/26] target/arm: Make functions used by translate-neon global
+Make the remaining functions needed by the translate-neon code
+global.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-13-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h |  8 ++++++++
+ target/arm/translate.c     | 10 ++--------
+files changed, 10 insertions(+), 8 deletions(-)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@ void gen_set_pc_im(DisasContext *s, target_ulong val);
+ void gen_lookup_tb(DisasContext *s);
+ long vfp_reg_offset(bool dp, unsigned reg);
+ long neon_full_reg_offset(unsigned reg);
++long neon_element_offset(int reg, int element, MemOp memop);
++void gen_rev16(TCGv_i32 dest, TCGv_i32 var);
+ static inline TCGv_i32 load_cpu_offset(int offset)
+ {
+@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
+ /* Set NZCV flags from the high 4 bits of var.  */
+ #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
++/* Swap low and high halfwords.  */
++static inline void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
++{
++    tcg_gen_rotri_i32(dest, var, 16);
++}
++
+ #endif
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
+ }
+ /* Byteswap each halfword.  */
+-static void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
++void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+     TCGv_i32 mask = tcg_const_i32(0x00ff00ff);
+@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
+     tcg_gen_ext16s_i32(dest, var);
+ }
+-/* Swap low and high halfwords.  */
+-static void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
+-{
+-    tcg_gen_rotri_i32(dest, var, 16);
+-}
+-
+ /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
+     tmp = (t0 ^ t1) & 0x8000;
+     t0 &= ~0x8000;
+@@ -XXX,XX +XXX,XX @@ long neon_full_reg_offset(unsigned reg)
+  * Return the offset of a 2**SIZE piece of a NEON register, at index ELE,
+  * where 0 is the least significant end of the register.
+  */
+-static long neon_element_offset(int reg, int element, MemOp memop)
++long neon_element_offset(int reg, int element, MemOp memop)
+ {
+     int element_size = 1 << (memop & MO_SIZE);
+     int ofs = element * element_size;
+--
+.20.1

-New patch
+[PULL 16/26] target/arm: Make translate-neon.c.inc its own compilation unit
+Switch translate-neon.c.inc from being #included into translate.c
+to being its own compilation unit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430132740.10391-14-peter.maydell@linaro.org
+---
+ target/arm/translate-a32.h                           |  3 +++
+ .../arm/{translate-neon.c.inc => translate-neon.c}   | 12 +++++++-----
+ target/arm/translate.c                               |  3 ---
+ target/arm/meson.build                               |  7 ++++---
+files changed, 14 insertions(+), 11 deletions(-)
+ rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
+diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a32.h
++++ b/target/arm/translate-a32.h
+@@ -XXX,XX +XXX,XX @@
+ bool disas_m_nocp(DisasContext *dc, uint32_t insn);
+ bool disas_vfp(DisasContext *s, uint32_t insn);
+ bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
++bool disas_neon_dp(DisasContext *s, uint32_t insn);
++bool disas_neon_ls(DisasContext *s, uint32_t insn);
++bool disas_neon_shared(DisasContext *s, uint32_t insn);
+ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
+ void arm_gen_condlabel(DisasContext *s);
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c
+similarity index 99%
+rename from target/arm/translate-neon.c.inc
+rename to target/arm/translate-neon.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.c.inc
++++ b/target/arm/translate-neon.c
+@@ -XXX,XX +XXX,XX @@
+  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+  */
+-/*
+- * This file is intended to be included from translate.c; it uses
+- * some macros and definitions provided by that file.
+- * It might be possible to convert it to a standalone .c file eventually.
+- */
++#include "qemu/osdep.h"
++#include "tcg/tcg-op.h"
++#include "tcg/tcg-op-gvec.h"
++#include "exec/exec-all.h"
++#include "exec/gen-icount.h"
++#include "translate.h"
++#include "translate-a32.h"
+ static inline int plus1(DisasContext *s, int x)
+ {
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
+ #define ARM_CP_RW_BIT   (1 << 20)
+-/* Include the Neon decoder */
+-#include "translate-neon.c.inc"
+-
+ static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
+ {
+     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@
+ gen = [
+   decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
+-  decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
+-  decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
+-  decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
++  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
++  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
++  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
+   decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
+   decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
+   decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
+   'tlb_helper.c',
+   'translate.c',
+   'translate-m-nocp.c',
++  'translate-neon.c',
+   'translate-vfp.c',
+   'vec_helper.c',
+   'vfp_helper.c',
+--
+.20.1

-New patch
+[PULL 17/26] target/arm: Make WFI a NOP for userspace emulators
+The WFI insn is not system-mode only, though it doesn't usually make
+a huge amount of sense for userspace code to execute it.  Currently
+if you try it in qemu-arm then the helper function will raise an
+EXCP_HLT exception, which is not covered by the switch in cpu_loop()
+and results in an abort:
+qemu: unhandled CPU exception 0x10001 - aborting
+R00=00000001 R01=408003e4 R02=408003ec R03=000102ec
+R04=00010a28 R05=00010158 R06=00087460 R07=00010158
+R08=00000000 R09=00000000 R10=00085b7c R11=408002a4
+R12=408002b8 R13=408002a0 R14=0001057c R15=000102f8
+PSR=60000010 -ZC- A usr32
+qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fcbfa4f0a12
+Make the WFI helper function return immediately in the usermode
+emulator. This turns WFI into a NOP, which is OK because:
+ * architecturally "WFI is a NOP" is a permitted implementation
+ * aarch64 Linux kernels use the SCTLR_EL1.nTWI bit to trap
+   userspace WFI and NOP it (though aarch32 kernels currently
+   just let WFI do whatever it would do)
+We could in theory make the translate.c code special case user-mode
+emulation and NOP the insn entirely rather than making the helper
+do nothing, but because no real world code will be trying to
+execute WFI we don't care about efficiency and the helper provides
+a single place where we can make the change rather than having
+to touch multiple places in translate.c and translate-a64.c.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1926759
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210430162212.825-1-peter.maydell@linaro.org
+---
+ target/arm/op_helper.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
+ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+ {
++#ifdef CONFIG_USER_ONLY
++    /*
++     * WFI in the user-mode emulator is technically permitted but not
++     * something any real-world code would do. AArch64 Linux kernels
++     * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP;
++     * AArch32 kernels don't trap it so it will delay a bit.
++     * For QEMU, make it NOP here, because trying to raise EXCP_HLT
++     * would trigger an abort.
++     */
++    return;
++#else
+     CPUState *cs = env_cpu(env);
+     int target_el = check_wfx_trap(env, false);
+@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+     cs->exception_index = EXCP_HLT;
+     cs->halted = 1;
+     cpu_loop_exit(cs);
++#endif
+ }
+ void HELPER(wfe)(CPUARMState *env)
+--
+.20.1

-New patch
+[PULL 18/26] hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
+The omap_mmc_reset() function resets its SD card via
+device_legacy_reset().  We know that the SD card does not have a qbus
+of its own, so the new device_cold_reset() function (which resets
+both the device and its child buses) is equivalent here to
+device_legacy_reset() and we can just switch to the new API.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210430222348.8514-1-peter.maydell@linaro.org
+---
+ hw/sd/omap_mmc.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/omap_mmc.c
++++ b/hw/sd/omap_mmc.c
+@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
+      * into any bus, and we must reset it manually. When omap_mmc is
+      * QOMified this must move into the QOM reset function.
+      */
+-    device_legacy_reset(DEVICE(host->card));
++    device_cold_reset(DEVICE(host->card));
+ }
+ static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
+--
+.20.1

-[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
+[PULL 19/26] osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
-In the mtspr helper we attempt to check for "is the timer disabled"
+Both os-win32.h and os-posix.h include system header files. Instead
-with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
+of having osdep.h include them inside its 'extern "C"' block, make
-is zero and the condition is always false (Coverity complains about
+these headers handle that themselves, so that we don't include the
-the dead code.)
+system headers inside 'extern "C"'.
-The correct check would be to test whether the TTMR_M field in the
+This doesn't fix any current problems, but it's conceptually the
-register is equal to TIMER_NONE instead.  However, the
+right way to handle system headers.
 cpu_openrisc_timer_update() function checks whether the timer is
 enabled (it looks at cpu->env.is_counting, which is set to 0 via
 cpu_openrisc_count_stop() when the TTMR_M field is set to
 TIMER_NONE), so there's no need to check for "timer disabled" in the
 target/openrisc code.  Instead, simply remove the dead code.
-Fixes: Coverity CID 1005812
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Stafford Horne <shorne@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
 ---
- target/openrisc/sys_helper.c | 3 ---
+ include/qemu/osdep.h      | 8 ++++----
-file changed, 3 deletions(-)
+ include/sysemu/os-posix.h | 8 ++++++++
  include/sysemu/os-win32.h | 8 ++++++++
 files changed, 20 insertions(+), 4 deletions(-)
-diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
+diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/sys_helper.c
+--- a/include/qemu/osdep.h
-+++ b/target/openrisc/sys_helper.c
++++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
+@@ -XXX,XX +XXX,XX @@ QEMU_EXTERN_C int daemon(int, int);
+  */
-     case TO_SPR(10, 1): /* TTCR */
+ #include "glib-compat.h"
-         cpu_openrisc_count_set(cpu, rb);
--        if (env->ttmr & TIMER_NONE) {
+-#ifdef __cplusplus
--            return;
+-extern "C" {
--        }
+-#endif
-         cpu_openrisc_timer_update(cpu);
+-
-         break;
+ #ifdef _WIN32
  #include "sysemu/os-win32.h"
  #endif
@@ -XXX,XX +XXX,XX @@ extern "C" {
  #include "sysemu/os-posix.h"
  #endif
 +#ifdef __cplusplus
 +extern "C" {
 +#endif
 +
  #include "qemu/typedefs.h"
  /*
 diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/os-posix.h
 +++ b/include/sysemu/os-posix.h
@@ -XXX,XX +XXX,XX @@
  #include <sys/sysmacros.h>
  #endif
 +#ifdef __cplusplus
 +extern "C" {
 +#endif
 +
  void os_set_line_buffering(void);
  void os_set_proc_name(const char *s);
  void os_setup_signal_handling(void);
@@ -XXX,XX +XXX,XX @@ static inline void qemu_funlockfile(FILE *f)
      funlockfile(f);
  }
 +#ifdef __cplusplus
 +}
 +#endif
 +
  #endif
 diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/os-win32.h
 +++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@
  #include <windows.h>
  #include <ws2tcpip.h>
 +#ifdef __cplusplus
 +extern "C" {
 +#endif
 +
  #if defined(_WIN64)
  /* On w64, setjmp is implemented by _setjmp which needs a second parameter.
   * If this parameter is NULL, longjump does no stack unwinding.
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_recv_wrap(int sockfd, void *buf, size_t len, int flags);
  ssize_t qemu_recvfrom_wrap(int sockfd, void *buf, size_t len, int flags,
                             struct sockaddr *addr, socklen_t *addrlen);
 +#ifdef __cplusplus
 +}
 +#endif
 +
  #endif
 --
 .20.1

-New patch
+[PULL 20/26] include/qemu/bswap.h: Handle being included outside extern "C" block
+Make bswap.h handle being included outside an 'extern "C"' block:
+all system headers are included first, then all declarations are
+put inside an 'extern "C"' block.
+This requires a little rearrangement as currently we have an ifdef
+ladder that has some system includes and some local declarations
+or definitions, and we need to separate those out.
+We want to do this because dis-asm.h includes bswap.h, dis-asm.h
+may need to be included from C++ files, and system headers should
+not be included within 'extern "C"' blocks.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/qemu/bswap.h | 26 ++++++++++++++++++++++----
+file changed, 22 insertions(+), 4 deletions(-)
+diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/bswap.h
++++ b/include/qemu/bswap.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BSWAP_H
+ #define BSWAP_H
+-#include "fpu/softfloat-types.h"
+-
+ #ifdef CONFIG_MACHINE_BSWAP_H
+ # include <sys/endian.h>
+ # include <machine/bswap.h>
+@@ -XXX,XX +XXX,XX @@
+ # include <endian.h>
+ #elif defined(CONFIG_BYTESWAP_H)
+ # include <byteswap.h>
++#define BSWAP_FROM_BYTESWAP
++# else
++#define BSWAP_FROM_FALLBACKS
++#endif /* ! CONFIG_MACHINE_BSWAP_H */
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "fpu/softfloat-types.h"
++
++#ifdef BSWAP_FROM_BYTESWAP
+ static inline uint16_t bswap16(uint16_t x)
+ {
+     return bswap_16(x);
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
+ {
+     return bswap_64(x);
+ }
+-# else
++#endif
++
++#ifdef BSWAP_FROM_FALLBACKS
+ static inline uint16_t bswap16(uint16_t x)
+ {
+     return (((x & 0x00ff) << 8) |
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
+             ((x & 0x00ff000000000000ULL) >> 40) |
+             ((x & 0xff00000000000000ULL) >> 56));
+ }
+-#endif /* ! CONFIG_MACHINE_BSWAP_H */
++#endif
++
++#undef BSWAP_FROM_BYTESWAP
++#undef BSWAP_FROM_FALLBACKS
+ static inline void bswap16s(uint16_t *s)
+ {
+@@ -XXX,XX +XXX,XX @@ DO_STN_LDN_P(be)
+ #undef le_bswaps
+ #undef be_bswaps
++#ifdef __cplusplus
++}
++#endif
++
+ #endif /* BSWAP_H */
+--
+.20.1

-New patch
+[PULL 21/26] include/disas/dis-asm.h: Handle being included outside 'extern "C"'
+Make dis-asm.h handle being included outside an 'extern "C"' block;
+this allows us to remove the 'extern "C"' blocks that our two C++
+files that include it are using.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/disas/dis-asm.h | 12 ++++++++++--
+ disas/arm-a64.cc        |  2 --
+ disas/nanomips.cpp      |  2 --
+files changed, 10 insertions(+), 6 deletions(-)
+diff --git a/include/disas/dis-asm.h b/include/disas/dis-asm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/disas/dis-asm.h
++++ b/include/disas/dis-asm.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef DISAS_DIS_ASM_H
+ #define DISAS_DIS_ASM_H
++#include "qemu/bswap.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
+ typedef void *PTR;
+ typedef uint64_t bfd_vma;
+ typedef int64_t bfd_signed_vma;
+@@ -XXX,XX +XXX,XX @@ bool cap_disas_plugin(disassemble_info *info, uint64_t pc, size_t size);
+ /* from libbfd */
+-#include "qemu/bswap.h"
+-
+ static inline bfd_vma bfd_getl64(const bfd_byte *addr)
+ {
+     return ldq_le_p(addr);
+@@ -XXX,XX +XXX,XX @@ static inline bfd_vma bfd_getb16(const bfd_byte *addr)
+ typedef bool bfd_boolean;
++#ifdef __cplusplus
++}
++#endif
++
+ #endif /* DISAS_DIS_ASM_H */
+diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/arm-a64.cc
++++ b/disas/arm-a64.cc
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+-extern "C" {
+ #include "disas/dis-asm.h"
+-}
+ #include "vixl/a64/disasm-a64.h"
+diff --git a/disas/nanomips.cpp b/disas/nanomips.cpp
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/nanomips.cpp
++++ b/disas/nanomips.cpp
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+-extern "C" {
+ #include "disas/dis-asm.h"
+-}
+ #include <cstring>
+ #include <stdexcept>
+--
+.20.1

-[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
+[PULL 22/26] hw/arm/imx25_pdk: Fix error message for invalid RAM size
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
+The i.MX25 PDK board has 2 banks for SDRAM, each can
 address up to 256 MiB. So the total RAM usable for this
 board is 512M. When we ask for more we get a misleading
 error message:
->>> Overrunning array "suffixes" of 7 8-byte elements at element
+  $ qemu-system-arm -M imx25-pdk -m 513M
-    index 7 (byte offset 63) using index "idx" (which evaluates to 7).
+  qemu-system-arm: Invalid RAM size, should be 128 MiB
-Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
+Update the error message to better match the reality:
 which is ~18.446 EHz, less than 1000 EHz.
-Reported-by: Eduardo Habkost <ehabkost@redhat.com>
+  $ qemu-system-arm -M imx25-pdk -m 513M
   qemu-system-arm: RAM size more than 512 MiB is not supported
 Fixes: bf350daae02 ("arm/imx25_pdk: drop RAM size fixup")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+Message-id: 20210407225608.1882855-1-f4bug@amsat.org
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/cutils.c | 3 ++-
+ hw/arm/imx25_pdk.c | 5 ++---
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/util/cutils.c b/util/cutils.c
+diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/cutils.c
+--- a/hw/arm/imx25_pdk.c
-+++ b/util/cutils.c
++++ b/hw/arm/imx25_pdk.c
-@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info imx25_pdk_binfo;
-     double freq = freq_hz;
-     size_t idx = 0;
+ static void imx25_pdk_init(MachineState *machine)
+ {
--    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-+    while (freq >= 1000.0) {
+     IMX25PDK *s = g_new0(IMX25PDK, 1);
-         freq /= 1000.0;
+     unsigned int ram_size;
-         idx++;
+     unsigned int alias_offset;
@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
      /* We need to initialize our memory */
      if (machine->ram_size > (FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE)) {
 -        char *sz = size_to_str(mc->default_ram_size);
 -        error_report("Invalid RAM size, should be %s", sz);
 +        char *sz = size_to_str(FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE);
 +        error_report("RAM size more than %s is not supported", sz);
          g_free(sz);
          exit(EXIT_FAILURE);
      }
-+    assert(idx < ARRAY_SIZE(suffixes));
-     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
- }
 --
 .20.1

-[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
+[PULL 23/26] hw/misc/mps2-scc: Add "QEMU interface" comment
-The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
+The MPS2 SCC device doesn't have any documentation of its properties;
-power-up reset values for the T_low and T_high registers are 80 degrees C
+add a "QEMU interface" format comment describing them.
 and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
 values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
 We were resetting these registers to zero, which is problematic for Linux
 guests which enable the alert interrupt and then immediately take an
 unexpected overtemperature alert because the current temperature is above
 freezing...
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
+Message-id: 20210504120912.23094-2-peter.maydell@linaro.org
 ---
- hw/misc/tmp105.c | 3 +++
+ include/hw/misc/mps2-scc.h | 12 ++++++++++++
-file changed, 3 insertions(+)
+file changed, 12 insertions(+)
-diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
+diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.c
+--- a/include/hw/misc/mps2-scc.h
-+++ b/hw/misc/tmp105.c
++++ b/include/hw/misc/mps2-scc.h
-@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
+@@ -XXX,XX +XXX,XX @@
-     s->faults = tmp105_faultq[(s->config >> 3) & 3];
+  *  (at your option) any later version.
-     s->alarm = 0;
+  */
-+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
++/*
-+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
++ * This is a model of the Serial Communication Controller (SCC)
-+
++ * block found in most MPS FPGA images.
-     tmp105_interrupt_update(s);
++ *
- }
++ * QEMU interface:
 + *  + sysbus MMIO region 0: the register bank
 + *  + QOM property "scc-cfg4": value of the read-only CFG4 register
 + *  + QOM property "scc-aid": value of the read-only SCC_AID register
 + *  + QOM property "scc-id": value of the read-only SCC_ID register
 + *  + QOM property array "oscclk": reset values of the OSCCLK registers
 + *    (which are accessed via the SYS_CFG channel provided by this device)
 + */
  #ifndef MPS2_SCC_H
  #define MPS2_SCC_H
 --
 .20.1

-[PULL 9/9] tmp105: Correct handling of temperature limit checks
+[PULL 24/26] hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
-The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
+On some boards, SCC config register CFG0 bit 0 controls whether
-signals an alert when the temperature equals or exceeds the T_high value and
+parts of the board memory map are remapped. Support this with:
-then remains high until a device register is read or the device responds to
+ * a device property scc-cfg0 so the board can specify the
-the SMBUS Alert Response address, or the device is put into Shutdown Mode.
+   initial value of the CFG0 register
-Thereafter the Alert pin will only be re-signalled when temperature falls
+ * an outbound GPIO line which tracks bit 0 and which the board
-below T_low; alert can then be cleared in the same set of ways, and the
+   can wire up to provide the remapping
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
 We were misimplementing this as a simple "always alert if temperature is
 above T_high or below T_low" condition, which gives a spurious alert on
 startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
 limit values.
 Implement the correct (hysteresis) behaviour by tracking whether we
 are currently looking for the temperature to rise over T_high or
 for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210504120912.23094-3-peter.maydell@linaro.org
 ---
- hw/misc/tmp105.h |  7 +++++
+ include/hw/misc/mps2-scc.h |  9 +++++++++
- hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
+ hw/misc/mps2-scc.c         | 13 ++++++++++---
-files changed, 68 insertions(+), 9 deletions(-)
+files changed, 19 insertions(+), 3 deletions(-)
-diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
+diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.h
+--- a/include/hw/misc/mps2-scc.h
-+++ b/hw/misc/tmp105.h
++++ b/include/hw/misc/mps2-scc.h
-@@ -XXX,XX +XXX,XX @@ struct TMP105State {
+@@ -XXX,XX +XXX,XX @@
-     int16_t limit[2];
+  *  + QOM property "scc-cfg4": value of the read-only CFG4 register
-     int faults;
+  *  + QOM property "scc-aid": value of the read-only SCC_AID register
-     uint8_t alarm;
+  *  + QOM property "scc-id": value of the read-only SCC_ID register
-+    /*
++ *  + QOM property "scc-cfg0": reset value of the CFG0 register
-+     * The TMP105 initially looks for a temperature rising above T_high;
+  *  + QOM property array "oscclk": reset values of the OSCCLK registers
-+     * once this is detected, the condition it looks for next is the
+  *    (which are accessed via the SYS_CFG channel provided by this device)
-+     * temperature falling below T_low. This flag is false when initially
++ *  + named GPIO output "remap": this tracks the value of CFG0 register
-+     * looking for T_high, true when looking for T_low.
++ *    bit 0. Boards where this bit controls memory remapping should
-+     */
++ *    connect this GPIO line to a function performing that mapping.
-+    bool detect_falling;
++ *    Boards where bit 0 has no special function should leave the GPIO
 + *    output disconnected.
   */
  #ifndef MPS2_SCC_H
  #define MPS2_SCC_H
@@ -XXX,XX +XXX,XX @@ struct MPS2SCC {
      uint32_t num_oscclk;
      uint32_t *oscclk;
      uint32_t *oscclk_reset;
 +    uint32_t cfg0_reset;
 +
 +    qemu_irq remap;
  };
  #endif
-diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
+diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.c
+--- a/hw/misc/mps2-scc.c
-+++ b/hw/misc/tmp105.c
++++ b/hw/misc/mps2-scc.c
-@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
+@@ -XXX,XX +XXX,XX @@
-             return;
+ #include "qemu/bitops.h"
-     }
+ #include "trace.h"
+ #include "hw/sysbus.h"
--    if ((s->config >> 1) & 1) {                    /* TM */
++#include "hw/irq.h"
--        if (s->temperature >= s->limit[1])
+ #include "migration/vmstate.h"
--            s->alarm = 1;
+ #include "hw/registerfields.h"
--        else if (s->temperature < s->limit[0])
+ #include "hw/misc/mps2-scc.h"
--            s->alarm = 1;
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
-+    if (s->config >> 1 & 1) {
+     switch (offset) {
-+        /*
+     case A_CFG0:
-+         * TM == 1 : Interrupt mode. We signal Alert when the
+         /*
-+         * temperature rises above T_high, and expect the guest to clear
+-         * TODO on some boards bit 0 controls RAM remapping;
-+         * it (eg by reading a device register).
+-         * on others bit 1 is CPU_WAIT.
-+         */
++         * On some boards bit 0 controls board-specific remapping;
-+        if (s->detect_falling) {
++         * we always reflect bit 0 in the 'remap' GPIO output line,
-+            if (s->temperature < s->limit[0]) {
++         * and let the board wire it up or not as it chooses.
-+                s->alarm = 1;
++         * TODO on some boards bit 1 is CPU_WAIT.
-+                s->detect_falling = false;
+          */
-+            }
+         s->cfg0 = value;
-+        } else {
++        qemu_set_irq(s->remap, s->cfg0 & 1);
-+            if (s->temperature >= s->limit[1]) {
+         break;
-+                s->alarm = 1;
+     case A_CFG1:
-+                s->detect_falling = true;
+         s->cfg1 = value;
-+            }
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_reset(DeviceState *dev)
-+        }
+     int i;
-     } else {
--        if (s->temperature >= s->limit[1])
+     trace_mps2_scc_reset();
--            s->alarm = 1;
+-    s->cfg0 = 0;
--        else if (s->temperature < s->limit[0])
++    s->cfg0 = s->cfg0_reset;
--            s->alarm = 0;
+     s->cfg1 = 0;
-+        /*
+     s->cfg2 = 0;
-+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+     s->cfg5 = 0;
-+         * rises above T_high, and stop signalling it when the temperature
+@@ -XXX,XX +XXX,XX @@ static void mps2_scc_init(Object *obj)
-+         * falls below T_low.
-+         */
+     memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
-+        if (s->detect_falling) {
+     sysbus_init_mmio(sbd, &s->iomem);
-+            if (s->temperature < s->limit[0]) {
++    qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1);
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
      tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
      return 0;
  }
-+static bool detect_falling_needed(void *opaque)
+ static void mps2_scc_realize(DeviceState *dev, Error **errp)
-+{
+@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
-+    TMP105State *s = opaque;
+     DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
-+
+     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
-+    /*
+     DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
-+     * We only need to migrate the detect_falling bool if it's set;
++    /* Reset value for CFG0 register */
-+     * for migration from older machines we assume that it is false
++    DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0),
-+     * (ie temperature is not out of range).
+     /*
-+     */
+      * These are the initial settings for the source clocks on the board.
-+    return s->detect_falling;
+      * In hardware they can be configured via a config file read by the
 +}
 +
 +static const VMStateDescription vmstate_tmp105_detect_falling = {
 +    .name = "TMP105/detect-falling",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = detect_falling_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_BOOL(detect_falling, TMP105State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_tmp105 = {
      .name = "TMP105",
      .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
          VMSTATE_UINT8(alarm, TMP105State),
          VMSTATE_I2C_SLAVE(i2c, TMP105State),
          VMSTATE_END_OF_LIST()
 +    },
 +    .subsections = (const VMStateDescription*[]) {
 +        &vmstate_tmp105_detect_falling,
 +        NULL
      }
  };
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
      s->config = 0;
      s->faults = tmp105_faultq[(s->config >> 3) & 3];
      s->alarm = 0;
 +    s->detect_falling = false;
      s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
      s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 --
 .20.1

-[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
+[PULL 25/26] hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
-In commit 76346b6264a9b01979 we tried to add a configure check that
+The AN524 FPGA image supports two memory maps, which differ in where
-the libgio pkg-config data was correct, which builds an executable
+the QSPI and BRAM are.  In the default map, the BRAM is at
-linked against it.  Unfortunately this doesn't catch the problem
+x0000_0000, and the QSPI at 0x2800_0000.  In the second map, they
-(missing static library dependency info), because a "do nothing" test
+are the other way around.
-source file doesn't have any symbol references that cause the linker
-to pull in .o files from libgio.a, and so we don't see the "missing
+In hardware, the initial mapping can be selected by the user by
-symbols from libmount" error that a full QEMU link triggers.
+writing either "REMAP: BRAM" (the default) or "REMAP: QSPI" in the
+board configuration file.  The board config file is acted on by the
-(The ineffective test went unnoticed because of a typo that
+"Motherboard Configuration Controller", which is an entirely separate
-effectively disabled libgio unconditionally, but after commit
+microcontroller on the dev board but outside the FPGA.
-a5dfc11f2 fixed that, a static link of the system emulator on
-Ubuntu stopped working again.)
+The guest can also dynamically change the mapping via the SCC
+CFG_REG0 register.
-Improve the gio test by having the test source fragment reference a
-g_dbus function (which is what is indirectly causing us to end up
+Implement this functionality for QEMU, using a machine property
-wanting functions from libmount).
+"remap" with valid values "BRAM" and "QSPI" to allow the user to set
 the initial mapping, in the same way they can on the FPGA, and
 wiring up the bit from the SCC register to also switch the mapping.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210504120912.23094-4-peter.maydell@linaro.org
 ---
- configure | 11 +++++++++--
+ docs/system/arm/mps2.rst |  10 ++++
-file changed, 9 insertions(+), 2 deletions(-)
+ hw/arm/mps2-tz.c         | 108 ++++++++++++++++++++++++++++++++++++++-
+files changed, 117 insertions(+), 1 deletion(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
+diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
---- a/configure
+index XXXXXXX..XXXXXXX 100644
-+++ b/configure
+--- a/docs/system/arm/mps2.rst
-@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
++++ b/docs/system/arm/mps2.rst
-     # Check that the libraries actually work -- Ubuntu 18.04 ships
+@@ -XXX,XX +XXX,XX @@ Differences between QEMU and real hardware:
-     # with pkg-config --static --libs data for gio-2.0 that is missing
+   flash, but only as simple ROM, so attempting to rewrite the flash
-     # -lblkid and will give a link error.
+   from the guest will fail
--    write_c_skeleton
+ - QEMU does not model the USB controller in MPS3 boards
--    if compile_prog "" "$gio_libs" ; then
++
-+    cat > $TMPC <<EOF
++Machine-specific options
-+#include <gio/gio.h>
++""""""""""""""""""""""""
-+int main(void)
++
-+{
++The following machine-specific options are supported:
-+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
++
-+    return 0;
++remap
-+}
++  Supported for ``mps3-an524`` only.
-+EOF
++  Set ``BRAM``/``QSPI`` to select the initial memory mapping. The
-+    if compile_prog "$gio_cflags" "$gio_libs" ; then
++  default is ``BRAM``.
-         gio=yes
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
-     else
+index XXXXXXX..XXXXXXX 100644
-         gio=no
+--- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/reset.h"
  #include "hw/misc/unimp.h"
  #include "hw/char/cmsdk-apb-uart.h"
  #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/core/split-irq.h"
  #include "hw/qdev-clock.h"
  #include "qom/object.h"
 +#include "hw/irq.h"
  #define MPS2TZ_NUMIRQ_MAX 96
  #define MPS2TZ_RAM_MAX 5
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
      SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
      Clock *sysclk;
      Clock *s32kclk;
 +
 +    bool remap;
 +    qemu_irq remap_irq;
  };
  #define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -XXX,XX +XXX,XX @@ static const RAMInfo an505_raminfo[] = { {
      },
  };
 +/*
 + * Note that the addresses and MPC numbering here should match up
 + * with those used in remap_memory(), which can swap the BRAM and QSPI.
 + */
  static const RAMInfo an524_raminfo[] = { {
          .name = "bram",
          .base = 0x00000000,
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
      object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
      sccdev = DEVICE(scc);
 +    qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
      qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
      qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
      qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
      return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
  }
 +static hwaddr boot_mem_base(MPS2TZMachineState *mms)
 +{
 +    /*
 +     * Return the canonical address of the block which will be mapped
 +     * at address 0x0 (i.e. where the vector table is).
 +     * This is usually 0, but if the AN524 alternate memory map is
 +     * enabled it will be the base address of the QSPI block.
 +     */
 +    return mms->remap ? 0x28000000 : 0;
 +}
 +
 +static void remap_memory(MPS2TZMachineState *mms, int map)
 +{
 +    /*
 +     * Remap the memory for the AN524. 'map' is the value of
 +     * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
 +     * for the "option 1" mapping where QSPI is at address 0.
 +     *
 +     * Effectively we need to swap around the "upstream" ends of
 +     * MPC 0 and MPC 1.
 +     */
 +    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 +    int i;
 +
 +    if (mmc->fpga_type != FPGA_AN524) {
 +        return;
 +    }
 +
 +    memory_region_transaction_begin();
 +    for (i = 0; i < 2; i++) {
 +        TZMPC *mpc = &mms->mpc[i];
 +        MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
 +        hwaddr addr = (i ^ map) ? 0x28000000 : 0;
 +
 +        memory_region_set_address(upstream, addr);
 +    }
 +    memory_region_transaction_commit();
 +}
 +
 +static void remap_irq_fn(void *opaque, int n, int level)
 +{
 +    MPS2TZMachineState *mms = opaque;
 +
 +    remap_memory(mms, level);
 +}
 +
  static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                                const char *name, hwaddr size,
                                const int *irqs)
@@ -XXX,XX +XXX,XX @@ static uint32_t boot_ram_size(MPS2TZMachineState *mms)
      MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
      for (p = mmc->raminfo; p->name; p++) {
 -        if (p->base == 0) {
 +        if (p->base == boot_mem_base(mms)) {
              return p->size;
          }
      }
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
      create_non_mpc_ram(mms);
 +    if (mmc->fpga_type == FPGA_AN524) {
 +        /*
 +         * Connect the line from the SCC so that we can remap when the
 +         * guest updates that register.
 +         */
 +        mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
 +        qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
 +                                    mms->remap_irq);
 +    }
 +
      armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
                         boot_ram_size(mms));
  }
@@ -XXX,XX +XXX,XX @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
      *iregion = region;
  }
 +static char *mps2_get_remap(Object *obj, Error **errp)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
 +    const char *val = mms->remap ? "QSPI" : "BRAM";
 +    return g_strdup(val);
 +}
 +
 +static void mps2_set_remap(Object *obj, const char *value, Error **errp)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
 +
 +    if (!strcmp(value, "BRAM")) {
 +        mms->remap = false;
 +    } else if (!strcmp(value, "QSPI")) {
 +        mms->remap = true;
 +    } else {
 +        error_setg(errp, "Invalid remap value");
 +        error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
 +    }
 +}
 +
 +static void mps2_machine_reset(MachineState *machine)
 +{
 +    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 +
 +    /*
 +     * Set the initial memory mapping before triggering the reset of
 +     * the rest of the system, so that the guest image loader and CPU
 +     * reset see the correct mapping.
 +     */
 +    remap_memory(mms, mms->remap);
 +    qemu_devices_reset();
 +}
 +
  static void mps2tz_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
      IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
      mc->init = mps2tz_common_init;
 +    mc->reset = mps2_machine_reset;
      iic->check = mps2_tz_idau_check;
  }
@@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
      mmc->raminfo = an524_raminfo;
      mmc->armsse_type = TYPE_SSE200;
      mps2tz_set_default_ram_info(mmc);
 +
 +    object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
 +    object_class_property_set_description(oc, "remap",
 +                                          "Set memory mapping. Valid values "
 +                                          "are BRAM (default) and QSPI.");
  }
  static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
 --
 .20.1

-[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
+[PULL 26/26] hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
-From: Andrew Jones <drjones@redhat.com>
+From: Guenter Roeck <linux@roeck-us.net>
-The removal of the selection of A15MPCORE from ARM_VIRT also
+Commit dfc388797cc4 ("hw/arm: xlnx: Set all boards' GEM 'phy-addr'
-removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
+property value to 23") configured the PHY address for xilinx-zynq-a9
 to 23. When trying to boot xilinx-zynq-a9 with zynq-zc702.dtb or
 zynq-zc706.dtb, this results in the following error message when
 trying to use the Ethernet interface.
-Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
+macb e000b000.ethernet eth0: Could not attach PHY (-19)
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+The devicetree files for ZC702 and ZC706 configure PHY address 7. The
-Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+documentation for the ZC702 and ZC706 evaluation boards suggest that the
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+PHY address is 7, not 23. Other boards use PHY address 0, 1, 3, or 7.
-Message-id: 20201111143440.112763-1-drjones@redhat.com
+I was unable to find a documentation or a devicetree file suggesting
 or using PHY address 23. The Ethernet interface starts working with
 zynq-zc702.dtb and zynq-zc706.dtb when setting the PHY address to 7,
 so let's use it.
 Cc: Bin Meng <bin.meng@windriver.com>
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20210504124140.1100346-1-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 +
+ hw/arm/xilinx_zynq.c | 2 +-
-file changed, 1 insertion(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
+--- a/hw/arm/xilinx_zynq.c
-+++ b/hw/arm/Kconfig
++++ b/hw/arm/xilinx_zynq.c
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
-     imply VFIO_PLATFORM
+         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
-     imply VFIO_XGMAC
+         qdev_set_nic_properties(dev, nd);
-     imply TPM_TIS_SYSBUS
+     }
-+    select ARM_GIC
+-    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
-     select ACPI
++    object_property_set_int(OBJECT(dev), "phy-addr", 7, &error_abort);
-     select ARM_SMMUV3
+     s = SYS_BUS_DEVICE(dev);
-     select GPIO_KEY
+     sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, base);
 --
 .20.1

Arm queue; bugfixes only.

thanks
-- PMM

The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117

for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:

tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: ARM_VIRT must select ARM_GIC
 * exynos: Fix bad printf format specifiers
 * hw/input/ps2.c: Remove remnants of printf debug
 * target/openrisc: Remove dead code attempting to check "is timer disabled"
 * register: Remove unnecessary NULL check
 * util/cutils: Fix Coverity array overrun in freq_to_str()
 * configure: Make "does libgio work" test pull in some actual functions
 * tmp105: reset the T_low and T_High registers
 * tmp105: Correct handling of temperature limit checks

----------------------------------------------------------------
Alex Chen (1):
      exynos: Fix bad printf format specifiers

Alistair Francis (1):
      register: Remove unnecessary NULL check

Andrew Jones (1):
      hw/arm/virt: ARM_VIRT must select ARM_GIC

Peter Maydell (5):
      hw/input/ps2.c: Remove remnants of printf debug
      target/openrisc: Remove dead code attempting to check "is timer disabled"
      configure: Make "does libgio work" test pull in some actual functions
      hw/misc/tmp105: reset the T_low and T_High registers
      tmp105: Correct handling of temperature limit checks

Philippe Mathieu-Daudé (1):
      util/cutils: Fix Coverity array overrun in freq_to_str()

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 hw/timer/exynos4210_pwm.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
     /* If CSTAT is pending and IRQ is enabled */
     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
             (s->reg.int_enb & G_INT_ENABLE(id))) {
-        DPRINTF("gcmp timer[%d] IRQ\n", id);
+        DPRINTF("gcmp timer[%u] IRQ\n", id);
         qemu_irq_raise(s->irq[id]);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
-        DPRINTF("freq=%dHz\n", s->freq);
+        DPRINTF("freq=%uHz\n", s->freq);
 
         /* global timer */
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 
     if (freq != s->timer[id].freq) {
         ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
-        DPRINTF("freq=%dHz\n", s->timer[id].freq);
+        DPRINTF("freq=%uHz\n", s->timer[id].freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     uint32_t id = s->id;
     bool cmp;
 
-    DPRINTF("timer %d tick\n", id);
+    DPRINTF("timer %u tick\n", id);
 
     /* set irq status */
     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
 
     /* raise IRQ */
     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
-        DPRINTF("timer %d IRQ\n", id);
+        DPRINTF("timer %u IRQ\n", id);
         qemu_irq_raise(p->timer[id].irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     }
 
     if (cmp) {
-        DPRINTF("auto reload timer %d count to %x\n", id,
+        DPRINTF("auto reload timer %u count to %x\n", id,
                 p->timer[id].reg_tcntb);
         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
         ptimer_run(p->timer[id].ptimer, 1);
-- 
2.20.1

In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
and mouse emulation. However we didn't remove all the debug-by-printf
support. In fact there is only one printf() remaining, and it is
redundant with the trace_ps2_write_mouse() event next to it.
Remove the printf() and the now-unused DEBUG* macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
---
 hw/input/ps2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -XXX,XX +XXX,XX @@
 
 #include "trace.h"
 
-/* debug PC keyboard */
-//#define DEBUG_KBD
-
-/* debug PC keyboard : only mouse */
-//#define DEBUG_MOUSE
-
 /* Keyboard Commands */
 #define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
 #define KBD_CMD_ECHO     	0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
     PS2MouseState *s = (PS2MouseState *)opaque;
 
     trace_ps2_write_mouse(opaque, val);
-#ifdef DEBUG_MOUSE
-    printf("kbd: write mouse 0x%02x\n", val);
-#endif
     switch(s->common.write_cmd) {
     default:
     case -1:
-- 
2.20.1

In the mtspr helper we attempt to check for "is the timer disabled"
with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
is zero and the condition is always false (Coverity complains about
the dead code.)

The correct check would be to test whether the TTMR_M field in the
register is equal to TIMER_NONE instead.  However, the
cpu_openrisc_timer_update() function checks whether the timer is
enabled (it looks at cpu->env.is_counting, which is set to 0 via
cpu_openrisc_count_stop() when the TTMR_M field is set to
TIMER_NONE), so there's no need to check for "timer disabled" in the
target/openrisc code.  Instead, simply remove the dead code.

Fixes: Coverity CID 1005812
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
---
 target/openrisc/sys_helper.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 
     case TO_SPR(10, 1): /* TTCR */
         cpu_openrisc_count_set(cpu, rb);
-        if (env->ttmr & TIMER_NONE) {
-            return;
-        }
         cpu_openrisc_timer_update(cpu);
         break;
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):

>>> Overrunning array "suffixes" of 7 8-byte elements at element
    index 7 (byte offset 63) using index "idx" (which evaluates to 7).

Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
which is ~18.446 EHz, less than 1000 EHz.

Reported-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/cutils.c b/util/cutils.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
     double freq = freq_hz;
     size_t idx = 0;
 
-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+    while (freq >= 1000.0) {
         freq /= 1000.0;
         idx++;
     }
+    assert(idx < ARRAY_SIZE(suffixes));
 
     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
 }
-- 
2.20.1

In commit 76346b6264a9b01979 we tried to add a configure check that
the libgio pkg-config data was correct, which builds an executable
linked against it.  Unfortunately this doesn't catch the problem
(missing static library dependency info), because a "do nothing" test
source file doesn't have any symbol references that cause the linker
to pull in .o files from libgio.a, and so we don't see the "missing
symbols from libmount" error that a full QEMU link triggers.

(The ineffective test went unnoticed because of a typo that
effectively disabled libgio unconditionally, but after commit
3569a5dfc11f2 fixed that, a static link of the system emulator on
Ubuntu stopped working again.)

Improve the gio test by having the test source fragment reference a
g_dbus function (which is what is indirectly causing us to end up
wanting functions from libmount).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
---
 configure | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
     # Check that the libraries actually work -- Ubuntu 18.04 ships
     # with pkg-config --static --libs data for gio-2.0 that is missing
     # -lblkid and will give a link error.
-    write_c_skeleton
-    if compile_prog "" "$gio_libs" ; then
+    cat > $TMPC <<EOF
+#include <gio/gio.h>
+int main(void)
+{
+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+    return 0;
+}
+EOF
+    if compile_prog "$gio_cflags" "$gio_libs" ; then
         gio=yes
     else
         gio=no
-- 
2.20.1

The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
power-up reset values for the T_low and T_high registers are 80 degrees C
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
values are then shifted right by four bits to give the register reset
values, since both registers store the 12 bits of temperature data in bits
[15..4] of a 16 bit register.

We were resetting these registers to zero, which is problematic for Linux
guests which enable the alert interrupt and then immediately take an
unexpected overtemperature alert because the current temperature is above
freezing...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
---
 hw/misc/tmp105.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
 
+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
+
     tmp105_interrupt_update(s);
 }
 
-- 
2.20.1

The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
signals an alert when the temperature equals or exceeds the T_high value and
then remains high until a device register is read or the device responds to
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
Thereafter the Alert pin will only be re-signalled when temperature falls
below T_low; alert can then be cleared in the same set of ways, and the
device returns to its initial "alert when temperature goes above T_high"
mode. (If this textual description is confusing, see figure 3 in the
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)

We were misimplementing this as a simple "always alert if temperature is
above T_high or below T_low" condition, which gives a spurious alert on
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
limit values.

Implement the correct (hysteresis) behaviour by tracking whether we
are currently looking for the temperature to rise over T_high or
for it to fall below T_low. Our implementation of the comparator
mode (TM==0) wasn't wrong, but rephrase it to match the way that
interrupt mode is now handled for clarity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
---
 hw/misc/tmp105.h |  7 +++++
 hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.h
+++ b/hw/misc/tmp105.h
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
     int16_t limit[2];
     int faults;
     uint8_t alarm;
+    /*
+     * The TMP105 initially looks for a temperature rising above T_high;
+     * once this is detected, the condition it looks for next is the
+     * temperature falling below T_low. This flag is false when initially
+     * looking for T_high, true when looking for T_low.
+     */
+    bool detect_falling;
 };
 
 #endif
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
             return;
     }
 
-    if ((s->config >> 1) & 1) {					/* TM */
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 1;
+    if (s->config >> 1 & 1) {
+        /*
+         * TM == 1 : Interrupt mode. We signal Alert when the
+         * temperature rises above T_high, and expect the guest to clear
+         * it (eg by reading a device register).
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 1;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     } else {
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 0;
+        /*
+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+         * rises above T_high, and stop signalling it when the temperature
+         * falls below T_low.
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 0;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     }
 
     tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool detect_falling_needed(void *opaque)
+{
+    TMP105State *s = opaque;
+
+    /*
+     * We only need to migrate the detect_falling bool if it's set;
+     * for migration from older machines we assume that it is false
+     * (ie temperature is not out of range).
+     */
+    return s->detect_falling;
+}
+
+static const VMStateDescription vmstate_tmp105_detect_falling = {
+    .name = "TMP105/detect-falling",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = detect_falling_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(detect_falling, TMP105State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_tmp105 = {
     .name = "TMP105",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
         VMSTATE_UINT8(alarm, TMP105State),
         VMSTATE_I2C_SLAVE(i2c, TMP105State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_tmp105_detect_falling,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->config = 0;
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
+    s->detect_falling = false;
 
     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- 
2.20.1

The following changes since commit 4cc10cae64c51e17844dc4358481c393d7bf1ed4:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-05-06 18:56:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210510

for you to fetch changes up to 8f96812baa53005f32aece3e30b140826c20aa19:

hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 (2021-05-10 13:24:09 +0100)

----------------------------------------------------------------
target-arm queue:
 * docs: fix link in sbsa description
 * linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
 * target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
 * target/arm: Split neon and vfp translation to their own
   compilation units
 * target/arm: Make WFI a NOP for userspace emulators
 * hw/sd/omap_mmc: Use device_cold_reset() instead of
   device_legacy_reset()
 * include: More fixes for 'extern "C"' block use
 * hw/arm/imx25_pdk: Fix error message for invalid RAM size
 * hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
 * hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9

----------------------------------------------------------------
Alex Bennée (1):
      docs: fix link in sbsa description

Guenter Roeck (1):
      hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9

Peter Maydell (22):
      target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
      target/arm: Move constant expanders to translate.h
      target/arm: Share unallocated_encoding() and gen_exception_insn()
      target/arm: Make functions used by m-nocp global
      target/arm: Split m-nocp trans functions into their own file
      target/arm: Move gen_aa32 functions to translate-a32.h
      target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
      target/arm: Make functions used by translate-vfp global
      target/arm: Make translate-vfp.c.inc its own compilation unit
      target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
      target/arm: Delete unused typedef
      target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
      target/arm: Make functions used by translate-neon global
      target/arm: Make translate-neon.c.inc its own compilation unit
      target/arm: Make WFI a NOP for userspace emulators
      hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
      osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
      include/qemu/bswap.h: Handle being included outside extern "C" block
      include/disas/dis-asm.h: Handle being included outside 'extern "C"'
      hw/misc/mps2-scc: Add "QEMU interface" comment
      hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
      hw/arm/mps2-tz: Implement AN524 memory remapping via machine property

Philippe Mathieu-Daudé (1):
      hw/arm/imx25_pdk: Fix error message for invalid RAM size

Richard Henderson (1):
      linux-user/aarch64: Enable hwcap for RND, BTI, and MTE

docs/system/arm/mps2.rst                           |  10 +
 docs/system/arm/sbsa.rst                           |   2 +-
 include/disas/dis-asm.h                            |  12 +-
 include/hw/misc/mps2-scc.h                         |  21 ++
 include/qemu/bswap.h                               |  26 ++-
 include/qemu/osdep.h                               |   8 +-
 include/sysemu/os-posix.h                          |   8 +
 include/sysemu/os-win32.h                          |   8 +
 target/arm/translate-a32.h                         | 144 +++++++++++++
 target/arm/translate-a64.h                         |   2 -
 target/arm/translate.h                             |  29 +++
 hw/arm/imx25_pdk.c                                 |   5 +-
 hw/arm/mps2-tz.c                                   | 108 +++++++++-
 hw/arm/xilinx_zynq.c                               |   2 +-
 hw/misc/mps2-scc.c                                 |  13 +-
 hw/sd/omap_mmc.c                                   |   2 +-
 linux-user/elfload.c                               |  13 ++
 target/arm/helper.c                                |   2 +-
 target/arm/op_helper.c                             |  12 ++
 target/arm/translate-a64.c                         |  15 --
 target/arm/translate-m-nocp.c                      | 221 ++++++++++++++++++++
 .../arm/{translate-neon.c.inc => translate-neon.c} |  19 +-
 .../arm/{translate-vfp.c.inc => translate-vfp.c}   | 230 +++------------------
 target/arm/translate.c                             | 200 ++++--------------
 disas/arm-a64.cc                                   |   2 -
 disas/nanomips.cpp                                 |   2 -
 target/arm/meson.build                             |  15 +-
 27 files changed, 718 insertions(+), 413 deletions(-)
 create mode 100644 target/arm/translate-a32.h
 create mode 100644 target/arm/translate-m-nocp.c
 rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
 rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (94%)

From: Alex Bennée <alex.bennee@linaro.org>

A trailing _ makes all the difference to the rendered link.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20210428131316.31390-1-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@ Arm Server Base System Architecture Reference board (``sbsa-ref``)
 While the `virt` board is a generic board platform that doesn't match
 any real hardware the `sbsa-ref` board intends to look like real
 hardware. The `Server Base System Architecture
-<https://developer.arm.com/documentation/den0029/latest>` defines a
+<https://developer.arm.com/documentation/den0029/latest>`_ defines a
 minimum base line of hardware support and importantly how the firmware
 reports that to any operating system. It is a static system that
 reports a very minimal DT to the firmware for non-discoverable
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

These three features are already enabled by TCG, but are missing
their hwcap bits.  Update HWCAP2 from linux v5.12.

Cc: qemu-stable@nongnu.org (for 6.0.1)
Buglink: https://bugs.launchpad.net/bugs/1926044
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210427214108.88503-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/elfload.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
     ARM_HWCAP2_A64_FRINT        = 1 << 8,
+    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
+    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
+    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
+    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
+    ARM_HWCAP2_A64_I8MM         = 1 << 13,
+    ARM_HWCAP2_A64_BF16         = 1 << 14,
+    ARM_HWCAP2_A64_DGH          = 1 << 15,
+    ARM_HWCAP2_A64_RNG          = 1 << 16,
+    ARM_HWCAP2_A64_BTI          = 1 << 17,
+    ARM_HWCAP2_A64_MTE          = 1 << 18,
 };
 
 #define ELF_HWCAP   get_elf_hwcap()
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap2(void)
     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
+    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
+    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
+    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
 
     return hwcaps;
 }
-- 
2.20.1

In tlbi_aa64_vae2is_write() the calculation
  bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
                            pageaddr)

has the two arms of the ?: expression reversed. Fix the bug.

Fixes: b6ad6062f1e5
Reported-by: Rebecca Cran <rebecca@nuviainc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Rebecca Cran <rebecca@nuviainc.com>
Message-id: 20210420123106.10861-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
     bool secure = arm_is_secure_below_el3(env);
     int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
-    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
+    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
                                   pageaddr);
 
     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
-- 
2.20.1

Some of the constant expanders defined in translate.c are generically
useful and will be used by the separate C files for VFP and Neon once
they are created; move the expander definitions to translate.h.

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
 extern TCGv_i64 cpu_exclusive_addr;
 extern TCGv_i64 cpu_exclusive_val;
 
+/*
+ * Constant expanders for the decoders.
+ */
+
+static inline int negate(DisasContext *s, int x)
+{
+    return -x;
+}
+
+static inline int plus_2(DisasContext *s, int x)
+{
+    return x + 2;
+}
+
+static inline int times_2(DisasContext *s, int x)
+{
+    return x * 2;
+}
+
+static inline int times_4(DisasContext *s, int x)
+{
+    return x * 4;
+}
+
 static inline int arm_dc_feature(DisasContext *dc, int feature)
 {
     return (dc->features & (1ULL << feature)) != 0;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
     }
 }
 
-/*
- * Constant expanders for the decoders.
- */
-
-static int negate(DisasContext *s, int x)
-{
-    return -x;
-}
-
-static int plus_2(DisasContext *s, int x)
-{
-    return x + 2;
-}
-
-static int times_2(DisasContext *s, int x)
-{
-    return x * 2;
-}
-
-static int times_4(DisasContext *s, int x)
-{
-    return x * 4;
-}
-
 /* Flags for the disas_set_da_iss info argument:
  * lower bits hold the Rt register number, higher bits are flags.
  */
-- 
2.20.1

The unallocated_encoding() function is the same in both
translate-a64.c and translate.c; make the translate.c function global
and drop the translate-a64.c version.  To do this we need to also
share gen_exception_insn(), which currently exists in two slightly
different versions for A32 and A64: merge those into a single
function that can work for both.

This will be useful for splitting up translate.c, which will require
unallocated_encoding() to no longer be file-local.  It's also
hopefully less confusing to have only one version of the function
rather than two.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-3-peter.maydell@linaro.org
---
 target/arm/translate-a64.h |  2 --
 target/arm/translate.h     |  3 +++
 target/arm/translate-a64.c | 15 ---------------
 target/arm/translate.c     | 14 +++++++++-----
 4 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_TRANSLATE_A64_H
 #define TARGET_ARM_TRANSLATE_A64_H
 
-void unallocated_encoding(DisasContext *s);
-
 #define unsupported_encoding(s, insn)                                    \
     do {                                                                 \
         qemu_log_mask(LOG_UNIMP,                                         \
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void arm_free_cc(DisasCompare *cmp);
 void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
+void unallocated_encoding(DisasContext *s);
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
-                               uint32_t syndrome, uint32_t target_el)
-{
-    gen_a64_set_pc_im(pc);
-    gen_exception(excp, syndrome, target_el);
-    s->base.is_jmp = DISAS_NORETURN;
-}
-
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
 {
     TCGv_i32 tcg_syn;
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
     }
 }
 
-void unallocated_encoding(DisasContext *s)
-{
-    /* Unallocated and reserved encodings are uncategorized */
-    gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
-}
-
 static void init_tmp_a64_array(DisasContext *s)
 {
 #ifdef CONFIG_DEBUG_TCG
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
-                               int syn, uint32_t target_el)
+void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
+                        uint32_t syn, uint32_t target_el)
 {
-    gen_set_condexec(s);
-    gen_set_pc_im(s, pc);
+    if (s->aarch64) {
+        gen_a64_set_pc_im(pc);
+    } else {
+        gen_set_condexec(s);
+        gen_set_pc_im(s, pc);
+    }
     gen_exception(excp, syn, target_el);
     s->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void unallocated_encoding(DisasContext *s)
+void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
     gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
-- 
2.20.1

We want to split out the .c.inc files which are currently included
into translate.c so they are separate compilation units.  To do this
we need to make some functions which are currently file-local to
translate.c have global scope; create a translate-a32.h paralleling
the existing translate-a64.h as a place for these declarations to
live, so that code moved into the new compilation units can call
them.

The functions made global here are those required by the
m-nocp.decode functions, except that I have converted the whole
family of {read,write}_neon_element* and also both the load_cpu and
store_cpu functions for consistency, even though m-nocp only wants a
few functions from each.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-4-peter.maydell@linaro.org
---
 target/arm/translate-a32.h     | 57 ++++++++++++++++++++++++++++++++++
 target/arm/translate.c         | 39 +++++------------------
 target/arm/translate-vfp.c.inc |  2 +-
 3 files changed, 65 insertions(+), 33 deletions(-)
 create mode 100644 target/arm/translate-a32.h

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  AArch32 translation, common definitions.
+ *
+ * Copyright (c) 2021 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_ARM_TRANSLATE_A64_H
+#define TARGET_ARM_TRANSLATE_A64_H
+
+void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
+void arm_gen_condlabel(DisasContext *s);
+bool vfp_access_check(DisasContext *s);
+void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
+void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
+void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
+void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
+
+static inline TCGv_i32 load_cpu_offset(int offset)
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_ld_i32(tmp, cpu_env, offset);
+    return tmp;
+}
+
+#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
+
+static inline void store_cpu_offset(TCGv_i32 var, int offset)
+{
+    tcg_gen_st_i32(var, cpu_env, offset);
+    tcg_temp_free_i32(var);
+}
+
+#define store_cpu_field(var, name) \
+    store_cpu_offset(var, offsetof(CPUARMState, name))
+
+/* Create a new temporary and set it to the value of a CPU register.  */
+static inline TCGv_i32 load_reg(DisasContext *s, int reg)
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    load_reg_var(s, tmp, reg);
+    return tmp;
+}
+
+#endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
 
 #include "translate.h"
+#include "translate-a32.h"
 
 #if defined(CONFIG_USER_ONLY)
 #define IS_USER(s) 1
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
 }
 
 /* Generate a label used for skipping this instruction */
-static void arm_gen_condlabel(DisasContext *s)
+void arm_gen_condlabel(DisasContext *s)
 {
     if (!s->condjmp) {
         s->condlabel = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
     }
 }
 
-static inline TCGv_i32 load_cpu_offset(int offset)
-{
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    tcg_gen_ld_i32(tmp, cpu_env, offset);
-    return tmp;
-}
-
-#define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
-
-static inline void store_cpu_offset(TCGv_i32 var, int offset)
-{
-    tcg_gen_st_i32(var, cpu_env, offset);
-    tcg_temp_free_i32(var);
-}
-
-#define store_cpu_field(var, name) \
-    store_cpu_offset(var, offsetof(CPUARMState, name))
-
 /* The architectural value of PC.  */
 static uint32_t read_pc(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t read_pc(DisasContext *s)
 }
 
 /* Set a variable to the value of a CPU register.  */
-static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
+void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 {
     if (reg == 15) {
         tcg_gen_movi_i32(var, read_pc(s));
@@ -XXX,XX +XXX,XX @@ static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
     }
 }
 
-/* Create a new temporary and set it to the value of a CPU register.  */
-static inline TCGv_i32 load_reg(DisasContext *s, int reg)
-{
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    load_reg_var(s, tmp, reg);
-    return tmp;
-}
-
 /*
  * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
  * This is used for load/store for which use of PC implies (literal),
@@ -XXX,XX +XXX,XX @@ static inline void vfp_store_reg32(TCGv_i32 var, int reg)
     tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
 }
 
-static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
+void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
     }
 }
 
-static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
+void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop)
     }
 }
 
-static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
+void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
@@ -XXX,XX +XXX,XX @@ static void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop)
     }
 }
 
-static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
+void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
 
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
  * The most usual kind of VFP access check, for everything except
  * FMXR/FMRX to the always-available special registers.
  */
-static bool vfp_access_check(DisasContext *s)
+bool vfp_access_check(DisasContext *s)
 {
     return full_vfp_access_check(s, false);
 }
-- 
2.20.1

Currently the trans functions for m-nocp.decode all live in
translate-vfp.inc.c; move them out into their own translation unit,
translate-m-nocp.c.

The trans_* functions here are pure code motion with no changes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-5-peter.maydell@linaro.org
---
 target/arm/translate-a32.h     |   3 +
 target/arm/translate-m-nocp.c  | 221 +++++++++++++++++++++++++++++++++
 target/arm/translate.c         |   1 -
 target/arm/translate-vfp.c.inc | 196 -----------------------------
 target/arm/meson.build         |   3 +-
 5 files changed, 226 insertions(+), 198 deletions(-)
 create mode 100644 target/arm/translate-m-nocp.c

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_TRANSLATE_A64_H
 #define TARGET_ARM_TRANSLATE_A64_H
 
+/* Prototypes for autogenerated disassembler functions */
+bool disas_m_nocp(DisasContext *dc, uint32_t insn);
+
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
 bool vfp_access_check(DisasContext *s);
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ARM translation: M-profile NOCP special-case instructions
+ *
+ *  Copyright (c) 2020 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "translate.h"
+#include "translate-a32.h"
+
+#include "decode-m-nocp.c.inc"
+
+/*
+ * Decode VLLDM and VLSTM are nonstandard because:
+ *  * if there is no FPU then these insns must NOP in
+ *    Secure state and UNDEF in Nonsecure state
+ *  * if there is an FPU then these insns do not have
+ *    the usual behaviour that vfp_access_check() provides of
+ *    being controlled by CPACR/NSACR enable bits or the
+ *    lazy-stacking logic.
+ */
+static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+{
+    TCGv_i32 fptr;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+        return false;
+    }
+
+    if (a->op) {
+        /*
+         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
+         * to take the IMPDEF option to make memory accesses to the stack
+         * slots that correspond to the D16-D31 registers (discarding
+         * read data and writing UNKNOWN values), so for us the T2
+         * encoding behaves identically to the T1 encoding.
+         */
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+    } else {
+        /*
+         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
+         * This is currently architecturally impossible, but we add the
+         * check to stay in line with the pseudocode. Note that we must
+         * emit code for the UNDEF so it takes precedence over the NOCP.
+         */
+        if (dc_isar_feature(aa32_simd_r32, s)) {
+            unallocated_encoding(s);
+            return true;
+        }
+    }
+
+    /*
+     * If not secure, UNDEF. We must emit code for this
+     * rather than returning false so that this takes
+     * precedence over the m-nocp.decode NOCP fallback.
+     */
+    if (!s->v8m_secure) {
+        unallocated_encoding(s);
+        return true;
+    }
+    /* If no fpu, NOP. */
+    if (!dc_isar_feature(aa32_vfp, s)) {
+        return true;
+    }
+
+    fptr = load_reg(s, a->rn);
+    if (a->l) {
+        gen_helper_v7m_vlldm(cpu_env, fptr);
+    } else {
+        gen_helper_v7m_vlstm(cpu_env, fptr);
+    }
+    tcg_temp_free_i32(fptr);
+
+    /* End the TB, because we have updated FP control bits */
+    s->base.is_jmp = DISAS_UPDATE_EXIT;
+    return true;
+}
+
+static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+{
+    int btmreg, topreg;
+    TCGv_i64 zero;
+    TCGv_i32 aspen, sfpa;
+
+    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+        /* Before v8.1M, fall through in decode to NOCP check */
+        return false;
+    }
+
+    /* Explicitly UNDEF because this takes precedence over NOCP */
+    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
+        unallocated_encoding(s);
+        return true;
+    }
+
+    if (!dc_isar_feature(aa32_vfp_simd, s)) {
+        /* NOP if we have neither FP nor MVE */
+        return true;
+    }
+
+    /*
+     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
+     * active floating point context so we must NOP (without doing
+     * any lazy state preservation or the NOCP check).
+     */
+    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
+    sfpa = load_cpu_field(v7m.control[M_REG_S]);
+    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
+    tcg_gen_or_i32(sfpa, sfpa, aspen);
+    arm_gen_condlabel(s);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+
+    if (s->fp_excp_el != 0) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), s->fp_excp_el);
+        return true;
+    }
+
+    topreg = a->vd + a->imm - 1;
+    btmreg = a->vd;
+
+    /* Convert to Sreg numbers if the insn specified in Dregs */
+    if (a->size == 3) {
+        topreg = topreg * 2 + 1;
+        btmreg *= 2;
+    }
+
+    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
+        /* UNPREDICTABLE: we choose to undef */
+        unallocated_encoding(s);
+        return true;
+    }
+
+    /* Silently ignore requests to clear D16-D31 if they don't exist */
+    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
+        topreg = 31;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    /* Zero the Sregs from btmreg to topreg inclusive. */
+    zero = tcg_const_i64(0);
+    if (btmreg & 1) {
+        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
+        btmreg++;
+    }
+    for (; btmreg + 1 <= topreg; btmreg += 2) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
+    }
+    if (btmreg == topreg) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
+        btmreg++;
+    }
+    assert(btmreg == topreg + 1);
+    /* TODO: when MVE is implemented, zero VPR here */
+    return true;
+}
+
+static bool trans_NOCP(DisasContext *s, arg_nocp *a)
+{
+    /*
+     * Handle M-profile early check for disabled coprocessor:
+     * all we need to do here is emit the NOCP exception if
+     * the coprocessor is disabled. Otherwise we return false
+     * and the real VFP/etc decode will handle the insn.
+     */
+    assert(arm_dc_feature(s, ARM_FEATURE_M));
+
+    if (a->cp == 11) {
+        a->cp = 10;
+    }
+    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
+        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
+        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
+        a->cp = 10;
+    }
+
+    if (a->cp != 10) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), default_exception_el(s));
+        return true;
+    }
+
+    if (s->fp_excp_el != 0) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), s->fp_excp_el);
+        return true;
+    }
+
+    return false;
+}
+
+static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
+{
+    /* This range needs a coprocessor check for v8.1M and later only */
+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+        return false;
+    }
+    return trans_NOCP(s, a);
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP and Neon decoders */
-#include "decode-m-nocp.c.inc"
 #include "translate-vfp.c.inc"
 #include "translate-neon.c.inc"
 
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     return true;
 }
 
-/*
- * Decode VLLDM and VLSTM are nonstandard because:
- *  * if there is no FPU then these insns must NOP in
- *    Secure state and UNDEF in Nonsecure state
- *  * if there is an FPU then these insns do not have
- *    the usual behaviour that vfp_access_check() provides of
- *    being controlled by CPACR/NSACR enable bits or the
- *    lazy-stacking logic.
- */
-static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
-{
-    TCGv_i32 fptr;
-
-    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
-        !arm_dc_feature(s, ARM_FEATURE_V8)) {
-        return false;
-    }
-
-    if (a->op) {
-        /*
-         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
-         * to take the IMPDEF option to make memory accesses to the stack
-         * slots that correspond to the D16-D31 registers (discarding
-         * read data and writing UNKNOWN values), so for us the T2
-         * encoding behaves identically to the T1 encoding.
-         */
-        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
-            return false;
-        }
-    } else {
-        /*
-         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
-         * This is currently architecturally impossible, but we add the
-         * check to stay in line with the pseudocode. Note that we must
-         * emit code for the UNDEF so it takes precedence over the NOCP.
-         */
-        if (dc_isar_feature(aa32_simd_r32, s)) {
-            unallocated_encoding(s);
-            return true;
-        }
-    }
-
-    /*
-     * If not secure, UNDEF. We must emit code for this
-     * rather than returning false so that this takes
-     * precedence over the m-nocp.decode NOCP fallback.
-     */
-    if (!s->v8m_secure) {
-        unallocated_encoding(s);
-        return true;
-    }
-    /* If no fpu, NOP. */
-    if (!dc_isar_feature(aa32_vfp, s)) {
-        return true;
-    }
-
-    fptr = load_reg(s, a->rn);
-    if (a->l) {
-        gen_helper_v7m_vlldm(cpu_env, fptr);
-    } else {
-        gen_helper_v7m_vlstm(cpu_env, fptr);
-    }
-    tcg_temp_free_i32(fptr);
-
-    /* End the TB, because we have updated FP control bits */
-    s->base.is_jmp = DISAS_UPDATE_EXIT;
-    return true;
-}
-
-static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
-{
-    int btmreg, topreg;
-    TCGv_i64 zero;
-    TCGv_i32 aspen, sfpa;
-
-    if (!dc_isar_feature(aa32_m_sec_state, s)) {
-        /* Before v8.1M, fall through in decode to NOCP check */
-        return false;
-    }
-
-    /* Explicitly UNDEF because this takes precedence over NOCP */
-    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
-        unallocated_encoding(s);
-        return true;
-    }
-
-    if (!dc_isar_feature(aa32_vfp_simd, s)) {
-        /* NOP if we have neither FP nor MVE */
-        return true;
-    }
-
-    /*
-     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
-     * active floating point context so we must NOP (without doing
-     * any lazy state preservation or the NOCP check).
-     */
-    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
-    sfpa = load_cpu_field(v7m.control[M_REG_S]);
-    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
-    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
-    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
-    tcg_gen_or_i32(sfpa, sfpa, aspen);
-    arm_gen_condlabel(s);
-    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
-
-    if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
-        return true;
-    }
-
-    topreg = a->vd + a->imm - 1;
-    btmreg = a->vd;
-
-    /* Convert to Sreg numbers if the insn specified in Dregs */
-    if (a->size == 3) {
-        topreg = topreg * 2 + 1;
-        btmreg *= 2;
-    }
-
-    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
-        /* UNPREDICTABLE: we choose to undef */
-        unallocated_encoding(s);
-        return true;
-    }
-
-    /* Silently ignore requests to clear D16-D31 if they don't exist */
-    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
-        topreg = 31;
-    }
-
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
-    /* Zero the Sregs from btmreg to topreg inclusive. */
-    zero = tcg_const_i64(0);
-    if (btmreg & 1) {
-        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
-        btmreg++;
-    }
-    for (; btmreg + 1 <= topreg; btmreg += 2) {
-        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
-    }
-    if (btmreg == topreg) {
-        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
-        btmreg++;
-    }
-    assert(btmreg == topreg + 1);
-    /* TODO: when MVE is implemented, zero VPR here */
-    return true;
-}
-
-static bool trans_NOCP(DisasContext *s, arg_nocp *a)
-{
-    /*
-     * Handle M-profile early check for disabled coprocessor:
-     * all we need to do here is emit the NOCP exception if
-     * the coprocessor is disabled. Otherwise we return false
-     * and the real VFP/etc decode will handle the insn.
-     */
-    assert(arm_dc_feature(s, ARM_FEATURE_M));
-
-    if (a->cp == 11) {
-        a->cp = 10;
-    }
-    if (arm_dc_feature(s, ARM_FEATURE_V8_1M) &&
-        (a->cp == 8 || a->cp == 9 || a->cp == 14 || a->cp == 15)) {
-        /* in v8.1M cp 8, 9, 14, 15 also are governed by the cp10 enable */
-        a->cp = 10;
-    }
-
-    if (a->cp != 10) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), default_exception_el(s));
-        return true;
-    }
-
-    if (s->fp_excp_el != 0) {
-        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                           syn_uncategorized(), s->fp_excp_el);
-        return true;
-    }
-
-    return false;
-}
-
-static bool trans_NOCP_8_1(DisasContext *s, arg_nocp *a)
-{
-    /* This range needs a coprocessor check for v8.1M and later only */
-    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
-        return false;
-    }
-    return trans_NOCP(s, a);
-}
-
 static bool trans_VINS(DisasContext *s, arg_VINS *a)
 {
     TCGv_i32 rd, rm;
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
   decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
   decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
-  decodetree.process('m-nocp.decode', extra_args: '--static-decode=disas_m_nocp'),
+  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
   decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'op_helper.c',
   'tlb_helper.c',
   'translate.c',
+  'translate-m-nocp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
-- 
2.20.1

Move the various gen_aa32* functions and macros out of translate.c
and into translate-a32.h.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
     return tmp;
 }
 
+void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc);
+void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc);
+
+#define DO_GEN_LD(SUFF, OPC)                                            \
+    static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
+                                         TCGv_i32 a32, int index)       \
+    {                                                                   \
+        gen_aa32_ld_i32(s, val, a32, index, OPC);                       \
+    }
+
+#define DO_GEN_ST(SUFF, OPC)                                            \
+    static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val, \
+                                         TCGv_i32 a32, int index)       \
+    {                                                                   \
+        gen_aa32_st_i32(s, val, a32, index, OPC);                       \
+    }
+
+static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
+                                 TCGv_i32 a32, int index)
+{
+    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
+}
+
+static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
+                                 TCGv_i32 a32, int index)
+{
+    gen_aa32_st_i64(s, val, a32, index, MO_Q);
+}
+
+DO_GEN_LD(8u, MO_UB)
+DO_GEN_LD(16u, MO_UW)
+DO_GEN_LD(32u, MO_UL)
+DO_GEN_ST(8, MO_UB)
+DO_GEN_ST(16, MO_UW)
+DO_GEN_ST(32, MO_UL)
+
+#undef DO_GEN_LD
+#undef DO_GEN_ST
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
  * Internal routines are used for NEON cases where the endianness
  * and/or alignment has already been taken into account and manipulated.
  */
-static void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
     tcg_gen_qemu_ld_i32(val, addr, index, opc);
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
     tcg_gen_qemu_st_i32(val, addr, index, opc);
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
 
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
-                                     TCGv_i32 a32, int index, MemOp opc)
+void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+                              TCGv_i32 a32, int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
 
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
     tcg_temp_free(addr);
 }
 
-static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_ld_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_ld_internal_i64(s, val, a32, index, finalize_memop(s, opc));
 }
 
-static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, MemOp opc)
+void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+                     int index, MemOp opc)
 {
     gen_aa32_st_internal_i64(s, val, a32, index, finalize_memop(s, opc));
 }
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
         gen_aa32_st_i32(s, val, a32, index, OPC);                       \
     }
 
-static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
-                                 TCGv_i32 a32, int index)
-{
-    gen_aa32_ld_i64(s, val, a32, index, MO_Q);
-}
-
-static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
-                                 TCGv_i32 a32, int index)
-{
-    gen_aa32_st_i64(s, val, a32, index, MO_Q);
-}
-
-DO_GEN_LD(8u, MO_UB)
-DO_GEN_LD(16u, MO_UW)
-DO_GEN_LD(32u, MO_UL)
-DO_GEN_ST(8, MO_UB)
-DO_GEN_ST(16, MO_UW)
-DO_GEN_ST(32, MO_UL)
-
 static inline void gen_hvc(DisasContext *s, int imm16)
 {
     /* The pre HVC helper handles cases when HVC gets trapped
-- 
2.20.1

The functions vfp_load_reg32(), vfp_load_reg64(), vfp_store_reg32()
and vfp_store_reg64() are used only in translate-vfp.c.inc. Move
them to that file.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static long vfp_reg_offset(bool dp, unsigned reg)
     }
 }
 
-static inline void vfp_load_reg64(TCGv_i64 var, int reg)
-{
-    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
-}
-
-static inline void vfp_store_reg64(TCGv_i64 var, int reg)
-{
-    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
-}
-
-static inline void vfp_load_reg32(TCGv_i32 var, int reg)
-{
-    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
-}
-
-static inline void vfp_store_reg32(TCGv_i32 var, int reg)
-{
-    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
-}
-
 void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop)
 {
     long off = neon_element_offset(reg, ele, memop);
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.c.inc"
 #include "decode-vfp-uncond.c.inc"
 
+static inline void vfp_load_reg64(TCGv_i64 var, int reg)
+{
+    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(true, reg));
+}
+
+static inline void vfp_store_reg64(TCGv_i64 var, int reg)
+{
+    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(true, reg));
+}
+
+static inline void vfp_load_reg32(TCGv_i32 var, int reg)
+{
+    tcg_gen_ld_i32(var, cpu_env, vfp_reg_offset(false, reg));
+}
+
+static inline void vfp_store_reg32(TCGv_i32 var, int reg)
+{
+    tcg_gen_st_i32(var, cpu_env, vfp_reg_offset(false, reg));
+}
+
 /*
  * The imm8 encodes the sign bit, enough bits to represent an exponent in
  * the range 01....1xx to 10....0xx, and the most significant 4 bits of
-- 
2.20.1

Make the remaining functions which are needed by translate-vfp.c.inc
global.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ void read_neon_element32(TCGv_i32 dest, int reg, int ele, MemOp memop);
 void read_neon_element64(TCGv_i64 dest, int reg, int ele, MemOp memop);
 void write_neon_element32(TCGv_i32 src, int reg, int ele, MemOp memop);
 void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop);
+TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs);
+void gen_set_cpsr(TCGv_i32 var, uint32_t mask);
+void gen_set_condexec(DisasContext *s);
+void gen_set_pc_im(DisasContext *s, target_ulong val);
+void gen_lookup_tb(DisasContext *s);
+long vfp_reg_offset(bool dp, unsigned reg);
+long neon_full_reg_offset(unsigned reg);
 
 static inline TCGv_i32 load_cpu_offset(int offset)
 {
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
     return tmp;
 }
 
+void store_reg(DisasContext *s, int reg, TCGv_i32 var);
+
 void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
                               TCGv_i32 a32, int index, MemOp opc);
 void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
 #undef DO_GEN_LD
 #undef DO_GEN_ST
 
+#if defined(CONFIG_USER_ONLY)
+#define IS_USER(s) 1
+#else
+#define IS_USER(s) (s->user)
+#endif
+
+/* Set NZCV flags from the high 4 bits of var.  */
+#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "translate.h"
 #include "translate-a32.h"
 
-#if defined(CONFIG_USER_ONLY)
-#define IS_USER(s) 1
-#else
-#define IS_USER(s) (s->user)
-#endif
-
 /* These are TCG temporaries used only by the legacy iwMMXt decoder */
 static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
 /* These are TCG globals which alias CPUARMState fields */
@@ -XXX,XX +XXX,XX @@ void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
  * This is used for load/store for which use of PC implies (literal),
  * or ADD that implies ADR.
  */
-static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
+TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
 
 /* Set a CPU register.  The source must be a temporary and will be
    marked as dead.  */
-static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 {
     if (reg == 15) {
         /* In Thumb mode, we must ignore bit 0.
@@ -XXX,XX +XXX,XX @@ static void store_sp_checked(DisasContext *s, TCGv_i32 var)
 #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
 #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
 
-
-static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
+void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
 {
     TCGv_i32 tmp_mask = tcg_const_i32(mask);
     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
     tcg_temp_free_i32(tmp_mask);
 }
-/* Set NZCV flags from the high 4 bits of var.  */
-#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 
 static void gen_exception_internal(int excp)
 {
@@ -XXX,XX +XXX,XX @@ void arm_gen_test_cc(int cc, TCGLabel *label)
     arm_free_cc(&cmp);
 }
 
-static inline void gen_set_condexec(DisasContext *s)
+void gen_set_condexec(DisasContext *s)
 {
     if (s->condexec_mask) {
         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_set_condexec(DisasContext *s)
     }
 }
 
-static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
+void gen_set_pc_im(DisasContext *s, target_ulong val)
 {
     tcg_gen_movi_i32(cpu_R[15], val);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
 }
 
 /* Force a TB lookup after an instruction that changes the CPU state.  */
-static inline void gen_lookup_tb(DisasContext *s)
+void gen_lookup_tb(DisasContext *s)
 {
     tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
     s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
 /*
  * Return the offset of a "full" NEON Dreg.
  */
-static long neon_full_reg_offset(unsigned reg)
+long neon_full_reg_offset(unsigned reg)
 {
     return offsetof(CPUARMState, vfp.zregs[reg >> 1].d[reg & 1]);
 }
@@ -XXX,XX +XXX,XX @@ static long neon_element_offset(int reg, int element, MemOp memop)
 }
 
 /* Return the offset of a VFP Dreg (dp = true) or VFP Sreg (dp = false). */
-static long vfp_reg_offset(bool dp, unsigned reg)
+long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
         return neon_element_offset(reg, 0, MO_64);
-- 
2.20.1

Switch translate-vfp.c.inc from being #included into translate.c
to being its own compilation unit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-9-peter.maydell@linaro.org
---
 target/arm/translate-a32.h                          |  2 ++
 target/arm/{translate-vfp.c.inc => translate-vfp.c} | 12 +++++++-----
 target/arm/translate.c                              |  3 +--
 target/arm/meson.build                              |  5 +++--
 4 files changed, 13 insertions(+), 9 deletions(-)
 rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (99%)

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 
 /* Prototypes for autogenerated disassembler functions */
 bool disas_m_nocp(DisasContext *dc, uint32_t insn);
+bool disas_vfp(DisasContext *s, uint32_t insn);
+bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
 
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c
similarity index 99%
rename from target/arm/translate-vfp.c.inc
rename to target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * This file is intended to be included from translate.c; it uses
- * some macros and definitions provided by that file.
- * It might be possible to convert it to a standalone .c file eventually.
- */
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "tcg/tcg-op-gvec.h"
+#include "exec/exec-all.h"
+#include "exec/gen-icount.h"
+#include "translate.h"
+#include "translate-a32.h"
 
 /* Include the generated VFP decoder */
 #include "decode-vfp.c.inc"
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 
 #define ARM_CP_RW_BIT   (1 << 20)
 
-/* Include the VFP and Neon decoders */
-#include "translate-vfp.c.inc"
+/* Include the Neon decoder */
 #include "translate-neon.c.inc"
 
 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
   decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
   decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
   decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
-  decodetree.process('vfp.decode', extra_args: '--static-decode=disas_vfp'),
-  decodetree.process('vfp-uncond.decode', extra_args: '--static-decode=disas_vfp_uncond'),
+  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
+  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
   decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
   decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'tlb_helper.c',
   'translate.c',
   'translate-m-nocp.c',
+  'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
-- 
2.20.1

The function vfp_reg_ptr() is used only in translate-neon.c.inc;
move it there.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
     }
 }
 
-static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-{
-    TCGv_ptr ret = tcg_temp_new_ptr();
-    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
-    return ret;
-}
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the Neon decoder */
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static inline int neon_3same_fp_size(DisasContext *s, int x)
 #include "decode-neon-ls.c.inc"
 #include "decode-neon-shared.c.inc"
 
+static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
+    return ret;
+}
+
 static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
 {
     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
-- 
2.20.1

Move the NeonGenThreeOpEnvFn typedef to translate.h together
with the other similar typedefs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210430132740.10391-12-peter.maydell@linaro.org
---
 target/arm/translate.h | 2 ++
 target/arm/translate.c | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i32, TCGv_i32);
 typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
 typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
 typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
+typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                 TCGv_i32, TCGv_i32);
 typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
 typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
 typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
 
-/* Function prototypes for gen_ functions calling Neon helpers.  */
-typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
-                                 TCGv_i32, TCGv_i32);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
-- 
2.20.1

Make the remaining functions needed by the translate-neon code
global.

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@ void gen_set_pc_im(DisasContext *s, target_ulong val);
 void gen_lookup_tb(DisasContext *s);
 long vfp_reg_offset(bool dp, unsigned reg);
 long neon_full_reg_offset(unsigned reg);
+long neon_element_offset(int reg, int element, MemOp memop);
+void gen_rev16(TCGv_i32 dest, TCGv_i32 var);
 
 static inline TCGv_i32 load_cpu_offset(int offset)
 {
@@ -XXX,XX +XXX,XX @@ DO_GEN_ST(32, MO_UL)
 /* Set NZCV flags from the high 4 bits of var.  */
 #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 
+/* Swap low and high halfwords.  */
+static inline void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
+{
+    tcg_gen_rotri_i32(dest, var, 16);
+}
+
 #endif
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
 }
 
 /* Byteswap each halfword.  */
-static void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
     TCGv_i32 mask = tcg_const_i32(0x00ff00ff);
@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
     tcg_gen_ext16s_i32(dest, var);
 }
 
-/* Swap low and high halfwords.  */
-static void gen_swap_half(TCGv_i32 dest, TCGv_i32 var)
-{
-    tcg_gen_rotri_i32(dest, var, 16);
-}
-
 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
     tmp = (t0 ^ t1) & 0x8000;
     t0 &= ~0x8000;
@@ -XXX,XX +XXX,XX @@ long neon_full_reg_offset(unsigned reg)
  * Return the offset of a 2**SIZE piece of a NEON register, at index ELE,
  * where 0 is the least significant end of the register.
  */
-static long neon_element_offset(int reg, int element, MemOp memop)
+long neon_element_offset(int reg, int element, MemOp memop)
 {
     int element_size = 1 << (memop & MO_SIZE);
     int ofs = element * element_size;
-- 
2.20.1

Switch translate-neon.c.inc from being #included into translate.c
to being its own compilation unit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430132740.10391-14-peter.maydell@linaro.org
---
 target/arm/translate-a32.h                           |  3 +++
 .../arm/{translate-neon.c.inc => translate-neon.c}   | 12 +++++++-----
 target/arm/translate.c                               |  3 ---
 target/arm/meson.build                               |  7 ++++---
 4 files changed, 14 insertions(+), 11 deletions(-)
 rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)

diff --git a/target/arm/translate-a32.h b/target/arm/translate-a32.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a32.h
+++ b/target/arm/translate-a32.h
@@ -XXX,XX +XXX,XX @@
 bool disas_m_nocp(DisasContext *dc, uint32_t insn);
 bool disas_vfp(DisasContext *s, uint32_t insn);
 bool disas_vfp_uncond(DisasContext *s, uint32_t insn);
+bool disas_neon_dp(DisasContext *s, uint32_t insn);
+bool disas_neon_ls(DisasContext *s, uint32_t insn);
+bool disas_neon_shared(DisasContext *s, uint32_t insn);
 
 void load_reg_var(DisasContext *s, TCGv_i32 var, int reg);
 void arm_gen_condlabel(DisasContext *s);
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c
similarity index 99%
rename from target/arm/translate-neon.c.inc
rename to target/arm/translate-neon.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * This file is intended to be included from translate.c; it uses
- * some macros and definitions provided by that file.
- * It might be possible to convert it to a standalone .c file eventually.
- */
+#include "qemu/osdep.h"
+#include "tcg/tcg-op.h"
+#include "tcg/tcg-op-gvec.h"
+#include "exec/exec-all.h"
+#include "exec/gen-icount.h"
+#include "translate.h"
+#include "translate-a32.h"
 
 static inline int plus1(DisasContext *s, int x)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
 
 #define ARM_CP_RW_BIT   (1 << 20)
 
-/* Include the Neon decoder */
-#include "translate-neon.c.inc"
-
 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
 {
     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
 gen = [
   decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
-  decodetree.process('neon-shared.decode', extra_args: '--static-decode=disas_neon_shared'),
-  decodetree.process('neon-dp.decode', extra_args: '--static-decode=disas_neon_dp'),
-  decodetree.process('neon-ls.decode', extra_args: '--static-decode=disas_neon_ls'),
+  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
+  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
+  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
   decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
   decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
   decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'tlb_helper.c',
   'translate.c',
   'translate-m-nocp.c',
+  'translate-neon.c',
   'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
-- 
2.20.1

The WFI insn is not system-mode only, though it doesn't usually make
a huge amount of sense for userspace code to execute it.  Currently
if you try it in qemu-arm then the helper function will raise an
EXCP_HLT exception, which is not covered by the switch in cpu_loop()
and results in an abort:

qemu: unhandled CPU exception 0x10001 - aborting
R00=00000001 R01=408003e4 R02=408003ec R03=000102ec
R04=00010a28 R05=00010158 R06=00087460 R07=00010158
R08=00000000 R09=00000000 R10=00085b7c R11=408002a4
R12=408002b8 R13=408002a0 R14=0001057c R15=000102f8
PSR=60000010 -ZC- A usr32
qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fcbfa4f0a12

Make the WFI helper function return immediately in the usermode
emulator. This turns WFI into a NOP, which is OK because:
 * architecturally "WFI is a NOP" is a permitted implementation
 * aarch64 Linux kernels use the SCTLR_EL1.nTWI bit to trap
   userspace WFI and NOP it (though aarch32 kernels currently
   just let WFI do whatever it would do)

We could in theory make the translate.c code special case user-mode
emulation and NOP the insn entirely rather than making the helper
do nothing, but because no real world code will be trying to
execute WFI we don't care about efficiency and the helper provides
a single place where we can make the change rather than having
to touch multiple places in translate.c and translate-a64.c.

Fixes: https://bugs.launchpad.net/qemu/+bug/1926759
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210430162212.825-1-peter.maydell@linaro.org
---
 target/arm/op_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
 
 void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
 {
+#ifdef CONFIG_USER_ONLY
+    /*
+     * WFI in the user-mode emulator is technically permitted but not
+     * something any real-world code would do. AArch64 Linux kernels
+     * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP;
+     * AArch32 kernels don't trap it so it will delay a bit.
+     * For QEMU, make it NOP here, because trying to raise EXCP_HLT
+     * would trigger an abort.
+     */
+    return;
+#else
     CPUState *cs = env_cpu(env);
     int target_el = check_wfx_trap(env, false);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
     cs->exception_index = EXCP_HLT;
     cs->halted = 1;
     cpu_loop_exit(cs);
+#endif
 }
 
 void HELPER(wfe)(CPUARMState *env)
-- 
2.20.1

The omap_mmc_reset() function resets its SD card via
device_legacy_reset().  We know that the SD card does not have a qbus
of its own, so the new device_cold_reset() function (which resets
both the device and its child buses) is equivalent here to
device_legacy_reset() and we can just switch to the new API.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210430222348.8514-1-peter.maydell@linaro.org
---
 hw/sd/omap_mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
      * into any bus, and we must reset it manually. When omap_mmc is
      * QOMified this must move into the QOM reset function.
      */
-    device_legacy_reset(DEVICE(host->card));
+    device_cold_reset(DEVICE(host->card));
 }
 
 static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
-- 
2.20.1

Both os-win32.h and os-posix.h include system header files. Instead
of having osdep.h include them inside its 'extern "C"' block, make
these headers handle that themselves, so that we don't include the
system headers inside 'extern "C"'.

This doesn't fix any current problems, but it's conceptually the
right way to handle system headers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/osdep.h      | 8 ++++----
 include/sysemu/os-posix.h | 8 ++++++++
 include/sysemu/os-win32.h | 8 ++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ QEMU_EXTERN_C int daemon(int, int);
  */
 #include "glib-compat.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #ifdef _WIN32
 #include "sysemu/os-win32.h"
 #endif
@@ -XXX,XX +XXX,XX @@ extern "C" {
 #include "sysemu/os-posix.h"
 #endif
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #include "qemu/typedefs.h"
 
 /*
diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-posix.h
+++ b/include/sysemu/os-posix.h
@@ -XXX,XX +XXX,XX @@
 #include <sys/sysmacros.h>
 #endif
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 void os_set_line_buffering(void);
 void os_set_proc_name(const char *s);
 void os_setup_signal_handling(void);
@@ -XXX,XX +XXX,XX @@ static inline void qemu_funlockfile(FILE *f)
     funlockfile(f);
 }
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif
diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@
 #include <windows.h>
 #include <ws2tcpip.h>
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #if defined(_WIN64)
 /* On w64, setjmp is implemented by _setjmp which needs a second parameter.
  * If this parameter is NULL, longjump does no stack unwinding.
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_recv_wrap(int sockfd, void *buf, size_t len, int flags);
 ssize_t qemu_recvfrom_wrap(int sockfd, void *buf, size_t len, int flags,
                            struct sockaddr *addr, socklen_t *addrlen);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif
-- 
2.20.1

Make bswap.h handle being included outside an 'extern "C"' block:
all system headers are included first, then all declarations are
put inside an 'extern "C"' block.

This requires a little rearrangement as currently we have an ifdef
ladder that has some system includes and some local declarations
or definitions, and we need to separate those out.

We want to do this because dis-asm.h includes bswap.h, dis-asm.h
may need to be included from C++ files, and system headers should
not be included within 'extern "C"' blocks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/bswap.h | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
-#include "fpu/softfloat-types.h"
-
 #ifdef CONFIG_MACHINE_BSWAP_H
 # include <sys/endian.h>
 # include <machine/bswap.h>
@@ -XXX,XX +XXX,XX @@
 # include <endian.h>
 #elif defined(CONFIG_BYTESWAP_H)
 # include <byteswap.h>
+#define BSWAP_FROM_BYTESWAP
+# else
+#define BSWAP_FROM_FALLBACKS
+#endif /* ! CONFIG_MACHINE_BSWAP_H */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "fpu/softfloat-types.h"
+
+#ifdef BSWAP_FROM_BYTESWAP
 static inline uint16_t bswap16(uint16_t x)
 {
     return bswap_16(x);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
 {
     return bswap_64(x);
 }
-# else
+#endif
+
+#ifdef BSWAP_FROM_FALLBACKS
 static inline uint16_t bswap16(uint16_t x)
 {
     return (((x & 0x00ff) << 8) |
@@ -XXX,XX +XXX,XX @@ static inline uint64_t bswap64(uint64_t x)
             ((x & 0x00ff000000000000ULL) >> 40) |
             ((x & 0xff00000000000000ULL) >> 56));
 }
-#endif /* ! CONFIG_MACHINE_BSWAP_H */
+#endif
+
+#undef BSWAP_FROM_BYTESWAP
+#undef BSWAP_FROM_FALLBACKS
 
 static inline void bswap16s(uint16_t *s)
 {
@@ -XXX,XX +XXX,XX @@ DO_STN_LDN_P(be)
 #undef le_bswaps
 #undef be_bswaps
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* BSWAP_H */
-- 
2.20.1

Make dis-asm.h handle being included outside an 'extern "C"' block;
this allows us to remove the 'extern "C"' blocks that our two C++
files that include it are using.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/disas/dis-asm.h | 12 ++++++++++--
 disas/arm-a64.cc        |  2 --
 disas/nanomips.cpp      |  2 --
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/disas/dis-asm.h b/include/disas/dis-asm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/disas/dis-asm.h
+++ b/include/disas/dis-asm.h
@@ -XXX,XX +XXX,XX @@
 #ifndef DISAS_DIS_ASM_H
 #define DISAS_DIS_ASM_H
 
+#include "qemu/bswap.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 typedef void *PTR;
 typedef uint64_t bfd_vma;
 typedef int64_t bfd_signed_vma;
@@ -XXX,XX +XXX,XX @@ bool cap_disas_plugin(disassemble_info *info, uint64_t pc, size_t size);
 
 /* from libbfd */
 
-#include "qemu/bswap.h"
-
 static inline bfd_vma bfd_getl64(const bfd_byte *addr)
 {
     return ldq_le_p(addr);
@@ -XXX,XX +XXX,XX @@ static inline bfd_vma bfd_getb16(const bfd_byte *addr)
 
 typedef bool bfd_boolean;
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* DISAS_DIS_ASM_H */
diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
index XXXXXXX..XXXXXXX 100644
--- a/disas/arm-a64.cc
+++ b/disas/arm-a64.cc
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-extern "C" {
 #include "disas/dis-asm.h"
-}
 
 #include "vixl/a64/disasm-a64.h"
 
diff --git a/disas/nanomips.cpp b/disas/nanomips.cpp
index XXXXXXX..XXXXXXX 100644
--- a/disas/nanomips.cpp
+++ b/disas/nanomips.cpp
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-extern "C" {
 #include "disas/dis-asm.h"
-}
 
 #include <cstring>
 #include <stdexcept>
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The i.MX25 PDK board has 2 banks for SDRAM, each can
address up to 256 MiB. So the total RAM usable for this
board is 512M. When we ask for more we get a misleading
error message:

$ qemu-system-arm -M imx25-pdk -m 513M
  qemu-system-arm: Invalid RAM size, should be 128 MiB

Update the error message to better match the reality:

$ qemu-system-arm -M imx25-pdk -m 513M
  qemu-system-arm: RAM size more than 512 MiB is not supported

Fixes: bf350daae02 ("arm/imx25_pdk: drop RAM size fixup")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210407225608.1882855-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/imx25_pdk.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/imx25_pdk.c
+++ b/hw/arm/imx25_pdk.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info imx25_pdk_binfo;
 
 static void imx25_pdk_init(MachineState *machine)
 {
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
     IMX25PDK *s = g_new0(IMX25PDK, 1);
     unsigned int ram_size;
     unsigned int alias_offset;
@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
 
     /* We need to initialize our memory */
     if (machine->ram_size > (FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE)) {
-        char *sz = size_to_str(mc->default_ram_size);
-        error_report("Invalid RAM size, should be %s", sz);
+        char *sz = size_to_str(FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE);
+        error_report("RAM size more than %s is not supported", sz);
         g_free(sz);
         exit(EXIT_FAILURE);
     }
-- 
2.20.1

The MPS2 SCC device doesn't have any documentation of its properties;
add a "QEMU interface" format comment describing them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210504120912.23094-2-peter.maydell@linaro.org
---
 include/hw/misc/mps2-scc.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mps2-scc.h
+++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
  *  (at your option) any later version.
  */
 
+/*
+ * This is a model of the Serial Communication Controller (SCC)
+ * block found in most MPS FPGA images.
+ *
+ * QEMU interface:
+ *  + sysbus MMIO region 0: the register bank
+ *  + QOM property "scc-cfg4": value of the read-only CFG4 register
+ *  + QOM property "scc-aid": value of the read-only SCC_AID register
+ *  + QOM property "scc-id": value of the read-only SCC_ID register
+ *  + QOM property array "oscclk": reset values of the OSCCLK registers
+ *    (which are accessed via the SYS_CFG channel provided by this device)
+ */
 #ifndef MPS2_SCC_H
 #define MPS2_SCC_H
 
-- 
2.20.1

On some boards, SCC config register CFG0 bit 0 controls whether
parts of the board memory map are remapped. Support this with:
 * a device property scc-cfg0 so the board can specify the
   initial value of the CFG0 register
 * an outbound GPIO line which tracks bit 0 and which the board
   can wire up to provide the remapping

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210504120912.23094-3-peter.maydell@linaro.org
---
 include/hw/misc/mps2-scc.h |  9 +++++++++
 hw/misc/mps2-scc.c         | 13 ++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mps2-scc.h
+++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
  *  + QOM property "scc-cfg4": value of the read-only CFG4 register
  *  + QOM property "scc-aid": value of the read-only SCC_AID register
  *  + QOM property "scc-id": value of the read-only SCC_ID register
+ *  + QOM property "scc-cfg0": reset value of the CFG0 register
  *  + QOM property array "oscclk": reset values of the OSCCLK registers
  *    (which are accessed via the SYS_CFG channel provided by this device)
+ *  + named GPIO output "remap": this tracks the value of CFG0 register
+ *    bit 0. Boards where this bit controls memory remapping should
+ *    connect this GPIO line to a function performing that mapping.
+ *    Boards where bit 0 has no special function should leave the GPIO
+ *    output disconnected.
  */
 #ifndef MPS2_SCC_H
 #define MPS2_SCC_H
@@ -XXX,XX +XXX,XX @@ struct MPS2SCC {
     uint32_t num_oscclk;
     uint32_t *oscclk;
     uint32_t *oscclk_reset;
+    uint32_t cfg0_reset;
+
+    qemu_irq remap;
 };
 
 #endif
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "trace.h"
 #include "hw/sysbus.h"
+#include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/registerfields.h"
 #include "hw/misc/mps2-scc.h"
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
     switch (offset) {
     case A_CFG0:
         /*
-         * TODO on some boards bit 0 controls RAM remapping;
-         * on others bit 1 is CPU_WAIT.
+         * On some boards bit 0 controls board-specific remapping;
+         * we always reflect bit 0 in the 'remap' GPIO output line,
+         * and let the board wire it up or not as it chooses.
+         * TODO on some boards bit 1 is CPU_WAIT.
          */
         s->cfg0 = value;
+        qemu_set_irq(s->remap, s->cfg0 & 1);
         break;
     case A_CFG1:
         s->cfg1 = value;
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_reset(DeviceState *dev)
     int i;
 
     trace_mps2_scc_reset();
-    s->cfg0 = 0;
+    s->cfg0 = s->cfg0_reset;
     s->cfg1 = 0;
     s->cfg2 = 0;
     s->cfg5 = 0;
@@ -XXX,XX +XXX,XX @@ static void mps2_scc_init(Object *obj)
 
     memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1);
 }
 
 static void mps2_scc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
     DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
     DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
+    /* Reset value for CFG0 register */
+    DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0),
     /*
      * These are the initial settings for the source clocks on the board.
      * In hardware they can be configured via a config file read by the
-- 
2.20.1

The AN524 FPGA image supports two memory maps, which differ in where
the QSPI and BRAM are.  In the default map, the BRAM is at
0x0000_0000, and the QSPI at 0x2800_0000.  In the second map, they
are the other way around.

In hardware, the initial mapping can be selected by the user by
writing either "REMAP: BRAM" (the default) or "REMAP: QSPI" in the
board configuration file.  The board config file is acted on by the
"Motherboard Configuration Controller", which is an entirely separate
microcontroller on the dev board but outside the FPGA.

The guest can also dynamically change the mapping via the SCC
CFG_REG0 register.

Implement this functionality for QEMU, using a machine property
"remap" with valid values "BRAM" and "QSPI" to allow the user to set
the initial mapping, in the same way they can on the FPGA, and
wiring up the bit from the SCC register to also switch the mapping.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210504120912.23094-4-peter.maydell@linaro.org
---
 docs/system/arm/mps2.rst |  10 ++++
 hw/arm/mps2-tz.c         | 108 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 117 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/mps2.rst
+++ b/docs/system/arm/mps2.rst
@@ -XXX,XX +XXX,XX @@ Differences between QEMU and real hardware:
   flash, but only as simple ROM, so attempting to rewrite the flash
   from the guest will fail
 - QEMU does not model the USB controller in MPS3 boards
+
+Machine-specific options
+""""""""""""""""""""""""
+
+The following machine-specific options are supported:
+
+remap
+  Supported for ``mps3-an524`` only.
+  Set ``BRAM``/``QSPI`` to select the initial memory mapping. The
+  default is ``BRAM``.
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/reset.h"
 #include "hw/misc/unimp.h"
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/core/split-irq.h"
 #include "hw/qdev-clock.h"
 #include "qom/object.h"
+#include "hw/irq.h"
 
 #define MPS2TZ_NUMIRQ_MAX 96
 #define MPS2TZ_RAM_MAX 5
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
     Clock *sysclk;
     Clock *s32kclk;
+
+    bool remap;
+    qemu_irq remap_irq;
 };
 
 #define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -XXX,XX +XXX,XX @@ static const RAMInfo an505_raminfo[] = { {
     },
 };
 
+/*
+ * Note that the addresses and MPC numbering here should match up
+ * with those used in remap_memory(), which can swap the BRAM and QSPI.
+ */
 static const RAMInfo an524_raminfo[] = { {
         .name = "bram",
         .base = 0x00000000,
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 
     object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
     sccdev = DEVICE(scc);
+    qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
     qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
     qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
     qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
 }
 
+static hwaddr boot_mem_base(MPS2TZMachineState *mms)
+{
+    /*
+     * Return the canonical address of the block which will be mapped
+     * at address 0x0 (i.e. where the vector table is).
+     * This is usually 0, but if the AN524 alternate memory map is
+     * enabled it will be the base address of the QSPI block.
+     */
+    return mms->remap ? 0x28000000 : 0;
+}
+
+static void remap_memory(MPS2TZMachineState *mms, int map)
+{
+    /*
+     * Remap the memory for the AN524. 'map' is the value of
+     * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
+     * for the "option 1" mapping where QSPI is at address 0.
+     *
+     * Effectively we need to swap around the "upstream" ends of
+     * MPC 0 and MPC 1.
+     */
+    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+    int i;
+
+    if (mmc->fpga_type != FPGA_AN524) {
+        return;
+    }
+
+    memory_region_transaction_begin();
+    for (i = 0; i < 2; i++) {
+        TZMPC *mpc = &mms->mpc[i];
+        MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
+        hwaddr addr = (i ^ map) ? 0x28000000 : 0;
+
+        memory_region_set_address(upstream, addr);
+    }
+    memory_region_transaction_commit();
+}
+
+static void remap_irq_fn(void *opaque, int n, int level)
+{
+    MPS2TZMachineState *mms = opaque;
+
+    remap_memory(mms, level);
+}
+
 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
                               const int *irqs)
@@ -XXX,XX +XXX,XX @@ static uint32_t boot_ram_size(MPS2TZMachineState *mms)
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 
     for (p = mmc->raminfo; p->name; p++) {
-        if (p->base == 0) {
+        if (p->base == boot_mem_base(mms)) {
             return p->size;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
 
     create_non_mpc_ram(mms);
 
+    if (mmc->fpga_type == FPGA_AN524) {
+        /*
+         * Connect the line from the SCC so that we can remap when the
+         * guest updates that register.
+         */
+        mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
+        qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
+                                    mms->remap_irq);
+    }
+
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
                        boot_ram_size(mms));
 }
@@ -XXX,XX +XXX,XX @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
     *iregion = region;
 }
 
+static char *mps2_get_remap(Object *obj, Error **errp)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+    const char *val = mms->remap ? "QSPI" : "BRAM";
+    return g_strdup(val);
+}
+
+static void mps2_set_remap(Object *obj, const char *value, Error **errp)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+
+    if (!strcmp(value, "BRAM")) {
+        mms->remap = false;
+    } else if (!strcmp(value, "QSPI")) {
+        mms->remap = true;
+    } else {
+        error_setg(errp, "Invalid remap value");
+        error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
+    }
+}
+
+static void mps2_machine_reset(MachineState *machine)
+{
+    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
+
+    /*
+     * Set the initial memory mapping before triggering the reset of
+     * the rest of the system, so that the guest image loader and CPU
+     * reset see the correct mapping.
+     */
+    remap_memory(mms, mms->remap);
+    qemu_devices_reset();
+}
+
 static void mps2tz_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
 
     mc->init = mps2tz_common_init;
+    mc->reset = mps2_machine_reset;
     iic->check = mps2_tz_idau_check;
 }
 
@@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
     mmc->raminfo = an524_raminfo;
     mmc->armsse_type = TYPE_SSE200;
     mps2tz_set_default_ram_info(mmc);
+
+    object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
+    object_class_property_set_description(oc, "remap",
+                                          "Set memory mapping. Valid values "
+                                          "are BRAM (default) and QSPI.");
 }
 
 static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Commit dfc388797cc4 ("hw/arm: xlnx: Set all boards' GEM 'phy-addr'
property value to 23") configured the PHY address for xilinx-zynq-a9
to 23. When trying to boot xilinx-zynq-a9 with zynq-zc702.dtb or
zynq-zc706.dtb, this results in the following error message when
trying to use the Ethernet interface.

macb e000b000.ethernet eth0: Could not attach PHY (-19)

The devicetree files for ZC702 and ZC706 configure PHY address 7. The
documentation for the ZC702 and ZC706 evaluation boards suggest that the
PHY address is 7, not 23. Other boards use PHY address 0, 1, 3, or 7.
I was unable to find a documentation or a devicetree file suggesting
or using PHY address 23. The Ethernet interface starts working with
zynq-zc702.dtb and zynq-zc706.dtb when setting the PHY address to 7,
so let's use it.

Cc: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210504124140.1100346-1-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xilinx_zynq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
         qdev_set_nic_properties(dev, nd);
     }
-    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
+    object_property_set_int(OBJECT(dev), "phy-addr", 7, &error_abort);
     s = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, base);
-- 
2.20.1