Series comparison

-[PULL 00/39] target-arm queue
+[PULL 00/23] target-arm queue
-Last pullreq before 6.0 softfreeze: a few minor feature patches,
+Two small bugfixes, plus most of RTH's refactoring of cpregs
-some bugfixes, some cleanups.
+handling.
 -- PMM
-The following changes since commit 6f34661b6c97a37a5efc27d31c037ddeda4547e2:
+The following changes since commit 1fba9dc71a170b3a05b9d3272dd8ecfe7f26e215:
-  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2021-03-11 18:55:27 +0000)
+  Merge tag 'pull-request-2022-05-04' of https://gitlab.com/thuth/qemu into staging (2022-05-04 08:07:02 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210312-1
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220505
-for you to fetch changes up to 41f09f2e9f09e4dd386d84174a6dcb5136af17ca:
+for you to fetch changes up to 99a50d1a67c602126fc2b3a4812d3000eba9bf34:
-  hw/display/pxa2xx: Inline template header (2021-03-12 13:26:08 +0000)
+  target/arm: read access to performance counters from EL0 (2022-05-05 09:36:22 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * versal: Support XRAMs and XRAM controller
+ * Enable read access to performance counters from EL0
- * smmu: Various minor bug fixes
+ * Enable SCTLR_EL1.BT0 for aarch64-linux-user
- * SVE emulation: fix bugs handling odd vector lengths
+ * Refactoring of cpreg handling
  * allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
  * tests/acceptance: fix orangepi-pc acceptance tests
  * hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
  * hw/arm/virt: KVM: The IPA lower bound is 32
  * npcm7xx: support MFT module
  * pl110, pxa2xx_lcd: tidy up template headers
 ----------------------------------------------------------------
-Andrew Jones (2):
+Alex Zuepke (1):
-      accel: kvm: Fix kvm_type invocation
+      target/arm: read access to performance counters from EL0
       hw/arm/virt: KVM: The IPA lower bound is 32
-Edgar E. Iglesias (2):
+Richard Henderson (22):
-      hw/misc: versal: Add a model of the XRAM controller
+      target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
-      hw/arm: versal: Add support for the XRAMs
+      target/arm: Split out cpregs.h
       target/arm: Reorg CPAccessResult and access_check_cp_reg
       target/arm: Replace sentinels with ARRAY_SIZE in cpregs.h
       target/arm: Make some more cpreg data static const
       target/arm: Reorg ARMCPRegInfo type field bits
       target/arm: Avoid bare abort() or assert(0)
       target/arm: Change cpreg access permissions to enum
       target/arm: Name CPState type
       target/arm: Name CPSecureState type
       target/arm: Drop always-true test in define_arm_vh_e2h_redirects_aliases
       target/arm: Store cpregs key in the hash table directly
       target/arm: Merge allocation of the cpreg and its name
       target/arm: Hoist computation of key in add_cpreg_to_hashtable
       target/arm: Consolidate cpreg updates in add_cpreg_to_hashtable
       target/arm: Use bool for is64 and ns in add_cpreg_to_hashtable
       target/arm: Hoist isbanked computation in add_cpreg_to_hashtable
       target/arm: Perform override check early in add_cpreg_to_hashtable
       target/arm: Reformat comments in add_cpreg_to_hashtable
       target/arm: Remove HOST_BIG_ENDIAN ifdef in add_cpreg_to_hashtable
       target/arm: Add isar predicates for FEAT_Debugv8p2
       target/arm: Add isar_feature_{aa64,any}_ras
-Eric Auger (7):
+ target/arm/cpregs.h               | 453 ++++++++++++++++++++++++++++++++++++++
-      intel_iommu: Fix mask may be uninitialized in vtd_context_device_invalidate
+ target/arm/cpu.h                  | 393 +++------------------------------
-      dma: Introduce dma_aligned_pow2_mask()
+ hw/arm/pxa2xx.c                   |   2 +-
-      virtio-iommu: Handle non power of 2 range invalidations
+ hw/arm/pxa2xx_pic.c               |   2 +-
-      hw/arm/smmu-common: Fix smmu_iotlb_inv_iova when asid is not set
+ hw/intc/arm_gicv3_cpuif.c         |   6 +-
-      hw/arm/smmuv3: Enforce invalidation on a power of two range
+ hw/intc/arm_gicv3_kvm.c           |   3 +-
-      hw/arm/smmuv3: Fix SMMU_CMD_CFGI_STE_RANGE handling
+ target/arm/cpu.c                  |  25 +--
-      hw/arm/smmuv3: Uniformize sid traces
+ target/arm/cpu64.c                |   2 +-
+ target/arm/cpu_tcg.c              |   5 +-
-Hao Wu (5):
+ target/arm/gdbstub.c              |   5 +-
-      hw/misc: Add GPIOs for duty in NPCM7xx PWM
+ target/arm/helper.c               | 358 +++++++++++++-----------------
-      hw/misc: Add NPCM7XX MFT Module
+ target/arm/hvf/hvf.c              |   2 +-
-      hw/arm: Add MFT device to NPCM7xx Soc
+ target/arm/kvm-stub.c             |   4 +-
-      hw/arm: Connect PWM fans in NPCM7XX boards
+ target/arm/kvm.c                  |   4 +-
-      tests/qtest: Test PWM fan RPM using MFT in PWM test
+ target/arm/machine.c              |   4 +-
+ target/arm/op_helper.c            |  57 ++---
-Niek Linnenbank (5):
+ target/arm/translate-a64.c        |  14 +-
-      hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
+ target/arm/translate-neon.c       |   2 +-
-      tests/acceptance/boot_linux_console: remove Armbian 19.11.3 bionic test for orangepi-pc machine
+ target/arm/translate.c            |  13 +-
-      tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08
+ tests/tcg/aarch64/bti-3.c         |  42 ++++
-      tests/acceptance: update sunxi kernel from armbian to 5.10.16
+ tests/tcg/aarch64/Makefile.target |   6 +-
-      tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests
+files changed, 738 insertions(+), 664 deletions(-)
+ create mode 100644 target/arm/cpregs.h
-Peter Maydell (9):
+ create mode 100644 tests/tcg/aarch64/bti-3.c
       hw/display/pl110: Remove dead code for non-32-bpp surfaces
       hw/display/pl110: Pull included-once parts of template header into pl110.c
       hw/display/pl110: Remove use of BITS from pl110_template.h
       hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces
       hw/display/pxa2xx_lcd: Remove dest_width state field
       hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h
       hw/display/pxa2xx: Apply brace-related coding style fixes to template header
       hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header
       hw/display/pxa2xx: Inline template header
 Philippe Mathieu-Daudé (1):
       hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
 Richard Henderson (8):
       target/arm: Fix sve_uzp_p vs odd vector lengths
       target/arm: Fix sve_zip_p vs odd vector lengths
       target/arm: Fix sve_punpk_p vs odd vector lengths
       target/arm: Update find_last_active for PREDDESC
       target/arm: Update BRKA, BRKB, BRKN for PREDDESC
       target/arm: Update CNTP for PREDDESC
       target/arm: Update WHILE for PREDDESC
       target/arm: Update sve reduction vs simd_desc
  docs/system/arm/nuvoton.rst            |   2 +-
  docs/system/arm/xlnx-versal-virt.rst   |   1 +
  hw/arm/smmu-internal.h                 |   5 +
  hw/display/pl110_template.h            | 120 +-------
  hw/display/pxa2xx_template.h           | 447 ---------------------------
  include/hw/arm/npcm7xx.h               |  13 +-
  include/hw/arm/xlnx-versal.h           |  13 +
  include/hw/boards.h                    |   1 +
  include/hw/misc/npcm7xx_mft.h          |  70 +++++
  include/hw/misc/npcm7xx_pwm.h          |   4 +-
  include/hw/misc/xlnx-versal-xramc.h    |  97 ++++++
  include/sysemu/dma.h                   |  12 +
  target/arm/kvm_arm.h                   |   6 +-
  accel/kvm/kvm-all.c                    |   2 +
  hw/arm/npcm7xx.c                       |  45 ++-
  hw/arm/npcm7xx_boards.c                |  99 ++++++
  hw/arm/smmu-common.c                   |  32 +-
  hw/arm/smmuv3.c                        |  58 ++--
  hw/arm/virt.c                          |  23 +-
  hw/arm/xlnx-versal.c                   |  36 +++
  hw/display/pl110.c                     | 123 +++++---
  hw/display/pxa2xx_lcd.c                | 520 ++++++++++++++++++++++++++-----
  hw/i386/intel_iommu.c                  |  32 +-
  hw/misc/npcm7xx_mft.c                  | 540 +++++++++++++++++++++++++++++++++
  hw/misc/npcm7xx_pwm.c                  |   4 +
  hw/misc/xlnx-versal-xramc.c            | 253 +++++++++++++++
  hw/net/allwinner-sun8i-emac.c          |  62 ++--
  hw/timer/sse-timer.c                   |   1 +
  hw/virtio/virtio-iommu.c               |  19 +-
  softmmu/dma-helpers.c                  |  26 ++
  target/arm/kvm.c                       |   4 +-
  target/arm/sve_helper.c                | 107 ++++---
  target/arm/translate-sve.c             |  26 +-
  tests/qtest/npcm7xx_pwm-test.c         | 205 ++++++++++++-
  hw/arm/trace-events                    |  24 +-
  hw/misc/meson.build                    |   2 +
  hw/misc/trace-events                   |   8 +
  tests/acceptance/boot_linux_console.py | 120 +++-----
  tests/acceptance/replay_kernel.py      |  10 +-
 files changed, 2235 insertions(+), 937 deletions(-)
  delete mode 100644 hw/display/pxa2xx_template.h
  create mode 100644 include/hw/misc/npcm7xx_mft.h
  create mode 100644 include/hw/misc/xlnx-versal-xramc.h
  create mode 100644 hw/misc/npcm7xx_mft.c
  create mode 100644 hw/misc/xlnx-versal-xramc.c

-[PULL 27/39] hw/misc: Add NPCM7XX MFT Module
+[PULL 01/23] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
-From: Hao Wu <wuhaotsh@google.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch implements Multi Function Timer (MFT) module for NPCM7XX.
+This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
-This module is mainly used to configure PWM fans. It has just enough
+(indirect branch from register other than x16/x17).  The linux kernel
-functionality to make the PWM fan kernel module work.
+sets this in bti_enable().
-The module takes two input, the max_rpm of a fan (modifiable via QMP)
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
-and duty cycle (a GPIO from the PWM module.) The actual measured RPM
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 is equal to max_rpm * duty_cycle / NPCM7XX_PWM_MAX_DUTY. The RPM is
 measured as a counter compared to a prescaled input clock. The kernel
 driver reads this counter and report to user space.
 Refs:
 https://github.com/torvalds/linux/blob/master/drivers/hwmon/npcm750-pwm-fan.c
 Reviewed-by: Doug Evans <dje@google.com>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210311180855.149764-3-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220427042312.294300-1-richard.henderson@linaro.org
+[PMM: remove stray change to makefile comment]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/npcm7xx_mft.h |  70 +++++
+ target/arm/cpu.c                  |  2 ++
- hw/misc/npcm7xx_mft.c         | 540 ++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/bti-3.c         | 42 +++++++++++++++++++++++++++++++
- hw/misc/meson.build           |   1 +
+ tests/tcg/aarch64/Makefile.target |  6 ++---
- hw/misc/trace-events          |   8 +
+files changed, 47 insertions(+), 3 deletions(-)
-files changed, 619 insertions(+)
+ create mode 100644 tests/tcg/aarch64/bti-3.c
  create mode 100644 include/hw/misc/npcm7xx_mft.h
  create mode 100644 hw/misc/npcm7xx_mft.c
-diff --git a/include/hw/misc/npcm7xx_mft.h b/include/hw/misc/npcm7xx_mft.h
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
          /* Enable all PAC keys.  */
          env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |
                                    SCTLR_EnDA | SCTLR_EnDB);
 +        /* Trap on btype=3 for PACIxSP. */
 +        env->cp15.sctlr_el[1] |= SCTLR_BT0;
          /* and to the FP/Neon instructions */
          env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3);
          /* and to the SVE instructions */
 diff --git a/tests/tcg/aarch64/bti-3.c b/tests/tcg/aarch64/bti-3.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/npcm7xx_mft.h
++++ b/tests/tcg/aarch64/bti-3.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Nuvoton NPCM7xx MFT Module
++ * BTI vs PACIASP
 + *
 + * Copyright 2021 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +#ifndef NPCM7XX_MFT_H
 +#define NPCM7XX_MFT_H
 +
 +#include "exec/memory.h"
 +#include "hw/clock.h"
 +#include "hw/irq.h"
 +#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +/* Max Fan input number. */
 +#define NPCM7XX_MFT_MAX_FAN_INPUT 19
 +
 +/*
 + * Number of registers in one MFT module. Don't change this without increasing
 + * the version_id in vmstate.
 + */
 +#define NPCM7XX_MFT_NR_REGS (0x20 / sizeof(uint16_t))
 +
 +/*
 + * The MFT can take up to 4 inputs: A0, B0, A1, B1. It can measure one A and one
 + * B simultaneously. NPCM7XX_MFT_INASEL and NPCM7XX_MFT_INBSEL are used to
 + * select which A or B input are used.
 + */
 +#define NPCM7XX_MFT_FANIN_COUNT 4
 +
 +/**
 + * struct NPCM7xxMFTState - Multi Functional Tachometer device state.
 + * @parent: System bus device.
 + * @iomem: Memory region through which registers are accessed.
 + * @clock_in: The input clock for MFT from CLK module.
 + * @clock_{1,2}: The counter clocks for NPCM7XX_MFT_CNT{1,2}
 + * @irq: The IRQ for this MFT state.
 + * @regs: The MMIO registers.
 + * @max_rpm: The maximum rpm for fans. Order: A0, B0, A1, B1.
 + * @duty: The duty cycles for fans, relative to NPCM7XX_PWM_MAX_DUTY.
 + */
 +typedef struct NPCM7xxMFTState {
 +    SysBusDevice parent;
 +
 +    MemoryRegion iomem;
 +
 +    Clock       *clock_in;
 +    Clock       *clock_1, *clock_2;
 +    qemu_irq    irq;
 +    uint16_t    regs[NPCM7XX_MFT_NR_REGS];
 +
 +    uint32_t    max_rpm[NPCM7XX_MFT_FANIN_COUNT];
 +    uint32_t    duty[NPCM7XX_MFT_FANIN_COUNT];
 +} NPCM7xxMFTState;
 +
 +#define TYPE_NPCM7XX_MFT "npcm7xx-mft"
 +#define NPCM7XX_MFT(obj) \
 +    OBJECT_CHECK(NPCM7xxMFTState, (obj), TYPE_NPCM7XX_MFT)
 +
 +#endif /* NPCM7XX_MFT_H */
 diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/npcm7xx_mft.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Nuvoton NPCM7xx MFT Module
 + *
 + * Copyright 2021 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
-+#include "qemu/osdep.h"
++#include "bti-crt.inc.c"
 +#include "hw/irq.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/misc/npcm7xx_mft.h"
 +#include "hw/misc/npcm7xx_pwm.h"
 +#include "hw/registerfields.h"
 +#include "migration/vmstate.h"
 +#include "qapi/error.h"
 +#include "qapi/visitor.h"
 +#include "qemu/bitops.h"
 +#include "qemu/error-report.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "qemu/timer.h"
 +#include "qemu/units.h"
 +#include "trace.h"
 +
-+/*
++static void skip2_sigill(int sig, siginfo_t *info, ucontext_t *uc)
 + * Some of the registers can only accessed via 16-bit ops and some can only
 + * be accessed via 8-bit ops. However we mark all of them using REG16 to
 + * simplify implementation. npcm7xx_mft_check_mem_op checks the access length
 + * of memory operations.
 + */
 +REG16(NPCM7XX_MFT_CNT1, 0x00);
 +REG16(NPCM7XX_MFT_CRA, 0x02);
 +REG16(NPCM7XX_MFT_CRB, 0x04);
 +REG16(NPCM7XX_MFT_CNT2, 0x06);
 +REG16(NPCM7XX_MFT_PRSC, 0x08);
 +REG16(NPCM7XX_MFT_CKC, 0x0a);
 +REG16(NPCM7XX_MFT_MCTRL, 0x0c);
 +REG16(NPCM7XX_MFT_ICTRL, 0x0e);
 +REG16(NPCM7XX_MFT_ICLR, 0x10);
 +REG16(NPCM7XX_MFT_IEN, 0x12);
 +REG16(NPCM7XX_MFT_CPA, 0x14);
 +REG16(NPCM7XX_MFT_CPB, 0x16);
 +REG16(NPCM7XX_MFT_CPCFG, 0x18);
 +REG16(NPCM7XX_MFT_INASEL, 0x1a);
 +REG16(NPCM7XX_MFT_INBSEL, 0x1c);
 +
 +/* Register Fields */
 +#define NPCM7XX_MFT_CKC_C2CSEL          BIT(3)
 +#define NPCM7XX_MFT_CKC_C1CSEL          BIT(0)
 +
 +#define NPCM7XX_MFT_MCTRL_TBEN          BIT(6)
 +#define NPCM7XX_MFT_MCTRL_TAEN          BIT(5)
 +#define NPCM7XX_MFT_MCTRL_TBEDG         BIT(4)
 +#define NPCM7XX_MFT_MCTRL_TAEDG         BIT(3)
 +#define NPCM7XX_MFT_MCTRL_MODE5         BIT(2)
 +
 +#define NPCM7XX_MFT_ICTRL_TFPND         BIT(5)
 +#define NPCM7XX_MFT_ICTRL_TEPND         BIT(4)
 +#define NPCM7XX_MFT_ICTRL_TDPND         BIT(3)
 +#define NPCM7XX_MFT_ICTRL_TCPND         BIT(2)
 +#define NPCM7XX_MFT_ICTRL_TBPND         BIT(1)
 +#define NPCM7XX_MFT_ICTRL_TAPND         BIT(0)
 +
 +#define NPCM7XX_MFT_ICLR_TFCLR          BIT(5)
 +#define NPCM7XX_MFT_ICLR_TECLR          BIT(4)
 +#define NPCM7XX_MFT_ICLR_TDCLR          BIT(3)
 +#define NPCM7XX_MFT_ICLR_TCCLR          BIT(2)
 +#define NPCM7XX_MFT_ICLR_TBCLR          BIT(1)
 +#define NPCM7XX_MFT_ICLR_TACLR          BIT(0)
 +
 +#define NPCM7XX_MFT_IEN_TFIEN           BIT(5)
 +#define NPCM7XX_MFT_IEN_TEIEN           BIT(4)
 +#define NPCM7XX_MFT_IEN_TDIEN           BIT(3)
 +#define NPCM7XX_MFT_IEN_TCIEN           BIT(2)
 +#define NPCM7XX_MFT_IEN_TBIEN           BIT(1)
 +#define NPCM7XX_MFT_IEN_TAIEN           BIT(0)
 +
 +#define NPCM7XX_MFT_CPCFG_GET_B(rv)     extract8((rv), 4, 4)
 +#define NPCM7XX_MFT_CPCFG_GET_A(rv)     extract8((rv), 0, 4)
 +#define NPCM7XX_MFT_CPCFG_HIEN          BIT(3)
 +#define NPCM7XX_MFT_CPCFG_EQEN          BIT(2)
 +#define NPCM7XX_MFT_CPCFG_LOEN          BIT(1)
 +#define NPCM7XX_MFT_CPCFG_CPSEL         BIT(0)
 +
 +#define NPCM7XX_MFT_INASEL_SELA         BIT(0)
 +#define NPCM7XX_MFT_INBSEL_SELB         BIT(0)
 +
 +/* Max CNT values of the module. The CNT value is a countdown from it. */
 +#define NPCM7XX_MFT_MAX_CNT             0xFFFF
 +
 +/* Each fan revolution should generated 2 pulses */
 +#define NPCM7XX_MFT_PULSE_PER_REVOLUTION 2
 +
 +typedef enum NPCM7xxMFTCaptureState {
 +    /* capture succeeded with a valid CNT value. */
 +    NPCM7XX_CAPTURE_SUCCEED,
 +    /* capture stopped prematurely due to reaching CPCFG condition. */
 +    NPCM7XX_CAPTURE_COMPARE_HIT,
 +    /* capture fails since it reaches underflow condition for CNT. */
 +    NPCM7XX_CAPTURE_UNDERFLOW,
 +} NPCM7xxMFTCaptureState;
 +
 +static void npcm7xx_mft_reset(NPCM7xxMFTState *s)
 +{
-+    int i;
++    uc->uc_mcontext.pc += 8;
-+
++    uc->uc_mcontext.pstate = 1;
 +    /* Only registers PRSC ~ INBSEL need to be reset. */
 +    for (i = R_NPCM7XX_MFT_PRSC; i <= R_NPCM7XX_MFT_INBSEL; ++i) {
 +        s->regs[i] = 0;
 +    }
 +}
 +
-+static void npcm7xx_mft_clear_interrupt(NPCM7xxMFTState *s, uint8_t iclr)
++#define BTYPE_1() \
 +    asm("mov %0,#1; adr x16, 1f; br x16; 1: hint #25; mov %0,#0" \
 +        : "=r"(skipped) : : "x16", "x30")
 +
 +#define BTYPE_2() \
 +    asm("mov %0,#1; adr x16, 1f; blr x16; 1: hint #25; mov %0,#0" \
 +        : "=r"(skipped) : : "x16", "x30")
 +
 +#define BTYPE_3() \
 +    asm("mov %0,#1; adr x15, 1f; br x15; 1: hint #25; mov %0,#0" \
 +        : "=r"(skipped) : : "x15", "x30")
 +
 +#define TEST(WHICH, EXPECT) \
 +    do { WHICH(); fail += skipped ^ EXPECT; } while (0)
 +
 +int main()
 +{
-+    /*
++    int fail = 0;
-+     * Clear bits in ICTRL where corresponding bits in iclr is 1.
++    int skipped;
-+     * Both iclr and ictrl are 8-bit regs. (See npcm7xx_mft_check_mem_op)
++
-+     */
++    /* Signal-like with SA_SIGINFO.  */
-+    s->regs[R_NPCM7XX_MFT_ICTRL] &= ~iclr;
++    signal_info(SIGILL, skip2_sigill);
 +
 +    /* With SCTLR_EL1.BT0 set, PACIASP is not compatible with type=3. */
 +    TEST(BTYPE_1, 0);
 +    TEST(BTYPE_2, 0);
 +    TEST(BTYPE_3, 1);
 +
 +    return fail;
 +}
-+
+diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 +/*
 + * If the CPCFG's condition should be triggered during count down from
 + * NPCM7XX_MFT_MAX_CNT to src if compared to tgt, return the count when
 + * the condition is triggered.
 + * Otherwise return -1.
 + * Since tgt is uint16_t it must always <= NPCM7XX_MFT_MAX_CNT.
 + */
 +static int npcm7xx_mft_compare(int32_t src, uint16_t tgt, uint8_t cpcfg)
 +{
 +    if (cpcfg & NPCM7XX_MFT_CPCFG_HIEN) {
 +        return NPCM7XX_MFT_MAX_CNT;
 +    }
 +    if ((cpcfg & NPCM7XX_MFT_CPCFG_EQEN) && (src <= tgt)) {
 +        return tgt;
 +    }
 +    if ((cpcfg & NPCM7XX_MFT_CPCFG_LOEN) && (tgt > 0) && (src < tgt)) {
 +        return tgt - 1;
 +    }
 +
 +    return -1;
 +}
 +
 +/* Compute CNT according to corresponding fan's RPM. */
 +static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
 +    Clock *clock, uint32_t max_rpm, uint32_t duty, uint16_t tgt,
 +    uint8_t cpcfg, uint16_t *cnt)
 +{
 +    uint32_t rpm = (uint64_t)max_rpm * (uint64_t)duty / NPCM7XX_PWM_MAX_DUTY;
 +    int32_t count;
 +    int stopped;
 +    NPCM7xxMFTCaptureState state;
 +
 +    if (rpm == 0) {
 +        /*
 +         * If RPM = 0, capture won't happen. CNT will continue count down.
 +         * So it's effective equivalent to have a cnt > NPCM7XX_MFT_MAX_CNT
 +         */
 +        count = NPCM7XX_MFT_MAX_CNT + 1;
 +    } else {
 +        /*
 +         * RPM = revolution/min. The time for one revlution (in ns) is
 +         * MINUTE_TO_NANOSECOND / RPM.
 +         */
 +        count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
 +            (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
 +    }
 +
 +    if (count > NPCM7XX_MFT_MAX_CNT) {
 +        count = -1;
 +    } else {
 +        /* The CNT is a countdown value from NPCM7XX_MFT_MAX_CNT. */
 +        count = NPCM7XX_MFT_MAX_CNT - count;
 +    }
 +    stopped = npcm7xx_mft_compare(count, tgt, cpcfg);
 +    if (stopped == -1) {
 +        if (count == -1) {
 +            /* Underflow */
 +            state = NPCM7XX_CAPTURE_UNDERFLOW;
 +        } else {
 +            state = NPCM7XX_CAPTURE_SUCCEED;
 +        }
 +    } else {
 +        count = stopped;
 +        state = NPCM7XX_CAPTURE_COMPARE_HIT;
 +    }
 +
 +    if (count != -1) {
 +        *cnt = count;
 +    }
 +    trace_npcm7xx_mft_rpm(clock->canonical_path, clock_get_hz(clock),
 +                          state, count, rpm, duty);
 +    return state;
 +}
 +
 +/*
 + * Capture Fan RPM and update CNT and CR registers accordingly.
 + * Raise IRQ if certain contidions are met in IEN.
 + */
 +static void npcm7xx_mft_capture(NPCM7xxMFTState *s)
 +{
 +    int irq_level = 0;
 +    NPCM7xxMFTCaptureState state;
 +    int sel;
 +    uint8_t cpcfg;
 +
 +    /*
 +     * If not mode 5, the behavior is undefined. We just do nothing in this
 +     * case.
 +     */
 +    if (!(s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_MODE5)) {
 +        return;
 +    }
 +
 +    /* Capture input A. */
 +    if (s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_TAEN &&
 +        s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C1CSEL) {
 +        sel = s->regs[R_NPCM7XX_MFT_INASEL] & NPCM7XX_MFT_INASEL_SELA;
 +        cpcfg = NPCM7XX_MFT_CPCFG_GET_A(s->regs[R_NPCM7XX_MFT_CPCFG]);
 +        state = npcm7xx_mft_compute_cnt(s->clock_1,
 +                                        sel ? s->max_rpm[2] : s->max_rpm[0],
 +                                        sel ? s->duty[2] : s->duty[0],
 +                                        s->regs[R_NPCM7XX_MFT_CPA],
 +                                        cpcfg,
 +                                        &s->regs[R_NPCM7XX_MFT_CNT1]);
 +        switch (state) {
 +        case NPCM7XX_CAPTURE_SUCCEED:
 +            /* Interrupt on input capture on TAn transition - TAPND */
 +            s->regs[R_NPCM7XX_MFT_CRA] = s->regs[R_NPCM7XX_MFT_CNT1];
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TAPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TAIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        case NPCM7XX_CAPTURE_COMPARE_HIT:
 +            /* Compare Hit - TEPND */
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TEPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TEIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        case NPCM7XX_CAPTURE_UNDERFLOW:
 +            /* Underflow - TCPND */
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TCPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TCIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +
 +    /* Capture input B. */
 +    if (s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_TBEN &&
 +        s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C2CSEL) {
 +        sel = s->regs[R_NPCM7XX_MFT_INBSEL] & NPCM7XX_MFT_INBSEL_SELB;
 +        cpcfg = NPCM7XX_MFT_CPCFG_GET_B(s->regs[R_NPCM7XX_MFT_CPCFG]);
 +        state = npcm7xx_mft_compute_cnt(s->clock_2,
 +                                        sel ? s->max_rpm[3] : s->max_rpm[1],
 +                                        sel ? s->duty[3] : s->duty[1],
 +                                        s->regs[R_NPCM7XX_MFT_CPB],
 +                                        cpcfg,
 +                                        &s->regs[R_NPCM7XX_MFT_CNT2]);
 +        switch (state) {
 +        case NPCM7XX_CAPTURE_SUCCEED:
 +            /* Interrupt on input capture on TBn transition - TBPND */
 +            s->regs[R_NPCM7XX_MFT_CRB] = s->regs[R_NPCM7XX_MFT_CNT2];
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TBPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TBIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        case NPCM7XX_CAPTURE_COMPARE_HIT:
 +            /* Compare Hit - TFPND */
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TFPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TFIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        case NPCM7XX_CAPTURE_UNDERFLOW:
 +            /* Underflow - TDPND */
 +            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TDPND;
 +            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TDIEN) {
 +                irq_level = 1;
 +            }
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +
 +    trace_npcm7xx_mft_capture(DEVICE(s)->canonical_path, irq_level);
 +    qemu_set_irq(s->irq, irq_level);
 +}
 +
 +/* Update clock for counters. */
 +static void npcm7xx_mft_update_clock(void *opaque, ClockEvent event)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
 +    uint64_t prescaled_clock_period;
 +
 +    prescaled_clock_period = clock_get(s->clock_in) *
 +        (s->regs[R_NPCM7XX_MFT_PRSC] + 1ULL);
 +    trace_npcm7xx_mft_update_clock(s->clock_in->canonical_path,
 +                                   s->regs[R_NPCM7XX_MFT_CKC],
 +                                   clock_get(s->clock_in),
 +                                   prescaled_clock_period);
 +    /* Update clock 1 */
 +    if (s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C1CSEL) {
 +        /* Clock is prescaled. */
 +        clock_update(s->clock_1, prescaled_clock_period);
 +    } else {
 +        /* Clock stopped. */
 +        clock_update(s->clock_1, 0);
 +    }
 +    /* Update clock 2 */
 +    if (s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C2CSEL) {
 +        /* Clock is prescaled. */
 +        clock_update(s->clock_2, prescaled_clock_period);
 +    } else {
 +        /* Clock stopped. */
 +        clock_update(s->clock_2, 0);
 +    }
 +
 +    npcm7xx_mft_capture(s);
 +}
 +
 +static uint64_t npcm7xx_mft_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
 +    uint16_t value = 0;
 +
 +    switch (offset) {
 +    case A_NPCM7XX_MFT_ICLR:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: register @ 0x%04" HWADDR_PRIx " is write-only\n",
 +                      __func__, offset);
 +        break;
 +
 +    default:
 +        value = s->regs[offset / 2];
 +    }
 +
 +    trace_npcm7xx_mft_read(DEVICE(s)->canonical_path, offset, value);
 +    return value;
 +}
 +
 +static void npcm7xx_mft_write(void *opaque, hwaddr offset,
 +                              uint64_t v, unsigned size)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
 +
 +    trace_npcm7xx_mft_write(DEVICE(s)->canonical_path, offset, v);
 +    switch (offset) {
 +    case A_NPCM7XX_MFT_ICLR:
 +        npcm7xx_mft_clear_interrupt(s, v);
 +        break;
 +
 +    case A_NPCM7XX_MFT_CKC:
 +    case A_NPCM7XX_MFT_PRSC:
 +        s->regs[offset / 2] = v;
 +        npcm7xx_mft_update_clock(s, ClockUpdate);
 +        break;
 +
 +    default:
 +        s->regs[offset / 2] = v;
 +        npcm7xx_mft_capture(s);
 +        break;
 +    }
 +}
 +
 +static bool npcm7xx_mft_check_mem_op(void *opaque, hwaddr offset,
 +                                     unsigned size, bool is_write,
 +                                     MemTxAttrs attrs)
 +{
 +    switch (offset) {
 +    /* 16-bit registers. Must be accessed with 16-bit read/write.*/
 +    case A_NPCM7XX_MFT_CNT1:
 +    case A_NPCM7XX_MFT_CRA:
 +    case A_NPCM7XX_MFT_CRB:
 +    case A_NPCM7XX_MFT_CNT2:
 +    case A_NPCM7XX_MFT_CPA:
 +    case A_NPCM7XX_MFT_CPB:
 +        return size == 2;
 +
 +    /* 8-bit registers. Must be accessed with 8-bit read/write.*/
 +    case A_NPCM7XX_MFT_PRSC:
 +    case A_NPCM7XX_MFT_CKC:
 +    case A_NPCM7XX_MFT_MCTRL:
 +    case A_NPCM7XX_MFT_ICTRL:
 +    case A_NPCM7XX_MFT_ICLR:
 +    case A_NPCM7XX_MFT_IEN:
 +    case A_NPCM7XX_MFT_CPCFG:
 +    case A_NPCM7XX_MFT_INASEL:
 +    case A_NPCM7XX_MFT_INBSEL:
 +        return size == 1;
 +
 +    default:
 +        /* Invalid registers. */
 +        return false;
 +    }
 +}
 +
 +static void npcm7xx_mft_get_max_rpm(Object *obj, Visitor *v, const char *name,
 +                                    void *opaque, Error **errp)
 +{
 +    visit_type_uint32(v, name, (uint32_t *)opaque, errp);
 +}
 +
 +static void npcm7xx_mft_set_max_rpm(Object *obj, Visitor *v, const char *name,
 +                                    void *opaque, Error **errp)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
 +    uint32_t *max_rpm = opaque;
 +    uint32_t value;
 +
 +    if (!visit_type_uint32(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    *max_rpm = value;
 +    npcm7xx_mft_capture(s);
 +}
 +
 +static void npcm7xx_mft_duty_handler(void *opaque, int n, int value)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
 +
 +    trace_npcm7xx_mft_set_duty(DEVICE(s)->canonical_path, n, value);
 +    s->duty[n] = value;
 +    npcm7xx_mft_capture(s);
 +}
 +
 +static const struct MemoryRegionOps npcm7xx_mft_ops = {
 +    .read       = npcm7xx_mft_read,
 +    .write      = npcm7xx_mft_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid      = {
 +        .min_access_size        = 1,
 +        .max_access_size        = 2,
 +        .unaligned              = false,
 +        .accepts                = npcm7xx_mft_check_mem_op,
 +    },
 +};
 +
 +static void npcm7xx_mft_enter_reset(Object *obj, ResetType type)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
 +
 +    npcm7xx_mft_reset(s);
 +}
 +
 +static void npcm7xx_mft_hold_reset(Object *obj)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
 +
 +    qemu_irq_lower(s->irq);
 +}
 +
 +static void npcm7xx_mft_init(Object *obj)
 +{
 +    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    DeviceState *dev = DEVICE(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &npcm7xx_mft_ops, s,
 +                          TYPE_NPCM7XX_MFT, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq);
 +    s->clock_in = qdev_init_clock_in(dev, "clock-in", npcm7xx_mft_update_clock,
 +                                     s, ClockUpdate);
 +    s->clock_1 = qdev_init_clock_out(dev, "clock1");
 +    s->clock_2 = qdev_init_clock_out(dev, "clock2");
 +
 +    for (int i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
 +        object_property_add(obj, "max_rpm[*]", "uint32",
 +                            npcm7xx_mft_get_max_rpm,
 +                            npcm7xx_mft_set_max_rpm,
 +                            NULL, &s->max_rpm[i]);
 +    }
 +    qdev_init_gpio_in_named(dev, npcm7xx_mft_duty_handler, "duty",
 +                            NPCM7XX_MFT_FANIN_COUNT);
 +}
 +
 +static const VMStateDescription vmstate_npcm7xx_mft = {
 +    .name = "npcm7xx-mft-module",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_CLOCK(clock_in, NPCM7xxMFTState),
 +        VMSTATE_CLOCK(clock_1, NPCM7xxMFTState),
 +        VMSTATE_CLOCK(clock_2, NPCM7xxMFTState),
 +        VMSTATE_UINT16_ARRAY(regs, NPCM7xxMFTState, NPCM7XX_MFT_NR_REGS),
 +        VMSTATE_UINT32_ARRAY(max_rpm, NPCM7xxMFTState, NPCM7XX_MFT_FANIN_COUNT),
 +        VMSTATE_UINT32_ARRAY(duty, NPCM7xxMFTState, NPCM7XX_MFT_FANIN_COUNT),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void npcm7xx_mft_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx MFT Controller";
 +    dc->vmsd = &vmstate_npcm7xx_mft;
 +    rc->phases.enter = npcm7xx_mft_enter_reset;
 +    rc->phases.hold = npcm7xx_mft_hold_reset;
 +}
 +
 +static const TypeInfo npcm7xx_mft_info = {
 +    .name               = TYPE_NPCM7XX_MFT,
 +    .parent             = TYPE_SYS_BUS_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxMFTState),
 +    .class_init         = npcm7xx_mft_class_init,
 +    .instance_init      = npcm7xx_mft_init,
 +};
 +
 +static void npcm7xx_mft_register_type(void)
 +{
 +    type_register_static(&npcm7xx_mft_info);
 +}
 +type_init(npcm7xx_mft_register_type);
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/meson.build
+--- a/tests/tcg/aarch64/Makefile.target
-+++ b/hw/misc/meson.build
++++ b/tests/tcg/aarch64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MAINSTONE', if_true: files('mst_fpga.c'))
+@@ -XXX,XX +XXX,XX @@ endif
- softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
+ # BTI Tests
-   'npcm7xx_clk.c',
+ # bti-1 tests the elf notes, so we require special compiler support.
-   'npcm7xx_gcr.c',
+ ifneq ($(CROSS_CC_HAS_ARMV8_BTI),)
-+  'npcm7xx_mft.c',
+-AARCH64_TESTS += bti-1
-   'npcm7xx_pwm.c',
+-bti-1: CFLAGS += -mbranch-protection=standard
-   'npcm7xx_rng.c',
+-bti-1: LDFLAGS += -nostdlib
- ))
++AARCH64_TESTS += bti-1 bti-3
-diff --git a/hw/misc/trace-events b/hw/misc/trace-events
++bti-1 bti-3: CFLAGS += -mbranch-protection=standard
-index XXXXXXX..XXXXXXX 100644
++bti-1 bti-3: LDFLAGS += -nostdlib
---- a/hw/misc/trace-events
+ endif
-+++ b/hw/misc/trace-events
+ # bti-2 tests PROT_BTI, so no special compiler support required.
-@@ -XXX,XX +XXX,XX @@ npcm7xx_clk_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " valu
+ AARCH64_TESTS += bti-2
  npcm7xx_gcr_read(uint64_t offset, uint32_t value) " offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
  npcm7xx_gcr_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 +# npcm7xx_mft.c
 +npcm7xx_mft_read(const char *name, uint64_t offset, uint16_t value) "%s: offset: 0x%04" PRIx64 " value: 0x%04" PRIx16
 +npcm7xx_mft_write(const char *name, uint64_t offset, uint16_t value) "%s: offset: 0x%04" PRIx64 " value: 0x%04" PRIx16
 +npcm7xx_mft_rpm(const char *clock, uint32_t clock_hz, int state, int32_t cnt, uint32_t rpm, uint32_t duty) " fan clk: %s clock_hz: %" PRIu32 ", state: %d, cnt: %" PRIi32 ", rpm: %" PRIu32 ", duty: %" PRIu32
 +npcm7xx_mft_capture(const char *name, int irq_level) "%s: level: %d"
 +npcm7xx_mft_update_clock(const char *name, uint16_t sel, uint64_t clock_period, uint64_t prescaled_clock_period) "%s: sel: 0x%02" PRIx16 ", period: %" PRIu64 ", prescaled: %" PRIu64
 +npcm7xx_mft_set_duty(const char *name, int n, int value) "%s[%d]: %d"
 +
  # npcm7xx_rng.c
  npcm7xx_rng_read(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
  npcm7xx_rng_write(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
 --
-.20.1
+.25.1

-[PULL 01/39] hw/misc: versal: Add a model of the XRAM controller
+[PULL 02/23] target/arm: Split out cpregs.h
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a model of the Xilinx Versal Accelerator RAM (XRAM).
+Move ARMCPRegInfo and all related declarations to a new
-This is mainly a stub to make firmware happy. The size of
+internal header, out of the public cpu.h.
 the RAMs can be probed. The interrupt mask logic is
 modelled but none of the interrups will ever be raised
 unless injected.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20210308224637.2949533-2-edgar.iglesias@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220501055028.646596-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/xlnx-versal-xramc.h |  97 +++++++++++
+ target/arm/cpregs.h        | 413 +++++++++++++++++++++++++++++++++++++
- hw/misc/xlnx-versal-xramc.c         | 253 ++++++++++++++++++++++++++++
+ target/arm/cpu.h           | 368 ---------------------------------
- hw/misc/meson.build                 |   1 +
+ hw/arm/pxa2xx.c            |   1 +
-files changed, 351 insertions(+)
+ hw/arm/pxa2xx_pic.c        |   1 +
- create mode 100644 include/hw/misc/xlnx-versal-xramc.h
+ hw/intc/arm_gicv3_cpuif.c  |   1 +
- create mode 100644 hw/misc/xlnx-versal-xramc.c
+ hw/intc/arm_gicv3_kvm.c    |   2 +
  target/arm/cpu.c           |   1 +
  target/arm/cpu64.c         |   1 +
  target/arm/cpu_tcg.c       |   1 +
  target/arm/gdbstub.c       |   3 +-
  target/arm/helper.c        |   1 +
  target/arm/op_helper.c     |   1 +
  target/arm/translate-a64.c |   4 +-
  target/arm/translate.c     |   3 +-
 files changed, 427 insertions(+), 374 deletions(-)
  create mode 100644 target/arm/cpregs.h
-diff --git a/include/hw/misc/xlnx-versal-xramc.h b/include/hw/misc/xlnx-versal-xramc.h
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/xlnx-versal-xramc.h
++++ b/target/arm/cpregs.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU model of the Xilinx XRAM Controller.
++ * QEMU ARM CP Register access and descriptions
 + *
-+ * Copyright (c) 2021 Xilinx Inc.
++ * Copyright (c) 2022 Linaro Ltd
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
-+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ * This program is free software; you can redistribute it and/or
-+ */
++ * modify it under the terms of the GNU General Public License
-+
++ * as published by the Free Software Foundation; either version 2
-+#ifndef XLNX_VERSAL_XRAMC_H
++ * of the License, or (at your option) any later version.
-+#define XLNX_VERSAL_XRAMC_H
++ *
-+
++ * This program is distributed in the hope that it will be useful,
-+#include "hw/sysbus.h"
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+#include "hw/register.h"
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+
++ * GNU General Public License for more details.
-+#define TYPE_XLNX_XRAM_CTRL "xlnx.versal-xramc"
++ *
-+
++ * You should have received a copy of the GNU General Public License
-+#define XLNX_XRAM_CTRL(obj) \
++ * along with this program; if not, see
-+     OBJECT_CHECK(XlnxXramCtrl, (obj), TYPE_XLNX_XRAM_CTRL)
++ * <http://www.gnu.org/licenses/gpl-2.0.html>
-+
++ */
-+REG32(XRAM_ERR_CTRL, 0x0)
++
-+    FIELD(XRAM_ERR_CTRL, UE_RES, 3, 1)
++#ifndef TARGET_ARM_CPREGS_H
-+    FIELD(XRAM_ERR_CTRL, PWR_ERR_RES, 2, 1)
++#define TARGET_ARM_CPREGS_H
-+    FIELD(XRAM_ERR_CTRL, PZ_ERR_RES, 1, 1)
++
-+    FIELD(XRAM_ERR_CTRL, APB_ERR_RES, 0, 1)
++/*
-+REG32(XRAM_ISR, 0x4)
++ * ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
-+    FIELD(XRAM_ISR, INV_APB, 0, 1)
++ * special-behaviour cp reg and bits [11..8] indicate what behaviour
-+REG32(XRAM_IMR, 0x8)
++ * it has. Otherwise it is a simple cp reg, where CONST indicates that
-+    FIELD(XRAM_IMR, INV_APB, 0, 1)
++ * TCG can assume the value to be constant (ie load at translate time)
-+REG32(XRAM_IEN, 0xc)
++ * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
-+    FIELD(XRAM_IEN, INV_APB, 0, 1)
++ * indicates that the TB should not be ended after a write to this register
-+REG32(XRAM_IDS, 0x10)
++ * (the default is that the TB ends after cp writes). OVERRIDE permits
-+    FIELD(XRAM_IDS, INV_APB, 0, 1)
++ * a register definition to override a previous definition for the
-+REG32(XRAM_ECC_CNTL, 0x14)
++ * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
-+    FIELD(XRAM_ECC_CNTL, FI_MODE, 2, 1)
++ * old must have the OVERRIDE bit set.
-+    FIELD(XRAM_ECC_CNTL, DET_ONLY, 1, 1)
++ * ALIAS indicates that this register is an alias view of some underlying
-+    FIELD(XRAM_ECC_CNTL, ECC_ON_OFF, 0, 1)
++ * state which is also visible via another register, and that the other
-+REG32(XRAM_CLR_EXE, 0x18)
++ * register is handling migration and reset; registers marked ALIAS will not be
-+    FIELD(XRAM_CLR_EXE, MON_7, 7, 1)
++ * migrated but may have their state set by syncing of register state from KVM.
-+    FIELD(XRAM_CLR_EXE, MON_6, 6, 1)
++ * NO_RAW indicates that this register has no underlying state and does not
-+    FIELD(XRAM_CLR_EXE, MON_5, 5, 1)
++ * support raw access for state saving/loading; it will not be used for either
-+    FIELD(XRAM_CLR_EXE, MON_4, 4, 1)
++ * migration or KVM state synchronization. (Typically this is for "registers"
-+    FIELD(XRAM_CLR_EXE, MON_3, 3, 1)
++ * which are actually used as instructions for cache maintenance and so on.)
-+    FIELD(XRAM_CLR_EXE, MON_2, 2, 1)
++ * IO indicates that this register does I/O and therefore its accesses
-+    FIELD(XRAM_CLR_EXE, MON_1, 1, 1)
++ * need to be marked with gen_io_start() and also end the TB. In particular,
-+    FIELD(XRAM_CLR_EXE, MON_0, 0, 1)
++ * registers which implement clocks or timers require this.
-+REG32(XRAM_CE_FFA, 0x1c)
++ * RAISES_EXC is for when the read or write hook might raise an exception;
-+    FIELD(XRAM_CE_FFA, ADDR, 0, 20)
++ * the generated code will synchronize the CPU state before calling the hook
-+REG32(XRAM_CE_FFD0, 0x20)
++ * so that it is safe for the hook to call raise_exception().
-+REG32(XRAM_CE_FFD1, 0x24)
++ * NEWEL is for writes to registers that might change the exception
-+REG32(XRAM_CE_FFD2, 0x28)
++ * level - typically on older ARM chips. For those cases we need to
-+REG32(XRAM_CE_FFD3, 0x2c)
++ * re-read the new el when recomputing the translation flags.
-+REG32(XRAM_CE_FFE, 0x30)
++ */
-+    FIELD(XRAM_CE_FFE, SYNDROME, 0, 16)
++#define ARM_CP_SPECIAL           0x0001
-+REG32(XRAM_UE_FFA, 0x34)
++#define ARM_CP_CONST             0x0002
-+    FIELD(XRAM_UE_FFA, ADDR, 0, 20)
++#define ARM_CP_64BIT             0x0004
-+REG32(XRAM_UE_FFD0, 0x38)
++#define ARM_CP_SUPPRESS_TB_END   0x0008
-+REG32(XRAM_UE_FFD1, 0x3c)
++#define ARM_CP_OVERRIDE          0x0010
-+REG32(XRAM_UE_FFD2, 0x40)
++#define ARM_CP_ALIAS             0x0020
-+REG32(XRAM_UE_FFD3, 0x44)
++#define ARM_CP_IO                0x0040
-+REG32(XRAM_UE_FFE, 0x48)
++#define ARM_CP_NO_RAW            0x0080
-+    FIELD(XRAM_UE_FFE, SYNDROME, 0, 16)
++#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
-+REG32(XRAM_FI_D0, 0x4c)
++#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
-+REG32(XRAM_FI_D1, 0x50)
++#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
-+REG32(XRAM_FI_D2, 0x54)
++#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
-+REG32(XRAM_FI_D3, 0x58)
++#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
-+REG32(XRAM_FI_SY, 0x5c)
++#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
-+    FIELD(XRAM_FI_SY, DATA, 0, 16)
++#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
-+REG32(XRAM_RMW_UE_FFA, 0x70)
++#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
-+    FIELD(XRAM_RMW_UE_FFA, ADDR, 0, 20)
++#define ARM_CP_FPU               0x1000
-+REG32(XRAM_FI_CNTR, 0x74)
++#define ARM_CP_SVE               0x2000
-+    FIELD(XRAM_FI_CNTR, COUNT, 0, 24)
++#define ARM_CP_NO_GDB            0x4000
-+REG32(XRAM_IMP, 0x80)
++#define ARM_CP_RAISES_EXC        0x8000
-+    FIELD(XRAM_IMP, SIZE, 0, 4)
++#define ARM_CP_NEWEL             0x10000
-+REG32(XRAM_PRDY_DBG, 0x84)
++/* Used only as a terminator for ARMCPRegInfo lists */
-+    FIELD(XRAM_PRDY_DBG, ISLAND3, 12, 4)
++#define ARM_CP_SENTINEL          0xfffff
-+    FIELD(XRAM_PRDY_DBG, ISLAND2, 8, 4)
++/* Mask of only the flag bits in a type field */
-+    FIELD(XRAM_PRDY_DBG, ISLAND1, 4, 4)
++#define ARM_CP_FLAG_MASK         0x1f0ff
-+    FIELD(XRAM_PRDY_DBG, ISLAND0, 0, 4)
++
-+REG32(XRAM_SAFETY_CHK, 0xff8)
++/*
-+
++ * Valid values for ARMCPRegInfo state field, indicating which of
-+#define XRAM_CTRL_R_MAX (R_XRAM_SAFETY_CHK + 1)
++ * the AArch32 and AArch64 execution states this register is visible in.
-+
++ * If the reginfo doesn't explicitly specify then it is AArch32 only.
-+typedef struct XlnxXramCtrl {
++ * If the reginfo is declared to be visible in both states then a second
-+    SysBusDevice parent_obj;
++ * reginfo is synthesised for the AArch32 view of the AArch64 register,
-+    MemoryRegion ram;
++ * such that the AArch32 view is the lower 32 bits of the AArch64 one.
-+    qemu_irq irq;
++ * Note that we rely on the values of these enums as we iterate through
-+
++ * the various states in some places.
-+    struct {
++ */
-+        uint64_t size;
++enum {
-+        unsigned int encoded_size;
++    ARM_CP_STATE_AA32 = 0,
-+    } cfg;
++    ARM_CP_STATE_AA64 = 1,
-+
++    ARM_CP_STATE_BOTH = 2,
-+    RegisterInfoArray *reg_array;
++};
-+    uint32_t regs[XRAM_CTRL_R_MAX];
++
-+    RegisterInfo regs_info[XRAM_CTRL_R_MAX];
++/*
-+} XlnxXramCtrl;
++ * ARM CP register secure state flags.  These flags identify security state
 + * attributes for a given CP register entry.
 + * The existence of both or neither secure and non-secure flags indicates that
 + * the register has both a secure and non-secure hash entry.  A single one of
 + * these flags causes the register to only be hashed for the specified
 + * security state.
 + * Although definitions may have any combination of the S/NS bits, each
 + * registered entry will only have one to identify whether the entry is secure
 + * or non-secure.
 + */
 +enum {
 +    ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
 +    ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
 +};
 +
 +/*
 + * Return true if cptype is a valid type field. This is used to try to
 + * catch errors where the sentinel has been accidentally left off the end
 + * of a list of registers.
 + */
 +static inline bool cptype_valid(int cptype)
 +{
 +    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
 +        || ((cptype & ARM_CP_SPECIAL) &&
 +            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
 +}
 +
 +/*
 + * Access rights:
 + * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
 + * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and
 + * PL2 (hyp). The other level which has Read and Write bits is Secure PL1
 + * (ie any of the privileged modes in Secure state, or Monitor mode).
 + * If a register is accessible in one privilege level it's always accessible
 + * in higher privilege levels too. Since "Secure PL1" also follows this rule
 + * (ie anything visible in PL2 is visible in S-PL1, some things are only
 + * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the
 + * terminology a little and call this PL3.
 + * In AArch64 things are somewhat simpler as the PLx bits line up exactly
 + * with the ELx exception levels.
 + *
 + * If access permissions for a register are more complex than can be
 + * described with these bits, then use a laxer set of restrictions, and
 + * do the more restrictive/complex check inside a helper function.
 + */
 +#define PL3_R 0x80
 +#define PL3_W 0x40
 +#define PL2_R (0x20 | PL3_R)
 +#define PL2_W (0x10 | PL3_W)
 +#define PL1_R (0x08 | PL2_R)
 +#define PL1_W (0x04 | PL2_W)
 +#define PL0_R (0x02 | PL1_R)
 +#define PL0_W (0x01 | PL1_W)
 +
 +/*
 + * For user-mode some registers are accessible to EL0 via a kernel
 + * trap-and-emulate ABI. In this case we define the read permissions
 + * as actually being PL0_R. However some bits of any given register
 + * may still be masked.
 + */
 +#ifdef CONFIG_USER_ONLY
 +#define PL0U_R PL0_R
 +#else
 +#define PL0U_R PL1_R
 +#endif
-diff --git a/hw/misc/xlnx-versal-xramc.c b/hw/misc/xlnx-versal-xramc.c
++
-new file mode 100644
++#define PL3_RW (PL3_R | PL3_W)
-index XXXXXXX..XXXXXXX
++#define PL2_RW (PL2_R | PL2_W)
---- /dev/null
++#define PL1_RW (PL1_R | PL1_W)
-+++ b/hw/misc/xlnx-versal-xramc.c
++#define PL0_RW (PL0_R | PL0_W)
-@@ -XXX,XX +XXX,XX @@
++
-+/*
++typedef enum CPAccessResult {
-+ * QEMU model of the Xilinx XRAM Controller.
++    /* Access is permitted */
-+ *
++    CP_ACCESS_OK = 0,
-+ * Copyright (c) 2021 Xilinx Inc.
++    /*
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++     * Access fails due to a configurable trap or enable which would
-+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++     * result in a categorized exception syndrome giving information about
-+ */
++     * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
-+
++     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
-+#include "qemu/osdep.h"
++     * PL1 if in EL0, otherwise to the current EL).
-+#include "qemu/units.h"
++     */
-+#include "qapi/error.h"
++    CP_ACCESS_TRAP = 1,
-+#include "migration/vmstate.h"
++    /*
-+#include "hw/sysbus.h"
++     * Access fails and results in an exception syndrome 0x0 ("uncategorized").
-+#include "hw/register.h"
++     * Note that this is not a catch-all case -- the set of cases which may
-+#include "hw/qdev-properties.h"
++     * result in this failure is specifically defined by the architecture.
-+#include "hw/irq.h"
++     */
-+#include "hw/misc/xlnx-versal-xramc.h"
++    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
-+
++    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
-+#ifndef XLNX_XRAM_CTRL_ERR_DEBUG
++    CP_ACCESS_TRAP_EL2 = 3,
-+#define XLNX_XRAM_CTRL_ERR_DEBUG 0
++    CP_ACCESS_TRAP_EL3 = 4,
-+#endif
++    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
-+
++    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
-+static void xram_update_irq(XlnxXramCtrl *s)
++    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
 +} CPAccessResult;
 +
 +typedef struct ARMCPRegInfo ARMCPRegInfo;
 +
 +/*
 + * Access functions for coprocessor registers. These cannot fail and
 + * may not raise exceptions.
 + */
 +typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
 +typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
 +                       uint64_t value);
 +/* Access permission check functions for coprocessor registers. */
 +typedef CPAccessResult CPAccessFn(CPUARMState *env,
 +                                  const ARMCPRegInfo *opaque,
 +                                  bool isread);
 +/* Hook function for register reset */
 +typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
 +
 +#define CP_ANY 0xff
 +
 +/* Definition of an ARM coprocessor register */
 +struct ARMCPRegInfo {
 +    /* Name of register (useful mainly for debugging, need not be unique) */
 +    const char *name;
 +    /*
 +     * Location of register: coprocessor number and (crn,crm,opc1,opc2)
 +     * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a
 +     * 'wildcard' field -- any value of that field in the MRC/MCR insn
 +     * will be decoded to this register. The register read and write
 +     * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2
 +     * used by the program, so it is possible to register a wildcard and
 +     * then behave differently on read/write if necessary.
 +     * For 64 bit registers, only crm and opc1 are relevant; crn and opc2
 +     * must both be zero.
 +     * For AArch64-visible registers, opc0 is also used.
 +     * Since there are no "coprocessors" in AArch64, cp is purely used as a
 +     * way to distinguish (for KVM's benefit) guest-visible system registers
 +     * from demuxed ones provided to preserve the "no side effects on
 +     * KVM register read/write from QEMU" semantics. cp==0x13 is guest
 +     * visible (to match KVM's encoding); cp==0 will be converted to
 +     * cp==0x13 when the ARMCPRegInfo is registered, for convenience.
 +     */
 +    uint8_t cp;
 +    uint8_t crn;
 +    uint8_t crm;
 +    uint8_t opc0;
 +    uint8_t opc1;
 +    uint8_t opc2;
 +    /* Execution state in which this register is visible: ARM_CP_STATE_* */
 +    int state;
 +    /* Register type: ARM_CP_* bits/values */
 +    int type;
 +    /* Access rights: PL*_[RW] */
 +    int access;
 +    /* Security state: ARM_CP_SECSTATE_* bits/values */
 +    int secure;
 +    /*
 +     * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
 +     * this register was defined: can be used to hand data through to the
 +     * register read/write functions, since they are passed the ARMCPRegInfo*.
 +     */
 +    void *opaque;
 +    /*
 +     * Value of this register, if it is ARM_CP_CONST. Otherwise, if
 +     * fieldoffset is non-zero, the reset value of the register.
 +     */
 +    uint64_t resetvalue;
 +    /*
 +     * Offset of the field in CPUARMState for this register.
 +     * This is not needed if either:
 +     *  1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs
 +     *  2. both readfn and writefn are specified
 +     */
 +    ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */
 +
 +    /*
 +     * Offsets of the secure and non-secure fields in CPUARMState for the
 +     * register if it is banked.  These fields are only used during the static
 +     * registration of a register.  During hashing the bank associated
 +     * with a given security state is copied to fieldoffset which is used from
 +     * there on out.
 +     *
 +     * It is expected that register definitions use either fieldoffset or
 +     * bank_fieldoffsets in the definition but not both.  It is also expected
 +     * that both bank offsets are set when defining a banked register.  This
 +     * use indicates that a register is banked.
 +     */
 +    ptrdiff_t bank_fieldoffsets[2];
 +
 +    /*
 +     * Function for making any access checks for this register in addition to
 +     * those specified by the 'access' permissions bits. If NULL, no extra
 +     * checks required. The access check is performed at runtime, not at
 +     * translate time.
 +     */
 +    CPAccessFn *accessfn;
 +    /*
 +     * Function for handling reads of this register. If NULL, then reads
 +     * will be done by loading from the offset into CPUARMState specified
 +     * by fieldoffset.
 +     */
 +    CPReadFn *readfn;
 +    /*
 +     * Function for handling writes of this register. If NULL, then writes
 +     * will be done by writing to the offset into CPUARMState specified
 +     * by fieldoffset.
 +     */
 +    CPWriteFn *writefn;
 +    /*
 +     * Function for doing a "raw" read; used when we need to copy
 +     * coprocessor state to the kernel for KVM or out for
 +     * migration. This only needs to be provided if there is also a
 +     * readfn and it has side effects (for instance clear-on-read bits).
 +     */
 +    CPReadFn *raw_readfn;
 +    /*
 +     * Function for doing a "raw" write; used when we need to copy KVM
 +     * kernel coprocessor state into userspace, or for inbound
 +     * migration. This only needs to be provided if there is also a
 +     * writefn and it masks out "unwritable" bits or has write-one-to-clear
 +     * or similar behaviour.
 +     */
 +    CPWriteFn *raw_writefn;
 +    /*
 +     * Function for resetting the register. If NULL, then reset will be done
 +     * by writing resetvalue to the field specified in fieldoffset. If
 +     * fieldoffset is 0 then no reset will be done.
 +     */
 +    CPResetFn *resetfn;
 +
 +    /*
 +     * "Original" writefn and readfn.
 +     * For ARMv8.1-VHE register aliases, we overwrite the read/write
 +     * accessor functions of various EL1/EL0 to perform the runtime
 +     * check for which sysreg should actually be modified, and then
 +     * forwards the operation.  Before overwriting the accessors,
 +     * the original function is copied here, so that accesses that
 +     * really do go to the EL1/EL0 version proceed normally.
 +     * (The corresponding EL2 register is linked via opaque.)
 +     */
 +    CPReadFn *orig_readfn;
 +    CPWriteFn *orig_writefn;
 +};
 +
 +/*
 + * Macros which are lvalues for the field in CPUARMState for the
 + * ARMCPRegInfo *ri.
 + */
 +#define CPREG_FIELD32(env, ri) \
 +    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
 +#define CPREG_FIELD64(env, ri) \
 +    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 +
 +#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
 +
 +void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
 +                                    const ARMCPRegInfo *regs, void *opaque);
 +void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
 +                                       const ARMCPRegInfo *regs, void *opaque);
 +static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
 +{
-+    bool pending = s->regs[R_XRAM_ISR] & ~s->regs[R_XRAM_IMR];
++    define_arm_cp_regs_with_opaque(cpu, regs, 0);
 +    qemu_set_irq(s->irq, pending);
 +}
-+
++static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
 +static void xram_isr_postw(RegisterInfo *reg, uint64_t val64)
 +{
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
++    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
 +    xram_update_irq(s);
 +}
-+
++const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
-+static uint64_t xram_ien_prew(RegisterInfo *reg, uint64_t val64)
++
 +/*
 + * Definition of an ARM co-processor register as viewed from
 + * userspace. This is used for presenting sanitised versions of
 + * registers to userspace when emulating the Linux AArch64 CPU
 + * ID/feature ABI (advertised as HWCAP_CPUID).
 + */
 +typedef struct ARMCPRegUserSpaceInfo {
 +    /* Name of register */
 +    const char *name;
 +
 +    /* Is the name actually a glob pattern */
 +    bool is_glob;
 +
 +    /* Only some bits are exported to user space */
 +    uint64_t exported_bits;
 +
 +    /* Fixed bits are applied after the mask */
 +    uint64_t fixed_bits;
 +} ARMCPRegUserSpaceInfo;
 +
 +#define REGUSERINFO_SENTINEL { .name = NULL }
 +
 +void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
 +
 +/* CPWriteFn that can be used to implement writes-ignored behaviour */
 +void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 +                         uint64_t value);
 +/* CPReadFn that can be used for read-as-zero behaviour */
 +uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 +
 +/*
 + * CPResetFn that does nothing, for use if no reset is required even
 + * if fieldoffset is non zero.
 + */
 +void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
 +
 +/*
 + * Return true if this reginfo struct's field in the cpu state struct
 + * is 64 bits wide.
 + */
 +static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
 +{
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
++    return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
 +    uint32_t val = val64;
 +
 +    s->regs[R_XRAM_IMR] &= ~val;
 +    xram_update_irq(s);
 +    return 0;
 +}
 +
-+static uint64_t xram_ids_prew(RegisterInfo *reg, uint64_t val64)
++static inline bool cp_access_ok(int current_el,
 +                                const ARMCPRegInfo *ri, int isread)
 +{
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
++    return (ri->access >> ((current_el * 2) + isread)) & 1;
 +    uint32_t val = val64;
 +
 +    s->regs[R_XRAM_IMR] |= val;
 +    xram_update_irq(s);
 +    return 0;
 +}
 +
-+static const RegisterAccessInfo xram_ctrl_regs_info[] = {
++/* Raw read of a coprocessor register (as needed for migration, etc) */
-+    {   .name = "XRAM_ERR_CTRL",  .addr = A_XRAM_ERR_CTRL,
++uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri);
-+        .reset = 0xf,
++
-+        .rsvd = 0xfffffff0,
++#endif /* TARGET_ARM_CPREGS_H */
-+    },{ .name = "XRAM_ISR",  .addr = A_XRAM_ISR,
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-+        .rsvd = 0xfffff800,
+index XXXXXXX..XXXXXXX 100644
-+        .w1c = 0x7ff,
+--- a/target/arm/cpu.h
-+        .post_write = xram_isr_postw,
++++ b/target/arm/cpu.h
-+    },{ .name = "XRAM_IMR",  .addr = A_XRAM_IMR,
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
-+        .reset = 0x7ff,
+     return kvmid;
-+        .rsvd = 0xfffff800,
+ }
-+        .ro = 0x7ff,
-+    },{ .name = "XRAM_IEN",  .addr = A_XRAM_IEN,
+-/* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
-+        .rsvd = 0xfffff800,
+- * special-behaviour cp reg and bits [11..8] indicate what behaviour
-+        .pre_write = xram_ien_prew,
+- * it has. Otherwise it is a simple cp reg, where CONST indicates that
-+    },{ .name = "XRAM_IDS",  .addr = A_XRAM_IDS,
+- * TCG can assume the value to be constant (ie load at translate time)
-+        .rsvd = 0xfffff800,
+- * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
-+        .pre_write = xram_ids_prew,
+- * indicates that the TB should not be ended after a write to this register
-+    },{ .name = "XRAM_ECC_CNTL",  .addr = A_XRAM_ECC_CNTL,
+- * (the default is that the TB ends after cp writes). OVERRIDE permits
-+        .rsvd = 0xfffffff8,
+- * a register definition to override a previous definition for the
-+    },{ .name = "XRAM_CLR_EXE",  .addr = A_XRAM_CLR_EXE,
+- * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
-+        .rsvd = 0xffffff00,
+- * old must have the OVERRIDE bit set.
-+    },{ .name = "XRAM_CE_FFA",  .addr = A_XRAM_CE_FFA,
+- * ALIAS indicates that this register is an alias view of some underlying
-+        .rsvd = 0xfff00000,
+- * state which is also visible via another register, and that the other
-+        .ro = 0xfffff,
+- * register is handling migration and reset; registers marked ALIAS will not be
-+    },{ .name = "XRAM_CE_FFD0",  .addr = A_XRAM_CE_FFD0,
+- * migrated but may have their state set by syncing of register state from KVM.
-+        .ro = 0xffffffff,
+- * NO_RAW indicates that this register has no underlying state and does not
-+    },{ .name = "XRAM_CE_FFD1",  .addr = A_XRAM_CE_FFD1,
+- * support raw access for state saving/loading; it will not be used for either
-+        .ro = 0xffffffff,
+- * migration or KVM state synchronization. (Typically this is for "registers"
-+    },{ .name = "XRAM_CE_FFD2",  .addr = A_XRAM_CE_FFD2,
+- * which are actually used as instructions for cache maintenance and so on.)
-+        .ro = 0xffffffff,
+- * IO indicates that this register does I/O and therefore its accesses
-+    },{ .name = "XRAM_CE_FFD3",  .addr = A_XRAM_CE_FFD3,
+- * need to be marked with gen_io_start() and also end the TB. In particular,
-+        .ro = 0xffffffff,
+- * registers which implement clocks or timers require this.
-+    },{ .name = "XRAM_CE_FFE",  .addr = A_XRAM_CE_FFE,
+- * RAISES_EXC is for when the read or write hook might raise an exception;
-+        .rsvd = 0xffff0000,
+- * the generated code will synchronize the CPU state before calling the hook
-+        .ro = 0xffff,
+- * so that it is safe for the hook to call raise_exception().
-+    },{ .name = "XRAM_UE_FFA",  .addr = A_XRAM_UE_FFA,
+- * NEWEL is for writes to registers that might change the exception
-+        .rsvd = 0xfff00000,
+- * level - typically on older ARM chips. For those cases we need to
-+        .ro = 0xfffff,
+- * re-read the new el when recomputing the translation flags.
-+    },{ .name = "XRAM_UE_FFD0",  .addr = A_XRAM_UE_FFD0,
+- */
-+        .ro = 0xffffffff,
+-#define ARM_CP_SPECIAL           0x0001
-+    },{ .name = "XRAM_UE_FFD1",  .addr = A_XRAM_UE_FFD1,
+-#define ARM_CP_CONST             0x0002
-+        .ro = 0xffffffff,
+-#define ARM_CP_64BIT             0x0004
-+    },{ .name = "XRAM_UE_FFD2",  .addr = A_XRAM_UE_FFD2,
+-#define ARM_CP_SUPPRESS_TB_END   0x0008
-+        .ro = 0xffffffff,
+-#define ARM_CP_OVERRIDE          0x0010
-+    },{ .name = "XRAM_UE_FFD3",  .addr = A_XRAM_UE_FFD3,
+-#define ARM_CP_ALIAS             0x0020
-+        .ro = 0xffffffff,
+-#define ARM_CP_IO                0x0040
-+    },{ .name = "XRAM_UE_FFE",  .addr = A_XRAM_UE_FFE,
+-#define ARM_CP_NO_RAW            0x0080
-+        .rsvd = 0xffff0000,
+-#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
-+        .ro = 0xffff,
+-#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
-+    },{ .name = "XRAM_FI_D0",  .addr = A_XRAM_FI_D0,
+-#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
-+    },{ .name = "XRAM_FI_D1",  .addr = A_XRAM_FI_D1,
+-#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
-+    },{ .name = "XRAM_FI_D2",  .addr = A_XRAM_FI_D2,
+-#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
-+    },{ .name = "XRAM_FI_D3",  .addr = A_XRAM_FI_D3,
+-#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
-+    },{ .name = "XRAM_FI_SY",  .addr = A_XRAM_FI_SY,
+-#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
-+        .rsvd = 0xffff0000,
+-#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
-+    },{ .name = "XRAM_RMW_UE_FFA",  .addr = A_XRAM_RMW_UE_FFA,
+-#define ARM_CP_FPU               0x1000
-+        .rsvd = 0xfff00000,
+-#define ARM_CP_SVE               0x2000
-+        .ro = 0xfffff,
+-#define ARM_CP_NO_GDB            0x4000
-+    },{ .name = "XRAM_FI_CNTR",  .addr = A_XRAM_FI_CNTR,
+-#define ARM_CP_RAISES_EXC        0x8000
-+        .rsvd = 0xff000000,
+-#define ARM_CP_NEWEL             0x10000
-+    },{ .name = "XRAM_IMP",  .addr = A_XRAM_IMP,
+-/* Used only as a terminator for ARMCPRegInfo lists */
-+        .reset = 0x4,
+-#define ARM_CP_SENTINEL          0xfffff
-+        .rsvd = 0xfffffff0,
+-/* Mask of only the flag bits in a type field */
-+        .ro = 0xf,
+-#define ARM_CP_FLAG_MASK         0x1f0ff
-+    },{ .name = "XRAM_PRDY_DBG",  .addr = A_XRAM_PRDY_DBG,
+-
-+        .reset = 0xffff,
+-/* Valid values for ARMCPRegInfo state field, indicating which of
-+        .rsvd = 0xffff0000,
+- * the AArch32 and AArch64 execution states this register is visible in.
-+        .ro = 0xffff,
+- * If the reginfo doesn't explicitly specify then it is AArch32 only.
-+    },{ .name = "XRAM_SAFETY_CHK",  .addr = A_XRAM_SAFETY_CHK,
+- * If the reginfo is declared to be visible in both states then a second
-+    }
+- * reginfo is synthesised for the AArch32 view of the AArch64 register,
-+};
+- * such that the AArch32 view is the lower 32 bits of the AArch64 one.
-+
+- * Note that we rely on the values of these enums as we iterate through
-+static void xram_ctrl_reset_enter(Object *obj, ResetType type)
+- * the various states in some places.
-+{
+- */
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+-enum {
-+    unsigned int i;
+-    ARM_CP_STATE_AA32 = 0,
-+
+-    ARM_CP_STATE_AA64 = 1,
-+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+-    ARM_CP_STATE_BOTH = 2,
-+        register_reset(&s->regs_info[i]);
+-};
-+    }
+-
-+
+-/* ARM CP register secure state flags.  These flags identify security state
-+    ARRAY_FIELD_DP32(s->regs, XRAM_IMP, SIZE, s->cfg.encoded_size);
+- * attributes for a given CP register entry.
-+}
+- * The existence of both or neither secure and non-secure flags indicates that
-+
+- * the register has both a secure and non-secure hash entry.  A single one of
-+static void xram_ctrl_reset_hold(Object *obj)
+- * these flags causes the register to only be hashed for the specified
-+{
+- * security state.
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+- * Although definitions may have any combination of the S/NS bits, each
-+
+- * registered entry will only have one to identify whether the entry is secure
-+    xram_update_irq(s);
+- * or non-secure.
-+}
+- */
-+
+-enum {
-+static const MemoryRegionOps xram_ctrl_ops = {
+-    ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
-+    .read = register_read_memory,
+-    ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
-+    .write = register_write_memory,
+-};
-+    .endianness = DEVICE_LITTLE_ENDIAN,
+-
-+    .valid = {
+-/* Return true if cptype is a valid type field. This is used to try to
-+        .min_access_size = 4,
+- * catch errors where the sentinel has been accidentally left off the end
-+        .max_access_size = 4,
+- * of a list of registers.
-+    },
+- */
-+};
+-static inline bool cptype_valid(int cptype)
-+
+-{
-+static void xram_ctrl_realize(DeviceState *dev, Error **errp)
+-    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
-+{
+-        || ((cptype & ARM_CP_SPECIAL) &&
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+-            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(dev);
+-}
-+
+-
-+    switch (s->cfg.size) {
+-/* Access rights:
-+    case 64 * KiB:
+- * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
-+        s->cfg.encoded_size = 0;
+- * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and
-+        break;
+- * PL2 (hyp). The other level which has Read and Write bits is Secure PL1
-+    case 128 * KiB:
+- * (ie any of the privileged modes in Secure state, or Monitor mode).
-+        s->cfg.encoded_size = 1;
+- * If a register is accessible in one privilege level it's always accessible
-+        break;
+- * in higher privilege levels too. Since "Secure PL1" also follows this rule
-+    case 256 * KiB:
+- * (ie anything visible in PL2 is visible in S-PL1, some things are only
-+        s->cfg.encoded_size = 2;
+- * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the
-+        break;
+- * terminology a little and call this PL3.
-+    case 512 * KiB:
+- * In AArch64 things are somewhat simpler as the PLx bits line up exactly
-+        s->cfg.encoded_size = 3;
+- * with the ELx exception levels.
-+        break;
+- *
-+    case 1 * MiB:
+- * If access permissions for a register are more complex than can be
-+        s->cfg.encoded_size = 4;
+- * described with these bits, then use a laxer set of restrictions, and
-+        break;
+- * do the more restrictive/complex check inside a helper function.
-+    default:
+- */
-+        error_setg(errp, "Unsupported XRAM size %" PRId64, s->cfg.size);
+-#define PL3_R 0x80
-+        return;
+-#define PL3_W 0x40
-+    }
+-#define PL2_R (0x20 | PL3_R)
-+
+-#define PL2_W (0x10 | PL3_W)
-+    memory_region_init_ram(&s->ram, OBJECT(s),
+-#define PL1_R (0x08 | PL2_R)
-+                           object_get_canonical_path_component(OBJECT(s)),
+-#define PL1_W (0x04 | PL2_W)
-+                           s->cfg.size, &error_fatal);
+-#define PL0_R (0x02 | PL1_R)
-+    sysbus_init_mmio(sbd, &s->ram);
+-#define PL0_W (0x01 | PL1_W)
-+}
+-
-+
+-/*
-+static void xram_ctrl_init(Object *obj)
+- * For user-mode some registers are accessible to EL0 via a kernel
-+{
+- * trap-and-emulate ABI. In this case we define the read permissions
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+- * as actually being PL0_R. However some bits of any given register
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+- * may still be masked.
-+
+- */
-+    s->reg_array =
+-#ifdef CONFIG_USER_ONLY
-+        register_init_block32(DEVICE(obj), xram_ctrl_regs_info,
+-#define PL0U_R PL0_R
-+                              ARRAY_SIZE(xram_ctrl_regs_info),
+-#else
-+                              s->regs_info, s->regs,
+-#define PL0U_R PL1_R
-+                              &xram_ctrl_ops,
+-#endif
-+                              XLNX_XRAM_CTRL_ERR_DEBUG,
+-
-+                              XRAM_CTRL_R_MAX * 4);
+-#define PL3_RW (PL3_R | PL3_W)
-+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+-#define PL2_RW (PL2_R | PL2_W)
-+    sysbus_init_irq(sbd, &s->irq);
+-#define PL1_RW (PL1_R | PL1_W)
-+}
+-#define PL0_RW (PL0_R | PL0_W)
-+
+-
-+static void xram_ctrl_finalize(Object *obj)
+ /* Return the highest implemented Exception Level */
-+{
+ static inline int arm_highest_el(CPUARMState *env)
-+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+ {
-+    register_finalize_block(s->reg_array);
+@@ -XXX,XX +XXX,XX @@ static inline int arm_current_el(CPUARMState *env)
-+}
+     }
-+
+ }
-+static const VMStateDescription vmstate_xram_ctrl = {
-+    .name = TYPE_XLNX_XRAM_CTRL,
+-typedef struct ARMCPRegInfo ARMCPRegInfo;
-+    .version_id = 1,
+-
-+    .minimum_version_id = 1,
+-typedef enum CPAccessResult {
-+    .fields = (VMStateField[]) {
+-    /* Access is permitted */
-+        VMSTATE_UINT32_ARRAY(regs, XlnxXramCtrl, XRAM_CTRL_R_MAX),
+-    CP_ACCESS_OK = 0,
-+        VMSTATE_END_OF_LIST(),
+-    /* Access fails due to a configurable trap or enable which would
-+    }
+-     * result in a categorized exception syndrome giving information about
-+};
+-     * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
-+
+-     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
-+static Property xram_ctrl_properties[] = {
+-     * PL1 if in EL0, otherwise to the current EL).
-+    DEFINE_PROP_UINT64("size", XlnxXramCtrl, cfg.size, 1 * MiB),
+-     */
-+    DEFINE_PROP_END_OF_LIST(),
+-    CP_ACCESS_TRAP = 1,
-+};
+-    /* Access fails and results in an exception syndrome 0x0 ("uncategorized").
-+
+-     * Note that this is not a catch-all case -- the set of cases which may
-+static void xram_ctrl_class_init(ObjectClass *klass, void *data)
+-     * result in this failure is specifically defined by the architecture.
-+{
+-     */
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+-    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
-+    DeviceClass *dc = DEVICE_CLASS(klass);
+-    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
-+
+-    CP_ACCESS_TRAP_EL2 = 3,
-+    dc->realize = xram_ctrl_realize;
+-    CP_ACCESS_TRAP_EL3 = 4,
-+    dc->vmsd = &vmstate_xram_ctrl;
+-    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
-+    device_class_set_props(dc, xram_ctrl_properties);
+-    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
-+
+-    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
-+    rc->phases.enter = xram_ctrl_reset_enter;
+-} CPAccessResult;
-+    rc->phases.hold = xram_ctrl_reset_hold;
+-
-+}
+-/* Access functions for coprocessor registers. These cannot fail and
-+
+- * may not raise exceptions.
-+static const TypeInfo xram_ctrl_info = {
+- */
-+    .name              = TYPE_XLNX_XRAM_CTRL,
+-typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
-+    .parent            = TYPE_SYS_BUS_DEVICE,
+-typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
-+    .instance_size     = sizeof(XlnxXramCtrl),
+-                       uint64_t value);
-+    .class_init        = xram_ctrl_class_init,
+-/* Access permission check functions for coprocessor registers. */
-+    .instance_init     = xram_ctrl_init,
+-typedef CPAccessResult CPAccessFn(CPUARMState *env,
-+    .instance_finalize = xram_ctrl_finalize,
+-                                  const ARMCPRegInfo *opaque,
-+};
+-                                  bool isread);
-+
+-/* Hook function for register reset */
-+static void xram_ctrl_register_types(void)
+-typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
-+{
+-
-+    type_register_static(&xram_ctrl_info);
+-#define CP_ANY 0xff
-+}
+-
-+
+-/* Definition of an ARM coprocessor register */
-+type_init(xram_ctrl_register_types)
+-struct ARMCPRegInfo {
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+-    /* Name of register (useful mainly for debugging, need not be unique) */
-index XXXXXXX..XXXXXXX 100644
+-    const char *name;
---- a/hw/misc/meson.build
+-    /* Location of register: coprocessor number and (crn,crm,opc1,opc2)
-+++ b/hw/misc/meson.build
+-     * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
+-     * 'wildcard' field -- any value of that field in the MRC/MCR insn
- ))
+-     * will be decoded to this register. The register read and write
- softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+-     * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2
- softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c', 'zynq-xadc.c'))
+-     * used by the program, so it is possible to register a wildcard and
-+softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-xramc.c'))
+-     * then behave differently on read/write if necessary.
- softmmu_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
+-     * For 64 bit registers, only crm and opc1 are relevant; crn and opc2
- softmmu_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
+-     * must both be zero.
- softmmu_ss.add(when: 'CONFIG_STM32F4XX_EXTI', if_true: files('stm32f4xx_exti.c'))
+-     * For AArch64-visible registers, opc0 is also used.
 -     * Since there are no "coprocessors" in AArch64, cp is purely used as a
 -     * way to distinguish (for KVM's benefit) guest-visible system registers
 -     * from demuxed ones provided to preserve the "no side effects on
 -     * KVM register read/write from QEMU" semantics. cp==0x13 is guest
 -     * visible (to match KVM's encoding); cp==0 will be converted to
 -     * cp==0x13 when the ARMCPRegInfo is registered, for convenience.
 -     */
 -    uint8_t cp;
 -    uint8_t crn;
 -    uint8_t crm;
 -    uint8_t opc0;
 -    uint8_t opc1;
 -    uint8_t opc2;
 -    /* Execution state in which this register is visible: ARM_CP_STATE_* */
 -    int state;
 -    /* Register type: ARM_CP_* bits/values */
 -    int type;
 -    /* Access rights: PL*_[RW] */
 -    int access;
 -    /* Security state: ARM_CP_SECSTATE_* bits/values */
 -    int secure;
 -    /* The opaque pointer passed to define_arm_cp_regs_with_opaque() when
 -     * this register was defined: can be used to hand data through to the
 -     * register read/write functions, since they are passed the ARMCPRegInfo*.
 -     */
 -    void *opaque;
 -    /* Value of this register, if it is ARM_CP_CONST. Otherwise, if
 -     * fieldoffset is non-zero, the reset value of the register.
 -     */
 -    uint64_t resetvalue;
 -    /* Offset of the field in CPUARMState for this register.
 -     *
 -     * This is not needed if either:
 -     *  1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs
 -     *  2. both readfn and writefn are specified
 -     */
 -    ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */
 -
 -    /* Offsets of the secure and non-secure fields in CPUARMState for the
 -     * register if it is banked.  These fields are only used during the static
 -     * registration of a register.  During hashing the bank associated
 -     * with a given security state is copied to fieldoffset which is used from
 -     * there on out.
 -     *
 -     * It is expected that register definitions use either fieldoffset or
 -     * bank_fieldoffsets in the definition but not both.  It is also expected
 -     * that both bank offsets are set when defining a banked register.  This
 -     * use indicates that a register is banked.
 -     */
 -    ptrdiff_t bank_fieldoffsets[2];
 -
 -    /* Function for making any access checks for this register in addition to
 -     * those specified by the 'access' permissions bits. If NULL, no extra
 -     * checks required. The access check is performed at runtime, not at
 -     * translate time.
 -     */
 -    CPAccessFn *accessfn;
 -    /* Function for handling reads of this register. If NULL, then reads
 -     * will be done by loading from the offset into CPUARMState specified
 -     * by fieldoffset.
 -     */
 -    CPReadFn *readfn;
 -    /* Function for handling writes of this register. If NULL, then writes
 -     * will be done by writing to the offset into CPUARMState specified
 -     * by fieldoffset.
 -     */
 -    CPWriteFn *writefn;
 -    /* Function for doing a "raw" read; used when we need to copy
 -     * coprocessor state to the kernel for KVM or out for
 -     * migration. This only needs to be provided if there is also a
 -     * readfn and it has side effects (for instance clear-on-read bits).
 -     */
 -    CPReadFn *raw_readfn;
 -    /* Function for doing a "raw" write; used when we need to copy KVM
 -     * kernel coprocessor state into userspace, or for inbound
 -     * migration. This only needs to be provided if there is also a
 -     * writefn and it masks out "unwritable" bits or has write-one-to-clear
 -     * or similar behaviour.
 -     */
 -    CPWriteFn *raw_writefn;
 -    /* Function for resetting the register. If NULL, then reset will be done
 -     * by writing resetvalue to the field specified in fieldoffset. If
 -     * fieldoffset is 0 then no reset will be done.
 -     */
 -    CPResetFn *resetfn;
 -
 -    /*
 -     * "Original" writefn and readfn.
 -     * For ARMv8.1-VHE register aliases, we overwrite the read/write
 -     * accessor functions of various EL1/EL0 to perform the runtime
 -     * check for which sysreg should actually be modified, and then
 -     * forwards the operation.  Before overwriting the accessors,
 -     * the original function is copied here, so that accesses that
 -     * really do go to the EL1/EL0 version proceed normally.
 -     * (The corresponding EL2 register is linked via opaque.)
 -     */
 -    CPReadFn *orig_readfn;
 -    CPWriteFn *orig_writefn;
 -};
 -
 -/* Macros which are lvalues for the field in CPUARMState for the
 - * ARMCPRegInfo *ri.
 - */
 -#define CPREG_FIELD32(env, ri) \
 -    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
 -#define CPREG_FIELD64(env, ri) \
 -    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 -
 -#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
 -
 -void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
 -                                    const ARMCPRegInfo *regs, void *opaque);
 -void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
 -                                       const ARMCPRegInfo *regs, void *opaque);
 -static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
 -{
 -    define_arm_cp_regs_with_opaque(cpu, regs, 0);
 -}
 -static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
 -{
 -    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
 -}
 -const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
 -
 -/*
 - * Definition of an ARM co-processor register as viewed from
 - * userspace. This is used for presenting sanitised versions of
 - * registers to userspace when emulating the Linux AArch64 CPU
 - * ID/feature ABI (advertised as HWCAP_CPUID).
 - */
 -typedef struct ARMCPRegUserSpaceInfo {
 -    /* Name of register */
 -    const char *name;
 -
 -    /* Is the name actually a glob pattern */
 -    bool is_glob;
 -
 -    /* Only some bits are exported to user space */
 -    uint64_t exported_bits;
 -
 -    /* Fixed bits are applied after the mask */
 -    uint64_t fixed_bits;
 -} ARMCPRegUserSpaceInfo;
 -
 -#define REGUSERINFO_SENTINEL { .name = NULL }
 -
 -void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
 -
 -/* CPWriteFn that can be used to implement writes-ignored behaviour */
 -void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 -                         uint64_t value);
 -/* CPReadFn that can be used for read-as-zero behaviour */
 -uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 -
 -/* CPResetFn that does nothing, for use if no reset is required even
 - * if fieldoffset is non zero.
 - */
 -void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
 -
 -/* Return true if this reginfo struct's field in the cpu state struct
 - * is 64 bits wide.
 - */
 -static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
 -{
 -    return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
 -}
 -
 -static inline bool cp_access_ok(int current_el,
 -                                const ARMCPRegInfo *ri, int isread)
 -{
 -    return (ri->access >> ((current_el * 2) + isread)) & 1;
 -}
 -
 -/* Raw read of a coprocessor register (as needed for migration, etc) */
 -uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri);
 -
  /**
   * write_list_to_cpustate
   * @cpu: ARMCPU
 diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx.c
 +++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/cutils.h"
  #include "qemu/log.h"
  #include "qom/object.h"
 +#include "target/arm/cpregs.h"
  static struct {
      hwaddr io_base;
 diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx_pic.c
 +++ b/hw/arm/pxa2xx_pic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "migration/vmstate.h"
  #include "qom/object.h"
 +#include "target/arm/cpregs.h"
  #define ICIP    0x00    /* Interrupt Controller IRQ Pending register */
  #define ICMR    0x04    /* Interrupt Controller Mask register */
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
  #include "gicv3_internal.h"
  #include "hw/irq.h"
  #include "cpu.h"
 +#include "target/arm/cpregs.h"
  /*
   * Special case return value from hppvi_index(); must be larger than
 diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_kvm.c
 +++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@
  #include "vgic_common.h"
  #include "migration/blocker.h"
  #include "qom/object.h"
 +#include "target/arm/cpregs.h"
 +
  #ifdef DEBUG_GICV3_KVM
  #define DPRINTF(fmt, ...) \
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "kvm_arm.h"
  #include "disas/capstone.h"
  #include "fpu/softfloat.h"
 +#include "cpregs.h"
  static void arm_cpu_set_pc(CPUState *cs, vaddr value)
  {
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #include "hvf_arm.h"
  #include "qapi/visitor.h"
  #include "hw/qdev-properties.h"
 +#include "cpregs.h"
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  #if !defined(CONFIG_USER_ONLY)
  #include "hw/boards.h"
  #endif
 +#include "cpregs.h"
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "internals.h"
  #include "exec/gdbstub.h"
 +#include "internals.h"
 +#include "cpregs.h"
  typedef struct RegisterSysregXmlParam {
      CPUState *cs;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/cpu_ldst.h"
  #include "semihosting/common-semi.h"
  #endif
 +#include "cpregs.h"
  #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
  #define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "internals.h"
  #include "exec/exec-all.h"
  #include "exec/cpu_ldst.h"
 +#include "cpregs.h"
  #define SIGNBIT (uint32_t)0x80000000
  #define SIGNBIT64 ((uint64_t)1 << 63)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@
  #include "translate.h"
  #include "internals.h"
  #include "qemu/host-utils.h"
 -
  #include "semihosting/semihost.h"
  #include "exec/gen-icount.h"
 -
  #include "exec/helper-proto.h"
  #include "exec/helper-gen.h"
  #include "exec/log.h"
 -
 +#include "cpregs.h"
  #include "translate-a64.h"
  #include "qemu/atomic128.h"
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bitops.h"
  #include "arm_ldst.h"
  #include "semihosting/semihost.h"
 -
  #include "exec/helper-proto.h"
  #include "exec/helper-gen.h"
 -
  #include "exec/log.h"
 +#include "cpregs.h"
  #define ENABLE_ARCH_4T    arm_dc_feature(s, ARM_FEATURE_V4T)
 --
-.20.1
+.25.1

-[PULL 02/39] hw/arm: versal: Add support for the XRAMs
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Connect the support for the Versal Accelerator RAMs (XRAMs).
-Reviewed-by: Luc Michel <luc@lmichel.fr>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20210308224637.2949533-3-edgar.iglesias@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/xlnx-versal-virt.rst |  1 +
- include/hw/arm/xlnx-versal.h         | 13 ++++++++++
- hw/arm/xlnx-versal.c                 | 36 ++++++++++++++++++++++++++++
-files changed, 50 insertions(+)
-diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/xlnx-versal-virt.rst
-+++ b/docs/system/arm/xlnx-versal-virt.rst
-@@ -XXX,XX +XXX,XX @@ Implemented devices:
- - 8 ADMA (Xilinx zDMA) channels
- - 2 SD Controllers
- - OCM (256KB of On Chip Memory)
-+- XRAM (4MB of on chip Accelerator RAM)
- - DDR memory
- QEMU does not yet model any other devices, including the PL and the AI Engine.
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
-+++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "hw/arm/boot.h"
-+#include "hw/or-irq.h"
- #include "hw/sd/sdhci.h"
- #include "hw/intc/arm_gicv3.h"
- #include "hw/char/pl011.h"
-@@ -XXX,XX +XXX,XX @@
- #include "hw/rtc/xlnx-zynqmp-rtc.h"
- #include "qom/object.h"
- #include "hw/usb/xlnx-usb-subsystem.h"
-+#include "hw/misc/xlnx-versal-xramc.h"
- #define TYPE_XLNX_VERSAL "xlnx-versal"
- OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
-@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
- #define XLNX_VERSAL_NR_GEMS    2
- #define XLNX_VERSAL_NR_ADMAS   8
- #define XLNX_VERSAL_NR_SDS     2
-+#define XLNX_VERSAL_NR_XRAM    4
- #define XLNX_VERSAL_NR_IRQS    192
- struct Versal {
-@@ -XXX,XX +XXX,XX @@ struct Versal {
-             XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
-             VersalUsb2 usb;
-         } iou;
-+
-+        struct {
-+            qemu_or_irq irq_orgate;
-+            XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
-+        } xram;
-     } lpd;
-     /* The Platform Management Controller subsystem.  */
-@@ -XXX,XX +XXX,XX @@ struct Versal {
- #define VERSAL_GEM1_IRQ_0          58
- #define VERSAL_GEM1_WAKE_IRQ_0     59
- #define VERSAL_ADMA_IRQ_0          60
-+#define VERSAL_XRAM_IRQ_0          79
- #define VERSAL_RTC_APB_ERR_IRQ     121
- #define VERSAL_SD0_IRQ_0           126
- #define VERSAL_RTC_ALARM_IRQ       142
-@@ -XXX,XX +XXX,XX @@ struct Versal {
- #define MM_OCM                      0xfffc0000U
- #define MM_OCM_SIZE                 0x40000
-+#define MM_XRAM                     0xfe800000
-+#define MM_XRAMC                    0xff8e0000
-+#define MM_XRAMC_SIZE               0x10000
-+
- #define MM_USB2_CTRL_REGS           0xFF9D0000
- #define MM_USB2_CTRL_REGS_SIZE      0x10000
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qemu/units.h"
- #include "qapi/error.h"
- #include "qemu/log.h"
- #include "qemu/module.h"
-@@ -XXX,XX +XXX,XX @@ static void versal_create_rtc(Versal *s, qemu_irq *pic)
-     sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
- }
-+static void versal_create_xrams(Versal *s, qemu_irq *pic)
-+{
-+    int nr_xrams = ARRAY_SIZE(s->lpd.xram.ctrl);
-+    DeviceState *orgate;
-+    int i;
-+
-+    /* XRAM IRQs get ORed into a single line.  */
-+    object_initialize_child(OBJECT(s), "xram-irq-orgate",
-+                            &s->lpd.xram.irq_orgate, TYPE_OR_IRQ);
-+    orgate = DEVICE(&s->lpd.xram.irq_orgate);
-+    object_property_set_int(OBJECT(orgate),
-+                            "num-lines", nr_xrams, &error_fatal);
-+    qdev_realize(orgate, NULL, &error_fatal);
-+    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_XRAM_IRQ_0]);
-+
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.xram.ctrl); i++) {
-+        SysBusDevice *sbd;
-+        MemoryRegion *mr;
-+
-+        object_initialize_child(OBJECT(s), "xram[*]", &s->lpd.xram.ctrl[i],
-+                                TYPE_XLNX_XRAM_CTRL);
-+        sbd = SYS_BUS_DEVICE(&s->lpd.xram.ctrl[i]);
-+        sysbus_realize(sbd, &error_fatal);
-+
-+        mr = sysbus_mmio_get_region(sbd, 0);
-+        memory_region_add_subregion(&s->mr_ps,
-+                                    MM_XRAMC + i * MM_XRAMC_SIZE, mr);
-+        mr = sysbus_mmio_get_region(sbd, 1);
-+        memory_region_add_subregion(&s->mr_ps, MM_XRAM + i * MiB, mr);
-+
-+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(orgate, i));
-+    }
-+}
-+
- /* This takes the board allocated linear DDR memory and creates aliases
-  * for each split DDR range/aperture on the Versal address map.
-  */
-@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
-     versal_create_admas(s, pic);
-     versal_create_sds(s, pic);
-     versal_create_rtc(s, pic);
-+    versal_create_xrams(s, pic);
-     versal_map_ddr(s);
-     versal_unimp(s);
---
-.20.1

-[PULL 03/39] intel_iommu: Fix mask may be uninitialized in vtd_context_device_invalidate
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-With -Werror=maybe-uninitialized configuration we get
-../hw/i386/intel_iommu.c: In function ‘vtd_context_device_invalidate’:
-../hw/i386/intel_iommu.c:1888:10: error: ‘mask’ may be used
-uninitialized in this function [-Werror=maybe-uninitialized]
-|     mask = ~mask;
-      |     ~~~~~^~~~~~~
-Add a g_assert_not_reached() to avoid the error.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20210309102742.30442-2-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/i386/intel_iommu.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/intel_iommu.c
-+++ b/hw/i386/intel_iommu.c
-@@ -XXX,XX +XXX,XX @@ static void vtd_context_device_invalidate(IntelIOMMUState *s,
-     case 3:
-         mask = 7;   /* Mask bit 2:0 in the SID field */
-         break;
-+    default:
-+        g_assert_not_reached();
-     }
-     mask = ~mask;
---
-.20.1

-[PULL 05/39] virtio-iommu: Handle non power of 2 range invalidations
+[PULL 03/23] target/arm: Reorg CPAccessResult and access_check_cp_reg
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Unmap notifiers work with an address mask assuming an
+Rearrange the values of the enumerators of CPAccessResult
-invalidation range of a power of 2. Nothing mandates this
+so that we may directly extract the target el. For the two
-in the VIRTIO-IOMMU spec.
+special cases in access_check_cp_reg, use CPAccessResult.
-So in case the range is not a power of 2, split it into
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-several invalidations.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20220501055028.646596-3-richard.henderson@linaro.org
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-id: 20210309102742.30442-4-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/virtio/virtio-iommu.c | 19 ++++++++++++++++---
+ target/arm/cpregs.h    | 26 ++++++++++++--------
-file changed, 16 insertions(+), 3 deletions(-)
+ target/arm/op_helper.c | 56 +++++++++++++++++++++---------------------
 files changed, 44 insertions(+), 38 deletions(-)
-diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-iommu.c
+--- a/target/arm/cpregs.h
-+++ b/hw/virtio/virtio-iommu.c
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
+@@ -XXX,XX +XXX,XX @@ static inline bool cptype_valid(int cptype)
-                                       hwaddr virt_end)
+ typedef enum CPAccessResult {
      /* Access is permitted */
      CP_ACCESS_OK = 0,
 +
 +    /*
 +     * Combined with one of the following, the low 2 bits indicate the
 +     * target exception level.  If 0, the exception is taken to the usual
 +     * target EL (EL1 or PL1 if in EL0, otherwise to the current EL).
 +     */
 +    CP_ACCESS_EL_MASK = 3,
 +
      /*
       * Access fails due to a configurable trap or enable which would
       * result in a categorized exception syndrome giving information about
       * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
 -     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
 -     * PL1 if in EL0, otherwise to the current EL).
 +     * 0xc or 0x18).
       */
 -    CP_ACCESS_TRAP = 1,
 +    CP_ACCESS_TRAP = (1 << 2),
 +    CP_ACCESS_TRAP_EL2 = CP_ACCESS_TRAP | 2,
 +    CP_ACCESS_TRAP_EL3 = CP_ACCESS_TRAP | 3,
 +
      /*
       * Access fails and results in an exception syndrome 0x0 ("uncategorized").
       * Note that this is not a catch-all case -- the set of cases which may
       * result in this failure is specifically defined by the architecture.
       */
 -    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
 -    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
 -    CP_ACCESS_TRAP_EL2 = 3,
 -    CP_ACCESS_TRAP_EL3 = 4,
 -    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
 -    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
 -    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
 +    CP_ACCESS_TRAP_UNCATEGORIZED = (2 << 2),
 +    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = CP_ACCESS_TRAP_UNCATEGORIZED | 2,
 +    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = CP_ACCESS_TRAP_UNCATEGORIZED | 3,
  } CPAccessResult;
  typedef struct ARMCPRegInfo ARMCPRegInfo;
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
                                   uint32_t isread)
  {
-     IOMMUTLBEvent event;
+     const ARMCPRegInfo *ri = rip;
-+    uint64_t delta = virt_end - virt_start;
++    CPAccessResult res = CP_ACCESS_OK;
+     int target_el;
-     if (!(mr->iommu_notify_flags & IOMMU_NOTIFIER_UNMAP)) {
      if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
          && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 -        raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 +        res = CP_ACCESS_TRAP;
 +        goto fail;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
          mask &= ~((1 << 4) | (1 << 14));
          if (env->cp15.hstr_el2 & mask) {
 -            target_el = 2;
 -            goto exept;
 +            res = CP_ACCESS_TRAP_EL2;
 +            goto fail;
          }
      }
 -    if (!ri->accessfn) {
 +    if (ri->accessfn) {
 +        res = ri->accessfn(env, ri, isread);
 +    }
 +    if (likely(res == CP_ACCESS_OK)) {
          return;
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
+     }
-     event.type = IOMMU_NOTIFIER_UNMAP;
+-    switch (ri->accessfn(env, ri, isread)) {
-     event.entry.target_as = &address_space_memory;
+-    case CP_ACCESS_OK:
--    event.entry.addr_mask = virt_end - virt_start;
+-        return;
--    event.entry.iova = virt_start;
++ fail:
-     event.entry.perm = IOMMU_NONE;
++    switch (res & ~CP_ACCESS_EL_MASK) {
-     event.entry.translated_addr = 0;
+     case CP_ACCESS_TRAP:
-+    event.entry.addr_mask = delta;
+-        target_el = exception_target_el(env);
-+    event.entry.iova = virt_start;
+-        break;
+-    case CP_ACCESS_TRAP_EL2:
--    memory_region_notify_iommu(mr, 0, event);
+-        /* Requesting a trap to EL2 when we're in EL3 is
-+    if (delta == UINT64_MAX) {
+-         * a bug in the access function.
-+        memory_region_notify_iommu(mr, 0, event);
+-         */
 -        assert(arm_current_el(env) != 3);
 -        target_el = 2;
 -        break;
 -    case CP_ACCESS_TRAP_EL3:
 -        target_el = 3;
          break;
      case CP_ACCESS_TRAP_UNCATEGORIZED:
 -        target_el = exception_target_el(env);
 -        syndrome = syn_uncategorized();
 -        break;
 -    case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
 -        target_el = 2;
 -        syndrome = syn_uncategorized();
 -        break;
 -    case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
 -        target_el = 3;
          syndrome = syn_uncategorized();
          break;
      default:
          g_assert_not_reached();
      }
 -exept:
 +    target_el = res & CP_ACCESS_EL_MASK;
 +    switch (target_el) {
 +    case 0:
 +        target_el = exception_target_el(env);
 +        break;
 +    case 2:
 +        assert(arm_current_el(env) != 3);
 +        assert(arm_is_el2_enabled(env));
 +        break;
 +    case 3:
 +        assert(arm_feature(env, ARM_FEATURE_EL3));
 +        break;
 +    default:
 +        /* No "direct" traps to EL1 */
 +        g_assert_not_reached();
 +    }
 +
-+
+     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 +    while (virt_start != virt_end + 1) {
 +        uint64_t mask = dma_aligned_pow2_mask(virt_start, virt_end, 64);
 +
 +        event.entry.addr_mask = mask;
 +        event.entry.iova = virt_start;
 +        memory_region_notify_iommu(mr, 0, event);
 +        virt_start += mask + 1;
 +    }
  }
- static gboolean virtio_iommu_notify_unmap_cb(gpointer key, gpointer value,
 --
-.20.1
+.25.1

-[PULL 38/39] hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header
+[PULL 04/23] target/arm: Replace sentinels with ARRAY_SIZE in cpregs.h
-We're about to move code from the template header into pxa2xx_lcd.c.
+From: Richard Henderson <richard.henderson@linaro.org>
 Before doing that, make coding style fixes so checkpatch doesn't
 complain about the patch which moves the code. This commit is
 whitespace changes only:
  * avoid hard-coded tabs
  * fix ident on function prototypes
  * no newline before open brace on array definitions
+Remove a possible source of error by removing REGINFO_SENTINEL
+and using ARRAY_SIZE (convinently hidden inside a macro) to
+find the end of the set of regs being registered or modified.
+The space saved by not having the extra array element reduces
+the executable's .data.rel.ro section by about 9k.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220501055028.646596-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-9-peter.maydell@linaro.org
 ---
- hw/display/pxa2xx_template.h | 66 +++++++++++++++++-------------------
+ target/arm/cpregs.h       |  53 +++++++++---------
-file changed, 32 insertions(+), 34 deletions(-)
+ hw/arm/pxa2xx.c           |   1 -
  hw/arm/pxa2xx_pic.c       |   1 -
  hw/intc/arm_gicv3_cpuif.c |   5 --
  hw/intc/arm_gicv3_kvm.c   |   1 -
  target/arm/cpu64.c        |   1 -
  target/arm/cpu_tcg.c      |   4 --
  target/arm/helper.c       | 111 ++++++++------------------------------
 files changed, 48 insertions(+), 129 deletions(-)
-diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_template.h
+--- a/target/arm/cpregs.h
-+++ b/hw/display/pxa2xx_template.h
++++ b/target/arm/cpregs.h
 @@ -XXX,XX +XXX,XX @@
-     } while (0)
+ #define ARM_CP_NO_GDB            0x4000
+ #define ARM_CP_RAISES_EXC        0x8000
- #ifdef HOST_WORDS_BIGENDIAN
+ #define ARM_CP_NEWEL             0x10000
--# define SWAP_WORDS    1
+-/* Used only as a terminator for ARMCPRegInfo lists */
-+# define SWAP_WORDS 1
+-#define ARM_CP_SENTINEL          0xfffff
- #endif
+ /* Mask of only the flag bits in a type field */
+ #define ARM_CP_FLAG_MASK         0x1f0ff
--#define FN_2(x)        FN(x + 1) FN(x)
--#define FN_4(x)        FN_2(x + 2) FN_2(x)
+@@ -XXX,XX +XXX,XX @@ enum {
-+#define FN_2(x) FN(x + 1) FN(x)
+     ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
-+#define FN_4(x) FN_2(x + 2) FN_2(x)
+ };
--static void pxa2xx_draw_line2(void *opaque,
+-/*
--                uint8_t *dest, const uint8_t *src, int width, int deststep)
+- * Return true if cptype is a valid type field. This is used to try to
-+static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
+- * catch errors where the sentinel has been accidentally left off the end
-+                              int width, int deststep)
+- * of a list of registers.
 - */
 -static inline bool cptype_valid(int cptype)
 -{
 -    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
 -        || ((cptype & ARM_CP_SPECIAL) &&
 -            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
 -}
 -
  /*
   * Access rights:
   * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
  #define CPREG_FIELD64(env, ri) \
      (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 -#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
 +void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, const ARMCPRegInfo *reg,
 +                                       void *opaque);
 -void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
 -                                    const ARMCPRegInfo *regs, void *opaque);
 -void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
 -                                       const ARMCPRegInfo *regs, void *opaque);
 -static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
 -{
 -    define_arm_cp_regs_with_opaque(cpu, regs, 0);
 -}
  static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
  {
-     uint32_t *palette = opaque;
+-    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
-     uint32_t data;
++    define_one_arm_cp_reg_with_opaque(cpu, regs, NULL);
-     while (width > 0) {
+ }
-         data = *(uint32_t *) src;
++
--#define FN(x)        COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
++void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
++                                        void *opaque, size_t len);
- #ifdef SWAP_WORDS
++
-         FN_4(12)
++#define define_arm_cp_regs_with_opaque(CPU, REGS, OPAQUE)               \
-         FN_4(8)
++    do {                                                                \
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line2(void *opaque,
++        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
 +        define_arm_cp_regs_with_opaque_len(CPU, REGS, OPAQUE,           \
 +                                           ARRAY_SIZE(REGS));           \
 +    } while (0)
 +
 +#define define_arm_cp_regs(CPU, REGS) \
 +    define_arm_cp_regs_with_opaque(CPU, REGS, NULL)
 +
  const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
  /*
@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPRegUserSpaceInfo {
      uint64_t fixed_bits;
  } ARMCPRegUserSpaceInfo;
 -#define REGUSERINFO_SENTINEL { .name = NULL }
 +void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
 +                                 const ARMCPRegUserSpaceInfo *mods,
 +                                 size_t mods_len);
 -void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
 +#define modify_arm_cp_regs(REGS, MODS)                                  \
 +    do {                                                                \
 +        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
 +        QEMU_BUILD_BUG_ON(ARRAY_SIZE(MODS) == 0);                       \
 +        modify_arm_cp_regs_with_len(REGS, ARRAY_SIZE(REGS),             \
 +                                    MODS, ARRAY_SIZE(MODS));            \
 +    } while (0)
  /* CPWriteFn that can be used to implement writes-ignored behaviour */
  void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx.c
 +++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pxa_cp_reginfo[] = {
      { .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
        .access = PL1_RW, .type = ARM_CP_IO,
        .readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
 -    REGINFO_SENTINEL
  };
  static void pxa2xx_setup_cp14(PXA2xxState *s)
 diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx_pic.c
 +++ b/hw/arm/pxa2xx_pic.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pxa_pic_cp_reginfo[] = {
      REGINFO_FOR_PIC_CP("ICLR2", 8),
      REGINFO_FOR_PIC_CP("ICFP2", 9),
      REGINFO_FOR_PIC_CP("ICPR2", 0xa),
 -    REGINFO_SENTINEL
  };
  static const MemoryRegionOps pxa2xx_pic_ops = {
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
        .readfn = icc_igrpen1_el3_read,
        .writefn = icc_igrpen1_el3_write,
      },
 -    REGINFO_SENTINEL
  };
  static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
        .readfn = ich_vmcr_read,
        .writefn = ich_vmcr_write,
      },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
        .readfn = ich_ap_read,
        .writefn = ich_ap_write,
      },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
        .readfn = ich_ap_read,
        .writefn = ich_ap_write,
      },
 -    REGINFO_SENTINEL
  };
  static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
@@ -XXX,XX +XXX,XX @@ void gicv3_init_cpuif(GICv3State *s)
                        .readfn = ich_lr_read,
                        .writefn = ich_lr_write,
                      },
 -                    REGINFO_SENTINEL
                  };
                  define_arm_cp_regs(cpu, lr_regset);
              }
 diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_kvm.c
 +++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
         */
        .resetfn = arm_gicv3_icc_reset,
      },
 -    REGINFO_SENTINEL
  };
  /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
      { .name = "L2MERRSR",
        .cp = 15, .opc1 = 3, .crm = 15,
        .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static void aarch64_a57_initfn(Object *obj)
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa8_cp_reginfo[] = {
        .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
      { .name = "L2AUXCR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2,
        .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static void cortex_a8_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa9_cp_reginfo[] = {
        .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST },
      { .name = "TLB_ATTR", .cp = 15, .crn = 15, .crm = 7, .opc1 = 5, .opc2 = 2,
        .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST },
 -    REGINFO_SENTINEL
  };
  static void cortex_a9_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
  #endif
      { .name = "L2ECTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 3,
        .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static void cortex_a7_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
        .access = PL1_RW, .type = ARM_CP_CONST },
      { .name = "DCACHE_INVAL", .cp = 15, .opc1 = 0, .crn = 15, .crm = 5,
        .opc2 = 0, .access = PL1_W, .type = ARM_CP_NOP },
 -    REGINFO_SENTINEL
  };
  static void cortex_r5_initfn(Object *obj)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cp_reginfo[] = {
        .secure = ARM_CP_SECSTATE_S,
        .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
        .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo not_v8_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v8_cp_reginfo[] = {
      { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
        .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
        .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo not_v6_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v6_cp_reginfo[] = {
       */
      { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
        .access = PL1_W, .type = ARM_CP_WFI },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo not_v7_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v7_cp_reginfo[] = {
        .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
      { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
        .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
 -    REGINFO_SENTINEL
  };
  static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
        .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
        .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
        .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
 -    REGINFO_SENTINEL
  };
  typedef struct pm_event {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
      { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
        .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
        .writefn = tlbimvaa_write },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo v7mp_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7mp_cp_reginfo[] = {
      { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
        .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
        .writefn = tlbimvaa_is_write },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
        .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
        .writefn = pmovsset_write,
        .raw_writefn = raw_write },
 -    REGINFO_SENTINEL
  };
  static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo t2ee_cp_reginfo[] = {
      { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
        .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
        .accessfn = teehbr_access, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo v6k_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
        .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
                               offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
        .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
        .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
      },
 -    REGINFO_SENTINEL
  };
  static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
        .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
        .readfn = gt_virt_cnt_read,
      },
 -    REGINFO_SENTINEL
  };
  #endif
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vapa_cp_reginfo[] = {
        .access = PL1_W, .accessfn = ats_access,
        .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
  #endif
 -    REGINFO_SENTINEL
  };
  /* Return basic MPU access permission bits.  */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
        .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
        .writefn = pmsav7_rgnr_write,
        .resetfn = arm_cp_reset_ignore },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
      { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
        .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
        .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
 -    REGINFO_SENTINEL
  };
  static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
        .access = PL1_RW, .accessfn = access_tvm_trvm,
        .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
        .resetvalue = 0, },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo vmsa_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
        /* No offsetoflow32 -- pass the entire TCR to writefn/raw_writefn. */
        .bank_fieldoffsets = { offsetof(CPUARMState, cp15.tcr_el[3]),
                               offsetof(CPUARMState, cp15.tcr_el[1])} },
 -    REGINFO_SENTINEL
  };
  /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo omap_cp_reginfo[] = {
      { .name = "C9", .cp = 15, .crn = 9,
        .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
        .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo xscale_cp_reginfo[] = {
      { .name = "XSCALE_UNLOCK_DCACHE",
        .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
        .access = PL1_W, .type = ARM_CP_NOP },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
        .access = PL1_RW,
        .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
        .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
      { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
        .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
        .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
        .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
      { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
        .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
      { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
        .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
        .resetvalue = (1 << 30) },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo strongarm_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo strongarm_cp_reginfo[] = {
        .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
        .access = PL1_RW, .resetvalue = 0,
        .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
 -    REGINFO_SENTINEL
  };
  static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
        .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
                               offsetof(CPUARMState, cp15.ttbr1_ns) },
        .writefn = vmsa_ttbr_write, },
 -    REGINFO_SENTINEL
  };
  static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
        .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
        .writefn = sdcr_write,
        .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
 -    REGINFO_SENTINEL
  };
  /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
        .type = ARM_CP_CONST,
        .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
        .access = PL2_RW, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  /* Ditto, but for registers which exist in ARMv8 but not v7 */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
        .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
        .access = PL2_RW,
        .type = ARM_CP_CONST, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
        .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
        .access = PL2_RW,
        .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
        .access = PL2_RW,
        .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
        .writefn = hcr_writehigh },
 -    REGINFO_SENTINEL
  };
  static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
        .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
        .access = PL2_RW, .accessfn = sel2_access,
        .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
 -    REGINFO_SENTINEL
  };
  static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
        .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
        .access = PL3_W, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae3_write },
 -    REGINFO_SENTINEL
  };
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
        .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
        .access = PL1_RW, .accessfn = access_tda,
        .type = ARM_CP_NOP },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
        .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
      { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
        .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  /* Return the exception level to which exceptions should be taken
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
                .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
                .writefn = dbgbcr_write, .raw_writefn = raw_write
              },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, dbgregs);
      }
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
                .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
                .writefn = dbgwcr_write, .raw_writefn = raw_write
              },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, dbgregs);
      }
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
                .type = ARM_CP_IO,
                .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
                .raw_writefn = pmevtyper_rawwrite },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, pmev_regs);
          g_free(pmevcntr_name);
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
                .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
                .resetvalue = extract64(cpu->pmceid1, 32, 32) },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, v81_pmu_regs);
      }
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lor_reginfo[] = {
        .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
        .access = PL1_R, .accessfn = access_lor_ns,
        .type = ARM_CP_CONST, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  #ifdef TARGET_AARCH64
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pauth_reginfo[] = {
        .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
        .access = PL1_RW, .accessfn = access_pauth,
        .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo tlbirange_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
        .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5,
        .access = PL3_W, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae3_write },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo tlbios_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
        .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5,
        .access = PL3_W, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae3is_write },
 -    REGINFO_SENTINEL
  };
  static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo rndr_reginfo[] = {
        .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
        .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
        .access = PL0_R, .readfn = rndr_readfn },
 -    REGINFO_SENTINEL
  };
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dcpop_reg[] = {
        .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1,
        .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
        .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo dcpodp_reg[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dcpodp_reg[] = {
        .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1,
        .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
        .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
 -    REGINFO_SENTINEL
  };
  #endif /*CONFIG_USER_ONLY*/
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_reginfo[] = {
      { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6,
        .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo mte_tco_ro_reginfo[] = {
      { .name = "TCO", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7,
        .type = ARM_CP_CONST, .access = PL0_RW, },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
        .accessfn = aa64_zva_access,
  #endif
      },
 -    REGINFO_SENTINEL
  };
  #endif
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
      { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
        .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
        .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
 -    REGINFO_SENTINEL
  };
  static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ccsidr2_reginfo[] = {
        .access = PL1_R,
        .accessfn = access_aa64_tid2,
        .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
 -    REGINFO_SENTINEL
  };
  static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo jazelle_regs[] = {
        .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0,
        .accessfn = access_joscr_jmcr,
        .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo vhe_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
        .access = PL2_RW, .accessfn = e2h_access,
        .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
  #endif
 -    REGINFO_SENTINEL
  };
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ats1e1_reginfo[] = {
        .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
        .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
        .writefn = ats_write64 },
 -    REGINFO_SENTINEL
  };
  static const ARMCPRegInfo ats1cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ats1cp_reginfo[] = {
        .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
        .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
        .writefn = ats_write },
 -    REGINFO_SENTINEL
  };
  #endif
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = {
        .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
        .access = PL2_RW, .type = ARM_CP_CONST,
        .resetvalue = 0 },
 -    REGINFO_SENTINEL
  };
  void register_cp_regs_for_features(ARMCPU *cpu)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .access = PL1_R, .type = ARM_CP_CONST,
                .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, v6_idregs);
          define_arm_cp_regs(cpu, v6_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
                .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
                .resetvalue = cpu->pmceid1 },
 -            REGINFO_SENTINEL
          };
  #ifdef CONFIG_USER_ONLY
          ARMCPRegUserSpaceInfo v8_user_idregs[] = {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .exported_bits = 0x000000f0ffffffff },
              { .name = "ID_AA64ISAR*_EL1_RESERVED",
                .is_glob = true                     },
 -            REGUSERINFO_SENTINEL
          };
          modify_arm_cp_regs(v8_idregs, v8_user_idregs);
  #endif
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .access = PL2_RW,
                .resetvalue = vmpidr_def,
                .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, vpidr_regs);
          define_arm_cp_regs(cpu, el2_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                    .access = PL2_RW, .accessfn = access_el3_aa32ns,
                    .type = ARM_CP_NO_RAW,
                    .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
 -                REGINFO_SENTINEL
              };
              define_arm_cp_regs(cpu, vpidr_regs);
              define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .raw_writefn = raw_write, .writefn = sctlr_write,
                .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
                .resetvalue = cpu->reset_sctlr },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, el3_regs);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "DUMMY",
                .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
                .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
 -            REGINFO_SENTINEL
          };
          ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
              { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .access = PL1_R,
                .accessfn = access_aa64_tid1,
                .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
 -            REGINFO_SENTINEL
          };
          ARMCPRegInfo id_cp_reginfo[] = {
              /* These are common to v8 and pre-v8 */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .access = PL1_R,
                .accessfn = access_aa32_tid1,
                .type = ARM_CP_CONST, .resetvalue = 0 },
 -            REGINFO_SENTINEL
          };
          /* TLBTR is specific to VMSA */
          ARMCPRegInfo id_tlbtr_reginfo = {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "MIDR_EL1",
                .exported_bits = 0x00000000ffffffff },
              { .name = "REVIDR_EL1"                },
 -            REGUSERINFO_SENTINEL
          };
          modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
  #endif
          if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
              arm_feature(env, ARM_FEATURE_STRONGARM)) {
 -            ARMCPRegInfo *r;
 +            size_t i;
              /* Register the blanket "writes ignored" value first to cover the
               * whole space. Then update the specific ID registers to allow write
               * access, so that they ignore writes rather than causing them to
               * UNDEF.
               */
              define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
 -            for (r = id_pre_v8_midr_cp_reginfo;
 -                 r->type != ARM_CP_SENTINEL; r++) {
 -                r->access = PL1_RW;
 +            for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) {
 +                id_pre_v8_midr_cp_reginfo[i].access = PL1_RW;
              }
 -            for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
 -                r->access = PL1_RW;
 +            for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) {
 +                id_cp_reginfo[i].access = PL1_RW;
              }
              id_mpuir_reginfo.access = PL1_RW;
              id_tlbtr_reginfo.access = PL1_RW;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
                .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
 -            REGINFO_SENTINEL
          };
  #ifdef CONFIG_USER_ONLY
          ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
              { .name = "MPIDR_EL1",
                .fixed_bits = 0x0000000080000000 },
 -            REGUSERINFO_SENTINEL
          };
          modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
  #endif
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
                .access = PL3_RW, .type = ARM_CP_CONST,
                .resetvalue = 0 },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, auxcr_reginfo);
          if (cpu_isar_feature(aa32_ac2, cpu)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                    .type = ARM_CP_CONST,
                    .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
                    .access = PL1_R, .resetvalue = cpu->reset_cbar },
 -                REGINFO_SENTINEL
              };
              /* We don't implement a r/w 64 bit CBAR currently */
              assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
                                       offsetof(CPUARMState, cp15.vbar_ns) },
                .resetvalue = 0 },
 -            REGINFO_SENTINEL
          };
          define_arm_cp_regs(cpu, vbar_cp_reginfo);
      }
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                     r->writefn);
          }
      }
 -    /* Bad type field probably means missing sentinel at end of reg list */
 -    assert(cptype_valid(r->type));
 +
      for (crm = crmmin; crm <= crmmax; crm++) {
          for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
              for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
      }
  }
--static void pxa2xx_draw_line4(void *opaque,
+-void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
--                uint8_t *dest, const uint8_t *src, int width, int deststep)
+-                                    const ARMCPRegInfo *regs, void *opaque)
-+static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
++/* Define a whole list of registers */
-+                              int width, int deststep)
++void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
 +                                        void *opaque, size_t len)
  {
-     uint32_t *palette = opaque;
+-    /* Define a whole list of registers */
-     uint32_t data;
+-    const ARMCPRegInfo *r;
-     while (width > 0) {
+-    for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
-         data = *(uint32_t *) src;
+-        define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
--#define FN(x)        COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
++    size_t i;
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
++    for (i = 0; i < len; ++i) {
- #ifdef SWAP_WORDS
++        define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque);
          FN_2(6)
          FN_2(4)
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line4(void *opaque,
      }
  }
--static void pxa2xx_draw_line8(void *opaque,
+@@ -XXX,XX +XXX,XX @@ void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
--                uint8_t *dest, const uint8_t *src, int width, int deststep)
+  * user-space cannot alter any values and dynamic values pertaining to
-+static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
+  * execution state are hidden from user space view anyway.
-+                              int width, int deststep)
+  */
 -void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
 +void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
 +                                 const ARMCPRegUserSpaceInfo *mods,
 +                                 size_t mods_len)
  {
-     uint32_t *palette = opaque;
+-    const ARMCPRegUserSpaceInfo *m;
-     uint32_t data;
+-    ARMCPRegInfo *r;
-     while (width > 0) {
+-
-         data = *(uint32_t *) src;
+-    for (m = mods; m->name; m++) {
--#define FN(x)        COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
++    for (size_t mi = 0; mi < mods_len; ++mi) {
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
++        const ARMCPRegUserSpaceInfo *m = mods + mi;
- #ifdef SWAP_WORDS
+         GPatternSpec *pat = NULL;
-         FN(24)
++
-         FN(16)
+         if (m->is_glob) {
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line8(void *opaque,
+             pat = g_pattern_spec_new(m->name);
-     }
+         }
- }
+-        for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
++        for (size_t ri = 0; ri < regs_len; ++ri) {
--static void pxa2xx_draw_line16(void *opaque,
++            ARMCPRegInfo *r = regs + ri;
--                uint8_t *dest, const uint8_t *src, int width, int deststep)
++
-+static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
+             if (pat && g_pattern_match_string(pat, r->name)) {
-+                               int width, int deststep)
+                 r->type = ARM_CP_CONST;
- {
+                 r->access = PL0U_R;
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16(void *opaque,
      }
  }
 -static void pxa2xx_draw_line16t(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
 +                                int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
      }
  }
 -static void pxa2xx_draw_line18(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
 +                               int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line18(void *opaque,
  }
  /* The wicked packed format */
 -static void pxa2xx_draw_line18p(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
 +                                int width, int deststep)
  {
      uint32_t data[3];
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line18p(void *opaque,
      }
  }
 -static void pxa2xx_draw_line19(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
 +                               int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19(void *opaque,
  }
  /* The wicked packed format */
 -static void pxa2xx_draw_line19p(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
 +                                int width, int deststep)
  {
      uint32_t data[3];
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
      }
  }
 -static void pxa2xx_draw_line24(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
 +                               int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24(void *opaque,
      }
  }
 -static void pxa2xx_draw_line24t(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
 +                                int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24t(void *opaque,
      }
  }
 -static void pxa2xx_draw_line25(void *opaque,
 -                uint8_t *dest, const uint8_t *src, int width, int deststep)
 +static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
 +                               int width, int deststep)
  {
      uint32_t data;
      unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line25(void *opaque,
  }
  /* Overlay planes disabled, no transparency */
 -static drawfn pxa2xx_draw_fn_32[16] =
 -{
 +static drawfn pxa2xx_draw_fn_32[16] = {
      [0 ... 0xf]       = NULL,
      [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
      [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
@@ -XXX,XX +XXX,XX @@ static drawfn pxa2xx_draw_fn_32[16] =
  };
  /* Overlay planes enabled, transparency used */
 -static drawfn pxa2xx_draw_fn_32t[16] =
 -{
 +static drawfn pxa2xx_draw_fn_32t[16] = {
      [0 ... 0xf]       = NULL,
      [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
      [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
 --
-.20.1
+.25.1

-[PULL 28/39] hw/arm: Add MFT device to NPCM7xx Soc
+[PULL 05/23] target/arm: Make some more cpreg data static const
-From: Hao Wu <wuhaotsh@google.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds the recently implemented MFT device to the NPCM7XX
+These particular data structures are not modified at runtime.
 SoC file.
-Reviewed-by: Doug Evans <dje@google.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210311180855.149764-4-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220501055028.646596-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/nuvoton.rst |  2 +-
+ target/arm/helper.c | 16 ++++++++--------
- include/hw/arm/npcm7xx.h    |  2 ++
+file changed, 8 insertions(+), 8 deletions(-)
  hw/arm/npcm7xx.c            | 45 ++++++++++++++++++++++++++++++-------
 files changed, 40 insertions(+), 9 deletions(-)
-diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/nuvoton.rst
+--- a/target/arm/helper.c
-+++ b/docs/system/arm/nuvoton.rst
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ Supported devices
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-  * Pulse Width Modulation (PWM)
+               .resetvalue = cpu->pmceid1 },
-  * SMBus controller (SMBF)
+         };
-  * Ethernet controller (EMC)
+ #ifdef CONFIG_USER_ONLY
-+ * Tachometer
+-        ARMCPRegUserSpaceInfo v8_user_idregs[] = {
++        static const ARMCPRegUserSpaceInfo v8_user_idregs[] = {
- Missing devices
+             { .name = "ID_AA64PFR0_EL1",
- ---------------
+               .exported_bits = 0x000f000f00ff0000,
-@@ -XXX,XX +XXX,XX @@ Missing devices
+               .fixed_bits    = 0x0000000000000011 },
-  * Peripheral SPI controller (PSPI)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-  * SD/MMC host
+      */
-  * PECI interface
+     if (arm_feature(env, ARM_FEATURE_EL3)) {
-- * Tachometer
+         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
-  * PCI and PCIe root complex and bridges
+-            ARMCPRegInfo nsacr = {
-  * VDM and MCTP support
++            static const ARMCPRegInfo nsacr = {
-  * Serial I/O expansion
+                 .name = "NSACR", .type = ARM_CP_CONST,
-diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
+                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
-index XXXXXXX..XXXXXXX 100644
+                 .access = PL1_RW, .accessfn = nsacr_access,
---- a/include/hw/arm/npcm7xx.h
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-+++ b/include/hw/arm/npcm7xx.h
+             };
-@@ -XXX,XX +XXX,XX @@
+             define_one_arm_cp_reg(cpu, &nsacr);
- #include "hw/mem/npcm7xx_mc.h"
+         } else {
- #include "hw/misc/npcm7xx_clk.h"
+-            ARMCPRegInfo nsacr = {
- #include "hw/misc/npcm7xx_gcr.h"
++            static const ARMCPRegInfo nsacr = {
-+#include "hw/misc/npcm7xx_mft.h"
+                 .name = "NSACR",
- #include "hw/misc/npcm7xx_pwm.h"
+                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
- #include "hw/misc/npcm7xx_rng.h"
+                 .access = PL3_RW | PL1_R,
- #include "hw/net/npcm7xx_emc.h"
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
+         }
-     NPCM7xxTimerCtrlState tim[3];
+     } else {
-     NPCM7xxADCState     adc;
+         if (arm_feature(env, ARM_FEATURE_V8)) {
-     NPCM7xxPWMState     pwm[2];
+-            ARMCPRegInfo nsacr = {
-+    NPCM7xxMFTState     mft[8];
++            static const ARMCPRegInfo nsacr = {
-     NPCM7xxOTPState     key_storage;
+                 .name = "NSACR", .type = ARM_CP_CONST,
-     NPCM7xxOTPState     fuse_array;
+                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
-     NPCM7xxMCState      mc;
+                 .access = PL1_R,
-diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-index XXXXXXX..XXXXXXX 100644
+               .access = PL1_R, .type = ARM_CP_CONST,
---- a/hw/arm/npcm7xx.c
+               .resetvalue = cpu->pmsav7_dregion << 8
-+++ b/hw/arm/npcm7xx.c
+         };
-@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
+-        ARMCPRegInfo crn0_wi_reginfo = {
-     NPCM7XX_SMBUS15_IRQ,
++        static const ARMCPRegInfo crn0_wi_reginfo = {
-     NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
+             .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
-     NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
+             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
-+    NPCM7XX_MFT0_IRQ            = 96,   /* MFT module 0 */
+             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
-+    NPCM7XX_MFT1_IRQ,                   /* MFT module 1 */
+         };
-+    NPCM7XX_MFT2_IRQ,                   /* MFT module 2 */
+ #ifdef CONFIG_USER_ONLY
-+    NPCM7XX_MFT3_IRQ,                   /* MFT module 3 */
+-        ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
-+    NPCM7XX_MFT4_IRQ,                   /* MFT module 4 */
++        static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
-+    NPCM7XX_MFT5_IRQ,                   /* MFT module 5 */
+             { .name = "MIDR_EL1",
-+    NPCM7XX_MFT6_IRQ,                   /* MFT module 6 */
+               .exported_bits = 0x00000000ffffffff },
-+    NPCM7XX_MFT7_IRQ,                   /* MFT module 7 */
+             { .name = "REVIDR_EL1"                },
-     NPCM7XX_EMC2RX_IRQ          = 114,
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-     NPCM7XX_EMC2TX_IRQ,
+               .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
-     NPCM7XX_GPIO0_IRQ           = 116,
+         };
-@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_pwm_addr[] = {
+ #ifdef CONFIG_USER_ONLY
-xf0104000,
+-        ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
- };
++        static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
+             { .name = "MPIDR_EL1",
-+/* Register base address for each MFT Module */
+               .fixed_bits = 0x0000000080000000 },
-+static const hwaddr npcm7xx_mft_addr[] = {
+         };
-+    0xf0180000,
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
 +    0xf0181000,
 +    0xf0182000,
 +    0xf0183000,
 +    0xf0184000,
 +    0xf0185000,
 +    0xf0186000,
 +    0xf0187000,
 +};
 +
  /* Direct memory-mapped access to each SMBus Module. */
  static const hwaddr npcm7xx_smbus_addr[] = {
 xf0080000,
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
          object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
      }
-+    for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
+     if (arm_feature(env, ARM_FEATURE_VBAR)) {
-+        object_initialize_child(obj, "mft[*]", &s->mft[i], TYPE_NPCM7XX_MFT);
+-        ARMCPRegInfo vbar_cp_reginfo[] = {
-+    }
++        static const ARMCPRegInfo vbar_cp_reginfo[] = {
-+
+             { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
-     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
+               .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
-         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
+               .access = PL1_RW, .writefn = vbar_write,
      }
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
          sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
      }
 +    /* MFT Modules. Cannot fail. */
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_mft_addr) != ARRAY_SIZE(s->mft));
 +    for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
 +        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->mft[i]);
 +
 +        qdev_connect_clock_in(DEVICE(&s->mft[i]), "clock-in",
 +                              qdev_get_clock_out(DEVICE(&s->clk),
 +                                                 "apb4-clock"));
 +        sysbus_realize(sbd, &error_abort);
 +        sysbus_mmio_map(sbd, 0, npcm7xx_mft_addr[i]);
 +        sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, NPCM7XX_MFT0_IRQ + i));
 +    }
 +
      /*
       * EMC Modules. Cannot fail.
       * The mapping of the device to its netdev backend works as follows:
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
      create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
      create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[0]",       0xf0180000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[1]",       0xf0181000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[2]",       0xf0182000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[3]",       0xf0183000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[4]",       0xf0184000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[5]",       0xf0185000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[6]",       0xf0186000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.mft[7]",       0xf0187000,   4 * KiB);
      create_unimplemented_device("npcm7xx.pspi1",        0xf0200000,   4 * KiB);
      create_unimplemented_device("npcm7xx.pspi2",        0xf0201000,   4 * KiB);
      create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
 --
-.20.1
+.25.1

-[PULL 15/39] target/arm: Update CNTP for PREDDESC
+[PULL 06/23] target/arm: Reorg ARMCPRegInfo type field bits
 From: Richard Henderson <richard.henderson@linaro.org>
-Since b64ee454a4a0, all predicate operations should be
+Instead of defining ARM_CP_FLAG_MASK to remove flags,
-using these field macros for predicates.
+define ARM_CP_SPECIAL_MASK to isolate special cases.
 Sort the specials to the low bits. Use an enum.
 Split the large comment block so as to document each
 value separately.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-7-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 6 +++---
+ target/arm/cpregs.h        | 130 +++++++++++++++++++++++--------------
- target/arm/translate-sve.c | 6 +++---
+ target/arm/cpu.c           |   4 +-
-files changed, 6 insertions(+), 6 deletions(-)
+ target/arm/helper.c        |   4 +-
+ target/arm/translate-a64.c |   6 +-
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+ target/arm/translate.c     |   6 +-
-index XXXXXXX..XXXXXXX 100644
+files changed, 92 insertions(+), 58 deletions(-)
---- a/target/arm/sve_helper.c
-+++ b/target/arm/sve_helper.c
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpregs.h
- uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
++++ b/target/arm/cpregs.h
- {
+@@ -XXX,XX +XXX,XX @@
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+ #define TARGET_ARM_CPREGS_H
--    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
-+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
+ /*
-+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+- * ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
-     uint64_t *n = vn, *g = vg, sum = 0, mask = pred_esz_masks[esz];
+- * special-behaviour cp reg and bits [11..8] indicate what behaviour
-     intptr_t i;
+- * it has. Otherwise it is a simple cp reg, where CONST indicates that
+- * TCG can assume the value to be constant (ie load at translate time)
--    for (i = 0; i < DIV_ROUND_UP(oprsz, 8); ++i) {
+- * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
-+    for (i = 0; i < words; ++i) {
+- * indicates that the TB should not be ended after a write to this register
-         uint64_t t = n[i] & g[i] & mask;
+- * (the default is that the TB ends after cp writes). OVERRIDE permits
-         sum += ctpop64(t);
+- * a register definition to override a previous definition for the
-     }
+- * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+- * old must have the OVERRIDE bit set.
-index XXXXXXX..XXXXXXX 100644
+- * ALIAS indicates that this register is an alias view of some underlying
---- a/target/arm/translate-sve.c
+- * state which is also visible via another register, and that the other
-+++ b/target/arm/translate-sve.c
+- * register is handling migration and reset; registers marked ALIAS will not be
-@@ -XXX,XX +XXX,XX @@ static void do_cntp(DisasContext *s, TCGv_i64 val, int esz, int pn, int pg)
+- * migrated but may have their state set by syncing of register state from KVM.
-     } else {
+- * NO_RAW indicates that this register has no underlying state and does not
-         TCGv_ptr t_pn = tcg_temp_new_ptr();
+- * support raw access for state saving/loading; it will not be used for either
-         TCGv_ptr t_pg = tcg_temp_new_ptr();
+- * migration or KVM state synchronization. (Typically this is for "registers"
--        unsigned desc;
+- * which are actually used as instructions for cache maintenance and so on.)
-+        unsigned desc = 0;
+- * IO indicates that this register does I/O and therefore its accesses
-         TCGv_i32 t_desc;
+- * need to be marked with gen_io_start() and also end the TB. In particular,
+- * registers which implement clocks or timers require this.
--        desc = psz - 2;
+- * RAISES_EXC is for when the read or write hook might raise an exception;
--        desc = deposit32(desc, SIMD_DATA_SHIFT, 2, esz);
+- * the generated code will synchronize the CPU state before calling the hook
-+        desc = FIELD_DP32(desc, PREDDESC, OPRSZ, psz);
+- * so that it is safe for the hook to call raise_exception().
-+        desc = FIELD_DP32(desc, PREDDESC, ESZ, esz);
+- * NEWEL is for writes to registers that might change the exception
+- * level - typically on older ARM chips. For those cases we need to
-         tcg_gen_addi_ptr(t_pn, cpu_env, pred_full_reg_offset(s, pn));
+- * re-read the new el when recomputing the translation flags.
-         tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
++ * ARMCPRegInfo type field bits:
   */
 -#define ARM_CP_SPECIAL           0x0001
 -#define ARM_CP_CONST             0x0002
 -#define ARM_CP_64BIT             0x0004
 -#define ARM_CP_SUPPRESS_TB_END   0x0008
 -#define ARM_CP_OVERRIDE          0x0010
 -#define ARM_CP_ALIAS             0x0020
 -#define ARM_CP_IO                0x0040
 -#define ARM_CP_NO_RAW            0x0080
 -#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
 -#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
 -#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
 -#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
 -#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
 -#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
 -#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
 -#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
 -#define ARM_CP_FPU               0x1000
 -#define ARM_CP_SVE               0x2000
 -#define ARM_CP_NO_GDB            0x4000
 -#define ARM_CP_RAISES_EXC        0x8000
 -#define ARM_CP_NEWEL             0x10000
 -/* Mask of only the flag bits in a type field */
 -#define ARM_CP_FLAG_MASK         0x1f0ff
 +enum {
 +    /*
 +     * Register must be handled specially during translation.
 +     * The method is one of the values below:
 +     */
 +    ARM_CP_SPECIAL_MASK          = 0x000f,
 +    /* Special: no change to PE state: writes ignored, reads ignored. */
 +    ARM_CP_NOP                   = 0x0001,
 +    /* Special: sysreg is WFI, for v5 and v6. */
 +    ARM_CP_WFI                   = 0x0002,
 +    /* Special: sysreg is NZCV. */
 +    ARM_CP_NZCV                  = 0x0003,
 +    /* Special: sysreg is CURRENTEL. */
 +    ARM_CP_CURRENTEL             = 0x0004,
 +    /* Special: sysreg is DC ZVA or similar. */
 +    ARM_CP_DC_ZVA                = 0x0005,
 +    ARM_CP_DC_GVA                = 0x0006,
 +    ARM_CP_DC_GZVA               = 0x0007,
 +
 +    /* Flag: reads produce resetvalue; writes ignored. */
 +    ARM_CP_CONST                 = 1 << 4,
 +    /* Flag: For ARM_CP_STATE_AA32, sysreg is 64-bit. */
 +    ARM_CP_64BIT                 = 1 << 5,
 +    /*
 +     * Flag: TB should not be ended after a write to this register
 +     * (the default is that the TB ends after cp writes).
 +     */
 +    ARM_CP_SUPPRESS_TB_END       = 1 << 6,
 +    /*
 +     * Flag: Permit a register definition to override a previous definition
 +     * for the same (cp, is64, crn, crm, opc1, opc2) tuple: either the new
 +     * or the old must have the ARM_CP_OVERRIDE bit set.
 +     */
 +    ARM_CP_OVERRIDE              = 1 << 7,
 +    /*
 +     * Flag: Register is an alias view of some underlying state which is also
 +     * visible via another register, and that the other register is handling
 +     * migration and reset; registers marked ARM_CP_ALIAS will not be migrated
 +     * but may have their state set by syncing of register state from KVM.
 +     */
 +    ARM_CP_ALIAS                 = 1 << 8,
 +    /*
 +     * Flag: Register does I/O and therefore its accesses need to be marked
 +     * with gen_io_start() and also end the TB. In particular, registers which
 +     * implement clocks or timers require this.
 +     */
 +    ARM_CP_IO                    = 1 << 9,
 +    /*
 +     * Flag: Register has no underlying state and does not support raw access
 +     * for state saving/loading; it will not be used for either migration or
 +     * KVM state synchronization. Typically this is for "registers" which are
 +     * actually used as instructions for cache maintenance and so on.
 +     */
 +    ARM_CP_NO_RAW                = 1 << 10,
 +    /*
 +     * Flag: The read or write hook might raise an exception; the generated
 +     * code will synchronize the CPU state before calling the hook so that it
 +     * is safe for the hook to call raise_exception().
 +     */
 +    ARM_CP_RAISES_EXC            = 1 << 11,
 +    /*
 +     * Flag: Writes to the sysreg might change the exception level - typically
 +     * on older ARM chips. For those cases we need to re-read the new el when
 +     * recomputing the translation flags.
 +     */
 +    ARM_CP_NEWEL                 = 1 << 12,
 +    /*
 +     * Flag: Access check for this sysreg is identical to accessing FPU state
 +     * from an instruction: use translation fp_access_check().
 +     */
 +    ARM_CP_FPU                   = 1 << 13,
 +    /*
 +     * Flag: Access check for this sysreg is identical to accessing SVE state
 +     * from an instruction: use translation sve_access_check().
 +     */
 +    ARM_CP_SVE                   = 1 << 14,
 +    /* Flag: Do not expose in gdb sysreg xml. */
 +    ARM_CP_NO_GDB                = 1 << 15,
 +};
  /*
   * Valid values for ARMCPRegInfo state field, indicating which of
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
      ARMCPRegInfo *ri = value;
      ARMCPU *cpu = opaque;
 -    if (ri->type & (ARM_CP_SPECIAL | ARM_CP_ALIAS)) {
 +    if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS)) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void cp_reg_check_reset(gpointer key, gpointer value,  gpointer opaque)
      ARMCPU *cpu = opaque;
      uint64_t oldvalue, newvalue;
 -    if (ri->type & (ARM_CP_SPECIAL | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
 +    if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
          return;
      }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
       * multiple times. Special registers (ie NOP/WFI) are
       * never migratable and not even raw-accessible.
       */
 -    if ((r->type & ARM_CP_SPECIAL)) {
 +    if (r->type & ARM_CP_SPECIAL_MASK) {
          r2->type |= ARM_CP_NO_RAW;
      }
      if (((r->crm == CP_ANY) && crm != 0) ||
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
      /* Check that the register definition has enough info to handle
       * reads and writes if they are permitted.
       */
 -    if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
 +    if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) {
          if (r->access & PL3_R) {
              assert((r->fieldoffset ||
                     (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
      }
      /* Handle special cases first */
 -    switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
 +    switch (ri->type & ARM_CP_SPECIAL_MASK) {
 +    case 0:
 +        break;
      case ARM_CP_NOP:
          return;
      case ARM_CP_NZCV:
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
          }
          return;
      default:
 -        break;
 +        g_assert_not_reached();
      }
      if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
          return;
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
          }
          /* Handle special cases first */
 -        switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
 +        switch (ri->type & ARM_CP_SPECIAL_MASK) {
 +        case 0:
 +            break;
          case ARM_CP_NOP:
              return;
          case ARM_CP_WFI:
@@ -XXX,XX +XXX,XX @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
              s->base.is_jmp = DISAS_WFI;
              return;
          default:
 -            break;
 +            g_assert_not_reached();
          }
          if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
 --
-.20.1
+.25.1

-[PULL 25/39] hw/arm/virt: KVM: The IPA lower bound is 32
+[PULL 07/23] target/arm: Avoid bare abort() or assert(0)
-From: Andrew Jones <drjones@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The virt machine already checks KVM_CAP_ARM_VM_IPA_SIZE to get the
+Standardize on g_assert_not_reached() for "should not happen".
-upper bound of the IPA size. If that bound is lower than the highest
+Retain abort() when preceeded by fprintf or error_report.
 possible GPA for the machine, then QEMU will error out. However, the
 IPA is set to 40 when the highest GPA is less than or equal to 40,
 even when KVM may support an IPA limit as low as 32. This means KVM
 may fail the VM creation unnecessarily. Additionally, 40 is selected
 with the value 0, which means use the default, and that gets around
 a check in some versions of KVM, causing a difficult to debug fail.
 Always use the IPA size that corresponds to the highest possible GPA,
 unless it's lower than 32, in which case use 32. Also, we must still
 use 0 when KVM only supports the legacy fixed 40 bit IPA.
-Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20220501055028.646596-7-richard.henderson@linaro.org
 Reviewed-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20210310135218.255205-3-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm_arm.h |  6 ++++--
+ target/arm/helper.c         | 7 +++----
- hw/arm/virt.c        | 23 ++++++++++++++++-------
+ target/arm/hvf/hvf.c        | 2 +-
- target/arm/kvm.c     |  4 +++-
+ target/arm/kvm-stub.c       | 4 ++--
-files changed, 23 insertions(+), 10 deletions(-)
+ target/arm/kvm.c            | 4 ++--
  target/arm/machine.c        | 4 ++--
  target/arm/translate-a64.c  | 4 ++--
  target/arm/translate-neon.c | 2 +-
  target/arm/translate.c      | 4 ++--
 files changed, 15 insertions(+), 16 deletions(-)
-diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm_arm.h
+--- a/target/arm/helper.c
-+++ b/target/arm/kvm_arm.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void);
+@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
- /**
+             break;
-  * kvm_arm_get_max_vm_ipa_size:
+         default:
-  * @ms: Machine state handle
+             /* broken reginfo with out-of-range opc1 */
-+ * @fixed_ipa: True when the IPA limit is fixed at 40. This is the case
+-            assert(false);
-+ * for legacy KVM.
+-            break;
-  *
++            g_assert_not_reached();
-  * Returns the number of bits in the IPA address space supported by KVM
+         }
-  */
+         /* assert our permissions are not too lax (stricter is fine) */
--int kvm_arm_get_max_vm_ipa_size(MachineState *ms);
+         assert((r->access & ~mask) == 0);
-+int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa);
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
+             break;
- /**
+         default:
-  * kvm_arm_sync_mpstate_to_kvm:
+             /* Never happens, but compiler isn't smart enough to tell.  */
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_add_vcpu_properties(Object *obj)
+-            abort();
-     g_assert_not_reached();
++            g_assert_not_reached();
          }
      }
      *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
              break;
          default:
              /* Never happens, but compiler isn't smart enough to tell.  */
 -            abort();
 +            g_assert_not_reached();
          }
      }
      if (domain_prot == 3) {
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
          /* we got kicked, no exit to process */
          return 0;
      default:
 -        assert(0);
 +        g_assert_not_reached();
      }
      hvf_sync_vtimer(cpu);
 diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm-stub.c
 +++ b/target/arm/kvm-stub.c
@@ -XXX,XX +XXX,XX @@
  bool write_kvmstate_to_list(ARMCPU *cpu)
  {
 -    abort();
 +    g_assert_not_reached();
  }
--static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
 +static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
  {
-     g_assert_not_reached();
+-    abort();
 +    g_assert_not_reached();
  }
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
- static int virt_kvm_type(MachineState *ms, const char *type_str)
- {
-     VirtMachineState *vms = VIRT_MACHINE(ms);
--    int max_vm_pa_size = kvm_arm_get_max_vm_ipa_size(ms);
--    int requested_pa_size;
-+    int max_vm_pa_size, requested_pa_size;
-+    bool fixed_ipa;
-+
-+    max_vm_pa_size = kvm_arm_get_max_vm_ipa_size(ms, &fixed_ipa);
-     /* we freeze the memory map to compute the highest gpa */
-     virt_set_memmap(vms);
-     requested_pa_size = 64 - clz64(vms->highest_gpa);
-+    /*
-+     * KVM requires the IPA size to be at least 32 bits.
-+     */
-+    if (requested_pa_size < 32) {
-+        requested_pa_size = 32;
-+    }
-+
-     if (requested_pa_size > max_vm_pa_size) {
-         error_report("-m and ,maxmem option values "
-                      "require an IPA range (%d bits) larger than "
-                      "the one supported by the host (%d bits)",
-                      requested_pa_size, max_vm_pa_size);
--       exit(1);
-+        exit(1);
-     }
-     /*
--     * By default we return 0 which corresponds to an implicit legacy
--     * 40b IPA setting. Otherwise we return the actual requested PA
--     * logsize
-+     * We return the requested PA log size, unless KVM only supports
-+     * the implicit legacy 40b IPA setting, in which case the kvm_type
-+     * must be 0.
-      */
--    return requested_pa_size > 40 ? requested_pa_size : 0;
-+    return fixed_ipa ? 0 : requested_pa_size;
- }
- static void virt_machine_class_init(ObjectClass *oc, void *data)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_pmu_supported(void)
+@@ -XXX,XX +XXX,XX @@ bool write_kvmstate_to_list(ARMCPU *cpu)
-     return kvm_check_extension(kvm_state, KVM_CAP_ARM_PMU_V3);
+             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
              break;
          default:
 -            abort();
 +            g_assert_not_reached();
          }
          if (ret) {
              ok = false;
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
              r.addr = (uintptr_t)(cpu->cpreg_values + i);
              break;
          default:
 -            abort();
 +            g_assert_not_reached();
          }
          ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
          if (ret) {
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
      if (kvm_enabled()) {
          if (!write_kvmstate_to_list(cpu)) {
              /* This should never fail */
 -            abort();
 +            g_assert_not_reached();
          }
          /*
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
      } else {
          if (!write_cpustate_to_list(cpu, false)) {
              /* This should never fail. */
 -            abort();
 +            g_assert_not_reached();
          }
      }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
          gen_helper_advsimd_rinth(tcg_res, tcg_op, fpst);
          break;
      default:
 -        abort();
 +        g_assert_not_reached();
      }
      write_fp_sreg(s, rd, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_fcvt(DisasContext *s, int opcode,
          break;
      }
      default:
 -        abort();
 +        g_assert_not_reached();
      }
  }
--int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+diff --git a/target/arm/translate-neon.c b/target/arm/translate-neon.c
-+int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/target/arm/translate-neon.c
-     KVMState *s = KVM_STATE(ms->accelerator);
++++ b/target/arm/translate-neon.c
-     int ret;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
+         }
-     ret = kvm_check_extension(s, KVM_CAP_ARM_VM_IPA_SIZE);
+         break;
-+    *fixed_ipa = ret <= 0;
+     default:
-+
+-        abort();
-     return ret > 0 ? ret : 40;
++        g_assert_not_reached();
- }
+     }
+     if ((vd + a->stride * (nregs - 1)) > 31) {
          /*
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
          offset = 4;
          break;
      default:
 -        abort();
 +        g_assert_not_reached();
      }
      tcg_gen_addi_i32(addr, addr, offset);
      tmp = load_reg(s, 14);
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
              offset = 0;
              break;
          default:
 -            abort();
 +            g_assert_not_reached();
          }
          tcg_gen_addi_i32(addr, addr, offset);
          gen_helper_set_r13_banked(cpu_env, tcg_constant_i32(mode), addr);
 --
-.20.1
+.25.1

-[PULL 12/39] target/arm: Fix sve_punpk_p vs odd vector lengths
+[PULL 08/23] target/arm: Change cpreg access permissions to enum
 From: Richard Henderson <richard.henderson@linaro.org>
-Wrote too much with punpk1 with vl % 512 != 0.
+Create a typedef as well, and use it in ARMCPRegInfo.
 This won't be perfect for debugging, but it'll nicely
 display the most common cases.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-4-richard.henderson@linaro.org
+Message-id: 20220501055028.646596-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c | 4 ++--
+ target/arm/cpregs.h | 44 +++++++++++++++++++++++---------------------
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/helper.c |  2 +-
 files changed, 24 insertions(+), 22 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/cpregs.h
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_punpk_p)(void *vd, void *vn, uint32_t pred_desc)
+@@ -XXX,XX +XXX,XX @@ enum {
-             high = oprsz >> 1;
+  * described with these bits, then use a laxer set of restrictions, and
-         }
+  * do the more restrictive/complex check inside a helper function.
+  */
--        if ((high & 3) == 0) {
+-#define PL3_R 0x80
-+        if ((oprsz & 7) == 0) {
+-#define PL3_W 0x40
-             uint32_t *n = vn;
+-#define PL2_R (0x20 | PL3_R)
-             high >>= 2;
+-#define PL2_W (0x10 | PL3_W)
+-#define PL1_R (0x08 | PL2_R)
--            for (i = 0; i < DIV_ROUND_UP(oprsz, 8); i++) {
+-#define PL1_W (0x04 | PL2_W)
-+            for (i = 0; i < oprsz / 8; i++) {
+-#define PL0_R (0x02 | PL1_R)
-                 uint64_t nn = n[H4(high + i)];
+-#define PL0_W (0x01 | PL1_W)
-                 d[i] = expand_bits(nn, 0);
++typedef enum {
-             }
++    PL3_R = 0x80,
 +    PL3_W = 0x40,
 +    PL2_R = 0x20 | PL3_R,
 +    PL2_W = 0x10 | PL3_W,
 +    PL1_R = 0x08 | PL2_R,
 +    PL1_W = 0x04 | PL2_W,
 +    PL0_R = 0x02 | PL1_R,
 +    PL0_W = 0x01 | PL1_W,
 -/*
 - * For user-mode some registers are accessible to EL0 via a kernel
 - * trap-and-emulate ABI. In this case we define the read permissions
 - * as actually being PL0_R. However some bits of any given register
 - * may still be masked.
 - */
 +    /*
 +     * For user-mode some registers are accessible to EL0 via a kernel
 +     * trap-and-emulate ABI. In this case we define the read permissions
 +     * as actually being PL0_R. However some bits of any given register
 +     * may still be masked.
 +     */
  #ifdef CONFIG_USER_ONLY
 -#define PL0U_R PL0_R
 +    PL0U_R = PL0_R,
  #else
 -#define PL0U_R PL1_R
 +    PL0U_R = PL1_R,
  #endif
 -#define PL3_RW (PL3_R | PL3_W)
 -#define PL2_RW (PL2_R | PL2_W)
 -#define PL1_RW (PL1_R | PL1_W)
 -#define PL0_RW (PL0_R | PL0_W)
 +    PL3_RW = PL3_R | PL3_W,
 +    PL2_RW = PL2_R | PL2_W,
 +    PL1_RW = PL1_R | PL1_W,
 +    PL0_RW = PL0_R | PL0_W,
 +} CPAccessRights;
  typedef enum CPAccessResult {
      /* Access is permitted */
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
      /* Register type: ARM_CP_* bits/values */
      int type;
      /* Access rights: PL*_[RW] */
 -    int access;
 +    CPAccessRights access;
      /* Security state: ARM_CP_SECSTATE_* bits/values */
      int secure;
      /*
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
       * to encompass the generic architectural permission check.
       */
      if (r->state != ARM_CP_STATE_AA32) {
 -        int mask = 0;
 +        CPAccessRights mask;
          switch (r->opc1) {
          case 0:
              /* min_EL EL1, but some accessible to EL0 via kernel ABI */
 --
-.20.1
+.25.1

-[PULL 26/39] hw/misc: Add GPIOs for duty in NPCM7xx PWM
+[PULL 09/23] target/arm: Name CPState type
-From: Hao Wu <wuhaotsh@google.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds GPIOs in NPCM7xx PWM module for its duty values.
+Give this enum a name and use in ARMCPRegInfo,
-The purpose of this is to connect it to the MFT module to provide
+add_cpreg_to_hashtable and define_one_arm_cp_reg_with_opaque.
 an input for measuring a PWM fan's RPM. Each PWM module has
 NPCM7XX_PWM_PER_MODULE of GPIOs, each one corresponds to
 one PWM instance and can connect to multiple fan instances in MFT.
-Reviewed-by: Doug Evans <dje@google.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210311180855.149764-2-wuhaotsh@google.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220501055028.646596-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/npcm7xx_pwm.h | 4 +++-
+ target/arm/cpregs.h | 6 +++---
- hw/misc/npcm7xx_pwm.c         | 4 ++++
+ target/arm/helper.c | 6 ++++--
-files changed, 7 insertions(+), 1 deletion(-)
+files changed, 7 insertions(+), 5 deletions(-)
-diff --git a/include/hw/misc/npcm7xx_pwm.h b/include/hw/misc/npcm7xx_pwm.h
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/npcm7xx_pwm.h
+--- a/target/arm/cpregs.h
-+++ b/include/hw/misc/npcm7xx_pwm.h
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxPWM {
+@@ -XXX,XX +XXX,XX @@ enum {
-  * @iomem: Memory region through which registers are accessed.
+  * Note that we rely on the values of these enums as we iterate through
-  * @clock: The PWM clock.
+  * the various states in some places.
-  * @pwm: The PWM channels owned by this module.
+  */
-+ * @duty_gpio_out: The duty cycle of each PWM channels as a output GPIO.
+-enum {
-  * @ppr: The prescaler register.
++typedef enum {
-  * @csr: The clock selector register.
+     ARM_CP_STATE_AA32 = 0,
-  * @pcr: The control register.
+     ARM_CP_STATE_AA64 = 1,
-@@ -XXX,XX +XXX,XX @@ struct NPCM7xxPWMState {
+     ARM_CP_STATE_BOTH = 2,
-     MemoryRegion iomem;
+-};
++} CPState;
-     Clock       *clock;
--    NPCM7xxPWM pwm[NPCM7XX_PWM_PER_MODULE];
+ /*
-+    NPCM7xxPWM  pwm[NPCM7XX_PWM_PER_MODULE];
+  * ARM CP register secure state flags.  These flags identify security state
-+    qemu_irq    duty_gpio_out[NPCM7XX_PWM_PER_MODULE];
+@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
+     uint8_t opc1;
-     uint32_t    ppr;
+     uint8_t opc2;
-     uint32_t    csr;
+     /* Execution state in which this register is visible: ARM_CP_STATE_* */
-diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
+-    int state;
 +    CPState state;
      /* Register type: ARM_CP_* bits/values */
      int type;
      /* Access rights: PL*_[RW] */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/npcm7xx_pwm.c
+--- a/target/arm/helper.c
-+++ b/hw/misc/npcm7xx_pwm.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_update_duty(NPCM7xxPWM *p)
+@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
          trace_npcm7xx_pwm_update_duty(DEVICE(p->module)->canonical_path,
                                        p->index, p->duty, duty);
          p->duty = duty;
 +        qemu_set_irq(p->module->duty_gpio_out[p->index], p->duty);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_init(Object *obj)
+ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+-                                   void *opaque, int state, int secstate,
-     int i;
++                                   void *opaque, CPState state, int secstate,
+                                    int crm, int opc1, int opc2,
-+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(s->pwm) != NPCM7XX_PWM_PER_MODULE);
+                                    const char *name)
-     for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
+ {
-         NPCM7xxPWM *p = &s->pwm[i];
+@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
-         p->module = s;
+      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_init(Object *obj)
+      * the register, if any.
-         object_property_add_uint32_ptr(obj, "duty[*]",
+      */
-                 &s->pwm[i].duty, OBJ_PROP_FLAG_READ);
+-    int crm, opc1, opc2, state;
-     }
++    int crm, opc1, opc2;
-+    qdev_init_gpio_out_named(DEVICE(s), s->duty_gpio_out,
+     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
-+                             "duty-gpio-out", NPCM7XX_PWM_PER_MODULE);
+     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
- }
+     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
+     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
- static const VMStateDescription vmstate_npcm7xx_pwm = {
+     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
      int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
 +    CPState state;
 +
      /* 64 bit registers have only CRm and Opc1 fields */
      assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
      /* op0 only exists in the AArch64 encodings */
 --
-.20.1
+.25.1

-[PULL 08/39] hw/arm/smmuv3: Fix SMMU_CMD_CFGI_STE_RANGE handling
+[PULL 10/23] target/arm: Name CPSecureState type
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-If the whole SID range (32b) is invalidated (SMMU_CMD_CFGI_ALL),
+Give this enum a name and use in ARMCPRegInfo and add_cpreg_to_hashtable.
-@end overflows and we fail to handle the command properly.
+Add the enumerator ARM_CP_SECSTATE_BOTH to clarify how 0
 is handled in define_one_arm_cp_reg_with_opaque.
-Once this gets fixed, the current code really is awkward in the
-sense it loops over the whole range instead of removing the
-currently cached configs through a hash table lookup.
-Fix both the overflow and the lookup.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210309102742.30442-7-eric.auger@redhat.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220501055028.646596-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmu-internal.h |  5 +++++
+ target/arm/cpregs.h | 7 ++++---
- hw/arm/smmuv3.c        | 34 ++++++++++++++++++++--------------
+ target/arm/helper.c | 7 +++++--
-files changed, 25 insertions(+), 14 deletions(-)
+files changed, 9 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmu-internal.h
+--- a/target/arm/cpregs.h
-+++ b/hw/arm/smmu-internal.h
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SMMUIOTLBPageInvInfo {
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-     uint64_t mask;
+  * registered entry will only have one to identify whether the entry is secure
- } SMMUIOTLBPageInvInfo;
+  * or non-secure.
+  */
-+typedef struct SMMUSIDRange {
+-enum {
-+    uint32_t start;
++typedef enum {
-+    uint32_t end;
++    ARM_CP_SECSTATE_BOTH = 0,       /* define one cpreg for each secstate */
-+} SMMUSIDRange;
+     ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
-+
+     ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
- #endif
+-};
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
++} CPSecureState;
  /*
   * Access rights:
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
      /* Access rights: PL*_[RW] */
      CPAccessRights access;
      /* Security state: ARM_CP_SECSTATE_* bits/values */
 -    int secure;
 +    CPSecureState secure;
      /*
       * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
       * this register was defined: can be used to hand data through to the
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/smmuv3.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
  #include "hw/arm/smmuv3.h"
  #include "smmuv3-internal.h"
 +#include "smmu-internal.h"
  /**
   * smmuv3_trigger_irq - pulse @irq if enabled and update
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      }
  }
-+static gboolean
+ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-+smmuv3_invalidate_ste(gpointer key, gpointer value, gpointer user_data)
+-                                   void *opaque, CPState state, int secstate,
-+{
++                                   void *opaque, CPState state,
-+    SMMUDevice *sdev = (SMMUDevice *)key;
++                                   CPSecureState secstate,
-+    uint32_t sid = smmu_get_sid(sdev);
+                                    int crm, int opc1, int opc2,
-+    SMMUSIDRange *sid_range = (SMMUSIDRange *)user_data;
+                                    const char *name)
 +
 +    if (sid < sid_range->start || sid > sid_range->end) {
 +        return false;
 +    }
 +    trace_smmuv3_config_cache_inv(sid);
 +    return true;
 +}
 +
  static int smmuv3_cmdq_consume(SMMUv3State *s)
  {
-     SMMUState *bs = ARM_SMMU(s);
+@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
-@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
+                                                    r->secure, crm, opc1, opc2,
-         }
+                                                    r->name);
-         case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
+                             break;
-         {
+-                        default:
--            uint32_t start = CMD_SID(&cmd), end, i;
++                        case ARM_CP_SECSTATE_BOTH:
-+            uint32_t start = CMD_SID(&cmd);
+                             name = g_strdup_printf("%s_S", r->name);
-             uint8_t range = CMD_STE_RANGE(&cmd);
+                             add_cpreg_to_hashtable(cpu, r, opaque, state,
-+            uint64_t end = start + (1ULL << (range + 1)) - 1;
+                                                    ARM_CP_SECSTATE_S,
-+            SMMUSIDRange sid_range = {start, end};
+@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
+                                                    ARM_CP_SECSTATE_NS,
-             if (CMD_SSEC(&cmd)) {
+                                                    crm, opc1, opc2, r->name);
-                 cmd_error = SMMU_CERROR_ILL;
+                             break;
-                 break;
++                        default:
-             }
++                            g_assert_not_reached();
--
+                         }
--            end = start + (1 << (range + 1)) - 1;
+                     } else {
-             trace_smmuv3_cmdq_cfgi_ste_range(start, end);
+                         /* AArch64 registers get mapped to non-secure instance
 -
 -            for (i = start; i <= end; i++) {
 -                IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, i);
 -                SMMUDevice *sdev;
 -
 -                if (!mr) {
 -                    continue;
 -                }
 -                sdev = container_of(mr, SMMUDevice, iommu);
 -                smmuv3_flush_config(sdev);
 -            }
 +            g_hash_table_foreach_remove(bs->configs, smmuv3_invalidate_ste,
 +                                        &sid_range);
              break;
          }
          case SMMU_CMD_CFGI_CD:
 --
-.20.1
+.25.1

-[PULL 16/39] target/arm: Update WHILE for PREDDESC
+[PULL 11/23] target/arm: Drop always-true test in define_arm_vh_e2h_redirects_aliases
 From: Richard Henderson <richard.henderson@linaro.org>
-Since b64ee454a4a0, all predicate operations should be
+The new_key field is always non-zero -- drop the if.
 using these field macros for predicates.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-8-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-11-richard.henderson@linaro.org
+[PMM: reinstated dropped PL3_RW mask]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 4 ++--
+ target/arm/helper.c | 23 +++++++++++------------
- target/arm/translate-sve.c | 7 ++++---
+file changed, 11 insertions(+), 12 deletions(-)
 files changed, 6 insertions(+), 5 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
+@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
- uint32_t HELPER(sve_while)(void *vd, uint32_t count, uint32_t pred_desc)
+     for (i = 0; i < ARRAY_SIZE(aliases); i++) {
- {
+         const struct E2HAlias *a = &aliases[i];
--    uintptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+-        ARMCPRegInfo *src_reg, *dst_reg;
--    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
++        ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
++        uint32_t *new_key;
-+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
++        bool ok;
-     uint64_t esz_mask = pred_esz_masks[esz];
-     ARMPredicateReg *d = vd;
+         if (a->feature && !a->feature(&cpu->isar)) {
-     uint32_t flags;
+             continue;
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
-index XXXXXXX..XXXXXXX 100644
+         g_assert(src_reg->opaque == NULL);
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
+         /* Create alias before redirection so we dup the right data. */
-@@ -XXX,XX +XXX,XX @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
+-        if (a->new_key) {
-     TCGv_i64 op0, op1, t0, t1, tmax;
+-            ARMCPRegInfo *new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
-     TCGv_i32 t2, t3;
+-            uint32_t *new_key = g_memdup(&a->new_key, sizeof(uint32_t));
-     TCGv_ptr ptr;
+-            bool ok;
--    unsigned desc, vsz = vec_full_reg_size(s);
++        new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
-+    unsigned vsz = vec_full_reg_size(s);
++        new_key = g_memdup(&a->new_key, sizeof(uint32_t));
-+    unsigned desc = 0;
-     TCGCond cond;
+-            new_reg->name = a->new_name;
+-            new_reg->type |= ARM_CP_ALIAS;
-     if (!sve_access_check(s)) {
+-            /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
-@@ -XXX,XX +XXX,XX @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
+-            new_reg->access &= PL2_RW | PL3_RW;
-     /* Scale elements to bits.  */
++        new_reg->name = a->new_name;
-     tcg_gen_shli_i32(t2, t2, a->esz);
++        new_reg->type |= ARM_CP_ALIAS;
++        /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
--    desc = (vsz / 8) - 2;
++        new_reg->access &= PL2_RW | PL3_RW;
--    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
-+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz / 8);
+-            ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
-+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+-            g_assert(ok);
-     t3 = tcg_const_i32(desc);
+-        }
++        ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
-     ptr = tcg_temp_new_ptr();
++        g_assert(ok);
          src_reg->opaque = dst_reg;
          src_reg->orig_readfn = src_reg->readfn ?: raw_read;
 --
-.20.1
+.25.1

-[PULL 14/39] target/arm: Update BRKA, BRKB, BRKN for PREDDESC
+[PULL 12/23] target/arm: Store cpregs key in the hash table directly
 From: Richard Henderson <richard.henderson@linaro.org>
-Since b64ee454a4a0, all predicate operations should be
+Cast the uint32_t key into a gpointer directly, which
-using these field macros for predicates.
+allows us to avoid allocating storage for each key.
 Use g_hash_table_lookup when we already have a gpointer
 (e.g. for callbacks like count_cpreg), or when using
 get_arm_cp_reginfo would require casting away const.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-6-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 30 ++++++++++++++----------------
+ target/arm/cpu.c     |  4 ++--
- target/arm/translate-sve.c |  4 ++--
+ target/arm/gdbstub.c |  2 +-
-files changed, 16 insertions(+), 18 deletions(-)
+ target/arm/helper.c  | 41 ++++++++++++++++++-----------------------
 files changed, 21 insertions(+), 26 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/cpu.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t do_zero(ARMPredicateReg *d, intptr_t oprsz)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
- void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
+     ARMCPU *cpu = ARM_CPU(obj);
-                        uint32_t pred_desc)
      cpu_set_cpustate_pointers(cpu);
 -    cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
 -                                         g_free, cpreg_hashtable_data_destroy);
 +    cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
 +                                         NULL, cpreg_hashtable_data_destroy);
      QLIST_INIT(&cpu->pre_el_change_hooks);
      QLIST_INIT(&cpu->el_change_hooks);
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static void arm_gen_one_xml_sysreg_tag(GString *s, DynamicGDBXMLInfo *dyn_xml,
  static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
                                          gpointer p)
  {
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+-    uint32_t ri_key = *(uint32_t *)key;
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
++    uint32_t ri_key = (uintptr_t)key;
-     if (last_active_pred(vn, vg, oprsz)) {
+     ARMCPRegInfo *ri = value;
-         compute_brk_z(vd, vm, vg, oprsz, true);
+     RegisterSysregXmlParam *param = (RegisterSysregXmlParam *)p;
      GString *s = param->s;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu)
  static void add_cpreg_to_list(gpointer key, gpointer opaque)
  {
      ARMCPU *cpu = opaque;
 -    uint64_t regidx;
 -    const ARMCPRegInfo *ri;
 -
 -    regidx = *(uint32_t *)key;
 -    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 +    uint32_t regidx = (uintptr_t)key;
 +    const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
      if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
          cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_list(gpointer key, gpointer opaque)
  static void count_cpreg(gpointer key, gpointer opaque)
  {
      ARMCPU *cpu = opaque;
 -    uint64_t regidx;
      const ARMCPRegInfo *ri;
 -    regidx = *(uint32_t *)key;
 -    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 +    ri = g_hash_table_lookup(cpu->cp_regs, key);
      if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
          cpu->cpreg_array_len++;
@@ -XXX,XX +XXX,XX @@ static void count_cpreg(gpointer key, gpointer opaque)
  static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
  {
 -    uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
 -    uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
 +    uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a);
 +    uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b);
      if (aidx > bidx) {
          return 1;
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
      for (i = 0; i < ARRAY_SIZE(aliases); i++) {
          const struct E2HAlias *a = &aliases[i];
          ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
 -        uint32_t *new_key;
          bool ok;
          if (a->feature && !a->feature(&cpu->isar)) {
              continue;
          }
 -        src_reg = g_hash_table_lookup(cpu->cp_regs, &a->src_key);
 -        dst_reg = g_hash_table_lookup(cpu->cp_regs, &a->dst_key);
 +        src_reg = g_hash_table_lookup(cpu->cp_regs,
 +                                      (gpointer)(uintptr_t)a->src_key);
 +        dst_reg = g_hash_table_lookup(cpu->cp_regs,
 +                                      (gpointer)(uintptr_t)a->dst_key);
          g_assert(src_reg != NULL);
          g_assert(dst_reg != NULL);
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
          /* Create alias before redirection so we dup the right data. */
          new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
 -        new_key = g_memdup(&a->new_key, sizeof(uint32_t));
          new_reg->name = a->new_name;
          new_reg->type |= ARM_CP_ALIAS;
          /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
          new_reg->access &= PL2_RW | PL3_RW;
 -        ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
 +        ok = g_hash_table_insert(cpu->cp_regs,
 +                                 (gpointer)(uintptr_t)a->new_key, new_reg);
          g_assert(ok);
          src_reg->opaque = dst_reg;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      /* Private utility function for define_one_arm_cp_reg_with_opaque():
       * add a single reginfo struct to the hash table.
       */
 -    uint32_t *key = g_new(uint32_t, 1);
 +    uint32_t key;
      ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
      int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
      int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
              r2->cp = CP_REG_ARM64_SYSREG_CP;
          }
 -        *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
 -                                  r2->opc0, opc1, opc2);
 +        key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
 +                                 r2->opc0, opc1, opc2);
      } else {
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
+-        *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
- uint32_t HELPER(sve_brkpas)(void *vd, void *vn, void *vm, void *vg,
++        key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
-                             uint32_t pred_desc)
+     }
      if (opaque) {
          r2->opaque = opaque;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
       * requested.
       */
      if (!(r->type & ARM_CP_OVERRIDE)) {
 -        ARMCPRegInfo *oldreg;
 -        oldreg = g_hash_table_lookup(cpu->cp_regs, key);
 +        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
          if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
              fprintf(stderr, "Register redefined: cp=%d %d bit "
                      "crn=%d crm=%d opc1=%d opc2=%d, "
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
              g_assert_not_reached();
          }
      }
 -    g_hash_table_insert(cpu->cp_regs, key, r2);
 +    g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
  }
@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
  const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
  {
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+-    return g_hash_table_lookup(cpregs, &encoded_cp);
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
++    return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp);
      if (last_active_pred(vn, vg, oprsz)) {
          return compute_brks_z(vd, vm, vg, oprsz, true);
      } else {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkpas)(void *vd, void *vn, void *vm, void *vg,
  void HELPER(sve_brkpb)(void *vd, void *vn, void *vm, void *vg,
                         uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      if (last_active_pred(vn, vg, oprsz)) {
          compute_brk_z(vd, vm, vg, oprsz, false);
      } else {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_brkpb)(void *vd, void *vn, void *vm, void *vg,
  uint32_t HELPER(sve_brkpbs)(void *vd, void *vn, void *vm, void *vg,
                              uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      if (last_active_pred(vn, vg, oprsz)) {
          return compute_brks_z(vd, vm, vg, oprsz, false);
      } else {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkpbs)(void *vd, void *vn, void *vm, void *vg,
  void HELPER(sve_brka_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      compute_brk_z(vd, vn, vg, oprsz, true);
  }
- uint32_t HELPER(sve_brkas_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
+ void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      return compute_brks_z(vd, vn, vg, oprsz, true);
  }
  void HELPER(sve_brkb_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      compute_brk_z(vd, vn, vg, oprsz, false);
  }
  uint32_t HELPER(sve_brkbs_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      return compute_brks_z(vd, vn, vg, oprsz, false);
  }
  void HELPER(sve_brka_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      compute_brk_m(vd, vn, vg, oprsz, true);
  }
  uint32_t HELPER(sve_brkas_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      return compute_brks_m(vd, vn, vg, oprsz, true);
  }
  void HELPER(sve_brkb_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      compute_brk_m(vd, vn, vg, oprsz, false);
  }
  uint32_t HELPER(sve_brkbs_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      return compute_brks_m(vd, vn, vg, oprsz, false);
  }
  void HELPER(sve_brkn)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 -
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      if (!last_active_pred(vn, vg, oprsz)) {
          do_zero(vd, oprsz);
      }
@@ -XXX,XX +XXX,XX @@ static uint32_t predtest_ones(ARMPredicateReg *d, intptr_t oprsz,
  uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 -
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
      if (last_active_pred(vn, vg, oprsz)) {
          return predtest_ones(vd, oprsz, -1);
      } else {
 diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_brk3(DisasContext *s, arg_rprr_s *a,
      TCGv_ptr n = tcg_temp_new_ptr();
      TCGv_ptr m = tcg_temp_new_ptr();
      TCGv_ptr g = tcg_temp_new_ptr();
 -    TCGv_i32 t = tcg_const_i32(vsz - 2);
 +    TCGv_i32 t = tcg_const_i32(FIELD_DP32(0, PREDDESC, OPRSZ, vsz));
      tcg_gen_addi_ptr(d, cpu_env, pred_full_reg_offset(s, a->rd));
      tcg_gen_addi_ptr(n, cpu_env, pred_full_reg_offset(s, a->rn));
@@ -XXX,XX +XXX,XX @@ static bool do_brk2(DisasContext *s, arg_rpr_s *a,
      TCGv_ptr d = tcg_temp_new_ptr();
      TCGv_ptr n = tcg_temp_new_ptr();
      TCGv_ptr g = tcg_temp_new_ptr();
 -    TCGv_i32 t = tcg_const_i32(vsz - 2);
 +    TCGv_i32 t = tcg_const_i32(FIELD_DP32(0, PREDDESC, OPRSZ, vsz));
      tcg_gen_addi_ptr(d, cpu_env, pred_full_reg_offset(s, a->rd));
      tcg_gen_addi_ptr(n, cpu_env, pred_full_reg_offset(s, a->rn));
 --
-.20.1
+.25.1

-[PULL 04/39] dma: Introduce dma_aligned_pow2_mask()
+[PULL 13/23] target/arm: Merge allocation of the cpreg and its name
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Currently get_naturally_aligned_size() is used by the intel iommu
+Simplify freeing cp_regs hash table entries by using a single
-to compute the maximum invalidation range based on @size which is
+allocation for the entire value.
 a power of 2 while being aligned with the @start address and less
 than the maximum range defined by @gaw.
-This helper is also useful for other iommu devices (virtio-iommu,
+This fixes a theoretical bug if we were to ever free the entire
-SMMUv3) to make sure IOMMU UNMAP notifiers only are called with
+hash table, because we've been installing string literal constants
-power of 2 range sizes.
+into the cpreg structure in define_arm_vh_e2h_redirects_aliases.
 However, at present we only free entries created for AArch32
 wildcard cpregs which get overwritten by more specific cpregs,
 so this bug is never exposed.
-Let's move this latter into dma-helpers.c and rename it into
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-dma_aligned_pow2_mask(). Also rewrite the helper so that it
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-accomodates UINT64_MAX values for the size mask and max mask.
+Message-id: 20220501055028.646596-13-richard.henderson@linaro.org
 It now returns a mask instead of a size. Change the caller.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-id: 20210309102742.30442-3-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/sysemu/dma.h  | 12 ++++++++++++
+ target/arm/cpu.c    | 16 +---------------
- hw/i386/intel_iommu.c | 30 +++++++-----------------------
+ target/arm/helper.c | 10 ++++++++--
- softmmu/dma-helpers.c | 26 ++++++++++++++++++++++++++
+files changed, 9 insertions(+), 17 deletions(-)
 files changed, 45 insertions(+), 23 deletions(-)
-diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/dma.h
+--- a/target/arm/cpu.c
-+++ b/include/sysemu/dma.h
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ uint64_t dma_buf_write(uint8_t *ptr, int32_t len, QEMUSGList *sg);
+@@ -XXX,XX +XXX,XX @@ uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz)
- void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
+     return (Aff1 << ARM_AFF1_SHIFT) | Aff0;
                      QEMUSGList *sg, enum BlockAcctType type);
 +/**
 + * dma_aligned_pow2_mask: Return the address bit mask of the largest
 + * power of 2 size less or equal than @end - @start + 1, aligned with @start,
 + * and bounded by 1 << @max_addr_bits bits.
 + *
 + * @start: range start address
 + * @end: range end address (greater than @start)
 + * @max_addr_bits: max address bits (<= 64)
 + */
 +uint64_t dma_aligned_pow2_mask(uint64_t start, uint64_t end,
 +                               int max_addr_bits);
 +
  #endif
 diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i386/intel_iommu.c
 +++ b/hw/i386/intel_iommu.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/i386/x86-iommu.h"
  #include "hw/pci-host/q35.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/dma.h"
  #include "sysemu/sysemu.h"
  #include "hw/i386/apic_internal.h"
  #include "kvm/kvm_i386.h"
@@ -XXX,XX +XXX,XX @@ VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus, int devfn)
      return vtd_dev_as;
  }
--static uint64_t get_naturally_aligned_size(uint64_t start,
+-static void cpreg_hashtable_data_destroy(gpointer data)
 -                                           uint64_t size, int gaw)
 -{
--    uint64_t max_mask = 1ULL << gaw;
+-    /*
--    uint64_t alignment = start ? start & -start : max_mask;
+-     * Destroy function for cpu->cp_regs hashtable data entries.
 -     * We must free the name string because it was g_strdup()ed in
 -     * add_cpreg_to_hashtable(). It's OK to cast away the 'const'
 -     * from r->name because we know we definitely allocated it.
 -     */
 -    ARMCPRegInfo *r = data;
 -
--    alignment = MIN(alignment, max_mask);
+-    g_free((void *)r->name);
--    size = MIN(size, max_mask);
+-    g_free(r);
 -
 -    if (alignment <= size) {
 -        /* Increase the alignment of start */
 -        return alignment;
 -    } else {
 -        /* Find the largest page mask from size */
 -        return 1ULL << (63 - clz64(size));
 -    }
 -}
 -
- /* Unmap the whole range in the notifier's scope. */
+ static void arm_cpu_initfn(Object *obj)
  static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
  {
-@@ -XXX,XX +XXX,XX @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
+     ARMCPU *cpu = ARM_CPU(obj);
-     while (remain >= VTD_PAGE_SIZE) {
+     cpu_set_cpustate_pointers(cpu);
-         IOMMUTLBEvent event;
+     cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
--        uint64_t mask = get_naturally_aligned_size(start, remain, s->aw_bits);
+-                                         NULL, cpreg_hashtable_data_destroy);
-+        uint64_t mask = dma_aligned_pow2_mask(start, end, s->aw_bits);
++                                         NULL, g_free);
-+        uint64_t size = mask + 1;
+     QLIST_INIT(&cpu->pre_el_change_hooks);
--        assert(mask);
+     QLIST_INIT(&cpu->el_change_hooks);
-+        assert(size);
+diff --git a/target/arm/helper.c b/target/arm/helper.c
          event.type = IOMMU_NOTIFIER_UNMAP;
          event.entry.iova = start;
 -        event.entry.addr_mask = mask - 1;
 +        event.entry.addr_mask = mask;
          event.entry.target_as = &address_space_memory;
          event.entry.perm = IOMMU_NONE;
          /* This field is meaningless for unmap */
@@ -XXX,XX +XXX,XX @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
          memory_region_notify_iommu_one(n, &event);
 -        start += mask;
 -        remain -= mask;
 +        start += size;
 +        remain -= size;
      }
      assert(!remain);
 diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/dma-helpers.c
+--- a/target/arm/helper.c
-+++ b/softmmu/dma-helpers.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
- {
+      * add a single reginfo struct to the hash table.
-     block_acct_start(blk_get_stats(blk), cookie, sg->size, type);
+      */
- }
+     uint32_t key;
 -    ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
 +    ARMCPRegInfo *r2;
      int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
      int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
 +    size_t name_len;
 +
-+uint64_t dma_aligned_pow2_mask(uint64_t start, uint64_t end, int max_addr_bits)
++    /* Combine cpreg and name into one allocation. */
-+{
++    name_len = strlen(name) + 1;
-+    uint64_t max_mask = UINT64_MAX, addr_mask = end - start;
++    r2 = g_malloc(sizeof(*r2) + name_len);
-+    uint64_t alignment_mask, size_mask;
++    *r2 = *r;
-+
++    r2->name = memcpy(r2 + 1, name, name_len);
-+    if (max_addr_bits != 64) {
-+        max_mask = (1ULL << max_addr_bits) - 1;
+-    r2->name = g_strdup(name);
-+    }
+     /* Reset the secure state to the specific incoming state.  This is
-+
+      * necessary as the register may have been defined with both states.
-+    alignment_mask = start ? (start & -start) - 1 : max_mask;
+      */
 +    alignment_mask = MIN(alignment_mask, max_mask);
 +    size_mask = MIN(addr_mask, max_mask);
 +
 +    if (alignment_mask <= size_mask) {
 +        /* Increase the alignment of start */
 +        return alignment_mask;
 +    } else {
 +        /* Find the largest page mask from size */
 +        if (addr_mask == UINT64_MAX) {
 +            return UINT64_MAX;
 +        }
 +        return (1ULL << (63 - clz64(addr_mask + 1))) - 1;
 +    }
 +}
 +
 --
-.20.1
+.25.1

-[PULL 06/39] hw/arm/smmu-common: Fix smmu_iotlb_inv_iova when asid is not set
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-If the asid is not set, do not attempt to locate the key directly
-as all inserted keys have a valid asid.
-Use g_hash_table_foreach_remove instead.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210309102742.30442-5-eric.auger@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/smmu-common.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmu-common.c
-+++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@ inline void
- smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
-                     uint8_t tg, uint64_t num_pages, uint8_t ttl)
- {
--    if (ttl && (num_pages == 1)) {
-+    if (ttl && (num_pages == 1) && (asid >= 0)) {
-         SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
-         g_hash_table_remove(s->iotlb, &key);
---
-.20.1

-[PULL 07/39] hw/arm/smmuv3: Enforce invalidation on a power of two range
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-As of today, the driver can invalidate a number of pages that is
-not a power of 2. However IOTLB unmap notifications and internal
-IOTLB invalidations work with masks leading to erroneous
-invalidations.
-In case the range is not a power of 2, split invalidations into
-power of 2 invalidations.
-When looking for a single page entry in the vSMMU internal IOTLB,
-let's make sure that if the entry is not found using a
-g_hash_table_remove() we iterate over all the entries to find a
-potential range that overlaps it.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210309102742.30442-6-eric.auger@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/smmu-common.c | 30 ++++++++++++++++++------------
- hw/arm/smmuv3.c      | 24 ++++++++++++++++++++----
-files changed, 38 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmu-common.c
-+++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@ inline void
- smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
-                     uint8_t tg, uint64_t num_pages, uint8_t ttl)
- {
-+    /* if tg is not set we use 4KB range invalidation */
-+    uint8_t granule = tg ? tg * 2 + 10 : 12;
-+
-     if (ttl && (num_pages == 1) && (asid >= 0)) {
-         SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
--        g_hash_table_remove(s->iotlb, &key);
--    } else {
--        /* if tg is not set we use 4KB range invalidation */
--        uint8_t granule = tg ? tg * 2 + 10 : 12;
--
--        SMMUIOTLBPageInvInfo info = {
--            .asid = asid, .iova = iova,
--            .mask = (num_pages * 1 << granule) - 1};
--
--        g_hash_table_foreach_remove(s->iotlb,
--                                    smmu_hash_remove_by_asid_iova,
--                                    &info);
-+        if (g_hash_table_remove(s->iotlb, &key)) {
-+            return;
-+        }
-+        /*
-+         * if the entry is not found, let's see if it does not
-+         * belong to a larger IOTLB entry
-+         */
-     }
-+
-+    SMMUIOTLBPageInvInfo info = {
-+        .asid = asid, .iova = iova,
-+        .mask = (num_pages * 1 << granule) - 1};
-+
-+    g_hash_table_foreach_remove(s->iotlb,
-+                                smmu_hash_remove_by_asid_iova,
-+                                &info);
- }
- inline void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
-+++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-     uint16_t vmid = CMD_VMID(cmd);
-     bool leaf = CMD_LEAF(cmd);
-     uint8_t tg = CMD_TG(cmd);
--    hwaddr num_pages = 1;
-+    uint64_t first_page = 0, last_page;
-+    uint64_t num_pages = 1;
-     int asid = -1;
-     if (tg) {
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-     if (type == SMMU_CMD_TLBI_NH_VA) {
-         asid = CMD_ASID(cmd);
-     }
--    trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
--    smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
--    smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
-+
-+    /* Split invalidations into ^2 range invalidations */
-+    last_page = num_pages - 1;
-+    while (num_pages) {
-+        uint8_t granule = tg * 2 + 10;
-+        uint64_t mask, count;
-+
-+        mask = dma_aligned_pow2_mask(first_page, last_page, 64 - granule);
-+        count = mask + 1;
-+
-+        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, count, ttl, leaf);
-+        smmuv3_inv_notifiers_iova(s, asid, addr, tg, count);
-+        smmu_iotlb_inv_iova(s, asid, addr, tg, count, ttl);
-+
-+        num_pages -= count;
-+        first_page += count;
-+        addr += count * BIT_ULL(granule);
-+    }
- }
- static int smmuv3_cmdq_consume(SMMUv3State *s)
---
-.20.1

-[PULL 09/39] hw/arm/smmuv3: Uniformize sid traces
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-Convert all sid printouts to sid=0x%x.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20210309102742.30442-8-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/trace-events | 24 ++++++++++++------------
-file changed, 12 insertions(+), 12 deletions(-)
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
-+++ b/hw/arm/trace-events
-@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
- smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
- smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
- smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
--smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
--smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
-+smmuv3_record_event(const char *type, uint32_t sid) "%s sid=0x%x"
-+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "sid=0x%x features:0x%x, sid_split:0x%x"
- smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%"PRIx64" l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
- smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
--smmuv3_translate_disable(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass (smmu disabled) iova:0x%"PRIx64" is_write=%d"
--smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d STE bypass iova:0x%"PRIx64" is_write=%d"
--smmuv3_translate_abort(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d abort on iova:0x%"PRIx64" is_write=%d"
--smmuv3_translate_success(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
-+smmuv3_translate_disable(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x bypass (smmu disabled) iova:0x%"PRIx64" is_write=%d"
-+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x STE bypass iova:0x%"PRIx64" is_write=%d"
-+smmuv3_translate_abort(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x abort on iova:0x%"PRIx64" is_write=%d"
-+smmuv3_translate_success(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=0x%x iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
- smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
- smmuv3_decode_cd(uint32_t oas) "oas=%d"
- smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz, bool had) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d had:%d"
--smmuv3_cmdq_cfgi_ste(int streamid) "streamid =%d"
-+smmuv3_cmdq_cfgi_ste(int streamid) "streamid= 0x%x"
- smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
--smmuv3_cmdq_cfgi_cd(uint32_t sid) "streamid = %d"
--smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid %d (hits=%d, misses=%d, hit rate=%d)"
--smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid %d (hits=%d, misses=%d, hit rate=%d)"
--smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid =%d asid =%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
-+smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
-+smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-+smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-+smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
- smmuv3_cmdq_tlbi_nh(void) ""
- smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
--smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid %d"
-+smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
- smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
- smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
- smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
---
-.20.1

-[PULL 10/39] target/arm: Fix sve_uzp_p vs odd vector lengths
+[PULL 14/23] target/arm: Hoist computation of key in add_cpreg_to_hashtable
 From: Richard Henderson <richard.henderson@linaro.org>
-Missed out on compressing the second half of a predicate
+Move the computation of key to the top of the function.
-with length vl % 512 > 256.
+Hoist the resolution of cp as well, as an input to the
 computation of key.
-Adjust all of the x + (y << s) to x | (y << s) as a
+This will be required by a subsequent patch.
 general style fix.  Drop the extract64 because the input
 uint64_t are known to be already zero-extended from the
 current size of the predicate.
-Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-14-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c | 30 +++++++++++++++++++++---------
+ target/arm/helper.c | 49 +++++++++++++++++++++++++--------------------
-file changed, 21 insertions(+), 9 deletions(-)
+file changed, 27 insertions(+), 22 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-     if (oprsz <= 8) {
+     ARMCPRegInfo *r2;
-         l = compress_bits(n[0] >> odd, esz);
+     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
-         h = compress_bits(m[0] >> odd, esz);
+     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
--        d[0] = extract64(l + (h << (4 * oprsz)), 0, 8 * oprsz);
++    int cp = r->cp;
-+        d[0] = l | (h << (4 * oprsz));
+     size_t name_len;
-     } else {
-         ARMPredicateReg tmp_m;
++    switch (state) {
-         intptr_t oprsz_16 = oprsz / 16;
++    case ARM_CP_STATE_AA32:
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
++        /* We assume it is a cp15 register if the .cp field is left unset. */
-             h = n[2 * i + 1];
++        if (cp == 0 && r->state == ARM_CP_STATE_BOTH) {
-             l = compress_bits(l >> odd, esz);
++            cp = 15;
-             h = compress_bits(h >> odd, esz);
++        }
--            d[i] = l + (h << 32);
++        key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
-+            d[i] = l | (h << 32);
++        break;
 +    case ARM_CP_STATE_AA64:
 +        /*
 +         * To allow abbreviation of ARMCPRegInfo definitions, we treat
 +         * cp == 0 as equivalent to the value for "standard guest-visible
 +         * sysreg".  STATE_BOTH definitions are also always "standard sysreg"
 +         * in their AArch64 view (the .cp value may be non-zero for the
 +         * benefit of the AArch32 view).
 +         */
 +        if (cp == 0 || r->state == ARM_CP_STATE_BOTH) {
 +            cp = CP_REG_ARM64_SYSREG_CP;
 +        }
 +        key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
      /* Combine cpreg and name into one allocation. */
      name_len = strlen(name) + 1;
      r2 = g_malloc(sizeof(*r2) + name_len);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          }
--        /* For VL which is not a power of 2, the results from M do not
+         if (r->state == ARM_CP_STATE_BOTH) {
--           align nicely with the uint64_t for D.  Put the aligned results
+-            /* We assume it is a cp15 register if the .cp field is left unset.
--           from M into TMP_M and then copy it into place afterward.  */
+-             */
-+        /*
+-            if (r2->cp == 0) {
-+         * For VL which is not a multiple of 512, the results from M do not
+-                r2->cp = 15;
-+         * align nicely with the uint64_t for D.  Put the aligned results
+-            }
-+         * from M into TMP_M and then copy it into place afterward.
+-
-+         */
+ #if HOST_BIG_ENDIAN
-         if (oprsz & 15) {
+             if (r2->fieldoffset) {
--            d[i] = compress_bits(n[2 * i] >> odd, esz);
+                 r2->fieldoffset += sizeof(uint32_t);
-+            int final_shift = (oprsz & 15) * 2;
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-+
+ #endif
 +            l = n[2 * i + 0];
 +            h = n[2 * i + 1];
 +            l = compress_bits(l >> odd, esz);
 +            h = compress_bits(h >> odd, esz);
 +            d[i] = l | (h << final_shift);
              for (i = 0; i < oprsz_16; i++) {
                  l = m[2 * i + 0];
                  h = m[2 * i + 1];
                  l = compress_bits(l >> odd, esz);
                  h = compress_bits(h >> odd, esz);
 -                tmp_m.p[i] = l + (h << 32);
 +                tmp_m.p[i] = l | (h << 32);
              }
 -            tmp_m.p[i] = compress_bits(m[2 * i] >> odd, esz);
 +            l = m[2 * i + 0];
 +            h = m[2 * i + 1];
 +            l = compress_bits(l >> odd, esz);
 +            h = compress_bits(h >> odd, esz);
 +            tmp_m.p[i] = l | (h << final_shift);
              swap_memmove(vd + oprsz / 2, &tmp_m, oprsz / 2);
          } else {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
                  h = m[2 * i + 1];
                  l = compress_bits(l >> odd, esz);
                  h = compress_bits(h >> odd, esz);
 -                d[oprsz_16 + i] = l + (h << 32);
 +                d[oprsz_16 + i] = l | (h << 32);
              }
          }
      }
+-    if (state == ARM_CP_STATE_AA64) {
+-        /* To allow abbreviation of ARMCPRegInfo
+-         * definitions, we treat cp == 0 as equivalent to
+-         * the value for "standard guest-visible sysreg".
+-         * STATE_BOTH definitions are also always "standard
+-         * sysreg" in their AArch64 view (the .cp value may
+-         * be non-zero for the benefit of the AArch32 view).
+-         */
+-        if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
+-            r2->cp = CP_REG_ARM64_SYSREG_CP;
+-        }
+-        key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
+-                                 r2->opc0, opc1, opc2);
+-    } else {
+-        key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
+-    }
+     if (opaque) {
+         r2->opaque = opaque;
+     }
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
+     /* Make sure reginfo passed to helpers for wildcarded regs
+      * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
+      */
++    r2->cp = cp;
+     r2->crm = crm;
+     r2->opc1 = opc1;
+     r2->opc2 = opc2;
 --
-.20.1
+.25.1

-[PULL 11/39] target/arm: Fix sve_zip_p vs odd vector lengths
+[PULL 15/23] target/arm: Consolidate cpreg updates in add_cpreg_to_hashtable
 From: Richard Henderson <richard.henderson@linaro.org>
-Wrote too much with low-half zip (zip1) with vl % 512 != 0.
+Put most of the value writeback to the same place,
 and improve the comment that goes with them.
-Adjust all of the x + (y << s) to x | (y << s) as a style fix.
-We only ever have exact overlap between D, M, and N.  Therefore
-we only need a single temporary, and we do not need to check for
-partial overlap.
-Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-15-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c | 25 ++++++++++++++-----------
+ target/arm/helper.c | 28 ++++++++++++----------------
-file changed, 14 insertions(+), 11 deletions(-)
+file changed, 12 insertions(+), 16 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-     intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+     *r2 = *r;
-     int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+     r2->name = memcpy(r2 + 1, name, name_len);
-     intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
-+    int esize = 1 << esz;
+-    /* Reset the secure state to the specific incoming state.  This is
-     uint64_t *d = vd;
+-     * necessary as the register may have been defined with both states.
-     intptr_t i;
++    /*
++     * Update fields to match the instantiation, overwiting wildcards
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
++     * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
-         mm = extract64(mm, high * half, half);
+      */
-         nn = expand_bits(nn, esz);
++    r2->cp = cp;
-         mm = expand_bits(mm, esz);
++    r2->crm = crm;
--        d[0] = nn + (mm << (1 << esz));
++    r2->opc1 = opc1;
-+        d[0] = nn | (mm << esize);
++    r2->opc2 = opc2;
-     } else {
++    r2->state = state;
--        ARMPredicateReg tmp_n, tmp_m;
+     r2->secure = secstate;
-+        ARMPredicateReg tmp;
++    if (opaque) {
++        r2->opaque = opaque;
-         /* We produce output faster than we consume input.
++    }
-            Therefore we must be mindful of possible overlap.  */
--        if ((vn - vd) < (uintptr_t)oprsz) {
+     if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
--            vn = memcpy(&tmp_n, vn, oprsz);
+         /* Register is banked (using both entries in array).
--        }
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
--        if ((vm - vd) < (uintptr_t)oprsz) {
+ #endif
 -            vm = memcpy(&tmp_m, vm, oprsz);
 +        if (vd == vn) {
 +            vn = memcpy(&tmp, vn, oprsz);
 +            if (vd == vm) {
 +                vm = vn;
 +            }
 +        } else if (vd == vm) {
 +            vm = memcpy(&tmp, vm, oprsz);
          }
          if (high) {
              high = oprsz >> 1;
          }
 -        if ((high & 3) == 0) {
 +        if ((oprsz & 7) == 0) {
              uint32_t *n = vn, *m = vm;
              high >>= 2;
 -            for (i = 0; i < DIV_ROUND_UP(oprsz, 8); i++) {
 +            for (i = 0; i < oprsz / 8; i++) {
                  uint64_t nn = n[H4(high + i)];
                  uint64_t mm = m[H4(high + i)];
                  nn = expand_bits(nn, esz);
                  mm = expand_bits(mm, esz);
 -                d[i] = nn + (mm << (1 << esz));
 +                d[i] = nn | (mm << esize);
              }
          } else {
              uint8_t *n = vn, *m = vm;
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
                  nn = expand_bits(nn, esz);
                  mm = expand_bits(mm, esz);
 -                d16[H2(i)] = nn + (mm << (1 << esz));
 +                d16[H2(i)] = nn | (mm << esize);
              }
          }
      }
+-    if (opaque) {
+-        r2->opaque = opaque;
+-    }
+-    /* reginfo passed to helpers is correct for the actual access,
+-     * and is never ARM_CP_STATE_BOTH:
+-     */
+-    r2->state = state;
+-    /* Make sure reginfo passed to helpers for wildcarded regs
+-     * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
+-     */
+-    r2->cp = cp;
+-    r2->crm = crm;
+-    r2->opc1 = opc1;
+-    r2->opc2 = opc2;
++
+     /* By convention, for wildcarded registers only the first
+      * entry is used for migration; the others are marked as
+      * ALIAS so we don't try to transfer the register
 --
-.20.1
+.25.1

-[PULL 17/39] target/arm: Update sve reduction vs simd_desc
+[PULL 16/23] target/arm: Use bool for is64 and ns in add_cpreg_to_hashtable
 From: Richard Henderson <richard.henderson@linaro.org>
-With the reduction operations, we intentionally increase maxsz to
+Bool is a more appropriate type for these variables.
 the next power of 2, so as to fill out the reduction tree correctly.
 Since e2e7168a214b, oprsz must equal maxsz, with exceptions for small
 vectors, so this triggers an assertion for vector sizes > 32 that are
 not themselves a power of 2.
 Pass the power-of-two value in the simd_data field instead.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-9-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-16-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 2 +-
+ target/arm/helper.c | 4 ++--
- target/arm/translate-sve.c | 2 +-
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static TYPE NAME##_reduce(TYPE *data, float_status *status, uintptr_t n) \
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
- }                                                                     \
+      */
- uint64_t HELPER(NAME)(void *vn, void *vg, void *vs, uint32_t desc)    \
+     uint32_t key;
- {                                                                     \
+     ARMCPRegInfo *r2;
--    uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_maxsz(desc);  \
+-    int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
-+    uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_data(desc);   \
+-    int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
-     TYPE data[sizeof(ARMVectorReg) / sizeof(TYPE)];                   \
++    bool is64 = r->type & ARM_CP_64BIT;
-     for (i = 0; i < oprsz; ) {                                        \
++    bool ns = secstate & ARM_CP_SECSTATE_NS;
-         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));               \
+     int cp = r->cp;
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+     size_t name_len;
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_reduce(DisasContext *s, arg_rpr_esz *a,
  {
      unsigned vsz = vec_full_reg_size(s);
      unsigned p2vsz = pow2ceil(vsz);
 -    TCGv_i32 t_desc = tcg_const_i32(simd_desc(vsz, p2vsz, 0));
 +    TCGv_i32 t_desc = tcg_const_i32(simd_desc(vsz, vsz, p2vsz));
      TCGv_ptr t_zn, t_pg, status;
      TCGv_i64 temp;
 --
-.20.1
+.25.1

-[PULL 24/39] accel: kvm: Fix kvm_type invocation
+[PULL 17/23] target/arm: Hoist isbanked computation in add_cpreg_to_hashtable
-From: Andrew Jones <drjones@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Prior to commit f2ce39b4f067 a MachineClass kvm_type method
+Computing isbanked only once makes the code
-only needed to be registered to ensure it would be executed.
+a bit easier to read.
 With commit f2ce39b4f067 a kvm-type machine property must also
 be specified. hw/arm/virt relies on the kvm_type method to pass
 its selected IPA limit to KVM, but this is not exposed as a
 machine property. Restore the previous functionality of invoking
 kvm_type when it's present.
-Fixes: f2ce39b4f067 ("vl: make qemu_get_machine_opts static")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20220501055028.646596-17-richard.henderson@linaro.org
 Message-id: 20210310135218.255205-2-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/boards.h | 1 +
+ target/arm/helper.c | 6 ++++--
- accel/kvm/kvm-all.c | 2 ++
+file changed, 4 insertions(+), 2 deletions(-)
 files changed, 3 insertions(+)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/arm/helper.c
-+++ b/include/hw/boards.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-  * @kvm_type:
+     bool is64 = r->type & ARM_CP_64BIT;
-  *    Return the type of KVM corresponding to the kvm-type string option or
+     bool ns = secstate & ARM_CP_SECSTATE_NS;
-  *    computed based on other criteria such as the host kernel capabilities.
+     int cp = r->cp;
-+ *    kvm-type may be NULL if it is not needed.
++    bool isbanked;
-  * @numa_mem_supported:
+     size_t name_len;
-  *    true if '--numa node.mem' option is supported and false otherwise
-  * @smp_parse:
+     switch (state) {
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-index XXXXXXX..XXXXXXX 100644
+         r2->opaque = opaque;
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
                                                              "kvm-type",
                                                              &error_abort);
          type = mc->kvm_type(ms, kvm_type);
 +    } else if (mc->kvm_type) {
 +        type = mc->kvm_type(ms, NULL);
      }
-     do {
+-    if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
 +    isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
 +    if (isbanked) {
          /* Register is banked (using both entries in array).
           * Overwriting fieldoffset as the array is only used to define
           * banked registers but later only fieldoffset is used.
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      }
      if (state == ARM_CP_STATE_AA32) {
 -        if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
 +        if (isbanked) {
              /* If the register is banked then we don't need to migrate or
               * reset the 32-bit instance in certain cases:
               *
 --
-.20.1
+.25.1

-[PULL 13/39] target/arm: Update find_last_active for PREDDESC
+[PULL 18/23] target/arm: Perform override check early in add_cpreg_to_hashtable
 From: Richard Henderson <richard.henderson@linaro.org>
-Since b64ee454a4a0, all predicate operations should be
+Perform the override check early, so that it is still done
-using these field macros for predicates.
+even when we decide to discard an unreachable cpreg.
 Use assert not printf+abort.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210309155305.11301-5-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-18-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 6 +++---
+ target/arm/helper.c | 22 ++++++++--------------
- target/arm/translate-sve.c | 7 +++----
+file changed, 8 insertions(+), 14 deletions(-)
 files changed, 6 insertions(+), 7 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_compact_d)(void *vd, void *vn, void *vg, uint32_t desc)
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-  */
+         g_assert_not_reached();
- int32_t HELPER(sve_last_active_element)(void *vg, uint32_t pred_desc)
+     }
- {
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
++    /* Overriding of an existing definition must be explicitly requested. */
--    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
++    if (!(r->type & ARM_CP_OVERRIDE)) {
-+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
++        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
-+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
++        if (oldreg) {
++            assert(oldreg->type & ARM_CP_OVERRIDE);
--    return last_active_element(vg, DIV_ROUND_UP(oprsz, 8), esz);
++        }
-+    return last_active_element(vg, words, esz);
++    }
 +
      /* Combine cpreg and name into one allocation. */
      name_len = strlen(name) + 1;
      r2 = g_malloc(sizeof(*r2) + name_len);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          assert(!raw_accessors_invalid(r2));
      }
 -    /* Overriding of an existing definition must be explicitly
 -     * requested.
 -     */
 -    if (!(r->type & ARM_CP_OVERRIDE)) {
 -        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
 -        if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
 -            fprintf(stderr, "Register redefined: cp=%d %d bit "
 -                    "crn=%d crm=%d opc1=%d opc2=%d, "
 -                    "was %s, now %s\n", r2->cp, 32 + 32 * is64,
 -                    r2->crn, r2->crm, r2->opc1, r2->opc2,
 -                    oldreg->name, r2->name);
 -            g_assert_not_reached();
 -        }
 -    }
      g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
  }
- void HELPER(sve_splice)(void *vd, void *vn, void *vm, void *vg, uint32_t desc)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static void find_last_active(DisasContext *s, TCGv_i32 ret, int esz, int pg)
-      */
-     TCGv_ptr t_p = tcg_temp_new_ptr();
-     TCGv_i32 t_desc;
--    unsigned vsz = pred_full_reg_size(s);
--    unsigned desc;
-+    unsigned desc = 0;
--    desc = vsz - 2;
--    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, esz);
-+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pred_full_reg_size(s));
-+    desc = FIELD_DP32(desc, PREDDESC, ESZ, esz);
-     tcg_gen_addi_ptr(t_p, cpu_env, pred_full_reg_offset(s, pg));
-     t_desc = tcg_const_i32(desc);
 --
-.20.1
+.25.1

-[PULL 18/39] hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
+[PULL 19/23] target/arm: Reformat comments in add_cpreg_to_hashtable
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Currently the emulated EMAC for sun8i always traverses the transmit queue
+Put the block comments into the current coding style.
 from the head when transferring packets. It searches for a list of consecutive
 descriptors whichs are flagged as ready for processing and transmits their payloads
 accordingly. The controller stops processing once it finds a descriptor that is not
 marked ready.
-While the above behaviour works in most situations, it is not the same as the actual
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-EMAC in hardware. Actual hardware uses the TX_CUR_DESC register value to keep track
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-of the last position in the transmit queue and continues processing from that position
+Message-id: 20220501055028.646596-19-richard.henderson@linaro.org
 when software triggers the start of DMA processing. The currently emulated behaviour can
 lead to packet loss on transmit when software fills the transmit queue with ready
 descriptors that overlap the tail of the circular list.
 This commit modifies the emulated EMAC for sun8i such that it processes
 the transmit queue using the TX_CUR_DESC register in the same way as hardware.
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210310195820.21950-2-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/allwinner-sun8i-emac.c | 62 +++++++++++++++++++----------------
+ target/arm/helper.c | 24 +++++++++++++++---------
-file changed, 34 insertions(+), 28 deletions(-)
+file changed, 15 insertions(+), 9 deletions(-)
-diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/allwinner-sun8i-emac.c
+--- a/target/arm/helper.c
-+++ b/hw/net/allwinner-sun8i-emac.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_update_irq(AwSun8iEmacState *s)
+@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
-     qemu_set_irq(s->irq, (s->int_sta & s->int_en) != 0);
+     return cpu_list;
  }
--static uint32_t allwinner_sun8i_emac_next_desc(AwSun8iEmacState *s,
++/*
--                                               FrameDescriptor *desc,
++ * Private utility function for define_one_arm_cp_reg_with_opaque():
--                                               size_t min_size)
++ * add a single reginfo struct to the hash table.
-+static bool allwinner_sun8i_emac_desc_owned(FrameDescriptor *desc,
++ */
-+                                            size_t min_buf_size)
+ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                     void *opaque, CPState state,
                                     CPSecureState secstate,
                                     int crm, int opc1, int opc2,
                                     const char *name)
  {
--    uint32_t paddr = desc->next;
+-    /* Private utility function for define_one_arm_cp_reg_with_opaque():
--
+-     * add a single reginfo struct to the hash table.
--    dma_memory_read(&s->dma_as, paddr, desc, sizeof(*desc));
+-     */
--
+     uint32_t key;
--    if ((desc->status & DESC_STATUS_CTL) &&
+     ARMCPRegInfo *r2;
--        (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
+     bool is64 = r->type & ARM_CP_64BIT;
--        return paddr;
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
--    } else {
--        return 0;
+     isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
--    }
+     if (isbanked) {
-+    return (desc->status & DESC_STATUS_CTL) && (min_buf_size == 0 ||
+-        /* Register is banked (using both entries in array).
-+           (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_buf_size);
++        /*
- }
++         * Register is banked (using both entries in array).
+          * Overwriting fieldoffset as the array is only used to define
--static uint32_t allwinner_sun8i_emac_get_desc(AwSun8iEmacState *s,
+          * banked registers but later only fieldoffset is used.
--                                              FrameDescriptor *desc,
+          */
--                                              uint32_t start_addr,
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
--                                              size_t min_size)
-+static void allwinner_sun8i_emac_get_desc(AwSun8iEmacState *s,
+     if (state == ARM_CP_STATE_AA32) {
-+                                          FrameDescriptor *desc,
+         if (isbanked) {
-+                                          uint32_t phys_addr)
+-            /* If the register is banked then we don't need to migrate or
-+{
++            /*
-+    dma_memory_read(&s->dma_as, phys_addr, desc, sizeof(*desc));
++             * If the register is banked then we don't need to migrate or
-+}
+              * reset the 32-bit instance in certain cases:
-+
+              *
-+static uint32_t allwinner_sun8i_emac_next_desc(AwSun8iEmacState *s,
+              * 1) If the register has both 32-bit and 64-bit instances then we
-+                                               FrameDescriptor *desc)
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-+{
+                 r2->type |= ARM_CP_ALIAS;
-+    const uint32_t nxt = desc->next;
+             }
-+    allwinner_sun8i_emac_get_desc(s, desc, nxt);
+         } else if ((secstate != r->secure) && !ns) {
-+    return nxt;
+-            /* The register is not banked so we only want to allow migration of
-+}
+-             * the non-secure instance.
-+
++            /*
-+static uint32_t allwinner_sun8i_emac_find_desc(AwSun8iEmacState *s,
++             * The register is not banked so we only want to allow migration
-+                                               FrameDescriptor *desc,
++             * of the non-secure instance.
-+                                               uint32_t start_addr,
+              */
-+                                               size_t min_size)
+             r2->type |= ARM_CP_ALIAS;
  {
      uint32_t desc_addr = start_addr;
      /* Note that the list is a cycle. Last entry points back to the head. */
      while (desc_addr != 0) {
 -        dma_memory_read(&s->dma_as, desc_addr, desc, sizeof(*desc));
 +        allwinner_sun8i_emac_get_desc(s, desc, desc_addr);
 -        if ((desc->status & DESC_STATUS_CTL) &&
 -            (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
 +        if (allwinner_sun8i_emac_desc_owned(desc, min_size)) {
              return desc_addr;
          } else if (desc->next == start_addr) {
              break;
@@ -XXX,XX +XXX,XX @@ static uint32_t allwinner_sun8i_emac_rx_desc(AwSun8iEmacState *s,
                                               FrameDescriptor *desc,
                                               size_t min_size)
  {
 -    return allwinner_sun8i_emac_get_desc(s, desc, s->rx_desc_curr, min_size);
 +    return allwinner_sun8i_emac_find_desc(s, desc, s->rx_desc_curr, min_size);
  }
  static uint32_t allwinner_sun8i_emac_tx_desc(AwSun8iEmacState *s,
 -                                             FrameDescriptor *desc,
 -                                             size_t min_size)
 +                                             FrameDescriptor *desc)
  {
 -    return allwinner_sun8i_emac_get_desc(s, desc, s->tx_desc_head, min_size);
 +    allwinner_sun8i_emac_get_desc(s, desc, s->tx_desc_curr);
 +    return s->tx_desc_curr;
  }
  static void allwinner_sun8i_emac_flush_desc(AwSun8iEmacState *s,
@@ -XXX,XX +XXX,XX @@ static ssize_t allwinner_sun8i_emac_receive(NetClientState *nc,
          bytes_left -= desc_bytes;
          /* Move to the next descriptor */
 -        s->rx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc, 64);
 +        s->rx_desc_curr = allwinner_sun8i_emac_find_desc(s, &desc, desc.next,
 +                                                         AW_SUN8I_EMAC_MIN_PKT_SZ);
          if (!s->rx_desc_curr) {
              /* Not enough buffer space available */
              s->int_sta |= INT_STA_RX_BUF_UA;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
      size_t transmitted = 0;
      static uint8_t packet_buf[2048];
 -    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc, 0);
 +    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc);
      /* Read all transmit descriptors */
 -    while (s->tx_desc_curr != 0) {
 +    while (allwinner_sun8i_emac_desc_owned(&desc, 0)) {
          /* Read from physical memory into packet buffer */
          bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
              packet_bytes = 0;
              transmitted++;
          }
--        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc, 0);
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-+        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc);
+         }
      }
-     /* Raise transmit completed interrupt */
+-    /* By convention, for wildcarded registers only the first
 +    /*
 +     * By convention, for wildcarded registers only the first
       * entry is used for migration; the others are marked as
       * ALIAS so we don't try to transfer the register
       * multiple times. Special registers (ie NOP/WFI) are
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
      }
 -    /* Check that raw accesses are either forbidden or handled. Note that
 +    /*
 +     * Check that raw accesses are either forbidden or handled. Note that
       * we can't assert this earlier because the setup of fieldoffset for
       * banked registers has to be done first.
       */
 --
-.20.1
+.25.1

-[PULL 19/39] tests/acceptance/boot_linux_console: remove Armbian 19.11.3 bionic test for orangepi-pc machine
+Deleted patch
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The image for Armbian 19.11.3 bionic has been removed from the armbian server.
-Without the image as input the test arm_orangepi_bionic_19_11 cannot run.
-This commit removes the test completely and merges the code of the generic function
-do_test_arm_orangepi_uboot_armbian back with the 20.08 test.
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Willian Rampazzo <willianr@redhat.com>
-Message-id: 20210310195820.21950-3-nieklinnenbank@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/acceptance/boot_linux_console.py | 72 ++++++++------------------
-file changed, 23 insertions(+), 49 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
-+++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):
-         # Wait for VM to shut down gracefully
-         self.vm.wait()
--    def do_test_arm_orangepi_uboot_armbian(self, image_path):
-+    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
-+                'Test artifacts fetched from unreliable apt.armbian.com')
-+    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
-+    def test_arm_orangepi_bionic_20_08(self):
-+        """
-+        :avocado: tags=arch:arm
-+        :avocado: tags=machine:orangepi-pc
-+        :avocado: tags=device:sd
-+        """
-+
-+        # This test download a 275 MiB compressed image and expand it
-+        # to 1036 MiB, but the underlying filesystem is 1552 MiB...
-+        # As we expand it to 2 GiB we are safe.
-+
-+        image_url = ('https://dl.armbian.com/orangepipc/archive/'
-+                     'Armbian_20.08.1_Orangepipc_bionic_current_5.8.5.img.xz')
-+        image_hash = ('b4d6775f5673486329e45a0586bf06b6'
-+                      'dbe792199fd182ac6b9c7bb6c7d3e6dd')
-+        image_path_xz = self.fetch_asset(image_url, asset_hash=image_hash,
-+                                         algorithm='sha256')
-+        image_path = archive.extract(image_path_xz, self.workdir)
-+        image_pow2ceil_expand(image_path)
-+
-         self.vm.set_console()
-         self.vm.add_args('-drive', 'file=' + image_path + ',if=sd,format=raw',
-                          '-nic', 'user',
-@@ -XXX,XX +XXX,XX @@ def do_test_arm_orangepi_uboot_armbian(self, image_path):
-                                       'to <orangepipc>')
-         self.wait_for_console_pattern('Starting Load Kernel Modules...')
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
--    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
--    @skipUnless(P7ZIP_AVAILABLE, '7z not installed')
--    def test_arm_orangepi_bionic_19_11(self):
--        """
--        :avocado: tags=arch:arm
--        :avocado: tags=machine:orangepi-pc
--        :avocado: tags=device:sd
--        """
--
--        # This test download a 196MB compressed image and expand it to 1GB
--        image_url = ('https://dl.armbian.com/orangepipc/archive/'
--                     'Armbian_19.11.3_Orangepipc_bionic_current_5.3.9.7z')
--        image_hash = '196a8ffb72b0123d92cea4a070894813d305c71e'
--        image_path_7z = self.fetch_asset(image_url, asset_hash=image_hash)
--        image_name = 'Armbian_19.11.3_Orangepipc_bionic_current_5.3.9.img'
--        image_path = os.path.join(self.workdir, image_name)
--        process.run("7z e -o%s %s" % (self.workdir, image_path_7z))
--        image_pow2ceil_expand(image_path)
--
--        self.do_test_arm_orangepi_uboot_armbian(image_path)
--
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
--    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
--    def test_arm_orangepi_bionic_20_08(self):
--        """
--        :avocado: tags=arch:arm
--        :avocado: tags=machine:orangepi-pc
--        :avocado: tags=device:sd
--        """
--
--        # This test download a 275 MiB compressed image and expand it
--        # to 1036 MiB, but the underlying filesystem is 1552 MiB...
--        # As we expand it to 2 GiB we are safe.
--
--        image_url = ('https://dl.armbian.com/orangepipc/archive/'
--                     'Armbian_20.08.1_Orangepipc_bionic_current_5.8.5.img.xz')
--        image_hash = ('b4d6775f5673486329e45a0586bf06b6'
--                      'dbe792199fd182ac6b9c7bb6c7d3e6dd')
--        image_path_xz = self.fetch_asset(image_url, asset_hash=image_hash,
--                                         algorithm='sha256')
--        image_path = archive.extract(image_path_xz, self.workdir)
--        image_pow2ceil_expand(image_path)
--
--        self.do_test_arm_orangepi_uboot_armbian(image_path)
--
-     @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
-     def test_arm_orangepi_uboot_netbsd9(self):
-         """
---
-.20.1

-[PULL 20/39] tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08
+Deleted patch
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Update the download URL of the Armbian 20.08 Bionic image for
-test_arm_orangepi_bionic_20_08 of the orangepi-pc machine.
-The archive.armbian.com URL contains more images and should keep stable
-for a longer period of time than dl.armbian.com.
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Willian Rampazzo <willianr@redhat.com>
-Message-id: 20210310195820.21950-4-nieklinnenbank@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/acceptance/boot_linux_console.py | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
-+++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_bionic_20_08(self):
-         # to 1036 MiB, but the underlying filesystem is 1552 MiB...
-         # As we expand it to 2 GiB we are safe.
--        image_url = ('https://dl.armbian.com/orangepipc/archive/'
-+        image_url = ('https://archive.armbian.com/orangepipc/archive/'
-                      'Armbian_20.08.1_Orangepipc_bionic_current_5.8.5.img.xz')
-         image_hash = ('b4d6775f5673486329e45a0586bf06b6'
-                       'dbe792199fd182ac6b9c7bb6c7d3e6dd')
---
-.20.1

-[PULL 21/39] tests/acceptance: update sunxi kernel from armbian to 5.10.16
+Deleted patch
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The linux kernel 4.20.7 binary for sunxi has been removed from apt.armbian.com:
-  $ ARMBIAN_ARTIFACTS_CACHED=yes AVOCADO_ALLOW_LARGE_STORAGE=yes avocado --show=app,console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
-  Fetching asset from tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi
-  ...
-  (1/6) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
-    CANCEL: Missing asset https://apt.armbian.com/pool/main/l/linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb (0.55 s)
-This commit updates the sunxi kernel to 5.10.16 for the acceptance
-tests of the orangepi-pc and cubieboard machines.
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Willian Rampazzo <willianr@redhat.com>
-Message-id: 20210310195820.21950-5-nieklinnenbank@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/acceptance/boot_linux_console.py | 40 +++++++++++++-------------
- tests/acceptance/replay_kernel.py      |  8 +++---
-files changed, 24 insertions(+), 24 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
-+++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
-         :avocado: tags=machine:cubieboard
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
-                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_sata(self):
-         :avocado: tags=machine:cubieboard
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
-                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi(self):
-         :avocado: tags=machine:orangepi-pc
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         self.vm.set_console()
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_initrd(self):
-         :avocado: tags=machine:orangepi-pc
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
-                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):
-         :avocado: tags=device:sd
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'
-                       'kci-2019.02/armel/base/rootfs.ext2.xz')
-diff --git a/tests/acceptance/replay_kernel.py b/tests/acceptance/replay_kernel.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/replay_kernel.py
-+++ b/tests/acceptance/replay_kernel.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
-         :avocado: tags=machine:cubieboard
-         """
-         deb_url = ('https://apt.armbian.com/pool/main/l/'
--                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
--        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
-+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
-         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-         kernel_path = self.extract_from_deb(deb_path,
--                                            '/boot/vmlinuz-4.20.7-sunxi')
--        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
-+                                            '/boot/vmlinuz-5.10.16-sunxi')
-+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
-         dtb_path = self.extract_from_deb(deb_path, dtb_path)
-         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
-                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
---
-.20.1

-[PULL 22/39] tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests
+Deleted patch
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Previously the ARMBIAN_ARTIFACTS_CACHED pre-condition was added to allow running
-tests that have already existing armbian.com artifacts stored in the local avocado cache,
-but do not have working URLs to download a fresh copy.
-At this time of writing the URLs for artifacts on the armbian.com server are updated and working.
-Any future broken URLs will result in a skipped acceptance test, for example:
- (1/5) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
-  CANCEL: Missing asset https://apt.armbian.com/pool/main/l/linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb (0.53 s)
-This commits removes the ARMBIAN_ARTIFACTS_CACHED pre-condition such that
-the acceptance tests for the orangepi-pc and cubieboard machines can run.
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Willian Rampazzo <willianr@redhat.com>
-Message-id: 20210310195820.21950-6-nieklinnenbank@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/acceptance/boot_linux_console.py | 12 ------------
- tests/acceptance/replay_kernel.py      |  2 --
-files changed, 14 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
-+++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_exynos4210_initrd(self):
-         self.wait_for_console_pattern('Boot successful.')
-         # TODO user command, for now the uart is stuck
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_cubieboard_initrd(self):
-         """
-         :avocado: tags=arch:arm
-@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
-                                                 'system-control@1c00000')
-         # cubieboard's reboot is not functioning; omit reboot test.
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_cubieboard_sata(self):
-         """
-         :avocado: tags=arch:arm
-@@ -XXX,XX +XXX,XX @@ def test_arm_quanta_gsj_initrd(self):
-         self.wait_for_console_pattern(
-                 'Give root password for system maintenance')
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_orangepi(self):
-         """
-         :avocado: tags=arch:arm
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi(self):
-         console_pattern = 'Kernel command line: %s' % kernel_command_line
-         self.wait_for_console_pattern(console_pattern)
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_orangepi_initrd(self):
-         """
-         :avocado: tags=arch:arm
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_initrd(self):
-         # Wait for VM to shut down gracefully
-         self.vm.wait()
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_orangepi_sd(self):
-         """
-         :avocado: tags=arch:arm
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):
-         # Wait for VM to shut down gracefully
-         self.vm.wait()
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
-     def test_arm_orangepi_bionic_20_08(self):
-         """
-diff --git a/tests/acceptance/replay_kernel.py b/tests/acceptance/replay_kernel.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/replay_kernel.py
-+++ b/tests/acceptance/replay_kernel.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_virt(self):
-         self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=1)
-     @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
--    @skipUnless(os.getenv('ARMBIAN_ARTIFACTS_CACHED'),
--                'Test artifacts fetched from unreliable apt.armbian.com')
-     def test_arm_cubieboard_initrd(self):
-         """
-         :avocado: tags=arch:arm
---
-.20.1

-[PULL 31/39] hw/display/pl110: Remove dead code for non-32-bpp surfaces
+[PULL 20/23] target/arm: Remove HOST_BIG_ENDIAN ifdef in add_cpreg_to_hashtable
-For a long time now the UI layer has guaranteed that the console
+From: Richard Henderson <richard.henderson@linaro.org>
 surface is always 32 bits per pixel. Remove the legacy dead
 code from the pl110 display device which was handling the
 possibility that the console surface was some other format.
+Since e03b56863d2bc, our host endian indicator is unconditionally
+set, which means that we can use a normal C condition.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220501055028.646596-20-richard.henderson@linaro.org
+[PMM: quote correct git hash in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-2-peter.maydell@linaro.org
 ---
- hw/display/pl110.c | 53 +++++++---------------------------------------
+ target/arm/helper.c | 9 +++------
-file changed, 8 insertions(+), 45 deletions(-)
+file changed, 3 insertions(+), 6 deletions(-)
-diff --git a/hw/display/pl110.c b/hw/display/pl110.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110.c
+--- a/target/arm/helper.c
-+++ b/hw/display/pl110.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
+@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-     pl111_id
+             r2->type |= ARM_CP_ALIAS;
- };
+         }
--#define BITS 8
+-        if (r->state == ARM_CP_STATE_BOTH) {
--#include "pl110_template.h"
+-#if HOST_BIG_ENDIAN
--#define BITS 15
+-            if (r2->fieldoffset) {
--#include "pl110_template.h"
+-                r2->fieldoffset += sizeof(uint32_t);
--#define BITS 16
+-            }
--#include "pl110_template.h"
+-#endif
--#define BITS 24
++        if (HOST_BIG_ENDIAN &&
--#include "pl110_template.h"
++            r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
- #define BITS 32
++            r2->fieldoffset += sizeof(uint32_t);
  #include "pl110_template.h"
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
      PL110State *s = (PL110State *)opaque;
      SysBusDevice *sbd;
      DisplaySurface *surface = qemu_console_surface(s->con);
 -    drawfn* fntable;
      drawfn fn;
 -    int dest_width;
      int src_width;
      int bpp_offset;
      int first;
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
      sbd = SYS_BUS_DEVICE(s);
 -    switch (surface_bits_per_pixel(surface)) {
 -    case 0:
 -        return;
 -    case 8:
 -        fntable = pl110_draw_fn_8;
 -        dest_width = 1;
 -        break;
 -    case 15:
 -        fntable = pl110_draw_fn_15;
 -        dest_width = 2;
 -        break;
 -    case 16:
 -        fntable = pl110_draw_fn_16;
 -        dest_width = 2;
 -        break;
 -    case 24:
 -        fntable = pl110_draw_fn_24;
 -        dest_width = 3;
 -        break;
 -    case 32:
 -        fntable = pl110_draw_fn_32;
 -        dest_width = 4;
 -        break;
 -    default:
 -        fprintf(stderr, "pl110: Bad color depth\n");
 -        exit(1);
 -    }
      if (s->cr & PL110_CR_BGR)
          bpp_offset = 0;
      else
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
          }
      }
--    if (s->cr & PL110_CR_BEBO)
--        fn = fntable[s->bpp + 8 + bpp_offset];
--    else if (s->cr & PL110_CR_BEPO)
--        fn = fntable[s->bpp + 16 + bpp_offset];
--    else
--        fn = fntable[s->bpp + bpp_offset];
-+    if (s->cr & PL110_CR_BEBO) {
-+        fn = pl110_draw_fn_32[s->bpp + 8 + bpp_offset];
-+    } else if (s->cr & PL110_CR_BEPO) {
-+        fn = pl110_draw_fn_32[s->bpp + 16 + bpp_offset];
-+    } else {
-+        fn = pl110_draw_fn_32[s->bpp + bpp_offset];
-+    }
-     src_width = s->cols;
-     switch (s->bpp) {
-@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
-         src_width <<= 2;
-         break;
-     }
--    dest_width *= s->cols;
-     first = 0;
-     if (s->invalidate) {
-         framebuffer_update_memory_section(&s->fbsection,
-@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
-     framebuffer_update_display(surface, &s->fbsection,
-                                s->cols, s->rows,
--                               src_width, dest_width, 0,
-+                               src_width, s->cols * 4, 0,
-                                s->invalidate,
-                                fn, s->palette,
-                                &first, &last);
 --
-.20.1
+.25.1

-[PULL 29/39] hw/arm: Connect PWM fans in NPCM7XX boards
+[PULL 21/23] target/arm: Add isar predicates for FEAT_Debugv8p2
-From: Hao Wu <wuhaotsh@google.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds fan_splitters (split IRQs) in NPCM7XX boards. Each fan
-splitter corresponds to 1 PWM output and can connect to multiple fan
-inputs (MFT devices).
-In NPCM7XX boards(NPCM750 EVB and Quanta GSJ boards), we initializes
-these splitters and connect them to their corresponding modules
-according their specific device trees.
-Reviewed-by: Doug Evans <dje@google.com>
-Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210311180855.149764-5-wuhaotsh@google.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220501055028.646596-24-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/npcm7xx.h | 11 ++++-
+ target/arm/cpu.h | 15 +++++++++++++++
- hw/arm/npcm7xx_boards.c  | 99 ++++++++++++++++++++++++++++++++++++++++
+file changed, 15 insertions(+)
 files changed, 109 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/npcm7xx.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/arm/npcm7xx.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
+     return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
  #include "hw/boards.h"
  #include "hw/adc/npcm7xx_adc.h"
 +#include "hw/core/split-irq.h"
  #include "hw/cpu/a9mpcore.h"
  #include "hw/gpio/npcm7xx_gpio.h"
  #include "hw/i2c/npcm7xx_smbus.h"
@@ -XXX,XX +XXX,XX @@
  #define NPCM7XX_GIC_CPU_IF_ADDR         (0xf03fe100)  /* GIC within A9 */
  #define NPCM7XX_BOARD_SETUP_ADDR        (0xffff1000)  /* Boot ROM */
 +#define NPCM7XX_NR_PWM_MODULES 2
 +
  typedef struct NPCM7xxMachine {
      MachineState        parent;
 +    /*
 +     * PWM fan splitter. each splitter connects to one PWM output and
 +     * multiple MFT inputs.
 +     */
 +    SplitIRQ            fan_splitter[NPCM7XX_NR_PWM_MODULES *
 +                                     NPCM7XX_PWM_PER_MODULE];
  } NPCM7xxMachine;
  #define TYPE_NPCM7XX_MACHINE MACHINE_TYPE_NAME("npcm7xx")
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
      NPCM7xxCLKState     clk;
      NPCM7xxTimerCtrlState tim[3];
      NPCM7xxADCState     adc;
 -    NPCM7xxPWMState     pwm[2];
 +    NPCM7xxPWMState     pwm[NPCM7XX_NR_PWM_MODULES];
      NPCM7xxMFTState     mft[8];
      NPCM7xxOTPState     key_storage;
      NPCM7xxOTPState     fuse_array;
 diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx_boards.c
 +++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/core/cpu.h"
  #include "hw/i2c/smbus_eeprom.h"
  #include "hw/loader.h"
 +#include "hw/qdev-core.h"
  #include "hw/qdev-properties.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_init(NPCM7xxState *soc, int bus, uint8_t addr,
      i2c_slave_realize_and_unref(i2c_dev, i2c_bus, &error_abort);
  }
-+static void npcm7xx_init_pwm_splitter(NPCM7xxMachine *machine,
++static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
 +                                      NPCM7xxState *soc, const int *fan_counts)
 +{
-+    SplitIRQ *splitters = machine->fan_splitter;
++    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
 +
 +    /*
 +     * PWM 0~3 belong to module 0 output 0~3.
 +     * PWM 4~7 belong to module 1 output 0~3.
 +     */
 +    for (int i = 0; i < NPCM7XX_NR_PWM_MODULES; ++i) {
 +        for (int j = 0; j < NPCM7XX_PWM_PER_MODULE; ++j) {
 +            int splitter_no = i * NPCM7XX_PWM_PER_MODULE + j;
 +            DeviceState *splitter;
 +
 +            if (fan_counts[splitter_no] < 1) {
 +                continue;
 +            }
 +            object_initialize_child(OBJECT(machine), "fan-splitter[*]",
 +                                    &splitters[splitter_no], TYPE_SPLIT_IRQ);
 +            splitter = DEVICE(&splitters[splitter_no]);
 +            qdev_prop_set_uint16(splitter, "num-lines",
 +                                 fan_counts[splitter_no]);
 +            qdev_realize(splitter, NULL, &error_abort);
 +            qdev_connect_gpio_out_named(DEVICE(&soc->pwm[i]), "duty-gpio-out",
 +                                        j, qdev_get_gpio_in(splitter, 0));
 +        }
 +    }
 +}
 +
-+static void npcm7xx_connect_pwm_fan(NPCM7xxState *soc, SplitIRQ *splitter,
+ /*
-+                                    int fan_no, int output_no)
+  * 64-bit feature tests via id registers.
   */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ssbs(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SSBS) != 0;
  }
 +static inline bool isar_feature_aa64_debugv8p2(const ARMISARegisters *id)
 +{
-+    DeviceState *fan;
++    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, DEBUGVER) >= 8;
 +    int fan_input;
 +    qemu_irq fan_duty_gpio;
 +
 +    g_assert(fan_no >= 0 && fan_no <= NPCM7XX_MFT_MAX_FAN_INPUT);
 +    /*
 +     * Fan 0~1 belong to module 0 input 0~1.
 +     * Fan 2~3 belong to module 1 input 0~1.
 +     * ...
 +     * Fan 14~15 belong to module 7 input 0~1.
 +     * Fan 16~17 belong to module 0 input 2~3.
 +     * Fan 18~19 belong to module 1 input 2~3.
 +     */
 +    if (fan_no < 16) {
 +        fan = DEVICE(&soc->mft[fan_no / 2]);
 +        fan_input = fan_no % 2;
 +    } else {
 +        fan = DEVICE(&soc->mft[(fan_no - 16) / 2]);
 +        fan_input = fan_no % 2 + 2;
 +    }
 +
 +    /* Connect the Fan to PWM module */
 +    fan_duty_gpio = qdev_get_gpio_in_named(fan, "duty", fan_input);
 +    qdev_connect_gpio_out(DEVICE(splitter), output_no, fan_duty_gpio);
 +}
 +
- static void npcm750_evb_i2c_init(NPCM7xxState *soc)
+ static inline bool isar_feature_aa64_sve2(const ARMISARegisters *id)
  {
-     /* lm75 temperature sensor on SVB, tmp105 is compatible */
+     return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SVEVER) != 0;
-@@ -XXX,XX +XXX,XX @@ static void npcm750_evb_i2c_init(NPCM7xxState *soc)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_tts2uxn(const ARMISARegisters *id)
-     i2c_slave_create_simple(npcm7xx_i2c_get_bus(soc, 6), "tmp105", 0x48);
+     return isar_feature_aa64_tts2uxn(id) || isar_feature_aa32_tts2uxn(id);
  }
-+static void npcm750_evb_fan_init(NPCM7xxMachine *machine, NPCM7xxState *soc)
++static inline bool isar_feature_any_debugv8p2(const ARMISARegisters *id)
 +{
-+    SplitIRQ *splitter = machine->fan_splitter;
++    return isar_feature_aa64_debugv8p2(id) || isar_feature_aa32_debugv8p2(id);
 +    static const int fan_counts[] = {2, 2, 2, 2, 2, 2, 2, 2};
 +
 +    npcm7xx_init_pwm_splitter(machine, soc, fan_counts);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x00, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x01, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x02, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x03, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x04, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x05, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[3], 0x06, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[3], 0x07, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[4], 0x08, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[4], 0x09, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[5], 0x0a, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[5], 0x0b, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[6], 0x0c, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[6], 0x0d, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[7], 0x0e, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[7], 0x0f, 1);
 +}
 +
- static void quanta_gsj_i2c_init(NPCM7xxState *soc)
+ /*
- {
+  * Forward to the above feature tests given an ARMCPU pointer.
-     /* GSJ machine have 4 max31725 temperature sensors, tmp105 is compatible. */
+  */
@@ -XXX,XX +XXX,XX @@ static void quanta_gsj_i2c_init(NPCM7xxState *soc)
      /* TODO: Add additional i2c devices. */
  }
 +static void quanta_gsj_fan_init(NPCM7xxMachine *machine, NPCM7xxState *soc)
 +{
 +    SplitIRQ *splitter = machine->fan_splitter;
 +    static const int fan_counts[] = {2, 2, 2, 0, 0, 0, 0, 0};
 +
 +    npcm7xx_init_pwm_splitter(machine, soc, fan_counts);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x00, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x01, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x02, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x03, 1);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x04, 0);
 +    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x05, 1);
 +}
 +
  static void npcm750_evb_init(MachineState *machine)
  {
      NPCM7xxState *soc;
@@ -XXX,XX +XXX,XX @@ static void npcm750_evb_init(MachineState *machine)
      npcm7xx_load_bootrom(machine, soc);
      npcm7xx_connect_flash(&soc->fiu[0], 0, "w25q256", drive_get(IF_MTD, 0, 0));
      npcm750_evb_i2c_init(soc);
 +    npcm750_evb_fan_init(NPCM7XX_MACHINE(machine), soc);
      npcm7xx_load_kernel(machine, soc);
  }
@@ -XXX,XX +XXX,XX @@ static void quanta_gsj_init(MachineState *machine)
      npcm7xx_connect_flash(&soc->fiu[0], 0, "mx25l25635e",
                            drive_get(IF_MTD, 0, 0));
      quanta_gsj_i2c_init(soc);
 +    quanta_gsj_fan_init(NPCM7XX_MACHINE(machine), soc);
      npcm7xx_load_kernel(machine, soc);
  }
 --
-.20.1
+.25.1

-[PULL 30/39] tests/qtest: Test PWM fan RPM using MFT in PWM test
+[PULL 22/23] target/arm: Add isar_feature_{aa64,any}_ras
-From: Hao Wu <wuhaotsh@google.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds testing of PWM fan RPMs in the existing npcm7xx pwm
+Add the aa64 predicate for detecting RAS support from id registers.
-test. It tests whether the MFT module can measure correct fan values
+We already have the aa32 version from the M-profile work.
-for a PWM fan in NPCM7XX boards.
+Add the 'any' predicate for testing both aa64 and aa32.
-Reviewed-by: Doug Evans <dje@google.com>
-Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210311180855.149764-6-wuhaotsh@google.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220501055028.646596-34-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/npcm7xx_pwm-test.c | 205 ++++++++++++++++++++++++++++++++-
+ target/arm/cpu.h | 10 ++++++++++
-file changed, 199 insertions(+), 6 deletions(-)
+file changed, 10 insertions(+)
-diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_pwm-test.c
+--- a/target/arm/cpu.h
-+++ b/tests/qtest/npcm7xx_pwm-test.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
- #define PLL_FBDV(rv)    extract32((rv), 16, 12)
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
  #define PLL_OTDV1(rv)   extract32((rv), 8, 3)
  #define PLL_OTDV2(rv)   extract32((rv), 13, 3)
 +#define APB4CKDIV(rv)   extract32((rv), 30, 2)
  #define APB3CKDIV(rv)   extract32((rv), 28, 2)
  #define CLK2CKDIV(rv)   extract32((rv), 0, 1)
  #define CLK4CKDIV(rv)   extract32((rv), 26, 2)
@@ -XXX,XX +XXX,XX @@
  #define MAX_DUTY        1000000
 +/* MFT (PWM fan) related */
 +#define MFT_BA(n)       (0xf0180000 + ((n) * 0x1000))
 +#define MFT_IRQ(n)      (96 + (n))
 +#define MFT_CNT1        0x00
 +#define MFT_CRA         0x02
 +#define MFT_CRB         0x04
 +#define MFT_CNT2        0x06
 +#define MFT_PRSC        0x08
 +#define MFT_CKC         0x0a
 +#define MFT_MCTRL       0x0c
 +#define MFT_ICTRL       0x0e
 +#define MFT_ICLR        0x10
 +#define MFT_IEN         0x12
 +#define MFT_CPA         0x14
 +#define MFT_CPB         0x16
 +#define MFT_CPCFG       0x18
 +#define MFT_INASEL      0x1a
 +#define MFT_INBSEL      0x1c
 +
 +#define MFT_MCTRL_ALL   0x64
 +#define MFT_ICLR_ALL    0x3f
 +#define MFT_IEN_ALL     0x3f
 +#define MFT_CPCFG_EQ_MODE 0x44
 +
 +#define MFT_CKC_C2CSEL  BIT(3)
 +#define MFT_CKC_C1CSEL  BIT(0)
 +
 +#define MFT_ICTRL_TFPND BIT(5)
 +#define MFT_ICTRL_TEPND BIT(4)
 +#define MFT_ICTRL_TDPND BIT(3)
 +#define MFT_ICTRL_TCPND BIT(2)
 +#define MFT_ICTRL_TBPND BIT(1)
 +#define MFT_ICTRL_TAPND BIT(0)
 +
 +#define MFT_MAX_CNT     0xffff
 +#define MFT_TIMEOUT     0x5000
 +
 +#define DEFAULT_RPM     19800
 +#define DEFAULT_PRSC    255
 +#define MFT_PULSE_PER_REVOLUTION 2
 +
 +#define MAX_ERROR       1
 +
  typedef struct PWMModule {
      int irq;
      uint64_t base_addr;
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_get_duty(QTestState *qts, int module_index, int pwm_index)
      return pwm_qom_get(qts, path, name);
  }
-+static void mft_qom_set(QTestState *qts, int index, const char *name,
++static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
 +                        uint32_t value)
 +{
-+    QDict *response;
++    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
 +    char *path = g_strdup_printf("/machine/soc/mft[%d]", index);
 +
 +    g_test_message("Setting properties %s of mft[%d] with value %u",
 +                   name, index, value);
 +    response = qtest_qmp(qts, "{ 'execute': 'qom-set',"
 +            " 'arguments': { 'path': %s, "
 +            " 'property': %s, 'value': %u}}",
 +            path, name, value);
 +    /* The qom set message returns successfully. */
 +    g_assert_true(qdict_haskey(response, "return"));
 +}
 +
- static uint32_t get_pll(uint32_t con)
+ static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
  {
-     return REF_HZ * PLL_FBDV(con) / (PLL_INDV(con) * PLL_OTDV1(con)
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
-             * PLL_OTDV2(con));
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_debugv8p2(const ARMISARegisters *id)
      return isar_feature_aa64_debugv8p2(id) || isar_feature_aa32_debugv8p2(id);
  }
--static uint64_t read_pclk(QTestState *qts)
++static inline bool isar_feature_any_ras(const ARMISARegisters *id)
 +static uint64_t read_pclk(QTestState *qts, bool mft)
  {
      uint64_t freq = REF_HZ;
      uint32_t clksel = qtest_readl(qts, CLK_BA + CLKSEL);
      uint32_t pllcon;
      uint32_t clkdiv1 = qtest_readl(qts, CLK_BA + CLKDIV1);
      uint32_t clkdiv2 = qtest_readl(qts, CLK_BA + CLKDIV2);
 +    uint32_t apbdiv = mft ? APB4CKDIV(clkdiv2) : APB3CKDIV(clkdiv2);
      switch (CPUCKSEL(clksel)) {
      case 0:
@@ -XXX,XX +XXX,XX @@ static uint64_t read_pclk(QTestState *qts)
          g_assert_not_reached();
      }
 -    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + APB3CKDIV(clkdiv2));
 +    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + apbdiv);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t pwm_selector(uint32_t csr)
  static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
          uint32_t cnr)
  {
 -    return read_pclk(qts) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
 +    return read_pclk(qts, false) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
  }
  static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
@@ -XXX,XX +XXX,XX @@ static void pwm_write(QTestState *qts, const TestData *td, unsigned offset,
      qtest_writel(qts, td->module->base_addr + offset, value);
  }
 +static uint8_t mft_readb(QTestState *qts, int index, unsigned offset)
 +{
-+    return qtest_readb(qts, MFT_BA(index) + offset);
++    return isar_feature_aa64_ras(id) || isar_feature_aa32_ras(id);
 +}
 +
-+static uint16_t mft_readw(QTestState *qts, int index, unsigned offset)
+ /*
-+{
+  * Forward to the above feature tests given an ARMCPU pointer.
-+    return qtest_readw(qts, MFT_BA(index) + offset);
+  */
 +}
 +
 +static void mft_writeb(QTestState *qts, int index, unsigned offset,
 +                        uint8_t value)
 +{
 +    qtest_writeb(qts, MFT_BA(index) + offset, value);
 +}
 +
 +static void mft_writew(QTestState *qts, int index, unsigned offset,
 +                        uint16_t value)
 +{
 +    return qtest_writew(qts, MFT_BA(index) + offset, value);
 +}
 +
  static uint32_t pwm_read_ppr(QTestState *qts, const TestData *td)
  {
      return extract32(pwm_read(qts, td, PPR), ppr_base[pwm_index(td->pwm)], 8);
@@ -XXX,XX +XXX,XX @@ static void pwm_write_cmr(QTestState *qts, const TestData *td, uint32_t value)
      pwm_write(qts, td, td->pwm->cmr_offset, value);
  }
 +static int mft_compute_index(const TestData *td)
 +{
 +    int index = pwm_module_index(td->module) * ARRAY_SIZE(pwm_list) +
 +                pwm_index(td->pwm);
 +
 +    g_assert_cmpint(index, <,
 +                    ARRAY_SIZE(pwm_module_list) * ARRAY_SIZE(pwm_list));
 +
 +    return index;
 +}
 +
 +static void mft_reset_counters(QTestState *qts, int index)
 +{
 +    mft_writew(qts, index, MFT_CNT1, MFT_MAX_CNT);
 +    mft_writew(qts, index, MFT_CNT2, MFT_MAX_CNT);
 +    mft_writew(qts, index, MFT_CRA, MFT_MAX_CNT);
 +    mft_writew(qts, index, MFT_CRB, MFT_MAX_CNT);
 +    mft_writew(qts, index, MFT_CPA, MFT_MAX_CNT - MFT_TIMEOUT);
 +    mft_writew(qts, index, MFT_CPB, MFT_MAX_CNT - MFT_TIMEOUT);
 +}
 +
 +static void mft_init(QTestState *qts, const TestData *td)
 +{
 +    int index = mft_compute_index(td);
 +
 +    /* Enable everything */
 +    mft_writeb(qts, index, MFT_CKC, 0);
 +    mft_writeb(qts, index, MFT_ICLR, MFT_ICLR_ALL);
 +    mft_writeb(qts, index, MFT_MCTRL, MFT_MCTRL_ALL);
 +    mft_writeb(qts, index, MFT_IEN, MFT_IEN_ALL);
 +    mft_writeb(qts, index, MFT_INASEL, 0);
 +    mft_writeb(qts, index, MFT_INBSEL, 0);
 +
 +    /* Set cpcfg to use EQ mode, same as kernel driver */
 +    mft_writeb(qts, index, MFT_CPCFG, MFT_CPCFG_EQ_MODE);
 +
 +    /* Write default counters, timeout and prescaler */
 +    mft_reset_counters(qts, index);
 +    mft_writeb(qts, index, MFT_PRSC, DEFAULT_PRSC);
 +
 +    /* Write default max rpm via QMP */
 +    mft_qom_set(qts, index, "max_rpm[0]", DEFAULT_RPM);
 +    mft_qom_set(qts, index, "max_rpm[1]", DEFAULT_RPM);
 +}
 +
 +static int32_t mft_compute_cnt(uint32_t rpm, uint64_t clk)
 +{
 +    uint64_t cnt;
 +
 +    if (rpm == 0) {
 +        return -1;
 +    }
 +
 +    cnt = clk * 60 / ((DEFAULT_PRSC + 1) * rpm * MFT_PULSE_PER_REVOLUTION);
 +    if (cnt >= MFT_TIMEOUT) {
 +        return -1;
 +    }
 +    return MFT_MAX_CNT - cnt;
 +}
 +
 +static void mft_verify_rpm(QTestState *qts, const TestData *td, uint64_t duty)
 +{
 +    int index = mft_compute_index(td);
 +    uint16_t cnt, cr;
 +    uint32_t rpm = DEFAULT_RPM * duty / MAX_DUTY;
 +    uint64_t clk = read_pclk(qts, true);
 +    int32_t expected_cnt = mft_compute_cnt(rpm, clk);
 +
 +    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
 +    g_test_message(
 +        "verifying rpm for mft[%d]: clk: %lu, duty: %lu, rpm: %u, cnt: %d",
 +        index, clk, duty, rpm, expected_cnt);
 +
 +    /* Verify rpm for fan A */
 +    /* Stop capture */
 +    mft_writeb(qts, index, MFT_CKC, 0);
 +    mft_writeb(qts, index, MFT_ICLR, MFT_ICLR_ALL);
 +    mft_reset_counters(qts, index);
 +    g_assert_cmphex(mft_readw(qts, index, MFT_CNT1), ==, MFT_MAX_CNT);
 +    g_assert_cmphex(mft_readw(qts, index, MFT_CRA), ==, MFT_MAX_CNT);
 +    g_assert_cmphex(mft_readw(qts, index, MFT_CPA), ==,
 +                    MFT_MAX_CNT - MFT_TIMEOUT);
 +    /* Start capture */
 +    mft_writeb(qts, index, MFT_CKC, MFT_CKC_C1CSEL);
 +    g_assert_true(qtest_get_irq(qts, MFT_IRQ(index)));
 +    if (expected_cnt == -1) {
 +        g_assert_cmphex(mft_readb(qts, index, MFT_ICTRL), ==, MFT_ICTRL_TEPND);
 +    } else {
 +        g_assert_cmphex(mft_readb(qts, index, MFT_ICTRL), ==, MFT_ICTRL_TAPND);
 +        cnt = mft_readw(qts, index, MFT_CNT1);
 +        /*
 +         * Due to error in clock measurement and rounding, we might have a small
 +         * error in measuring RPM.
 +         */
 +        g_assert_cmphex(cnt + MAX_ERROR, >=, expected_cnt);
 +        g_assert_cmphex(cnt, <=, expected_cnt + MAX_ERROR);
 +        cr = mft_readw(qts, index, MFT_CRA);
 +        g_assert_cmphex(cnt, ==, cr);
 +    }
 +
 +    /* Verify rpm for fan B */
 +
 +    qtest_irq_intercept_out(qts, "/machine/soc/a9mpcore/gic");
 +}
 +
  /* Check pwm registers can be reset to default value */
  static void test_init(gconstpointer test_data)
  {
      const TestData *td = test_data;
 -    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    QTestState *qts = qtest_init("-machine npcm750-evb");
      int module = pwm_module_index(td->module);
      int pwm = pwm_index(td->pwm);
@@ -XXX,XX +XXX,XX @@ static void test_init(gconstpointer test_data)
  static void test_oneshot(gconstpointer test_data)
  {
      const TestData *td = test_data;
 -    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    QTestState *qts = qtest_init("-machine npcm750-evb");
      int module = pwm_module_index(td->module);
      int pwm = pwm_index(td->pwm);
      uint32_t ppr, csr, pcr;
@@ -XXX,XX +XXX,XX @@ static void test_oneshot(gconstpointer test_data)
  static void test_toggle(gconstpointer test_data)
  {
      const TestData *td = test_data;
 -    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    QTestState *qts = qtest_init("-machine npcm750-evb");
      int module = pwm_module_index(td->module);
      int pwm = pwm_index(td->pwm);
      uint32_t ppr, csr, pcr, cnr, cmr;
      int i, j, k, l;
      uint64_t expected_freq, expected_duty;
 +    mft_init(qts, td);
 +
      pcr = CH_EN | CH_MOD;
      for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
          ppr = ppr_list[i];
@@ -XXX,XX +XXX,XX @@ static void test_toggle(gconstpointer test_data)
                                  ==, expected_freq);
                      }
 +                    /* Test MFT's RPM is correct. */
 +                    mft_verify_rpm(qts, td, expected_duty);
 +
                      /* Test inverted mode */
                      expected_duty = pwm_compute_duty(cnr, cmr, true);
                      pwm_write_pcr(qts, td, pcr | CH_INV);
 --
-.20.1
+.25.1

-[PULL 23/39] hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
+[PULL 23/23] target/arm: read access to performance counters from EL0
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Alex Zuepke <alex.zuepke@tum.de>
-If the SSECounter link is absent, we set an error message
+The ARMv8 manual defines that PMUSERENR_EL0.ER enables read-access
-in sse_timer_realize() but forgot to propagate this error.
+to both PMXEVCNTR_EL0 and PMEVCNTR<n>_EL0 registers, however,
-Add the missing 'return'.
+we only use it for PMXEVCNTR_EL0. Extend to PMEVCNTR<n>_EL0 as well.
-Fixes: CID 1450755 (Null pointer dereferences)
+Signed-off-by: Alex Zuepke <alex.zuepke@tum.de>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210312001845.1562670-1-f4bug@amsat.org
+Message-id: 20220428132717.84190-1-alex.zuepke@tum.de
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/sse-timer.c | 1 +
+ target/arm/helper.c | 4 ++--
-file changed, 1 insertion(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/sse-timer.c b/hw/timer/sse-timer.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/sse-timer.c
+--- a/target/arm/helper.c
-+++ b/hw/timer/sse-timer.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void sse_timer_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
+               .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
-     if (!s->counter) {
+               .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
-         error_setg(errp, "counter property was not set");
+               .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-+        return;
+-              .accessfn = pmreg_access },
-     }
++              .accessfn = pmreg_access_xevcntr },
+             { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
-     s->counter_notifier.notify = sse_timer_counter_callback;
+               .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
 -              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
 +              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr,
                .type = ARM_CP_IO,
                .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
                .raw_readfn = pmevcntr_rawread,
 --
-.20.1
+.25.1

-[PULL 32/39] hw/display/pl110: Pull included-once parts of template header into pl110.c
+Deleted patch
-The pl110_template.h header has a doubly-nested multiple-include pattern:
- * pl110.c includes it once for each host bit depth (now always 32)
- * every time it is included, it includes itself 6 times, to account
-   for multiple guest device pixel and byte orders
-Now we only have to deal with 32-bit host bit depths, we can move the
-code corresponding to the outer layer of this double-nesting to be
-directly in pl110.c and reduce the template header to a single layer
-of nesting.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-3-peter.maydell@linaro.org
----
- hw/display/pl110_template.h | 100 +-----------------------------------
- hw/display/pl110.c          |  79 ++++++++++++++++++++++++++++
-files changed, 80 insertions(+), 99 deletions(-)
-diff --git a/hw/display/pl110_template.h b/hw/display/pl110_template.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110_template.h
-+++ b/hw/display/pl110_template.h
-@@ -XXX,XX +XXX,XX @@
-  */
- #ifndef ORDER
--
--#if BITS == 8
--#define COPY_PIXEL(to, from) *(to++) = from
--#elif BITS == 15 || BITS == 16
--#define COPY_PIXEL(to, from) do { *(uint16_t *)to = from; to += 2; } while (0)
--#elif BITS == 24
--#define COPY_PIXEL(to, from)    \
--    do {                        \
--        *(to++) = from;         \
--        *(to++) = (from) >> 8;  \
--        *(to++) = (from) >> 16; \
--    } while (0)
--#elif BITS == 32
--#define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
--#else
--#error unknown bit depth
-+#error "pl110_template.h is only for inclusion by pl110.c"
- #endif
--#undef RGB
--#define BORDER bgr
--#define ORDER 0
--#include "pl110_template.h"
--#define ORDER 1
--#include "pl110_template.h"
--#define ORDER 2
--#include "pl110_template.h"
--#undef BORDER
--#define RGB
--#define BORDER rgb
--#define ORDER 0
--#include "pl110_template.h"
--#define ORDER 1
--#include "pl110_template.h"
--#define ORDER 2
--#include "pl110_template.h"
--#undef BORDER
--
--static drawfn glue(pl110_draw_fn_,BITS)[48] =
--{
--    glue(pl110_draw_line1_lblp_bgr,BITS),
--    glue(pl110_draw_line2_lblp_bgr,BITS),
--    glue(pl110_draw_line4_lblp_bgr,BITS),
--    glue(pl110_draw_line8_lblp_bgr,BITS),
--    glue(pl110_draw_line16_555_lblp_bgr,BITS),
--    glue(pl110_draw_line32_lblp_bgr,BITS),
--    glue(pl110_draw_line16_lblp_bgr,BITS),
--    glue(pl110_draw_line12_lblp_bgr,BITS),
--
--    glue(pl110_draw_line1_bbbp_bgr,BITS),
--    glue(pl110_draw_line2_bbbp_bgr,BITS),
--    glue(pl110_draw_line4_bbbp_bgr,BITS),
--    glue(pl110_draw_line8_bbbp_bgr,BITS),
--    glue(pl110_draw_line16_555_bbbp_bgr,BITS),
--    glue(pl110_draw_line32_bbbp_bgr,BITS),
--    glue(pl110_draw_line16_bbbp_bgr,BITS),
--    glue(pl110_draw_line12_bbbp_bgr,BITS),
--
--    glue(pl110_draw_line1_lbbp_bgr,BITS),
--    glue(pl110_draw_line2_lbbp_bgr,BITS),
--    glue(pl110_draw_line4_lbbp_bgr,BITS),
--    glue(pl110_draw_line8_lbbp_bgr,BITS),
--    glue(pl110_draw_line16_555_lbbp_bgr,BITS),
--    glue(pl110_draw_line32_lbbp_bgr,BITS),
--    glue(pl110_draw_line16_lbbp_bgr,BITS),
--    glue(pl110_draw_line12_lbbp_bgr,BITS),
--
--    glue(pl110_draw_line1_lblp_rgb,BITS),
--    glue(pl110_draw_line2_lblp_rgb,BITS),
--    glue(pl110_draw_line4_lblp_rgb,BITS),
--    glue(pl110_draw_line8_lblp_rgb,BITS),
--    glue(pl110_draw_line16_555_lblp_rgb,BITS),
--    glue(pl110_draw_line32_lblp_rgb,BITS),
--    glue(pl110_draw_line16_lblp_rgb,BITS),
--    glue(pl110_draw_line12_lblp_rgb,BITS),
--
--    glue(pl110_draw_line1_bbbp_rgb,BITS),
--    glue(pl110_draw_line2_bbbp_rgb,BITS),
--    glue(pl110_draw_line4_bbbp_rgb,BITS),
--    glue(pl110_draw_line8_bbbp_rgb,BITS),
--    glue(pl110_draw_line16_555_bbbp_rgb,BITS),
--    glue(pl110_draw_line32_bbbp_rgb,BITS),
--    glue(pl110_draw_line16_bbbp_rgb,BITS),
--    glue(pl110_draw_line12_bbbp_rgb,BITS),
--
--    glue(pl110_draw_line1_lbbp_rgb,BITS),
--    glue(pl110_draw_line2_lbbp_rgb,BITS),
--    glue(pl110_draw_line4_lbbp_rgb,BITS),
--    glue(pl110_draw_line8_lbbp_rgb,BITS),
--    glue(pl110_draw_line16_555_lbbp_rgb,BITS),
--    glue(pl110_draw_line32_lbbp_rgb,BITS),
--    glue(pl110_draw_line16_lbbp_rgb,BITS),
--    glue(pl110_draw_line12_lbbp_rgb,BITS),
--};
--
--#undef BITS
--#undef COPY_PIXEL
--
--#else
--
- #if ORDER == 0
- #define NAME glue(glue(lblp_, BORDER), BITS)
- #ifdef HOST_WORDS_BIGENDIAN
-@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line12_,NAME)(void *opaque, uint8_t *d, const uint8_
- #undef NAME
- #undef SWAP_WORDS
- #undef ORDER
--
--#endif
-diff --git a/hw/display/pl110.c b/hw/display/pl110.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110.c
-+++ b/hw/display/pl110.c
-@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
- };
- #define BITS 32
-+#define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
-+
-+#undef RGB
-+#define BORDER bgr
-+#define ORDER 0
- #include "pl110_template.h"
-+#define ORDER 1
-+#include "pl110_template.h"
-+#define ORDER 2
-+#include "pl110_template.h"
-+#undef BORDER
-+#define RGB
-+#define BORDER rgb
-+#define ORDER 0
-+#include "pl110_template.h"
-+#define ORDER 1
-+#include "pl110_template.h"
-+#define ORDER 2
-+#include "pl110_template.h"
-+#undef BORDER
-+
-+static drawfn pl110_draw_fn_32[48] = {
-+    pl110_draw_line1_lblp_bgr32,
-+    pl110_draw_line2_lblp_bgr32,
-+    pl110_draw_line4_lblp_bgr32,
-+    pl110_draw_line8_lblp_bgr32,
-+    pl110_draw_line16_555_lblp_bgr32,
-+    pl110_draw_line32_lblp_bgr32,
-+    pl110_draw_line16_lblp_bgr32,
-+    pl110_draw_line12_lblp_bgr32,
-+
-+    pl110_draw_line1_bbbp_bgr32,
-+    pl110_draw_line2_bbbp_bgr32,
-+    pl110_draw_line4_bbbp_bgr32,
-+    pl110_draw_line8_bbbp_bgr32,
-+    pl110_draw_line16_555_bbbp_bgr32,
-+    pl110_draw_line32_bbbp_bgr32,
-+    pl110_draw_line16_bbbp_bgr32,
-+    pl110_draw_line12_bbbp_bgr32,
-+
-+    pl110_draw_line1_lbbp_bgr32,
-+    pl110_draw_line2_lbbp_bgr32,
-+    pl110_draw_line4_lbbp_bgr32,
-+    pl110_draw_line8_lbbp_bgr32,
-+    pl110_draw_line16_555_lbbp_bgr32,
-+    pl110_draw_line32_lbbp_bgr32,
-+    pl110_draw_line16_lbbp_bgr32,
-+    pl110_draw_line12_lbbp_bgr32,
-+
-+    pl110_draw_line1_lblp_rgb32,
-+    pl110_draw_line2_lblp_rgb32,
-+    pl110_draw_line4_lblp_rgb32,
-+    pl110_draw_line8_lblp_rgb32,
-+    pl110_draw_line16_555_lblp_rgb32,
-+    pl110_draw_line32_lblp_rgb32,
-+    pl110_draw_line16_lblp_rgb32,
-+    pl110_draw_line12_lblp_rgb32,
-+
-+    pl110_draw_line1_bbbp_rgb32,
-+    pl110_draw_line2_bbbp_rgb32,
-+    pl110_draw_line4_bbbp_rgb32,
-+    pl110_draw_line8_bbbp_rgb32,
-+    pl110_draw_line16_555_bbbp_rgb32,
-+    pl110_draw_line32_bbbp_rgb32,
-+    pl110_draw_line16_bbbp_rgb32,
-+    pl110_draw_line12_bbbp_rgb32,
-+
-+    pl110_draw_line1_lbbp_rgb32,
-+    pl110_draw_line2_lbbp_rgb32,
-+    pl110_draw_line4_lbbp_rgb32,
-+    pl110_draw_line8_lbbp_rgb32,
-+    pl110_draw_line16_555_lbbp_rgb32,
-+    pl110_draw_line32_lbbp_rgb32,
-+    pl110_draw_line16_lbbp_rgb32,
-+    pl110_draw_line12_lbbp_rgb32,
-+};
-+
-+#undef BITS
-+#undef COPY_PIXEL
-+
- static int pl110_enabled(PL110State *s)
- {
---
-.20.1

-[PULL 33/39] hw/display/pl110: Remove use of BITS from pl110_template.h
+Deleted patch
-BITS is always 32, so remove all uses of it from the template header,
-by dropping the trailing '32' from the draw function names and
-not constructing the name of rgb_to_pixel32() via the glue() macro.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-4-peter.maydell@linaro.org
----
- hw/display/pl110_template.h |  20 +++----
- hw/display/pl110.c          | 113 ++++++++++++++++++------------------
-files changed, 65 insertions(+), 68 deletions(-)
-diff --git a/hw/display/pl110_template.h b/hw/display/pl110_template.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110_template.h
-+++ b/hw/display/pl110_template.h
-@@ -XXX,XX +XXX,XX @@
- #endif
- #if ORDER == 0
--#define NAME glue(glue(lblp_, BORDER), BITS)
-+#define NAME glue(lblp_, BORDER)
- #ifdef HOST_WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
- #elif ORDER == 1
--#define NAME glue(glue(bbbp_, BORDER), BITS)
-+#define NAME glue(bbbp_, BORDER)
- #ifndef HOST_WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
- #else
- #define SWAP_PIXELS 1
--#define NAME glue(glue(lbbp_, BORDER), BITS)
-+#define NAME glue(lbbp_, BORDER)
- #ifdef HOST_WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
-@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line16_,NAME)(void *opaque, uint8_t *d, const uint8_
-         MSB = (data & 0x1f) << 3;
-         data >>= 5;
- #endif
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
-         LSB = (data & 0x1f) << 3;
-         data >>= 5;
-         g = (data & 0x3f) << 2;
-         data >>= 6;
-         MSB = (data & 0x1f) << 3;
-         data >>= 5;
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
- #undef MSB
- #undef LSB
-         width -= 2;
-@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line32_,NAME)(void *opaque, uint8_t *d, const uint8_
-         g = (data >> 16) & 0xff;
-         MSB = (data >> 8) & 0xff;
- #endif
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
- #undef MSB
- #undef LSB
-         width--;
-@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line16_555_,NAME)(void *opaque, uint8_t *d, const ui
-         data >>= 5;
-         MSB = (data & 0x1f) << 3;
-         data >>= 5;
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
-         LSB = (data & 0x1f) << 3;
-         data >>= 5;
-         g = (data & 0x1f) << 3;
-         data >>= 5;
-         MSB = (data & 0x1f) << 3;
-         data >>= 6;
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
- #undef MSB
- #undef LSB
-         width -= 2;
-@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line12_,NAME)(void *opaque, uint8_t *d, const uint8_
-         data >>= 4;
-         MSB = (data & 0xf) << 4;
-         data >>= 8;
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
-         LSB = (data & 0xf) << 4;
-         data >>= 4;
-         g = (data & 0xf) << 4;
-         data >>= 4;
-         MSB = (data & 0xf) << 4;
-         data >>= 8;
--        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
- #undef MSB
- #undef LSB
-         width -= 2;
-diff --git a/hw/display/pl110.c b/hw/display/pl110.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110.c
-+++ b/hw/display/pl110.c
-@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
-     pl111_id
- };
--#define BITS 32
- #define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
- #undef RGB
-@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
- #include "pl110_template.h"
- #undef BORDER
--static drawfn pl110_draw_fn_32[48] = {
--    pl110_draw_line1_lblp_bgr32,
--    pl110_draw_line2_lblp_bgr32,
--    pl110_draw_line4_lblp_bgr32,
--    pl110_draw_line8_lblp_bgr32,
--    pl110_draw_line16_555_lblp_bgr32,
--    pl110_draw_line32_lblp_bgr32,
--    pl110_draw_line16_lblp_bgr32,
--    pl110_draw_line12_lblp_bgr32,
--
--    pl110_draw_line1_bbbp_bgr32,
--    pl110_draw_line2_bbbp_bgr32,
--    pl110_draw_line4_bbbp_bgr32,
--    pl110_draw_line8_bbbp_bgr32,
--    pl110_draw_line16_555_bbbp_bgr32,
--    pl110_draw_line32_bbbp_bgr32,
--    pl110_draw_line16_bbbp_bgr32,
--    pl110_draw_line12_bbbp_bgr32,
--
--    pl110_draw_line1_lbbp_bgr32,
--    pl110_draw_line2_lbbp_bgr32,
--    pl110_draw_line4_lbbp_bgr32,
--    pl110_draw_line8_lbbp_bgr32,
--    pl110_draw_line16_555_lbbp_bgr32,
--    pl110_draw_line32_lbbp_bgr32,
--    pl110_draw_line16_lbbp_bgr32,
--    pl110_draw_line12_lbbp_bgr32,
--
--    pl110_draw_line1_lblp_rgb32,
--    pl110_draw_line2_lblp_rgb32,
--    pl110_draw_line4_lblp_rgb32,
--    pl110_draw_line8_lblp_rgb32,
--    pl110_draw_line16_555_lblp_rgb32,
--    pl110_draw_line32_lblp_rgb32,
--    pl110_draw_line16_lblp_rgb32,
--    pl110_draw_line12_lblp_rgb32,
--
--    pl110_draw_line1_bbbp_rgb32,
--    pl110_draw_line2_bbbp_rgb32,
--    pl110_draw_line4_bbbp_rgb32,
--    pl110_draw_line8_bbbp_rgb32,
--    pl110_draw_line16_555_bbbp_rgb32,
--    pl110_draw_line32_bbbp_rgb32,
--    pl110_draw_line16_bbbp_rgb32,
--    pl110_draw_line12_bbbp_rgb32,
--
--    pl110_draw_line1_lbbp_rgb32,
--    pl110_draw_line2_lbbp_rgb32,
--    pl110_draw_line4_lbbp_rgb32,
--    pl110_draw_line8_lbbp_rgb32,
--    pl110_draw_line16_555_lbbp_rgb32,
--    pl110_draw_line32_lbbp_rgb32,
--    pl110_draw_line16_lbbp_rgb32,
--    pl110_draw_line12_lbbp_rgb32,
--};
--
--#undef BITS
- #undef COPY_PIXEL
-+static drawfn pl110_draw_fn_32[48] = {
-+    pl110_draw_line1_lblp_bgr,
-+    pl110_draw_line2_lblp_bgr,
-+    pl110_draw_line4_lblp_bgr,
-+    pl110_draw_line8_lblp_bgr,
-+    pl110_draw_line16_555_lblp_bgr,
-+    pl110_draw_line32_lblp_bgr,
-+    pl110_draw_line16_lblp_bgr,
-+    pl110_draw_line12_lblp_bgr,
-+
-+    pl110_draw_line1_bbbp_bgr,
-+    pl110_draw_line2_bbbp_bgr,
-+    pl110_draw_line4_bbbp_bgr,
-+    pl110_draw_line8_bbbp_bgr,
-+    pl110_draw_line16_555_bbbp_bgr,
-+    pl110_draw_line32_bbbp_bgr,
-+    pl110_draw_line16_bbbp_bgr,
-+    pl110_draw_line12_bbbp_bgr,
-+
-+    pl110_draw_line1_lbbp_bgr,
-+    pl110_draw_line2_lbbp_bgr,
-+    pl110_draw_line4_lbbp_bgr,
-+    pl110_draw_line8_lbbp_bgr,
-+    pl110_draw_line16_555_lbbp_bgr,
-+    pl110_draw_line32_lbbp_bgr,
-+    pl110_draw_line16_lbbp_bgr,
-+    pl110_draw_line12_lbbp_bgr,
-+
-+    pl110_draw_line1_lblp_rgb,
-+    pl110_draw_line2_lblp_rgb,
-+    pl110_draw_line4_lblp_rgb,
-+    pl110_draw_line8_lblp_rgb,
-+    pl110_draw_line16_555_lblp_rgb,
-+    pl110_draw_line32_lblp_rgb,
-+    pl110_draw_line16_lblp_rgb,
-+    pl110_draw_line12_lblp_rgb,
-+
-+    pl110_draw_line1_bbbp_rgb,
-+    pl110_draw_line2_bbbp_rgb,
-+    pl110_draw_line4_bbbp_rgb,
-+    pl110_draw_line8_bbbp_rgb,
-+    pl110_draw_line16_555_bbbp_rgb,
-+    pl110_draw_line32_bbbp_rgb,
-+    pl110_draw_line16_bbbp_rgb,
-+    pl110_draw_line12_bbbp_rgb,
-+
-+    pl110_draw_line1_lbbp_rgb,
-+    pl110_draw_line2_lbbp_rgb,
-+    pl110_draw_line4_lbbp_rgb,
-+    pl110_draw_line8_lbbp_rgb,
-+    pl110_draw_line16_555_lbbp_rgb,
-+    pl110_draw_line32_lbbp_rgb,
-+    pl110_draw_line16_lbbp_rgb,
-+    pl110_draw_line12_lbbp_rgb,
-+};
- static int pl110_enabled(PL110State *s)
- {
---
-.20.1

-[PULL 34/39] hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces
+Deleted patch
-For a long time now the UI layer has guaranteed that the console
-surface is always 32 bits per pixel.  Remove the legacy dead code
-from the pxa2xx_lcd display device which was handling the possibility
-that the console surface was some other format.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-5-peter.maydell@linaro.org
----
- hw/display/pxa2xx_lcd.c | 79 +++++++++--------------------------------
-file changed, 17 insertions(+), 62 deletions(-)
-diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_lcd.c
-+++ b/hw/display/pxa2xx_lcd.c
-@@ -XXX,XX +XXX,XX @@ struct PXA2xxLCDState {
-     int invalidated;
-     QemuConsole *con;
--    drawfn *line_fn[2];
-     int dest_width;
-     int xres, yres;
-     int pal_for;
-@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
- #define LDCMD_SOFINT    (1 << 22)
- #define LDCMD_PAL    (1 << 26)
-+#define BITS 32
-+#include "pxa2xx_template.h"
-+
- /* Route internal interrupt lines to the global IC */
- static void pxa2xx_lcdc_int_update(PXA2xxLCDState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_palette_parse(PXA2xxLCDState *s, int ch, int bpp)
-     }
- }
-+static inline drawfn pxa2xx_drawfn(PXA2xxLCDState *s)
-+{
-+    if (s->transp) {
-+        return pxa2xx_draw_fn_32t[s->bpp];
-+    } else {
-+        return pxa2xx_draw_fn_32[s->bpp];
-+    }
-+}
-+
- static void pxa2xx_lcdc_dma0_redraw_rot0(PXA2xxLCDState *s,
-                 hwaddr addr, int *miny, int *maxy)
- {
-     DisplaySurface *surface = qemu_console_surface(s->con);
-     int src_width, dest_width;
--    drawfn fn = NULL;
--    if (s->dest_width)
--        fn = s->line_fn[s->transp][s->bpp];
-+    drawfn fn = pxa2xx_drawfn(s);
-     if (!fn)
-         return;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot90(PXA2xxLCDState *s,
- {
-     DisplaySurface *surface = qemu_console_surface(s->con);
-     int src_width, dest_width;
--    drawfn fn = NULL;
--    if (s->dest_width)
--        fn = s->line_fn[s->transp][s->bpp];
-+    drawfn fn = pxa2xx_drawfn(s);
-     if (!fn)
-         return;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot180(PXA2xxLCDState *s,
- {
-     DisplaySurface *surface = qemu_console_surface(s->con);
-     int src_width, dest_width;
--    drawfn fn = NULL;
--    if (s->dest_width) {
--        fn = s->line_fn[s->transp][s->bpp];
--    }
-+    drawfn fn = pxa2xx_drawfn(s);
-     if (!fn) {
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot270(PXA2xxLCDState *s,
- {
-     DisplaySurface *surface = qemu_console_surface(s->con);
-     int src_width, dest_width;
--    drawfn fn = NULL;
--    if (s->dest_width) {
--        fn = s->line_fn[s->transp][s->bpp];
--    }
-+    drawfn fn = pxa2xx_drawfn(s);
-     if (!fn) {
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pxa2xx_lcdc = {
-     }
- };
--#define BITS 8
--#include "pxa2xx_template.h"
--#define BITS 15
--#include "pxa2xx_template.h"
--#define BITS 16
--#include "pxa2xx_template.h"
--#define BITS 24
--#include "pxa2xx_template.h"
--#define BITS 32
--#include "pxa2xx_template.h"
--
- static const GraphicHwOps pxa2xx_ops = {
-     .invalidate  = pxa2xx_invalidate_display,
-     .gfx_update  = pxa2xx_update_display,
-@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
-                                  hwaddr base, qemu_irq irq)
- {
-     PXA2xxLCDState *s;
--    DisplaySurface *surface;
-     s = (PXA2xxLCDState *) g_malloc0(sizeof(PXA2xxLCDState));
-     s->invalidated = 1;
-@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
-     memory_region_add_subregion(sysmem, base, &s->iomem);
-     s->con = graphic_console_init(NULL, 0, &pxa2xx_ops, s);
--    surface = qemu_console_surface(s->con);
--
--    switch (surface_bits_per_pixel(surface)) {
--    case 0:
--        s->dest_width = 0;
--        break;
--    case 8:
--        s->line_fn[0] = pxa2xx_draw_fn_8;
--        s->line_fn[1] = pxa2xx_draw_fn_8t;
--        s->dest_width = 1;
--        break;
--    case 15:
--        s->line_fn[0] = pxa2xx_draw_fn_15;
--        s->line_fn[1] = pxa2xx_draw_fn_15t;
--        s->dest_width = 2;
--        break;
--    case 16:
--        s->line_fn[0] = pxa2xx_draw_fn_16;
--        s->line_fn[1] = pxa2xx_draw_fn_16t;
--        s->dest_width = 2;
--        break;
--    case 24:
--        s->line_fn[0] = pxa2xx_draw_fn_24;
--        s->line_fn[1] = pxa2xx_draw_fn_24t;
--        s->dest_width = 3;
--        break;
--    case 32:
--        s->line_fn[0] = pxa2xx_draw_fn_32;
--        s->line_fn[1] = pxa2xx_draw_fn_32t;
--        s->dest_width = 4;
--        break;
--    default:
--        fprintf(stderr, "%s: Bad color depth\n", __func__);
--        exit(1);
--    }
-+    s->dest_width = 4;
-     vmstate_register(NULL, 0, &vmstate_pxa2xx_lcdc, s);
---
-.20.1

-[PULL 35/39] hw/display/pxa2xx_lcd: Remove dest_width state field
+Deleted patch
-Since the dest_width is now always 4 because the output surface is
-bpp, we can replace the dest_width state field with a constant.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-6-peter.maydell@linaro.org
----
- hw/display/pxa2xx_lcd.c | 20 +++++++++++---------
-file changed, 11 insertions(+), 9 deletions(-)
-diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_lcd.c
-+++ b/hw/display/pxa2xx_lcd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
- #define LDCMD_SOFINT    (1 << 22)
- #define LDCMD_PAL    (1 << 26)
-+/* Size of a pixel in the QEMU UI output surface, in bytes */
-+#define DEST_PIXEL_WIDTH 4
-+
- #define BITS 32
- #include "pxa2xx_template.h"
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot0(PXA2xxLCDState *s,
-     else if (s->bpp > pxa_lcdc_8bpp)
-         src_width *= 2;
--    dest_width = s->xres * s->dest_width;
-+    dest_width = s->xres * DEST_PIXEL_WIDTH;
-     *miny = 0;
-     if (s->invalidated) {
-         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
-                                           addr, s->yres, src_width);
-     }
-     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
--                               src_width, dest_width, s->dest_width,
-+                               src_width, dest_width, DEST_PIXEL_WIDTH,
-                                s->invalidated,
-                                fn, s->dma_ch[0].palette, miny, maxy);
- }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot90(PXA2xxLCDState *s,
-     else if (s->bpp > pxa_lcdc_8bpp)
-         src_width *= 2;
--    dest_width = s->yres * s->dest_width;
-+    dest_width = s->yres * DEST_PIXEL_WIDTH;
-     *miny = 0;
-     if (s->invalidated) {
-         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
-                                           addr, s->yres, src_width);
-     }
-     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
--                               src_width, s->dest_width, -dest_width,
-+                               src_width, DEST_PIXEL_WIDTH, -dest_width,
-                                s->invalidated,
-                                fn, s->dma_ch[0].palette,
-                                miny, maxy);
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot180(PXA2xxLCDState *s,
-         src_width *= 2;
-     }
--    dest_width = s->xres * s->dest_width;
-+    dest_width = s->xres * DEST_PIXEL_WIDTH;
-     *miny = 0;
-     if (s->invalidated) {
-         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
-                                           addr, s->yres, src_width);
-     }
-     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
--                               src_width, -dest_width, -s->dest_width,
-+                               src_width, -dest_width, -DEST_PIXEL_WIDTH,
-                                s->invalidated,
-                                fn, s->dma_ch[0].palette, miny, maxy);
- }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot270(PXA2xxLCDState *s,
-         src_width *= 2;
-     }
--    dest_width = s->yres * s->dest_width;
-+    dest_width = s->yres * DEST_PIXEL_WIDTH;
-     *miny = 0;
-     if (s->invalidated) {
-         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
-                                           addr, s->yres, src_width);
-     }
-     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
--                               src_width, -s->dest_width, dest_width,
-+                               src_width, -DEST_PIXEL_WIDTH, dest_width,
-                                s->invalidated,
-                                fn, s->dma_ch[0].palette,
-                                miny, maxy);
-@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
-     memory_region_add_subregion(sysmem, base, &s->iomem);
-     s->con = graphic_console_init(NULL, 0, &pxa2xx_ops, s);
--    s->dest_width = 4;
-     vmstate_register(NULL, 0, &vmstate_pxa2xx_lcdc, s);
---
-.20.1

-[PULL 36/39] hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h
+Deleted patch
-Now that BITS is always 32, expand out all its uses in the template
-header, including removing now-useless uses of the glue() macro.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-7-peter.maydell@linaro.org
----
- hw/display/pxa2xx_template.h | 110 ++++++++++++++---------------------
-file changed, 45 insertions(+), 65 deletions(-)
-diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_template.h
-+++ b/hw/display/pxa2xx_template.h
-@@ -XXX,XX +XXX,XX @@
-  */
- # define SKIP_PIXEL(to)        to += deststep
--#if BITS == 8
--# define COPY_PIXEL(to, from)  do { *to = from; SKIP_PIXEL(to); } while (0)
--#elif BITS == 15 || BITS == 16
--# define COPY_PIXEL(to, from)    \
--    do {                         \
--        *(uint16_t *) to = from; \
--        SKIP_PIXEL(to);          \
--    } while (0)
--#elif BITS == 24
--# define COPY_PIXEL(to, from)     \
--    do {                          \
--        *(uint16_t *) to = from;  \
--        *(to + 2) = (from) >> 16; \
--        SKIP_PIXEL(to);           \
--    } while (0)
--#elif BITS == 32
- # define COPY_PIXEL(to, from)    \
-     do {                         \
-         *(uint32_t *) to = from; \
-         SKIP_PIXEL(to);          \
-     } while (0)
--#else
--# error unknown bit depth
--#endif
- #ifdef HOST_WORDS_BIGENDIAN
- # define SWAP_WORDS    1
-@@ -XXX,XX +XXX,XX @@
- #define FN_2(x)        FN(x + 1) FN(x)
- #define FN_4(x)        FN_2(x + 2) FN_2(x)
--static void glue(pxa2xx_draw_line2_, BITS)(void *opaque,
-+static void pxa2xx_draw_line2(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t *palette = opaque;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line2_, BITS)(void *opaque,
-     }
- }
--static void glue(pxa2xx_draw_line4_, BITS)(void *opaque,
-+static void pxa2xx_draw_line4(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t *palette = opaque;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line4_, BITS)(void *opaque,
-     }
- }
--static void glue(pxa2xx_draw_line8_, BITS)(void *opaque,
-+static void pxa2xx_draw_line8(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t *palette = opaque;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line8_, BITS)(void *opaque,
-     }
- }
--static void glue(pxa2xx_draw_line16_, BITS)(void *opaque,
-+static void pxa2xx_draw_line16(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16_, BITS)(void *opaque,
-         data >>= 6;
-         r = (data & 0x1f) << 3;
-         data >>= 5;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         b = (data & 0x1f) << 3;
-         data >>= 5;
-         g = (data & 0x3f) << 2;
-         data >>= 6;
-         r = (data & 0x1f) << 3;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 2;
-         src += 4;
-     }
- }
--static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
-+static void pxa2xx_draw_line16t(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
-         if (data & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         data >>= 1;
-         b = (data & 0x1f) << 3;
-         data >>= 5;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
-         if (data & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 2;
-         src += 4;
-     }
- }
--static void glue(pxa2xx_draw_line18_, BITS)(void *opaque,
-+static void pxa2xx_draw_line18(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line18_, BITS)(void *opaque,
-         g = (data & 0x3f) << 2;
-         data >>= 6;
-         r = (data & 0x3f) << 2;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 1;
-         src += 4;
-     }
- }
- /* The wicked packed format */
--static void glue(pxa2xx_draw_line18p_, BITS)(void *opaque,
-+static void pxa2xx_draw_line18p(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data[3];
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line18p_, BITS)(void *opaque,
-         data[0] >>= 6;
-         r = (data[0] & 0x3f) << 2;
-         data[0] >>= 12;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         b = (data[0] & 0x3f) << 2;
-         data[0] >>= 6;
-         g = ((data[1] & 0xf) << 4) | (data[0] << 2);
-         data[1] >>= 4;
-         r = (data[1] & 0x3f) << 2;
-         data[1] >>= 12;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         b = (data[1] & 0x3f) << 2;
-         data[1] >>= 6;
-         g = (data[1] & 0x3f) << 2;
-         data[1] >>= 6;
-         r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-         data[2] >>= 8;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         b = (data[2] & 0x3f) << 2;
-         data[2] >>= 6;
-         g = (data[2] & 0x3f) << 2;
-         data[2] >>= 6;
-         r = data[2] << 2;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 4;
-     }
- }
--static void glue(pxa2xx_draw_line19_, BITS)(void *opaque,
-+static void pxa2xx_draw_line19(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19_, BITS)(void *opaque,
-         if (data & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 1;
-         src += 4;
-     }
- }
- /* The wicked packed format */
--static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
-+static void pxa2xx_draw_line19p(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data[3];
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
-         if (data[0] & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         data[0] >>= 6;
-         b = (data[0] & 0x3f) << 2;
-         data[0] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
-         if (data[1] & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         data[1] >>= 6;
-         b = (data[1] & 0x3f) << 2;
-         data[1] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
-         if (data[2] & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         data[2] >>= 6;
-         b = (data[2] & 0x3f) << 2;
-         data[2] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
-         if (data[2] & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 4;
-     }
- }
--static void glue(pxa2xx_draw_line24_, BITS)(void *opaque,
-+static void pxa2xx_draw_line24(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line24_, BITS)(void *opaque,
-         g = data & 0xff;
-         data >>= 8;
-         r = data & 0xff;
--        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 1;
-         src += 4;
-     }
- }
--static void glue(pxa2xx_draw_line24t_, BITS)(void *opaque,
-+static void pxa2xx_draw_line24t(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line24t_, BITS)(void *opaque,
-         if (data & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 1;
-         src += 4;
-     }
- }
--static void glue(pxa2xx_draw_line25_, BITS)(void *opaque,
-+static void pxa2xx_draw_line25(void *opaque,
-                 uint8_t *dest, const uint8_t *src, int width, int deststep)
- {
-     uint32_t data;
-@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line25_, BITS)(void *opaque,
-         if (data & 1)
-             SKIP_PIXEL(dest);
-         else
--            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-         width -= 1;
-         src += 4;
-     }
- }
- /* Overlay planes disabled, no transparency */
--static drawfn glue(pxa2xx_draw_fn_, BITS)[16] =
-+static drawfn pxa2xx_draw_fn_32[16] =
- {
-     [0 ... 0xf]       = NULL,
--    [pxa_lcdc_2bpp]   = glue(pxa2xx_draw_line2_, BITS),
--    [pxa_lcdc_4bpp]   = glue(pxa2xx_draw_line4_, BITS),
--    [pxa_lcdc_8bpp]   = glue(pxa2xx_draw_line8_, BITS),
--    [pxa_lcdc_16bpp]  = glue(pxa2xx_draw_line16_, BITS),
--    [pxa_lcdc_18bpp]  = glue(pxa2xx_draw_line18_, BITS),
--    [pxa_lcdc_18pbpp] = glue(pxa2xx_draw_line18p_, BITS),
--    [pxa_lcdc_24bpp]  = glue(pxa2xx_draw_line24_, BITS),
-+    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
-+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
-+    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
-+    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
-+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
- };
- /* Overlay planes enabled, transparency used */
--static drawfn glue(glue(pxa2xx_draw_fn_, BITS), t)[16] =
-+static drawfn pxa2xx_draw_fn_32t[16] =
- {
-     [0 ... 0xf]       = NULL,
--    [pxa_lcdc_4bpp]   = glue(pxa2xx_draw_line4_, BITS),
--    [pxa_lcdc_8bpp]   = glue(pxa2xx_draw_line8_, BITS),
--    [pxa_lcdc_16bpp]  = glue(pxa2xx_draw_line16t_, BITS),
--    [pxa_lcdc_19bpp]  = glue(pxa2xx_draw_line19_, BITS),
--    [pxa_lcdc_19pbpp] = glue(pxa2xx_draw_line19p_, BITS),
--    [pxa_lcdc_24bpp]  = glue(pxa2xx_draw_line24t_, BITS),
--    [pxa_lcdc_25bpp]  = glue(pxa2xx_draw_line25_, BITS),
-+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
-+    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
-+    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
-+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
-+    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
- };
--#undef BITS
- #undef COPY_PIXEL
- #undef SKIP_PIXEL
---
-.20.1

-[PULL 37/39] hw/display/pxa2xx: Apply brace-related coding style fixes to template header
+Deleted patch
-We're about to move code from the template header into pxa2xx_lcd.c.
-Before doing that, make coding style fixes so checkpatch doesn't
-complain about the patch which moves the code. This commit fixes
-missing braces in the SKIP_PIXEL() macro definition and in if()
-statements.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-8-peter.maydell@linaro.org
----
- hw/display/pxa2xx_template.h | 47 +++++++++++++++++++++---------------
-file changed, 28 insertions(+), 19 deletions(-)
-diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_template.h
-+++ b/hw/display/pxa2xx_template.h
-@@ -XXX,XX +XXX,XX @@
-  * Framebuffer format conversion routines.
-  */
--# define SKIP_PIXEL(to)        to += deststep
-+# define SKIP_PIXEL(to) do { to += deststep; } while (0)
- # define COPY_PIXEL(to, from)    \
-     do {                         \
-         *(uint32_t *) to = from; \
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
-         data >>= 5;
-         r = (data & 0x1f) << 3;
-         data >>= 5;
--        if (data & 1)
-+        if (data & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         data >>= 1;
-         b = (data & 0x1f) << 3;
-         data >>= 5;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
-         data >>= 5;
-         r = (data & 0x1f) << 3;
-         data >>= 5;
--        if (data & 1)
-+        if (data & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         width -= 2;
-         src += 4;
-     }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19(void *opaque,
-         data >>= 6;
-         r = (data & 0x3f) << 2;
-         data >>= 6;
--        if (data & 1)
-+        if (data & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         width -= 1;
-         src += 4;
-     }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
-         data[0] >>= 6;
-         r = (data[0] & 0x3f) << 2;
-         data[0] >>= 6;
--        if (data[0] & 1)
-+        if (data[0] & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         data[0] >>= 6;
-         b = (data[0] & 0x3f) << 2;
-         data[0] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
-         data[1] >>= 4;
-         r = (data[1] & 0x3f) << 2;
-         data[1] >>= 6;
--        if (data[1] & 1)
-+        if (data[1] & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         data[1] >>= 6;
-         b = (data[1] & 0x3f) << 2;
-         data[1] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
-         data[1] >>= 6;
-         r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-         data[2] >>= 2;
--        if (data[2] & 1)
-+        if (data[2] & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         data[2] >>= 6;
-         b = (data[2] & 0x3f) << 2;
-         data[2] >>= 6;
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
-         data[2] >>= 6;
-         r = data[2] << 2;
-         data[2] >>= 6;
--        if (data[2] & 1)
-+        if (data[2] & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         width -= 4;
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24t(void *opaque,
-         data >>= 8;
-         r = data & 0xff;
-         data >>= 8;
--        if (data & 1)
-+        if (data & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         width -= 1;
-         src += 4;
-     }
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line25(void *opaque,
-         data >>= 8;
-         r = data & 0xff;
-         data >>= 8;
--        if (data & 1)
-+        if (data & 1) {
-             SKIP_PIXEL(dest);
--        else
-+        } else {
-             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-         width -= 1;
-         src += 4;
-     }
---
-.20.1

-[PULL 39/39] hw/display/pxa2xx: Inline template header
+Deleted patch
-The template header is now included only once; just inline its contents
-in hw/display/pxa2xx_lcd.c.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20210211141515.8755-10-peter.maydell@linaro.org
----
- hw/display/pxa2xx_template.h | 434 -----------------------------------
- hw/display/pxa2xx_lcd.c      | 427 +++++++++++++++++++++++++++++++++-
-files changed, 425 insertions(+), 436 deletions(-)
- delete mode 100644 hw/display/pxa2xx_template.h
-diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
---- a/hw/display/pxa2xx_template.h
-+++ /dev/null
-@@ -XXX,XX +XXX,XX @@
--/*
-- * Intel XScale PXA255/270 LCDC emulation.
-- *
-- * Copyright (c) 2006 Openedhand Ltd.
-- * Written by Andrzej Zaborowski <balrog@zabor.org>
-- *
-- * This code is licensed under the GPLv2.
-- *
-- * Framebuffer format conversion routines.
-- */
--
--# define SKIP_PIXEL(to) do { to += deststep; } while (0)
--# define COPY_PIXEL(to, from)    \
--    do {                         \
--        *(uint32_t *) to = from; \
--        SKIP_PIXEL(to);          \
--    } while (0)
--
--#ifdef HOST_WORDS_BIGENDIAN
--# define SWAP_WORDS 1
--#endif
--
--#define FN_2(x) FN(x + 1) FN(x)
--#define FN_4(x) FN_2(x + 2) FN_2(x)
--
--static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
--                              int width, int deststep)
--{
--    uint32_t *palette = opaque;
--    uint32_t data;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
--#ifdef SWAP_WORDS
--        FN_4(12)
--        FN_4(8)
--        FN_4(4)
--        FN_4(0)
--#else
--        FN_4(0)
--        FN_4(4)
--        FN_4(8)
--        FN_4(12)
--#endif
--#undef FN
--        width -= 16;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
--                              int width, int deststep)
--{
--    uint32_t *palette = opaque;
--    uint32_t data;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
--#ifdef SWAP_WORDS
--        FN_2(6)
--        FN_2(4)
--        FN_2(2)
--        FN_2(0)
--#else
--        FN_2(0)
--        FN_2(2)
--        FN_2(4)
--        FN_2(6)
--#endif
--#undef FN
--        width -= 8;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
--                              int width, int deststep)
--{
--    uint32_t *palette = opaque;
--    uint32_t data;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
--#ifdef SWAP_WORDS
--        FN(24)
--        FN(16)
--        FN(8)
--        FN(0)
--#else
--        FN(0)
--        FN(8)
--        FN(16)
--        FN(24)
--#endif
--#undef FN
--        width -= 4;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
--                               int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = (data & 0x1f) << 3;
--        data >>= 5;
--        g = (data & 0x3f) << 2;
--        data >>= 6;
--        r = (data & 0x1f) << 3;
--        data >>= 5;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        b = (data & 0x1f) << 3;
--        data >>= 5;
--        g = (data & 0x3f) << 2;
--        data >>= 6;
--        r = (data & 0x1f) << 3;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        width -= 2;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
--                                int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = (data & 0x1f) << 3;
--        data >>= 5;
--        g = (data & 0x1f) << 3;
--        data >>= 5;
--        r = (data & 0x1f) << 3;
--        data >>= 5;
--        if (data & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        data >>= 1;
--        b = (data & 0x1f) << 3;
--        data >>= 5;
--        g = (data & 0x1f) << 3;
--        data >>= 5;
--        r = (data & 0x1f) << 3;
--        data >>= 5;
--        if (data & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        width -= 2;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
--                               int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = (data & 0x3f) << 2;
--        data >>= 6;
--        g = (data & 0x3f) << 2;
--        data >>= 6;
--        r = (data & 0x3f) << 2;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        width -= 1;
--        src += 4;
--    }
--}
--
--/* The wicked packed format */
--static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
--                                int width, int deststep)
--{
--    uint32_t data[3];
--    unsigned int r, g, b;
--    while (width > 0) {
--        data[0] = *(uint32_t *) src;
--        src += 4;
--        data[1] = *(uint32_t *) src;
--        src += 4;
--        data[2] = *(uint32_t *) src;
--        src += 4;
--#ifdef SWAP_WORDS
--        data[0] = bswap32(data[0]);
--        data[1] = bswap32(data[1]);
--        data[2] = bswap32(data[2]);
--#endif
--        b = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        g = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        r = (data[0] & 0x3f) << 2;
--        data[0] >>= 12;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        b = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
--        data[1] >>= 4;
--        r = (data[1] & 0x3f) << 2;
--        data[1] >>= 12;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        b = (data[1] & 0x3f) << 2;
--        data[1] >>= 6;
--        g = (data[1] & 0x3f) << 2;
--        data[1] >>= 6;
--        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
--        data[2] >>= 8;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        b = (data[2] & 0x3f) << 2;
--        data[2] >>= 6;
--        g = (data[2] & 0x3f) << 2;
--        data[2] >>= 6;
--        r = data[2] << 2;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        width -= 4;
--    }
--}
--
--static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
--                               int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = (data & 0x3f) << 2;
--        data >>= 6;
--        g = (data & 0x3f) << 2;
--        data >>= 6;
--        r = (data & 0x3f) << 2;
--        data >>= 6;
--        if (data & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        width -= 1;
--        src += 4;
--    }
--}
--
--/* The wicked packed format */
--static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
--                                int width, int deststep)
--{
--    uint32_t data[3];
--    unsigned int r, g, b;
--    while (width > 0) {
--        data[0] = *(uint32_t *) src;
--        src += 4;
--        data[1] = *(uint32_t *) src;
--        src += 4;
--        data[2] = *(uint32_t *) src;
--        src += 4;
--# ifdef SWAP_WORDS
--        data[0] = bswap32(data[0]);
--        data[1] = bswap32(data[1]);
--        data[2] = bswap32(data[2]);
--# endif
--        b = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        g = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        r = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        if (data[0] & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        data[0] >>= 6;
--        b = (data[0] & 0x3f) << 2;
--        data[0] >>= 6;
--        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
--        data[1] >>= 4;
--        r = (data[1] & 0x3f) << 2;
--        data[1] >>= 6;
--        if (data[1] & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        data[1] >>= 6;
--        b = (data[1] & 0x3f) << 2;
--        data[1] >>= 6;
--        g = (data[1] & 0x3f) << 2;
--        data[1] >>= 6;
--        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
--        data[2] >>= 2;
--        if (data[2] & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        data[2] >>= 6;
--        b = (data[2] & 0x3f) << 2;
--        data[2] >>= 6;
--        g = (data[2] & 0x3f) << 2;
--        data[2] >>= 6;
--        r = data[2] << 2;
--        data[2] >>= 6;
--        if (data[2] & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        width -= 4;
--    }
--}
--
--static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
--                               int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = data & 0xff;
--        data >>= 8;
--        g = data & 0xff;
--        data >>= 8;
--        r = data & 0xff;
--        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        width -= 1;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
--                                int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = (data & 0x7f) << 1;
--        data >>= 7;
--        g = data & 0xff;
--        data >>= 8;
--        r = data & 0xff;
--        data >>= 8;
--        if (data & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        width -= 1;
--        src += 4;
--    }
--}
--
--static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
--                               int width, int deststep)
--{
--    uint32_t data;
--    unsigned int r, g, b;
--    while (width > 0) {
--        data = *(uint32_t *) src;
--#ifdef SWAP_WORDS
--        data = bswap32(data);
--#endif
--        b = data & 0xff;
--        data >>= 8;
--        g = data & 0xff;
--        data >>= 8;
--        r = data & 0xff;
--        data >>= 8;
--        if (data & 1) {
--            SKIP_PIXEL(dest);
--        } else {
--            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
--        }
--        width -= 1;
--        src += 4;
--    }
--}
--
--/* Overlay planes disabled, no transparency */
--static drawfn pxa2xx_draw_fn_32[16] = {
--    [0 ... 0xf]       = NULL,
--    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
--    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
--    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
--    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
--    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
--    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
--    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
--};
--
--/* Overlay planes enabled, transparency used */
--static drawfn pxa2xx_draw_fn_32t[16] = {
--    [0 ... 0xf]       = NULL,
--    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
--    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
--    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
--    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
--    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
--    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
--    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
--};
--
--#undef COPY_PIXEL
--#undef SKIP_PIXEL
--
--#ifdef SWAP_WORDS
--# undef SWAP_WORDS
--#endif
-diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pxa2xx_lcd.c
-+++ b/hw/display/pxa2xx_lcd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
- /* Size of a pixel in the QEMU UI output surface, in bytes */
- #define DEST_PIXEL_WIDTH 4
--#define BITS 32
--#include "pxa2xx_template.h"
-+/* Line drawing code to handle the various possible guest pixel formats */
-+
-+# define SKIP_PIXEL(to) do { to += deststep; } while (0)
-+# define COPY_PIXEL(to, from)    \
-+    do {                         \
-+        *(uint32_t *) to = from; \
-+        SKIP_PIXEL(to);          \
-+    } while (0)
-+
-+#ifdef HOST_WORDS_BIGENDIAN
-+# define SWAP_WORDS 1
-+#endif
-+
-+#define FN_2(x) FN(x + 1) FN(x)
-+#define FN_4(x) FN_2(x + 2) FN_2(x)
-+
-+static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
-+                              int width, int deststep)
-+{
-+    uint32_t *palette = opaque;
-+    uint32_t data;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
-+#ifdef SWAP_WORDS
-+        FN_4(12)
-+        FN_4(8)
-+        FN_4(4)
-+        FN_4(0)
-+#else
-+        FN_4(0)
-+        FN_4(4)
-+        FN_4(8)
-+        FN_4(12)
-+#endif
-+#undef FN
-+        width -= 16;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
-+                              int width, int deststep)
-+{
-+    uint32_t *palette = opaque;
-+    uint32_t data;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
-+#ifdef SWAP_WORDS
-+        FN_2(6)
-+        FN_2(4)
-+        FN_2(2)
-+        FN_2(0)
-+#else
-+        FN_2(0)
-+        FN_2(2)
-+        FN_2(4)
-+        FN_2(6)
-+#endif
-+#undef FN
-+        width -= 8;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
-+                              int width, int deststep)
-+{
-+    uint32_t *palette = opaque;
-+    uint32_t data;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
-+#ifdef SWAP_WORDS
-+        FN(24)
-+        FN(16)
-+        FN(8)
-+        FN(0)
-+#else
-+        FN(0)
-+        FN(8)
-+        FN(16)
-+        FN(24)
-+#endif
-+#undef FN
-+        width -= 4;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
-+                               int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = (data & 0x1f) << 3;
-+        data >>= 5;
-+        g = (data & 0x3f) << 2;
-+        data >>= 6;
-+        r = (data & 0x1f) << 3;
-+        data >>= 5;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        b = (data & 0x1f) << 3;
-+        data >>= 5;
-+        g = (data & 0x3f) << 2;
-+        data >>= 6;
-+        r = (data & 0x1f) << 3;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        width -= 2;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
-+                                int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = (data & 0x1f) << 3;
-+        data >>= 5;
-+        g = (data & 0x1f) << 3;
-+        data >>= 5;
-+        r = (data & 0x1f) << 3;
-+        data >>= 5;
-+        if (data & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        data >>= 1;
-+        b = (data & 0x1f) << 3;
-+        data >>= 5;
-+        g = (data & 0x1f) << 3;
-+        data >>= 5;
-+        r = (data & 0x1f) << 3;
-+        data >>= 5;
-+        if (data & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        width -= 2;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
-+                               int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = (data & 0x3f) << 2;
-+        data >>= 6;
-+        g = (data & 0x3f) << 2;
-+        data >>= 6;
-+        r = (data & 0x3f) << 2;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        width -= 1;
-+        src += 4;
-+    }
-+}
-+
-+/* The wicked packed format */
-+static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
-+                                int width, int deststep)
-+{
-+    uint32_t data[3];
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data[0] = *(uint32_t *) src;
-+        src += 4;
-+        data[1] = *(uint32_t *) src;
-+        src += 4;
-+        data[2] = *(uint32_t *) src;
-+        src += 4;
-+#ifdef SWAP_WORDS
-+        data[0] = bswap32(data[0]);
-+        data[1] = bswap32(data[1]);
-+        data[2] = bswap32(data[2]);
-+#endif
-+        b = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        g = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        r = (data[0] & 0x3f) << 2;
-+        data[0] >>= 12;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        b = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
-+        data[1] >>= 4;
-+        r = (data[1] & 0x3f) << 2;
-+        data[1] >>= 12;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        b = (data[1] & 0x3f) << 2;
-+        data[1] >>= 6;
-+        g = (data[1] & 0x3f) << 2;
-+        data[1] >>= 6;
-+        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-+        data[2] >>= 8;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        b = (data[2] & 0x3f) << 2;
-+        data[2] >>= 6;
-+        g = (data[2] & 0x3f) << 2;
-+        data[2] >>= 6;
-+        r = data[2] << 2;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        width -= 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
-+                               int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = (data & 0x3f) << 2;
-+        data >>= 6;
-+        g = (data & 0x3f) << 2;
-+        data >>= 6;
-+        r = (data & 0x3f) << 2;
-+        data >>= 6;
-+        if (data & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        width -= 1;
-+        src += 4;
-+    }
-+}
-+
-+/* The wicked packed format */
-+static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
-+                                int width, int deststep)
-+{
-+    uint32_t data[3];
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data[0] = *(uint32_t *) src;
-+        src += 4;
-+        data[1] = *(uint32_t *) src;
-+        src += 4;
-+        data[2] = *(uint32_t *) src;
-+        src += 4;
-+# ifdef SWAP_WORDS
-+        data[0] = bswap32(data[0]);
-+        data[1] = bswap32(data[1]);
-+        data[2] = bswap32(data[2]);
-+# endif
-+        b = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        g = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        r = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        if (data[0] & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        data[0] >>= 6;
-+        b = (data[0] & 0x3f) << 2;
-+        data[0] >>= 6;
-+        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
-+        data[1] >>= 4;
-+        r = (data[1] & 0x3f) << 2;
-+        data[1] >>= 6;
-+        if (data[1] & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        data[1] >>= 6;
-+        b = (data[1] & 0x3f) << 2;
-+        data[1] >>= 6;
-+        g = (data[1] & 0x3f) << 2;
-+        data[1] >>= 6;
-+        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-+        data[2] >>= 2;
-+        if (data[2] & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        data[2] >>= 6;
-+        b = (data[2] & 0x3f) << 2;
-+        data[2] >>= 6;
-+        g = (data[2] & 0x3f) << 2;
-+        data[2] >>= 6;
-+        r = data[2] << 2;
-+        data[2] >>= 6;
-+        if (data[2] & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        width -= 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
-+                               int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = data & 0xff;
-+        data >>= 8;
-+        g = data & 0xff;
-+        data >>= 8;
-+        r = data & 0xff;
-+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        width -= 1;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
-+                                int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = (data & 0x7f) << 1;
-+        data >>= 7;
-+        g = data & 0xff;
-+        data >>= 8;
-+        r = data & 0xff;
-+        data >>= 8;
-+        if (data & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        width -= 1;
-+        src += 4;
-+    }
-+}
-+
-+static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
-+                               int width, int deststep)
-+{
-+    uint32_t data;
-+    unsigned int r, g, b;
-+    while (width > 0) {
-+        data = *(uint32_t *) src;
-+#ifdef SWAP_WORDS
-+        data = bswap32(data);
-+#endif
-+        b = data & 0xff;
-+        data >>= 8;
-+        g = data & 0xff;
-+        data >>= 8;
-+        r = data & 0xff;
-+        data >>= 8;
-+        if (data & 1) {
-+            SKIP_PIXEL(dest);
-+        } else {
-+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-+        }
-+        width -= 1;
-+        src += 4;
-+    }
-+}
-+
-+/* Overlay planes disabled, no transparency */
-+static drawfn pxa2xx_draw_fn_32[16] = {
-+    [0 ... 0xf]       = NULL,
-+    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
-+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
-+    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
-+    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
-+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
-+};
-+
-+/* Overlay planes enabled, transparency used */
-+static drawfn pxa2xx_draw_fn_32t[16] = {
-+    [0 ... 0xf]       = NULL,
-+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
-+    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
-+    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
-+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
-+    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
-+};
-+
-+#undef COPY_PIXEL
-+#undef SKIP_PIXEL
-+
-+#ifdef SWAP_WORDS
-+# undef SWAP_WORDS
-+#endif
- /* Route internal interrupt lines to the global IC */
- static void pxa2xx_lcdc_int_update(PXA2xxLCDState *s)
---
-.20.1

Last pullreq before 6.0 softfreeze: a few minor feature patches,
some bugfixes, some cleanups.

-- PMM

The following changes since commit 6f34661b6c97a37a5efc27d31c037ddeda4547e2:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2021-03-11 18:55:27 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210312-1

for you to fetch changes up to 41f09f2e9f09e4dd386d84174a6dcb5136af17ca:

hw/display/pxa2xx: Inline template header (2021-03-12 13:26:08 +0000)

----------------------------------------------------------------
target-arm queue:
 * versal: Support XRAMs and XRAM controller
 * smmu: Various minor bug fixes
 * SVE emulation: fix bugs handling odd vector lengths
 * allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
 * tests/acceptance: fix orangepi-pc acceptance tests
 * hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
 * hw/arm/virt: KVM: The IPA lower bound is 32
 * npcm7xx: support MFT module
 * pl110, pxa2xx_lcd: tidy up template headers

----------------------------------------------------------------
Andrew Jones (2):
      accel: kvm: Fix kvm_type invocation
      hw/arm/virt: KVM: The IPA lower bound is 32

Edgar E. Iglesias (2):
      hw/misc: versal: Add a model of the XRAM controller
      hw/arm: versal: Add support for the XRAMs

Eric Auger (7):
      intel_iommu: Fix mask may be uninitialized in vtd_context_device_invalidate
      dma: Introduce dma_aligned_pow2_mask()
      virtio-iommu: Handle non power of 2 range invalidations
      hw/arm/smmu-common: Fix smmu_iotlb_inv_iova when asid is not set
      hw/arm/smmuv3: Enforce invalidation on a power of two range
      hw/arm/smmuv3: Fix SMMU_CMD_CFGI_STE_RANGE handling
      hw/arm/smmuv3: Uniformize sid traces

Hao Wu (5):
      hw/misc: Add GPIOs for duty in NPCM7xx PWM
      hw/misc: Add NPCM7XX MFT Module
      hw/arm: Add MFT device to NPCM7xx Soc
      hw/arm: Connect PWM fans in NPCM7XX boards
      tests/qtest: Test PWM fan RPM using MFT in PWM test

Niek Linnenbank (5):
      hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
      tests/acceptance/boot_linux_console: remove Armbian 19.11.3 bionic test for orangepi-pc machine
      tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08
      tests/acceptance: update sunxi kernel from armbian to 5.10.16
      tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests

Peter Maydell (9):
      hw/display/pl110: Remove dead code for non-32-bpp surfaces
      hw/display/pl110: Pull included-once parts of template header into pl110.c
      hw/display/pl110: Remove use of BITS from pl110_template.h
      hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces
      hw/display/pxa2xx_lcd: Remove dest_width state field
      hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h
      hw/display/pxa2xx: Apply brace-related coding style fixes to template header
      hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header
      hw/display/pxa2xx: Inline template header

Philippe Mathieu-Daudé (1):
      hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()

Richard Henderson (8):
      target/arm: Fix sve_uzp_p vs odd vector lengths
      target/arm: Fix sve_zip_p vs odd vector lengths
      target/arm: Fix sve_punpk_p vs odd vector lengths
      target/arm: Update find_last_active for PREDDESC
      target/arm: Update BRKA, BRKB, BRKN for PREDDESC
      target/arm: Update CNTP for PREDDESC
      target/arm: Update WHILE for PREDDESC
      target/arm: Update sve reduction vs simd_desc

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx Versal Accelerator RAM (XRAM).
This is mainly a stub to make firmware happy. The size of
the RAMs can be probed. The interrupt mask logic is
modelled but none of the interrups will ever be raised
unless injected.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210308224637.2949533-2-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-versal-xramc.h |  97 +++++++++++
 hw/misc/xlnx-versal-xramc.c         | 253 ++++++++++++++++++++++++++++
 hw/misc/meson.build                 |   1 +
 3 files changed, 351 insertions(+)
 create mode 100644 include/hw/misc/xlnx-versal-xramc.h
 create mode 100644 hw/misc/xlnx-versal-xramc.c

diff --git a/include/hw/misc/xlnx-versal-xramc.h b/include/hw/misc/xlnx-versal-xramc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-versal-xramc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx XRAM Controller.
+ *
+ * Copyright (c) 2021 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#ifndef XLNX_VERSAL_XRAMC_H
+#define XLNX_VERSAL_XRAMC_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+
+#define TYPE_XLNX_XRAM_CTRL "xlnx.versal-xramc"
+
+#define XLNX_XRAM_CTRL(obj) \
+     OBJECT_CHECK(XlnxXramCtrl, (obj), TYPE_XLNX_XRAM_CTRL)
+
+REG32(XRAM_ERR_CTRL, 0x0)
+    FIELD(XRAM_ERR_CTRL, UE_RES, 3, 1)
+    FIELD(XRAM_ERR_CTRL, PWR_ERR_RES, 2, 1)
+    FIELD(XRAM_ERR_CTRL, PZ_ERR_RES, 1, 1)
+    FIELD(XRAM_ERR_CTRL, APB_ERR_RES, 0, 1)
+REG32(XRAM_ISR, 0x4)
+    FIELD(XRAM_ISR, INV_APB, 0, 1)
+REG32(XRAM_IMR, 0x8)
+    FIELD(XRAM_IMR, INV_APB, 0, 1)
+REG32(XRAM_IEN, 0xc)
+    FIELD(XRAM_IEN, INV_APB, 0, 1)
+REG32(XRAM_IDS, 0x10)
+    FIELD(XRAM_IDS, INV_APB, 0, 1)
+REG32(XRAM_ECC_CNTL, 0x14)
+    FIELD(XRAM_ECC_CNTL, FI_MODE, 2, 1)
+    FIELD(XRAM_ECC_CNTL, DET_ONLY, 1, 1)
+    FIELD(XRAM_ECC_CNTL, ECC_ON_OFF, 0, 1)
+REG32(XRAM_CLR_EXE, 0x18)
+    FIELD(XRAM_CLR_EXE, MON_7, 7, 1)
+    FIELD(XRAM_CLR_EXE, MON_6, 6, 1)
+    FIELD(XRAM_CLR_EXE, MON_5, 5, 1)
+    FIELD(XRAM_CLR_EXE, MON_4, 4, 1)
+    FIELD(XRAM_CLR_EXE, MON_3, 3, 1)
+    FIELD(XRAM_CLR_EXE, MON_2, 2, 1)
+    FIELD(XRAM_CLR_EXE, MON_1, 1, 1)
+    FIELD(XRAM_CLR_EXE, MON_0, 0, 1)
+REG32(XRAM_CE_FFA, 0x1c)
+    FIELD(XRAM_CE_FFA, ADDR, 0, 20)
+REG32(XRAM_CE_FFD0, 0x20)
+REG32(XRAM_CE_FFD1, 0x24)
+REG32(XRAM_CE_FFD2, 0x28)
+REG32(XRAM_CE_FFD3, 0x2c)
+REG32(XRAM_CE_FFE, 0x30)
+    FIELD(XRAM_CE_FFE, SYNDROME, 0, 16)
+REG32(XRAM_UE_FFA, 0x34)
+    FIELD(XRAM_UE_FFA, ADDR, 0, 20)
+REG32(XRAM_UE_FFD0, 0x38)
+REG32(XRAM_UE_FFD1, 0x3c)
+REG32(XRAM_UE_FFD2, 0x40)
+REG32(XRAM_UE_FFD3, 0x44)
+REG32(XRAM_UE_FFE, 0x48)
+    FIELD(XRAM_UE_FFE, SYNDROME, 0, 16)
+REG32(XRAM_FI_D0, 0x4c)
+REG32(XRAM_FI_D1, 0x50)
+REG32(XRAM_FI_D2, 0x54)
+REG32(XRAM_FI_D3, 0x58)
+REG32(XRAM_FI_SY, 0x5c)
+    FIELD(XRAM_FI_SY, DATA, 0, 16)
+REG32(XRAM_RMW_UE_FFA, 0x70)
+    FIELD(XRAM_RMW_UE_FFA, ADDR, 0, 20)
+REG32(XRAM_FI_CNTR, 0x74)
+    FIELD(XRAM_FI_CNTR, COUNT, 0, 24)
+REG32(XRAM_IMP, 0x80)
+    FIELD(XRAM_IMP, SIZE, 0, 4)
+REG32(XRAM_PRDY_DBG, 0x84)
+    FIELD(XRAM_PRDY_DBG, ISLAND3, 12, 4)
+    FIELD(XRAM_PRDY_DBG, ISLAND2, 8, 4)
+    FIELD(XRAM_PRDY_DBG, ISLAND1, 4, 4)
+    FIELD(XRAM_PRDY_DBG, ISLAND0, 0, 4)
+REG32(XRAM_SAFETY_CHK, 0xff8)
+
+#define XRAM_CTRL_R_MAX (R_XRAM_SAFETY_CHK + 1)
+
+typedef struct XlnxXramCtrl {
+    SysBusDevice parent_obj;
+    MemoryRegion ram;
+    qemu_irq irq;
+
+    struct {
+        uint64_t size;
+        unsigned int encoded_size;
+    } cfg;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[XRAM_CTRL_R_MAX];
+    RegisterInfo regs_info[XRAM_CTRL_R_MAX];
+} XlnxXramCtrl;
+#endif
diff --git a/hw/misc/xlnx-versal-xramc.c b/hw/misc/xlnx-versal-xramc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-versal-xramc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx XRAM Controller.
+ *
+ * Copyright (c) 2021 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "hw/qdev-properties.h"
+#include "hw/irq.h"
+#include "hw/misc/xlnx-versal-xramc.h"
+
+#ifndef XLNX_XRAM_CTRL_ERR_DEBUG
+#define XLNX_XRAM_CTRL_ERR_DEBUG 0
+#endif
+
+static void xram_update_irq(XlnxXramCtrl *s)
+{
+    bool pending = s->regs[R_XRAM_ISR] & ~s->regs[R_XRAM_IMR];
+    qemu_set_irq(s->irq, pending);
+}
+
+static void xram_isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
+    xram_update_irq(s);
+}
+
+static uint64_t xram_ien_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_XRAM_IMR] &= ~val;
+    xram_update_irq(s);
+    return 0;
+}
+
+static uint64_t xram_ids_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_XRAM_IMR] |= val;
+    xram_update_irq(s);
+    return 0;
+}
+
+static const RegisterAccessInfo xram_ctrl_regs_info[] = {
+    {   .name = "XRAM_ERR_CTRL",  .addr = A_XRAM_ERR_CTRL,
+        .reset = 0xf,
+        .rsvd = 0xfffffff0,
+    },{ .name = "XRAM_ISR",  .addr = A_XRAM_ISR,
+        .rsvd = 0xfffff800,
+        .w1c = 0x7ff,
+        .post_write = xram_isr_postw,
+    },{ .name = "XRAM_IMR",  .addr = A_XRAM_IMR,
+        .reset = 0x7ff,
+        .rsvd = 0xfffff800,
+        .ro = 0x7ff,
+    },{ .name = "XRAM_IEN",  .addr = A_XRAM_IEN,
+        .rsvd = 0xfffff800,
+        .pre_write = xram_ien_prew,
+    },{ .name = "XRAM_IDS",  .addr = A_XRAM_IDS,
+        .rsvd = 0xfffff800,
+        .pre_write = xram_ids_prew,
+    },{ .name = "XRAM_ECC_CNTL",  .addr = A_XRAM_ECC_CNTL,
+        .rsvd = 0xfffffff8,
+    },{ .name = "XRAM_CLR_EXE",  .addr = A_XRAM_CLR_EXE,
+        .rsvd = 0xffffff00,
+    },{ .name = "XRAM_CE_FFA",  .addr = A_XRAM_CE_FFA,
+        .rsvd = 0xfff00000,
+        .ro = 0xfffff,
+    },{ .name = "XRAM_CE_FFD0",  .addr = A_XRAM_CE_FFD0,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_CE_FFD1",  .addr = A_XRAM_CE_FFD1,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_CE_FFD2",  .addr = A_XRAM_CE_FFD2,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_CE_FFD3",  .addr = A_XRAM_CE_FFD3,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_CE_FFE",  .addr = A_XRAM_CE_FFE,
+        .rsvd = 0xffff0000,
+        .ro = 0xffff,
+    },{ .name = "XRAM_UE_FFA",  .addr = A_XRAM_UE_FFA,
+        .rsvd = 0xfff00000,
+        .ro = 0xfffff,
+    },{ .name = "XRAM_UE_FFD0",  .addr = A_XRAM_UE_FFD0,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_UE_FFD1",  .addr = A_XRAM_UE_FFD1,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_UE_FFD2",  .addr = A_XRAM_UE_FFD2,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_UE_FFD3",  .addr = A_XRAM_UE_FFD3,
+        .ro = 0xffffffff,
+    },{ .name = "XRAM_UE_FFE",  .addr = A_XRAM_UE_FFE,
+        .rsvd = 0xffff0000,
+        .ro = 0xffff,
+    },{ .name = "XRAM_FI_D0",  .addr = A_XRAM_FI_D0,
+    },{ .name = "XRAM_FI_D1",  .addr = A_XRAM_FI_D1,
+    },{ .name = "XRAM_FI_D2",  .addr = A_XRAM_FI_D2,
+    },{ .name = "XRAM_FI_D3",  .addr = A_XRAM_FI_D3,
+    },{ .name = "XRAM_FI_SY",  .addr = A_XRAM_FI_SY,
+        .rsvd = 0xffff0000,
+    },{ .name = "XRAM_RMW_UE_FFA",  .addr = A_XRAM_RMW_UE_FFA,
+        .rsvd = 0xfff00000,
+        .ro = 0xfffff,
+    },{ .name = "XRAM_FI_CNTR",  .addr = A_XRAM_FI_CNTR,
+        .rsvd = 0xff000000,
+    },{ .name = "XRAM_IMP",  .addr = A_XRAM_IMP,
+        .reset = 0x4,
+        .rsvd = 0xfffffff0,
+        .ro = 0xf,
+    },{ .name = "XRAM_PRDY_DBG",  .addr = A_XRAM_PRDY_DBG,
+        .reset = 0xffff,
+        .rsvd = 0xffff0000,
+        .ro = 0xffff,
+    },{ .name = "XRAM_SAFETY_CHK",  .addr = A_XRAM_SAFETY_CHK,
+    }
+};
+
+static void xram_ctrl_reset_enter(Object *obj, ResetType type)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    ARRAY_FIELD_DP32(s->regs, XRAM_IMP, SIZE, s->cfg.encoded_size);
+}
+
+static void xram_ctrl_reset_hold(Object *obj)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+
+    xram_update_irq(s);
+}
+
+static const MemoryRegionOps xram_ctrl_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void xram_ctrl_realize(DeviceState *dev, Error **errp)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(dev);
+
+    switch (s->cfg.size) {
+    case 64 * KiB:
+        s->cfg.encoded_size = 0;
+        break;
+    case 128 * KiB:
+        s->cfg.encoded_size = 1;
+        break;
+    case 256 * KiB:
+        s->cfg.encoded_size = 2;
+        break;
+    case 512 * KiB:
+        s->cfg.encoded_size = 3;
+        break;
+    case 1 * MiB:
+        s->cfg.encoded_size = 4;
+        break;
+    default:
+        error_setg(errp, "Unsupported XRAM size %" PRId64, s->cfg.size);
+        return;
+    }
+
+    memory_region_init_ram(&s->ram, OBJECT(s),
+                           object_get_canonical_path_component(OBJECT(s)),
+                           s->cfg.size, &error_fatal);
+    sysbus_init_mmio(sbd, &s->ram);
+}
+
+static void xram_ctrl_init(Object *obj)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), xram_ctrl_regs_info,
+                              ARRAY_SIZE(xram_ctrl_regs_info),
+                              s->regs_info, s->regs,
+                              &xram_ctrl_ops,
+                              XLNX_XRAM_CTRL_ERR_DEBUG,
+                              XRAM_CTRL_R_MAX * 4);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static void xram_ctrl_finalize(Object *obj)
+{
+    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_xram_ctrl = {
+    .name = TYPE_XLNX_XRAM_CTRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxXramCtrl, XRAM_CTRL_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static Property xram_ctrl_properties[] = {
+    DEFINE_PROP_UINT64("size", XlnxXramCtrl, cfg.size, 1 * MiB),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xram_ctrl_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = xram_ctrl_realize;
+    dc->vmsd = &vmstate_xram_ctrl;
+    device_class_set_props(dc, xram_ctrl_properties);
+
+    rc->phases.enter = xram_ctrl_reset_enter;
+    rc->phases.hold = xram_ctrl_reset_hold;
+}
+
+static const TypeInfo xram_ctrl_info = {
+    .name              = TYPE_XLNX_XRAM_CTRL,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(XlnxXramCtrl),
+    .class_init        = xram_ctrl_class_init,
+    .instance_init     = xram_ctrl_init,
+    .instance_finalize = xram_ctrl_finalize,
+};
+
+static void xram_ctrl_register_types(void)
+{
+    type_register_static(&xram_ctrl_info);
+}
+
+type_init(xram_ctrl_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c', 'zynq-xadc.c'))
+softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-xramc.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F4XX_EXTI', if_true: files('stm32f4xx_exti.c'))
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Connect the support for the Versal Accelerator RAMs (XRAMs).

Reviewed-by: Luc Michel <luc@lmichel.fr>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210308224637.2949533-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xlnx-versal-virt.rst |  1 +
 include/hw/arm/xlnx-versal.h         | 13 ++++++++++
 hw/arm/xlnx-versal.c                 | 36 ++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+)

diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/xlnx-versal-virt.rst
+++ b/docs/system/arm/xlnx-versal-virt.rst
@@ -XXX,XX +XXX,XX @@ Implemented devices:
 - 8 ADMA (Xilinx zDMA) channels
 - 2 SD Controllers
 - OCM (256KB of On Chip Memory)
+- XRAM (4MB of on chip Accelerator RAM)
 - DDR memory
 
 QEMU does not yet model any other devices, including the PL and the AI Engine.
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/or-irq.h"
 #include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
+#include "hw/misc/xlnx-versal-xramc.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
 #define XLNX_VERSAL_NR_GEMS    2
 #define XLNX_VERSAL_NR_ADMAS   8
 #define XLNX_VERSAL_NR_SDS     2
+#define XLNX_VERSAL_NR_XRAM    4
 #define XLNX_VERSAL_NR_IRQS    192
 
 struct Versal {
@@ -XXX,XX +XXX,XX @@ struct Versal {
             XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
             VersalUsb2 usb;
         } iou;
+
+        struct {
+            qemu_or_irq irq_orgate;
+            XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
+        } xram;
     } lpd;
 
     /* The Platform Management Controller subsystem.  */
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define VERSAL_GEM1_IRQ_0          58
 #define VERSAL_GEM1_WAKE_IRQ_0     59
 #define VERSAL_ADMA_IRQ_0          60
+#define VERSAL_XRAM_IRQ_0          79
 #define VERSAL_RTC_APB_ERR_IRQ     121
 #define VERSAL_SD0_IRQ_0           126
 #define VERSAL_RTC_ALARM_IRQ       142
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define MM_OCM                      0xfffc0000U
 #define MM_OCM_SIZE                 0x40000
 
+#define MM_XRAM                     0xfe800000
+#define MM_XRAMC                    0xff8e0000
+#define MM_XRAMC_SIZE               0x10000
+
 #define MM_USB2_CTRL_REGS           0xFF9D0000
 #define MM_USB2_CTRL_REGS_SIZE      0x10000
 
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ static void versal_create_rtc(Versal *s, qemu_irq *pic)
     sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
 }
 
+static void versal_create_xrams(Versal *s, qemu_irq *pic)
+{
+    int nr_xrams = ARRAY_SIZE(s->lpd.xram.ctrl);
+    DeviceState *orgate;
+    int i;
+
+    /* XRAM IRQs get ORed into a single line.  */
+    object_initialize_child(OBJECT(s), "xram-irq-orgate",
+                            &s->lpd.xram.irq_orgate, TYPE_OR_IRQ);
+    orgate = DEVICE(&s->lpd.xram.irq_orgate);
+    object_property_set_int(OBJECT(orgate),
+                            "num-lines", nr_xrams, &error_fatal);
+    qdev_realize(orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_XRAM_IRQ_0]);
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.xram.ctrl); i++) {
+        SysBusDevice *sbd;
+        MemoryRegion *mr;
+
+        object_initialize_child(OBJECT(s), "xram[*]", &s->lpd.xram.ctrl[i],
+                                TYPE_XLNX_XRAM_CTRL);
+        sbd = SYS_BUS_DEVICE(&s->lpd.xram.ctrl[i]);
+        sysbus_realize(sbd, &error_fatal);
+
+        mr = sysbus_mmio_get_region(sbd, 0);
+        memory_region_add_subregion(&s->mr_ps,
+                                    MM_XRAMC + i * MM_XRAMC_SIZE, mr);
+        mr = sysbus_mmio_get_region(sbd, 1);
+        memory_region_add_subregion(&s->mr_ps, MM_XRAM + i * MiB, mr);
+
+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(orgate, i));
+    }
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_admas(s, pic);
     versal_create_sds(s, pic);
     versal_create_rtc(s, pic);
+    versal_create_xrams(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

With -Werror=maybe-uninitialized configuration we get
../hw/i386/intel_iommu.c: In function ‘vtd_context_device_invalidate’:
../hw/i386/intel_iommu.c:1888:10: error: ‘mask’ may be used
uninitialized in this function [-Werror=maybe-uninitialized]
 1888 |     mask = ~mask;
      |     ~~~~~^~~~~~~

Add a g_assert_not_reached() to avoid the error.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20210309102742.30442-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/intel_iommu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -XXX,XX +XXX,XX @@ static void vtd_context_device_invalidate(IntelIOMMUState *s,
     case 3:
         mask = 7;   /* Mask bit 2:0 in the SID field */
         break;
+    default:
+        g_assert_not_reached();
     }
     mask = ~mask;
 
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Currently get_naturally_aligned_size() is used by the intel iommu
to compute the maximum invalidation range based on @size which is
a power of 2 while being aligned with the @start address and less
than the maximum range defined by @gaw.

This helper is also useful for other iommu devices (virtio-iommu,
SMMUv3) to make sure IOMMU UNMAP notifiers only are called with
power of 2 range sizes.

Let's move this latter into dma-helpers.c and rename it into
dma_aligned_pow2_mask(). Also rewrite the helper so that it
accomodates UINT64_MAX values for the size mask and max mask.
It now returns a mask instead of a size. Change the caller.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-id: 20210309102742.30442-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/dma.h  | 12 ++++++++++++
 hw/i386/intel_iommu.c | 30 +++++++-----------------------
 softmmu/dma-helpers.c | 26 ++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 23 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -XXX,XX +XXX,XX @@ uint64_t dma_buf_write(uint8_t *ptr, int32_t len, QEMUSGList *sg);
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
                     QEMUSGList *sg, enum BlockAcctType type);
 
+/**
+ * dma_aligned_pow2_mask: Return the address bit mask of the largest
+ * power of 2 size less or equal than @end - @start + 1, aligned with @start,
+ * and bounded by 1 << @max_addr_bits bits.
+ *
+ * @start: range start address
+ * @end: range end address (greater than @start)
+ * @max_addr_bits: max address bits (<= 64)
+ */
+uint64_t dma_aligned_pow2_mask(uint64_t start, uint64_t end,
+                               int max_addr_bits);
+
 #endif
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/i386/x86-iommu.h"
 #include "hw/pci-host/q35.h"
 #include "sysemu/kvm.h"
+#include "sysemu/dma.h"
 #include "sysemu/sysemu.h"
 #include "hw/i386/apic_internal.h"
 #include "kvm/kvm_i386.h"
@@ -XXX,XX +XXX,XX @@ VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus, int devfn)
     return vtd_dev_as;
 }
 
-static uint64_t get_naturally_aligned_size(uint64_t start,
-                                           uint64_t size, int gaw)
-{
-    uint64_t max_mask = 1ULL << gaw;
-    uint64_t alignment = start ? start & -start : max_mask;
-
-    alignment = MIN(alignment, max_mask);
-    size = MIN(size, max_mask);
-
-    if (alignment <= size) {
-        /* Increase the alignment of start */
-        return alignment;
-    } else {
-        /* Find the largest page mask from size */
-        return 1ULL << (63 - clz64(size));
-    }
-}
-
 /* Unmap the whole range in the notifier's scope. */
 static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
 {
@@ -XXX,XX +XXX,XX @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
 
     while (remain >= VTD_PAGE_SIZE) {
         IOMMUTLBEvent event;
-        uint64_t mask = get_naturally_aligned_size(start, remain, s->aw_bits);
+        uint64_t mask = dma_aligned_pow2_mask(start, end, s->aw_bits);
+        uint64_t size = mask + 1;
 
-        assert(mask);
+        assert(size);
 
         event.type = IOMMU_NOTIFIER_UNMAP;
         event.entry.iova = start;
-        event.entry.addr_mask = mask - 1;
+        event.entry.addr_mask = mask;
         event.entry.target_as = &address_space_memory;
         event.entry.perm = IOMMU_NONE;
         /* This field is meaningless for unmap */
@@ -XXX,XX +XXX,XX @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
 
         memory_region_notify_iommu_one(n, &event);
 
-        start += mask;
-        remain -= mask;
+        start += size;
+        remain -= size;
     }
 
     assert(!remain);
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -XXX,XX +XXX,XX @@ void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
 {
     block_acct_start(blk_get_stats(blk), cookie, sg->size, type);
 }
+
+uint64_t dma_aligned_pow2_mask(uint64_t start, uint64_t end, int max_addr_bits)
+{
+    uint64_t max_mask = UINT64_MAX, addr_mask = end - start;
+    uint64_t alignment_mask, size_mask;
+
+    if (max_addr_bits != 64) {
+        max_mask = (1ULL << max_addr_bits) - 1;
+    }
+
+    alignment_mask = start ? (start & -start) - 1 : max_mask;
+    alignment_mask = MIN(alignment_mask, max_mask);
+    size_mask = MIN(addr_mask, max_mask);
+
+    if (alignment_mask <= size_mask) {
+        /* Increase the alignment of start */
+        return alignment_mask;
+    } else {
+        /* Find the largest page mask from size */
+        if (addr_mask == UINT64_MAX) {
+            return UINT64_MAX;
+        }
+        return (1ULL << (63 - clz64(addr_mask + 1))) - 1;
+    }
+}
+
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Unmap notifiers work with an address mask assuming an
invalidation range of a power of 2. Nothing mandates this
in the VIRTIO-IOMMU spec.

So in case the range is not a power of 2, split it into
several invalidations.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-id: 20210309102742.30442-4-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/virtio/virtio-iommu.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
                                       hwaddr virt_end)
 {
     IOMMUTLBEvent event;
+    uint64_t delta = virt_end - virt_start;
 
     if (!(mr->iommu_notify_flags & IOMMU_NOTIFIER_UNMAP)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
 
     event.type = IOMMU_NOTIFIER_UNMAP;
     event.entry.target_as = &address_space_memory;
-    event.entry.addr_mask = virt_end - virt_start;
-    event.entry.iova = virt_start;
     event.entry.perm = IOMMU_NONE;
     event.entry.translated_addr = 0;
+    event.entry.addr_mask = delta;
+    event.entry.iova = virt_start;
 
-    memory_region_notify_iommu(mr, 0, event);
+    if (delta == UINT64_MAX) {
+        memory_region_notify_iommu(mr, 0, event);
+    }
+
+
+    while (virt_start != virt_end + 1) {
+        uint64_t mask = dma_aligned_pow2_mask(virt_start, virt_end, 64);
+
+        event.entry.addr_mask = mask;
+        event.entry.iova = virt_start;
+        memory_region_notify_iommu(mr, 0, event);
+        virt_start += mask + 1;
+    }
 }
 
 static gboolean virtio_iommu_notify_unmap_cb(gpointer key, gpointer value,
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

If the asid is not set, do not attempt to locate the key directly
as all inserted keys have a valid asid.

Use g_hash_table_foreach_remove instead.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210309102742.30442-5-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Eric Auger <eric.auger@redhat.com>

As of today, the driver can invalidate a number of pages that is
not a power of 2. However IOTLB unmap notifications and internal
IOTLB invalidations work with masks leading to erroneous
invalidations.

In case the range is not a power of 2, split invalidations into
power of 2 invalidations.

When looking for a single page entry in the vSMMU internal IOTLB,
let's make sure that if the entry is not found using a
g_hash_table_remove() we iterate over all the entries to find a
potential range that overlaps it.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210309102742.30442-6-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c | 30 ++++++++++++++++++------------
 hw/arm/smmuv3.c      | 24 ++++++++++++++++++++----
 2 files changed, 38 insertions(+), 16 deletions(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ inline void
 smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
                     uint8_t tg, uint64_t num_pages, uint8_t ttl)
 {
+    /* if tg is not set we use 4KB range invalidation */
+    uint8_t granule = tg ? tg * 2 + 10 : 12;
+
     if (ttl && (num_pages == 1) && (asid >= 0)) {
         SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
 
-        g_hash_table_remove(s->iotlb, &key);
-    } else {
-        /* if tg is not set we use 4KB range invalidation */
-        uint8_t granule = tg ? tg * 2 + 10 : 12;
-
-        SMMUIOTLBPageInvInfo info = {
-            .asid = asid, .iova = iova,
-            .mask = (num_pages * 1 << granule) - 1};
-
-        g_hash_table_foreach_remove(s->iotlb,
-                                    smmu_hash_remove_by_asid_iova,
-                                    &info);
+        if (g_hash_table_remove(s->iotlb, &key)) {
+            return;
+        }
+        /*
+         * if the entry is not found, let's see if it does not
+         * belong to a larger IOTLB entry
+         */
     }
+
+    SMMUIOTLBPageInvInfo info = {
+        .asid = asid, .iova = iova,
+        .mask = (num_pages * 1 << granule) - 1};
+
+    g_hash_table_foreach_remove(s->iotlb,
+                                smmu_hash_remove_by_asid_iova,
+                                &info);
 }
 
 inline void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     uint16_t vmid = CMD_VMID(cmd);
     bool leaf = CMD_LEAF(cmd);
     uint8_t tg = CMD_TG(cmd);
-    hwaddr num_pages = 1;
+    uint64_t first_page = 0, last_page;
+    uint64_t num_pages = 1;
     int asid = -1;
 
     if (tg) {
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
     }
-    trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-    smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-    smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
+
+    /* Split invalidations into ^2 range invalidations */
+    last_page = num_pages - 1;
+    while (num_pages) {
+        uint8_t granule = tg * 2 + 10;
+        uint64_t mask, count;
+
+        mask = dma_aligned_pow2_mask(first_page, last_page, 64 - granule);
+        count = mask + 1;
+
+        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, count, ttl, leaf);
+        smmuv3_inv_notifiers_iova(s, asid, addr, tg, count);
+        smmu_iotlb_inv_iova(s, asid, addr, tg, count, ttl);
+
+        num_pages -= count;
+        first_page += count;
+        addr += count * BIT_ULL(granule);
+    }
 }
 
 static int smmuv3_cmdq_consume(SMMUv3State *s)
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

If the whole SID range (32b) is invalidated (SMMU_CMD_CFGI_ALL),
@end overflows and we fail to handle the command properly.

Once this gets fixed, the current code really is awkward in the
sense it loops over the whole range instead of removing the
currently cached configs through a hash table lookup.

Fix both the overflow and the lookup.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210309102742.30442-7-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h |  5 +++++
 hw/arm/smmuv3.c        | 34 ++++++++++++++++++++--------------
 2 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUIOTLBPageInvInfo {
     uint64_t mask;
 } SMMUIOTLBPageInvInfo;
 
+typedef struct SMMUSIDRange {
+    uint32_t start;
+    uint32_t end;
+} SMMUSIDRange;
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/arm/smmuv3.h"
 #include "smmuv3-internal.h"
+#include "smmu-internal.h"
 
 /**
  * smmuv3_trigger_irq - pulse @irq if enabled and update
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     }
 }
 
+static gboolean
+smmuv3_invalidate_ste(gpointer key, gpointer value, gpointer user_data)
+{
+    SMMUDevice *sdev = (SMMUDevice *)key;
+    uint32_t sid = smmu_get_sid(sdev);
+    SMMUSIDRange *sid_range = (SMMUSIDRange *)user_data;
+
+    if (sid < sid_range->start || sid > sid_range->end) {
+        return false;
+    }
+    trace_smmuv3_config_cache_inv(sid);
+    return true;
+}
+
 static int smmuv3_cmdq_consume(SMMUv3State *s)
 {
     SMMUState *bs = ARM_SMMU(s);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         }
         case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
         {
-            uint32_t start = CMD_SID(&cmd), end, i;
+            uint32_t start = CMD_SID(&cmd);
             uint8_t range = CMD_STE_RANGE(&cmd);
+            uint64_t end = start + (1ULL << (range + 1)) - 1;
+            SMMUSIDRange sid_range = {start, end};
 
             if (CMD_SSEC(&cmd)) {
                 cmd_error = SMMU_CERROR_ILL;
                 break;
             }
-
-            end = start + (1 << (range + 1)) - 1;
             trace_smmuv3_cmdq_cfgi_ste_range(start, end);
-
-            for (i = start; i <= end; i++) {
-                IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, i);
-                SMMUDevice *sdev;
-
-                if (!mr) {
-                    continue;
-                }
-                sdev = container_of(mr, SMMUDevice, iommu);
-                smmuv3_flush_config(sdev);
-            }
+            g_hash_table_foreach_remove(bs->configs, smmuv3_invalidate_ste,
+                                        &sid_range);
             break;
         }
         case SMMU_CMD_CFGI_CD:
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Convert all sid printouts to sid=0x%x.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20210309102742.30442-8-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/trace-events | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
 smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
 smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
 smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
-smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
+smmuv3_record_event(const char *type, uint32_t sid) "%s sid=0x%x"
+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "sid=0x%x features:0x%x, sid_split:0x%x"
 smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%"PRIx64" l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
 smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
-smmuv3_translate_disable(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass (smmu disabled) iova:0x%"PRIx64" is_write=%d"
-smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d STE bypass iova:0x%"PRIx64" is_write=%d"
-smmuv3_translate_abort(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d abort on iova:0x%"PRIx64" is_write=%d"
-smmuv3_translate_success(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
+smmuv3_translate_disable(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x bypass (smmu disabled) iova:0x%"PRIx64" is_write=%d"
+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x STE bypass iova:0x%"PRIx64" is_write=%d"
+smmuv3_translate_abort(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=0x%x abort on iova:0x%"PRIx64" is_write=%d"
+smmuv3_translate_success(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=0x%x iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
 smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
 smmuv3_decode_cd(uint32_t oas) "oas=%d"
 smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz, bool had) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d had:%d"
-smmuv3_cmdq_cfgi_ste(int streamid) "streamid =%d"
+smmuv3_cmdq_cfgi_ste(int streamid) "streamid= 0x%x"
 smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
-smmuv3_cmdq_cfgi_cd(uint32_t sid) "streamid = %d"
-smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid %d (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid %d (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid =%d asid =%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
+smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
+smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
+smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
+smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 smmuv3_cmdq_tlbi_nh(void) ""
 smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
-smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid %d"
+smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Missed out on compressing the second half of a predicate
with length vl % 512 > 256.

Adjust all of the x + (y << s) to x | (y << s) as a
general style fix.  Drop the extract64 because the input
uint64_t are known to be already zero-extended from the
current size of the predicate.

Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
     if (oprsz <= 8) {
         l = compress_bits(n[0] >> odd, esz);
         h = compress_bits(m[0] >> odd, esz);
-        d[0] = extract64(l + (h << (4 * oprsz)), 0, 8 * oprsz);
+        d[0] = l | (h << (4 * oprsz));
     } else {
         ARMPredicateReg tmp_m;
         intptr_t oprsz_16 = oprsz / 16;
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
             h = n[2 * i + 1];
             l = compress_bits(l >> odd, esz);
             h = compress_bits(h >> odd, esz);
-            d[i] = l + (h << 32);
+            d[i] = l | (h << 32);
         }
 
-        /* For VL which is not a power of 2, the results from M do not
-           align nicely with the uint64_t for D.  Put the aligned results
-           from M into TMP_M and then copy it into place afterward.  */
+        /*
+         * For VL which is not a multiple of 512, the results from M do not
+         * align nicely with the uint64_t for D.  Put the aligned results
+         * from M into TMP_M and then copy it into place afterward.
+         */
         if (oprsz & 15) {
-            d[i] = compress_bits(n[2 * i] >> odd, esz);
+            int final_shift = (oprsz & 15) * 2;
+
+            l = n[2 * i + 0];
+            h = n[2 * i + 1];
+            l = compress_bits(l >> odd, esz);
+            h = compress_bits(h >> odd, esz);
+            d[i] = l | (h << final_shift);
 
             for (i = 0; i < oprsz_16; i++) {
                 l = m[2 * i + 0];
                 h = m[2 * i + 1];
                 l = compress_bits(l >> odd, esz);
                 h = compress_bits(h >> odd, esz);
-                tmp_m.p[i] = l + (h << 32);
+                tmp_m.p[i] = l | (h << 32);
             }
-            tmp_m.p[i] = compress_bits(m[2 * i] >> odd, esz);
+            l = m[2 * i + 0];
+            h = m[2 * i + 1];
+            l = compress_bits(l >> odd, esz);
+            h = compress_bits(h >> odd, esz);
+            tmp_m.p[i] = l | (h << final_shift);
 
             swap_memmove(vd + oprsz / 2, &tmp_m, oprsz / 2);
         } else {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
                 h = m[2 * i + 1];
                 l = compress_bits(l >> odd, esz);
                 h = compress_bits(h >> odd, esz);
-                d[oprsz_16 + i] = l + (h << 32);
+                d[oprsz_16 + i] = l | (h << 32);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Wrote too much with low-half zip (zip1) with vl % 512 != 0.

Adjust all of the x + (y << s) to x | (y << s) as a style fix.

We only ever have exact overlap between D, M, and N.  Therefore
we only need a single temporary, and we do not need to check for
partial overlap.

Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
     intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
+    int esize = 1 << esz;
     uint64_t *d = vd;
     intptr_t i;
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
         mm = extract64(mm, high * half, half);
         nn = expand_bits(nn, esz);
         mm = expand_bits(mm, esz);
-        d[0] = nn + (mm << (1 << esz));
+        d[0] = nn | (mm << esize);
     } else {
-        ARMPredicateReg tmp_n, tmp_m;
+        ARMPredicateReg tmp;
 
         /* We produce output faster than we consume input.
            Therefore we must be mindful of possible overlap.  */
-        if ((vn - vd) < (uintptr_t)oprsz) {
-            vn = memcpy(&tmp_n, vn, oprsz);
-        }
-        if ((vm - vd) < (uintptr_t)oprsz) {
-            vm = memcpy(&tmp_m, vm, oprsz);
+        if (vd == vn) {
+            vn = memcpy(&tmp, vn, oprsz);
+            if (vd == vm) {
+                vm = vn;
+            }
+        } else if (vd == vm) {
+            vm = memcpy(&tmp, vm, oprsz);
         }
         if (high) {
             high = oprsz >> 1;
         }
 
-        if ((high & 3) == 0) {
+        if ((oprsz & 7) == 0) {
             uint32_t *n = vn, *m = vm;
             high >>= 2;
 
-            for (i = 0; i < DIV_ROUND_UP(oprsz, 8); i++) {
+            for (i = 0; i < oprsz / 8; i++) {
                 uint64_t nn = n[H4(high + i)];
                 uint64_t mm = m[H4(high + i)];
 
                 nn = expand_bits(nn, esz);
                 mm = expand_bits(mm, esz);
-                d[i] = nn + (mm << (1 << esz));
+                d[i] = nn | (mm << esize);
             }
         } else {
             uint8_t *n = vn, *m = vm;
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 
                 nn = expand_bits(nn, esz);
                 mm = expand_bits(mm, esz);
-                d16[H2(i)] = nn + (mm << (1 << esz));
+                d16[H2(i)] = nn | (mm << esize);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Wrote too much with punpk1 with vl % 512 != 0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_punpk_p)(void *vd, void *vn, uint32_t pred_desc)
             high = oprsz >> 1;
         }
 
-        if ((high & 3) == 0) {
+        if ((oprsz & 7) == 0) {
             uint32_t *n = vn;
             high >>= 2;
 
-            for (i = 0; i < DIV_ROUND_UP(oprsz, 8); i++) {
+            for (i = 0; i < oprsz / 8; i++) {
                 uint64_t nn = n[H4(high + i)];
                 d[i] = expand_bits(nn, 0);
             }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Since b64ee454a4a0, all predicate operations should be
using these field macros for predicates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 6 +++---
 target/arm/translate-sve.c | 7 +++----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_compact_d)(void *vd, void *vn, void *vg, uint32_t desc)
  */
 int32_t HELPER(sve_last_active_element)(void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
 
-    return last_active_element(vg, DIV_ROUND_UP(oprsz, 8), esz);
+    return last_active_element(vg, words, esz);
 }
 
 void HELPER(sve_splice)(void *vd, void *vn, void *vm, void *vg, uint32_t desc)
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void find_last_active(DisasContext *s, TCGv_i32 ret, int esz, int pg)
      */
     TCGv_ptr t_p = tcg_temp_new_ptr();
     TCGv_i32 t_desc;
-    unsigned vsz = pred_full_reg_size(s);
-    unsigned desc;
+    unsigned desc = 0;
 
-    desc = vsz - 2;
-    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, esz);
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pred_full_reg_size(s));
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, esz);
 
     tcg_gen_addi_ptr(t_p, cpu_env, pred_full_reg_offset(s, pg));
     t_desc = tcg_const_i32(desc);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Since b64ee454a4a0, all predicate operations should be
using these field macros for predicates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-6-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 30 ++++++++++++++----------------
 target/arm/translate-sve.c |  4 ++--
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t do_zero(ARMPredicateReg *d, intptr_t oprsz)
 void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
                        uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
         compute_brk_z(vd, vm, vg, oprsz, true);
     } else {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
 uint32_t HELPER(sve_brkpas)(void *vd, void *vn, void *vm, void *vg,
                             uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
         return compute_brks_z(vd, vm, vg, oprsz, true);
     } else {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkpas)(void *vd, void *vn, void *vm, void *vg,
 void HELPER(sve_brkpb)(void *vd, void *vn, void *vm, void *vg,
                        uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
         compute_brk_z(vd, vm, vg, oprsz, false);
     } else {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_brkpb)(void *vd, void *vn, void *vm, void *vg,
 uint32_t HELPER(sve_brkpbs)(void *vd, void *vn, void *vm, void *vg,
                             uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
         return compute_brks_z(vd, vm, vg, oprsz, false);
     } else {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkpbs)(void *vd, void *vn, void *vm, void *vg,
 
 void HELPER(sve_brka_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     compute_brk_z(vd, vn, vg, oprsz, true);
 }
 
 uint32_t HELPER(sve_brkas_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     return compute_brks_z(vd, vn, vg, oprsz, true);
 }
 
 void HELPER(sve_brkb_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     compute_brk_z(vd, vn, vg, oprsz, false);
 }
 
 uint32_t HELPER(sve_brkbs_z)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     return compute_brks_z(vd, vn, vg, oprsz, false);
 }
 
 void HELPER(sve_brka_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     compute_brk_m(vd, vn, vg, oprsz, true);
 }
 
 uint32_t HELPER(sve_brkas_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     return compute_brks_m(vd, vn, vg, oprsz, true);
 }
 
 void HELPER(sve_brkb_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     compute_brk_m(vd, vn, vg, oprsz, false);
 }
 
 uint32_t HELPER(sve_brkbs_m)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     return compute_brks_m(vd, vn, vg, oprsz, false);
 }
 
 void HELPER(sve_brkn)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (!last_active_pred(vn, vg, oprsz)) {
         do_zero(vd, oprsz);
     }
@@ -XXX,XX +XXX,XX @@ static uint32_t predtest_ones(ARMPredicateReg *d, intptr_t oprsz,
 
 uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
         return predtest_ones(vd, oprsz, -1);
     } else {
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_brk3(DisasContext *s, arg_rprr_s *a,
     TCGv_ptr n = tcg_temp_new_ptr();
     TCGv_ptr m = tcg_temp_new_ptr();
     TCGv_ptr g = tcg_temp_new_ptr();
-    TCGv_i32 t = tcg_const_i32(vsz - 2);
+    TCGv_i32 t = tcg_const_i32(FIELD_DP32(0, PREDDESC, OPRSZ, vsz));
 
     tcg_gen_addi_ptr(d, cpu_env, pred_full_reg_offset(s, a->rd));
     tcg_gen_addi_ptr(n, cpu_env, pred_full_reg_offset(s, a->rn));
@@ -XXX,XX +XXX,XX @@ static bool do_brk2(DisasContext *s, arg_rpr_s *a,
     TCGv_ptr d = tcg_temp_new_ptr();
     TCGv_ptr n = tcg_temp_new_ptr();
     TCGv_ptr g = tcg_temp_new_ptr();
-    TCGv_i32 t = tcg_const_i32(vsz - 2);
+    TCGv_i32 t = tcg_const_i32(FIELD_DP32(0, PREDDESC, OPRSZ, vsz));
 
     tcg_gen_addi_ptr(d, cpu_env, pred_full_reg_offset(s, a->rd));
     tcg_gen_addi_ptr(n, cpu_env, pred_full_reg_offset(s, a->rn));
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Since b64ee454a4a0, all predicate operations should be
using these field macros for predicates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-7-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 6 +++---
 target/arm/translate-sve.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 
 uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     uint64_t *n = vn, *g = vg, sum = 0, mask = pred_esz_masks[esz];
     intptr_t i;
 
-    for (i = 0; i < DIV_ROUND_UP(oprsz, 8); ++i) {
+    for (i = 0; i < words; ++i) {
         uint64_t t = n[i] & g[i] & mask;
         sum += ctpop64(t);
     }
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_cntp(DisasContext *s, TCGv_i64 val, int esz, int pn, int pg)
     } else {
         TCGv_ptr t_pn = tcg_temp_new_ptr();
         TCGv_ptr t_pg = tcg_temp_new_ptr();
-        unsigned desc;
+        unsigned desc = 0;
         TCGv_i32 t_desc;
 
-        desc = psz - 2;
-        desc = deposit32(desc, SIMD_DATA_SHIFT, 2, esz);
+        desc = FIELD_DP32(desc, PREDDESC, OPRSZ, psz);
+        desc = FIELD_DP32(desc, PREDDESC, ESZ, esz);
 
         tcg_gen_addi_ptr(t_pn, cpu_env, pred_full_reg_offset(s, pn));
         tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Since b64ee454a4a0, all predicate operations should be
using these field macros for predicates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-8-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 4 ++--
 target/arm/translate-sve.c | 7 ++++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
 
 uint32_t HELPER(sve_while)(void *vd, uint32_t count, uint32_t pred_desc)
 {
-    uintptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     uint64_t esz_mask = pred_esz_masks[esz];
     ARMPredicateReg *d = vd;
     uint32_t flags;
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     TCGv_i64 op0, op1, t0, t1, tmax;
     TCGv_i32 t2, t3;
     TCGv_ptr ptr;
-    unsigned desc, vsz = vec_full_reg_size(s);
+    unsigned vsz = vec_full_reg_size(s);
+    unsigned desc = 0;
     TCGCond cond;
 
     if (!sve_access_check(s)) {
@@ -XXX,XX +XXX,XX @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     /* Scale elements to bits.  */
     tcg_gen_shli_i32(t2, t2, a->esz);
 
-    desc = (vsz / 8) - 2;
-    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz / 8);
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
     t3 = tcg_const_i32(desc);
 
     ptr = tcg_temp_new_ptr();
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

With the reduction operations, we intentionally increase maxsz to
the next power of 2, so as to fill out the reduction tree correctly.
Since e2e7168a214b, oprsz must equal maxsz, with exceptions for small
vectors, so this triggers an assertion for vector sizes > 32 that are
not themselves a power of 2.

Pass the power-of-two value in the simd_data field instead.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210309155305.11301-9-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 2 +-
 target/arm/translate-sve.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static TYPE NAME##_reduce(TYPE *data, float_status *status, uintptr_t n) \
 }                                                                     \
 uint64_t HELPER(NAME)(void *vn, void *vg, void *vs, uint32_t desc)    \
 {                                                                     \
-    uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_maxsz(desc);  \
+    uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_data(desc);   \
     TYPE data[sizeof(ARMVectorReg) / sizeof(TYPE)];                   \
     for (i = 0; i < oprsz; ) {                                        \
         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));               \
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_reduce(DisasContext *s, arg_rpr_esz *a,
 {
     unsigned vsz = vec_full_reg_size(s);
     unsigned p2vsz = pow2ceil(vsz);
-    TCGv_i32 t_desc = tcg_const_i32(simd_desc(vsz, p2vsz, 0));
+    TCGv_i32 t_desc = tcg_const_i32(simd_desc(vsz, vsz, p2vsz));
     TCGv_ptr t_zn, t_pg, status;
     TCGv_i64 temp;
 
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

Currently the emulated EMAC for sun8i always traverses the transmit queue
from the head when transferring packets. It searches for a list of consecutive
descriptors whichs are flagged as ready for processing and transmits their payloads
accordingly. The controller stops processing once it finds a descriptor that is not
marked ready.

While the above behaviour works in most situations, it is not the same as the actual
EMAC in hardware. Actual hardware uses the TX_CUR_DESC register value to keep track
of the last position in the transmit queue and continues processing from that position
when software triggers the start of DMA processing. The currently emulated behaviour can
lead to packet loss on transmit when software fills the transmit queue with ready
descriptors that overlap the tail of the circular list.

This commit modifies the emulated EMAC for sun8i such that it processes
the transmit queue using the TX_CUR_DESC register in the same way as hardware.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210310195820.21950-2-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/allwinner-sun8i-emac.c | 62 +++++++++++++++++++----------------
 1 file changed, 34 insertions(+), 28 deletions(-)

diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/allwinner-sun8i-emac.c
+++ b/hw/net/allwinner-sun8i-emac.c
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_update_irq(AwSun8iEmacState *s)
     qemu_set_irq(s->irq, (s->int_sta & s->int_en) != 0);
 }
 
-static uint32_t allwinner_sun8i_emac_next_desc(AwSun8iEmacState *s,
-                                               FrameDescriptor *desc,
-                                               size_t min_size)
+static bool allwinner_sun8i_emac_desc_owned(FrameDescriptor *desc,
+                                            size_t min_buf_size)
 {
-    uint32_t paddr = desc->next;
-
-    dma_memory_read(&s->dma_as, paddr, desc, sizeof(*desc));
-
-    if ((desc->status & DESC_STATUS_CTL) &&
-        (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
-        return paddr;
-    } else {
-        return 0;
-    }
+    return (desc->status & DESC_STATUS_CTL) && (min_buf_size == 0 ||
+           (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_buf_size);
 }
 
-static uint32_t allwinner_sun8i_emac_get_desc(AwSun8iEmacState *s,
-                                              FrameDescriptor *desc,
-                                              uint32_t start_addr,
-                                              size_t min_size)
+static void allwinner_sun8i_emac_get_desc(AwSun8iEmacState *s,
+                                          FrameDescriptor *desc,
+                                          uint32_t phys_addr)
+{
+    dma_memory_read(&s->dma_as, phys_addr, desc, sizeof(*desc));
+}
+
+static uint32_t allwinner_sun8i_emac_next_desc(AwSun8iEmacState *s,
+                                               FrameDescriptor *desc)
+{
+    const uint32_t nxt = desc->next;
+    allwinner_sun8i_emac_get_desc(s, desc, nxt);
+    return nxt;
+}
+
+static uint32_t allwinner_sun8i_emac_find_desc(AwSun8iEmacState *s,
+                                               FrameDescriptor *desc,
+                                               uint32_t start_addr,
+                                               size_t min_size)
 {
     uint32_t desc_addr = start_addr;
 
     /* Note that the list is a cycle. Last entry points back to the head. */
     while (desc_addr != 0) {
-        dma_memory_read(&s->dma_as, desc_addr, desc, sizeof(*desc));
+        allwinner_sun8i_emac_get_desc(s, desc, desc_addr);
 
-        if ((desc->status & DESC_STATUS_CTL) &&
-            (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
+        if (allwinner_sun8i_emac_desc_owned(desc, min_size)) {
             return desc_addr;
         } else if (desc->next == start_addr) {
             break;
@@ -XXX,XX +XXX,XX @@ static uint32_t allwinner_sun8i_emac_rx_desc(AwSun8iEmacState *s,
                                              FrameDescriptor *desc,
                                              size_t min_size)
 {
-    return allwinner_sun8i_emac_get_desc(s, desc, s->rx_desc_curr, min_size);
+    return allwinner_sun8i_emac_find_desc(s, desc, s->rx_desc_curr, min_size);
 }
 
 static uint32_t allwinner_sun8i_emac_tx_desc(AwSun8iEmacState *s,
-                                             FrameDescriptor *desc,
-                                             size_t min_size)
+                                             FrameDescriptor *desc)
 {
-    return allwinner_sun8i_emac_get_desc(s, desc, s->tx_desc_head, min_size);
+    allwinner_sun8i_emac_get_desc(s, desc, s->tx_desc_curr);
+    return s->tx_desc_curr;
 }
 
 static void allwinner_sun8i_emac_flush_desc(AwSun8iEmacState *s,
@@ -XXX,XX +XXX,XX @@ static ssize_t allwinner_sun8i_emac_receive(NetClientState *nc,
         bytes_left -= desc_bytes;
 
         /* Move to the next descriptor */
-        s->rx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc, 64);
+        s->rx_desc_curr = allwinner_sun8i_emac_find_desc(s, &desc, desc.next,
+                                                         AW_SUN8I_EMAC_MIN_PKT_SZ);
         if (!s->rx_desc_curr) {
             /* Not enough buffer space available */
             s->int_sta |= INT_STA_RX_BUF_UA;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
     size_t transmitted = 0;
     static uint8_t packet_buf[2048];
 
-    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc, 0);
+    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc);
 
     /* Read all transmit descriptors */
-    while (s->tx_desc_curr != 0) {
+    while (allwinner_sun8i_emac_desc_owned(&desc, 0)) {
 
         /* Read from physical memory into packet buffer */
         bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
             packet_bytes = 0;
             transmitted++;
         }
-        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc, 0);
+        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(s, &desc);
     }
 
     /* Raise transmit completed interrupt */
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The image for Armbian 19.11.3 bionic has been removed from the armbian server.
Without the image as input the test arm_orangepi_bionic_19_11 cannot run.

This commit removes the test completely and merges the code of the generic function
do_test_arm_orangepi_uboot_armbian back with the 20.08 test.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Message-id: 20210310195820.21950-3-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 72 ++++++++------------------
 1 file changed, 23 insertions(+), 49 deletions(-)

From: Niek Linnenbank <nieklinnenbank@gmail.com>

Update the download URL of the Armbian 20.08 Bionic image for
test_arm_orangepi_bionic_20_08 of the orangepi-pc machine.

The archive.armbian.com URL contains more images and should keep stable
for a longer period of time than dl.armbian.com.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Message-id: 20210310195820.21950-4-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The linux kernel 4.20.7 binary for sunxi has been removed from apt.armbian.com:

$ ARMBIAN_ARTIFACTS_CACHED=yes AVOCADO_ALLOW_LARGE_STORAGE=yes avocado --show=app,console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
  Fetching asset from tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi
  ...
  (1/6) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
    CANCEL: Missing asset https://apt.armbian.com/pool/main/l/linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb (0.55 s)

This commit updates the sunxi kernel to 5.10.16 for the acceptance
tests of the orangepi-pc and cubieboard machines.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Message-id: 20210310195820.21950-5-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 40 +++++++++++++-------------
 tests/acceptance/replay_kernel.py      |  8 +++---
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
         :avocado: tags=machine:cubieboard
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_sata(self):
         :avocado: tags=machine:cubieboard
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
         rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi(self):
         :avocado: tags=machine:orangepi-pc
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
 
         self.vm.set_console()
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_initrd(self):
         :avocado: tags=machine:orangepi-pc
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):
         :avocado: tags=device:sd
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
         rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'
                       'kci-2019.02/armel/base/rootfs.ext2.xz')
diff --git a/tests/acceptance/replay_kernel.py b/tests/acceptance/replay_kernel.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/replay_kernel.py
+++ b/tests/acceptance/replay_kernel.py
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
         :avocado: tags=machine:cubieboard
         """
         deb_url = ('https://apt.armbian.com/pool/main/l/'
-                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                   'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
+        deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
         deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
         kernel_path = self.extract_from_deb(deb_path,
-                                            '/boot/vmlinuz-4.20.7-sunxi')
-        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+                                            '/boot/vmlinuz-5.10.16-sunxi')
+        dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
         dtb_path = self.extract_from_deb(deb_path, dtb_path)
         initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
                       '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

Previously the ARMBIAN_ARTIFACTS_CACHED pre-condition was added to allow running
tests that have already existing armbian.com artifacts stored in the local avocado cache,
but do not have working URLs to download a fresh copy.

At this time of writing the URLs for artifacts on the armbian.com server are updated and working.
Any future broken URLs will result in a skipped acceptance test, for example:

(1/5) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
  CANCEL: Missing asset https://apt.armbian.com/pool/main/l/linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb (0.53 s)

This commits removes the ARMBIAN_ARTIFACTS_CACHED pre-condition such that
the acceptance tests for the orangepi-pc and cubieboard machines can run.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Message-id: 20210310195820.21950-6-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 12 ------------
 tests/acceptance/replay_kernel.py      |  2 --
 2 files changed, 14 deletions(-)

From: Andrew Jones <drjones@redhat.com>

Prior to commit f2ce39b4f067 a MachineClass kvm_type method
only needed to be registered to ensure it would be executed.
With commit f2ce39b4f067 a kvm-type machine property must also
be specified. hw/arm/virt relies on the kvm_type method to pass
its selected IPA limit to KVM, but this is not exposed as a
machine property. Restore the previous functionality of invoking
kvm_type when it's present.

Fixes: f2ce39b4f067 ("vl: make qemu_get_machine_opts static")
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210310135218.255205-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/boards.h | 1 +
 accel/kvm/kvm-all.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  * @kvm_type:
  *    Return the type of KVM corresponding to the kvm-type string option or
  *    computed based on other criteria such as the host kernel capabilities.
+ *    kvm-type may be NULL if it is not needed.
  * @numa_mem_supported:
  *    true if '--numa node.mem' option is supported and false otherwise
  * @smp_parse:
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
                                                             "kvm-type",
                                                             &error_abort);
         type = mc->kvm_type(ms, kvm_type);
+    } else if (mc->kvm_type) {
+        type = mc->kvm_type(ms, NULL);
     }
 
     do {
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

The virt machine already checks KVM_CAP_ARM_VM_IPA_SIZE to get the
upper bound of the IPA size. If that bound is lower than the highest
possible GPA for the machine, then QEMU will error out. However, the
IPA is set to 40 when the highest GPA is less than or equal to 40,
even when KVM may support an IPA limit as low as 32. This means KVM
may fail the VM creation unnecessarily. Additionally, 40 is selected
with the value 0, which means use the default, and that gets around
a check in some versions of KVM, causing a difficult to debug fail.
Always use the IPA size that corresponds to the highest possible GPA,
unless it's lower than 32, in which case use 32. Also, we must still
use 0 when KVM only supports the legacy fixed 40 bit IPA.

Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Message-id: 20210310135218.255205-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h |  6 ++++--
 hw/arm/virt.c        | 23 ++++++++++++++++-------
 target/arm/kvm.c     |  4 +++-
 3 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void);
 /**
  * kvm_arm_get_max_vm_ipa_size:
  * @ms: Machine state handle
+ * @fixed_ipa: True when the IPA limit is fixed at 40. This is the case
+ * for legacy KVM.
  *
  * Returns the number of bits in the IPA address space supported by KVM
  */
-int kvm_arm_get_max_vm_ipa_size(MachineState *ms);
+int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa);
 
 /**
  * kvm_arm_sync_mpstate_to_kvm:
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_add_vcpu_properties(Object *obj)
     g_assert_not_reached();
 }
 
-static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
 {
     g_assert_not_reached();
 }
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
 static int virt_kvm_type(MachineState *ms, const char *type_str)
 {
     VirtMachineState *vms = VIRT_MACHINE(ms);
-    int max_vm_pa_size = kvm_arm_get_max_vm_ipa_size(ms);
-    int requested_pa_size;
+    int max_vm_pa_size, requested_pa_size;
+    bool fixed_ipa;
+
+    max_vm_pa_size = kvm_arm_get_max_vm_ipa_size(ms, &fixed_ipa);
 
     /* we freeze the memory map to compute the highest gpa */
     virt_set_memmap(vms);
 
     requested_pa_size = 64 - clz64(vms->highest_gpa);
 
+    /*
+     * KVM requires the IPA size to be at least 32 bits.
+     */
+    if (requested_pa_size < 32) {
+        requested_pa_size = 32;
+    }
+
     if (requested_pa_size > max_vm_pa_size) {
         error_report("-m and ,maxmem option values "
                      "require an IPA range (%d bits) larger than "
                      "the one supported by the host (%d bits)",
                      requested_pa_size, max_vm_pa_size);
-       exit(1);
+        exit(1);
     }
     /*
-     * By default we return 0 which corresponds to an implicit legacy
-     * 40b IPA setting. Otherwise we return the actual requested PA
-     * logsize
+     * We return the requested PA log size, unless KVM only supports
+     * the implicit legacy 40b IPA setting, in which case the kvm_type
+     * must be 0.
      */
-    return requested_pa_size > 40 ? requested_pa_size : 0;
+    return fixed_ipa ? 0 : requested_pa_size;
 }
 
 static void virt_machine_class_init(ObjectClass *oc, void *data)
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_pmu_supported(void)
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_PMU_V3);
 }
 
-int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
 {
     KVMState *s = KVM_STATE(ms->accelerator);
     int ret;
 
     ret = kvm_check_extension(s, KVM_CAP_ARM_VM_IPA_SIZE);
+    *fixed_ipa = ret <= 0;
+
     return ret > 0 ? ret : 40;
 }
 
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch adds GPIOs in NPCM7xx PWM module for its duty values.
The purpose of this is to connect it to the MFT module to provide
an input for measuring a PWM fan's RPM. Each PWM module has
NPCM7XX_PWM_PER_MODULE of GPIOs, each one corresponds to
one PWM instance and can connect to multiple fan instances in MFT.

Reviewed-by: Doug Evans <dje@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210311180855.149764-2-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/npcm7xx_pwm.h | 4 +++-
 hw/misc/npcm7xx_pwm.c         | 4 ++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/hw/misc/npcm7xx_pwm.h b/include/hw/misc/npcm7xx_pwm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/npcm7xx_pwm.h
+++ b/include/hw/misc/npcm7xx_pwm.h
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxPWM {
  * @iomem: Memory region through which registers are accessed.
  * @clock: The PWM clock.
  * @pwm: The PWM channels owned by this module.
+ * @duty_gpio_out: The duty cycle of each PWM channels as a output GPIO.
  * @ppr: The prescaler register.
  * @csr: The clock selector register.
  * @pcr: The control register.
@@ -XXX,XX +XXX,XX @@ struct NPCM7xxPWMState {
     MemoryRegion iomem;
 
     Clock       *clock;
-    NPCM7xxPWM pwm[NPCM7XX_PWM_PER_MODULE];
+    NPCM7xxPWM  pwm[NPCM7XX_PWM_PER_MODULE];
+    qemu_irq    duty_gpio_out[NPCM7XX_PWM_PER_MODULE];
 
     uint32_t    ppr;
     uint32_t    csr;
diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_update_duty(NPCM7xxPWM *p)
         trace_npcm7xx_pwm_update_duty(DEVICE(p->module)->canonical_path,
                                       p->index, p->duty, duty);
         p->duty = duty;
+        qemu_set_irq(p->module->duty_gpio_out[p->index], p->duty);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_init(Object *obj)
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     int i;
 
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(s->pwm) != NPCM7XX_PWM_PER_MODULE);
     for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
         NPCM7xxPWM *p = &s->pwm[i];
         p->module = s;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_init(Object *obj)
         object_property_add_uint32_ptr(obj, "duty[*]",
                 &s->pwm[i].duty, OBJ_PROP_FLAG_READ);
     }
+    qdev_init_gpio_out_named(DEVICE(s), s->duty_gpio_out,
+                             "duty-gpio-out", NPCM7XX_PWM_PER_MODULE);
 }
 
 static const VMStateDescription vmstate_npcm7xx_pwm = {
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch implements Multi Function Timer (MFT) module for NPCM7XX.
This module is mainly used to configure PWM fans. It has just enough
functionality to make the PWM fan kernel module work.

The module takes two input, the max_rpm of a fan (modifiable via QMP)
and duty cycle (a GPIO from the PWM module.) The actual measured RPM
is equal to max_rpm * duty_cycle / NPCM7XX_PWM_MAX_DUTY. The RPM is
measured as a counter compared to a prescaled input clock. The kernel
driver reads this counter and report to user space.

Refs:
https://github.com/torvalds/linux/blob/master/drivers/hwmon/npcm750-pwm-fan.c

Reviewed-by: Doug Evans <dje@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210311180855.149764-3-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/npcm7xx_mft.h |  70 +++++
 hw/misc/npcm7xx_mft.c         | 540 ++++++++++++++++++++++++++++++++++
 hw/misc/meson.build           |   1 +
 hw/misc/trace-events          |   8 +
 4 files changed, 619 insertions(+)
 create mode 100644 include/hw/misc/npcm7xx_mft.h
 create mode 100644 hw/misc/npcm7xx_mft.c

diff --git a/include/hw/misc/npcm7xx_mft.h b/include/hw/misc/npcm7xx_mft.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/npcm7xx_mft.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx MFT Module
+ *
+ * Copyright 2021 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+#ifndef NPCM7XX_MFT_H
+#define NPCM7XX_MFT_H
+
+#include "exec/memory.h"
+#include "hw/clock.h"
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+/* Max Fan input number. */
+#define NPCM7XX_MFT_MAX_FAN_INPUT 19
+
+/*
+ * Number of registers in one MFT module. Don't change this without increasing
+ * the version_id in vmstate.
+ */
+#define NPCM7XX_MFT_NR_REGS (0x20 / sizeof(uint16_t))
+
+/*
+ * The MFT can take up to 4 inputs: A0, B0, A1, B1. It can measure one A and one
+ * B simultaneously. NPCM7XX_MFT_INASEL and NPCM7XX_MFT_INBSEL are used to
+ * select which A or B input are used.
+ */
+#define NPCM7XX_MFT_FANIN_COUNT 4
+
+/**
+ * struct NPCM7xxMFTState - Multi Functional Tachometer device state.
+ * @parent: System bus device.
+ * @iomem: Memory region through which registers are accessed.
+ * @clock_in: The input clock for MFT from CLK module.
+ * @clock_{1,2}: The counter clocks for NPCM7XX_MFT_CNT{1,2}
+ * @irq: The IRQ for this MFT state.
+ * @regs: The MMIO registers.
+ * @max_rpm: The maximum rpm for fans. Order: A0, B0, A1, B1.
+ * @duty: The duty cycles for fans, relative to NPCM7XX_PWM_MAX_DUTY.
+ */
+typedef struct NPCM7xxMFTState {
+    SysBusDevice parent;
+
+    MemoryRegion iomem;
+
+    Clock       *clock_in;
+    Clock       *clock_1, *clock_2;
+    qemu_irq    irq;
+    uint16_t    regs[NPCM7XX_MFT_NR_REGS];
+
+    uint32_t    max_rpm[NPCM7XX_MFT_FANIN_COUNT];
+    uint32_t    duty[NPCM7XX_MFT_FANIN_COUNT];
+} NPCM7xxMFTState;
+
+#define TYPE_NPCM7XX_MFT "npcm7xx-mft"
+#define NPCM7XX_MFT(obj) \
+    OBJECT_CHECK(NPCM7xxMFTState, (obj), TYPE_NPCM7XX_MFT)
+
+#endif /* NPCM7XX_MFT_H */
diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/npcm7xx_mft.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx MFT Module
+ *
+ * Copyright 2021 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/npcm7xx_mft.h"
+#include "hw/misc/npcm7xx_pwm.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "qemu/bitops.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/timer.h"
+#include "qemu/units.h"
+#include "trace.h"
+
+/*
+ * Some of the registers can only accessed via 16-bit ops and some can only
+ * be accessed via 8-bit ops. However we mark all of them using REG16 to
+ * simplify implementation. npcm7xx_mft_check_mem_op checks the access length
+ * of memory operations.
+ */
+REG16(NPCM7XX_MFT_CNT1, 0x00);
+REG16(NPCM7XX_MFT_CRA, 0x02);
+REG16(NPCM7XX_MFT_CRB, 0x04);
+REG16(NPCM7XX_MFT_CNT2, 0x06);
+REG16(NPCM7XX_MFT_PRSC, 0x08);
+REG16(NPCM7XX_MFT_CKC, 0x0a);
+REG16(NPCM7XX_MFT_MCTRL, 0x0c);
+REG16(NPCM7XX_MFT_ICTRL, 0x0e);
+REG16(NPCM7XX_MFT_ICLR, 0x10);
+REG16(NPCM7XX_MFT_IEN, 0x12);
+REG16(NPCM7XX_MFT_CPA, 0x14);
+REG16(NPCM7XX_MFT_CPB, 0x16);
+REG16(NPCM7XX_MFT_CPCFG, 0x18);
+REG16(NPCM7XX_MFT_INASEL, 0x1a);
+REG16(NPCM7XX_MFT_INBSEL, 0x1c);
+
+/* Register Fields */
+#define NPCM7XX_MFT_CKC_C2CSEL          BIT(3)
+#define NPCM7XX_MFT_CKC_C1CSEL          BIT(0)
+
+#define NPCM7XX_MFT_MCTRL_TBEN          BIT(6)
+#define NPCM7XX_MFT_MCTRL_TAEN          BIT(5)
+#define NPCM7XX_MFT_MCTRL_TBEDG         BIT(4)
+#define NPCM7XX_MFT_MCTRL_TAEDG         BIT(3)
+#define NPCM7XX_MFT_MCTRL_MODE5         BIT(2)
+
+#define NPCM7XX_MFT_ICTRL_TFPND         BIT(5)
+#define NPCM7XX_MFT_ICTRL_TEPND         BIT(4)
+#define NPCM7XX_MFT_ICTRL_TDPND         BIT(3)
+#define NPCM7XX_MFT_ICTRL_TCPND         BIT(2)
+#define NPCM7XX_MFT_ICTRL_TBPND         BIT(1)
+#define NPCM7XX_MFT_ICTRL_TAPND         BIT(0)
+
+#define NPCM7XX_MFT_ICLR_TFCLR          BIT(5)
+#define NPCM7XX_MFT_ICLR_TECLR          BIT(4)
+#define NPCM7XX_MFT_ICLR_TDCLR          BIT(3)
+#define NPCM7XX_MFT_ICLR_TCCLR          BIT(2)
+#define NPCM7XX_MFT_ICLR_TBCLR          BIT(1)
+#define NPCM7XX_MFT_ICLR_TACLR          BIT(0)
+
+#define NPCM7XX_MFT_IEN_TFIEN           BIT(5)
+#define NPCM7XX_MFT_IEN_TEIEN           BIT(4)
+#define NPCM7XX_MFT_IEN_TDIEN           BIT(3)
+#define NPCM7XX_MFT_IEN_TCIEN           BIT(2)
+#define NPCM7XX_MFT_IEN_TBIEN           BIT(1)
+#define NPCM7XX_MFT_IEN_TAIEN           BIT(0)
+
+#define NPCM7XX_MFT_CPCFG_GET_B(rv)     extract8((rv), 4, 4)
+#define NPCM7XX_MFT_CPCFG_GET_A(rv)     extract8((rv), 0, 4)
+#define NPCM7XX_MFT_CPCFG_HIEN          BIT(3)
+#define NPCM7XX_MFT_CPCFG_EQEN          BIT(2)
+#define NPCM7XX_MFT_CPCFG_LOEN          BIT(1)
+#define NPCM7XX_MFT_CPCFG_CPSEL         BIT(0)
+
+#define NPCM7XX_MFT_INASEL_SELA         BIT(0)
+#define NPCM7XX_MFT_INBSEL_SELB         BIT(0)
+
+/* Max CNT values of the module. The CNT value is a countdown from it. */
+#define NPCM7XX_MFT_MAX_CNT             0xFFFF
+
+/* Each fan revolution should generated 2 pulses */
+#define NPCM7XX_MFT_PULSE_PER_REVOLUTION 2
+
+typedef enum NPCM7xxMFTCaptureState {
+    /* capture succeeded with a valid CNT value. */
+    NPCM7XX_CAPTURE_SUCCEED,
+    /* capture stopped prematurely due to reaching CPCFG condition. */
+    NPCM7XX_CAPTURE_COMPARE_HIT,
+    /* capture fails since it reaches underflow condition for CNT. */
+    NPCM7XX_CAPTURE_UNDERFLOW,
+} NPCM7xxMFTCaptureState;
+
+static void npcm7xx_mft_reset(NPCM7xxMFTState *s)
+{
+    int i;
+
+    /* Only registers PRSC ~ INBSEL need to be reset. */
+    for (i = R_NPCM7XX_MFT_PRSC; i <= R_NPCM7XX_MFT_INBSEL; ++i) {
+        s->regs[i] = 0;
+    }
+}
+
+static void npcm7xx_mft_clear_interrupt(NPCM7xxMFTState *s, uint8_t iclr)
+{
+    /*
+     * Clear bits in ICTRL where corresponding bits in iclr is 1.
+     * Both iclr and ictrl are 8-bit regs. (See npcm7xx_mft_check_mem_op)
+     */
+    s->regs[R_NPCM7XX_MFT_ICTRL] &= ~iclr;
+}
+
+/*
+ * If the CPCFG's condition should be triggered during count down from
+ * NPCM7XX_MFT_MAX_CNT to src if compared to tgt, return the count when
+ * the condition is triggered.
+ * Otherwise return -1.
+ * Since tgt is uint16_t it must always <= NPCM7XX_MFT_MAX_CNT.
+ */
+static int npcm7xx_mft_compare(int32_t src, uint16_t tgt, uint8_t cpcfg)
+{
+    if (cpcfg & NPCM7XX_MFT_CPCFG_HIEN) {
+        return NPCM7XX_MFT_MAX_CNT;
+    }
+    if ((cpcfg & NPCM7XX_MFT_CPCFG_EQEN) && (src <= tgt)) {
+        return tgt;
+    }
+    if ((cpcfg & NPCM7XX_MFT_CPCFG_LOEN) && (tgt > 0) && (src < tgt)) {
+        return tgt - 1;
+    }
+
+    return -1;
+}
+
+/* Compute CNT according to corresponding fan's RPM. */
+static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt(
+    Clock *clock, uint32_t max_rpm, uint32_t duty, uint16_t tgt,
+    uint8_t cpcfg, uint16_t *cnt)
+{
+    uint32_t rpm = (uint64_t)max_rpm * (uint64_t)duty / NPCM7XX_PWM_MAX_DUTY;
+    int32_t count;
+    int stopped;
+    NPCM7xxMFTCaptureState state;
+
+    if (rpm == 0) {
+        /*
+         * If RPM = 0, capture won't happen. CNT will continue count down.
+         * So it's effective equivalent to have a cnt > NPCM7XX_MFT_MAX_CNT
+         */
+        count = NPCM7XX_MFT_MAX_CNT + 1;
+    } else {
+        /*
+         * RPM = revolution/min. The time for one revlution (in ns) is
+         * MINUTE_TO_NANOSECOND / RPM.
+         */
+        count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) /
+            (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION));
+    }
+
+    if (count > NPCM7XX_MFT_MAX_CNT) {
+        count = -1;
+    } else {
+        /* The CNT is a countdown value from NPCM7XX_MFT_MAX_CNT. */
+        count = NPCM7XX_MFT_MAX_CNT - count;
+    }
+    stopped = npcm7xx_mft_compare(count, tgt, cpcfg);
+    if (stopped == -1) {
+        if (count == -1) {
+            /* Underflow */
+            state = NPCM7XX_CAPTURE_UNDERFLOW;
+        } else {
+            state = NPCM7XX_CAPTURE_SUCCEED;
+        }
+    } else {
+        count = stopped;
+        state = NPCM7XX_CAPTURE_COMPARE_HIT;
+    }
+
+    if (count != -1) {
+        *cnt = count;
+    }
+    trace_npcm7xx_mft_rpm(clock->canonical_path, clock_get_hz(clock),
+                          state, count, rpm, duty);
+    return state;
+}
+
+/*
+ * Capture Fan RPM and update CNT and CR registers accordingly.
+ * Raise IRQ if certain contidions are met in IEN.
+ */
+static void npcm7xx_mft_capture(NPCM7xxMFTState *s)
+{
+    int irq_level = 0;
+    NPCM7xxMFTCaptureState state;
+    int sel;
+    uint8_t cpcfg;
+
+    /*
+     * If not mode 5, the behavior is undefined. We just do nothing in this
+     * case.
+     */
+    if (!(s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_MODE5)) {
+        return;
+    }
+
+    /* Capture input A. */
+    if (s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_TAEN &&
+        s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C1CSEL) {
+        sel = s->regs[R_NPCM7XX_MFT_INASEL] & NPCM7XX_MFT_INASEL_SELA;
+        cpcfg = NPCM7XX_MFT_CPCFG_GET_A(s->regs[R_NPCM7XX_MFT_CPCFG]);
+        state = npcm7xx_mft_compute_cnt(s->clock_1,
+                                        sel ? s->max_rpm[2] : s->max_rpm[0],
+                                        sel ? s->duty[2] : s->duty[0],
+                                        s->regs[R_NPCM7XX_MFT_CPA],
+                                        cpcfg,
+                                        &s->regs[R_NPCM7XX_MFT_CNT1]);
+        switch (state) {
+        case NPCM7XX_CAPTURE_SUCCEED:
+            /* Interrupt on input capture on TAn transition - TAPND */
+            s->regs[R_NPCM7XX_MFT_CRA] = s->regs[R_NPCM7XX_MFT_CNT1];
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TAPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TAIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        case NPCM7XX_CAPTURE_COMPARE_HIT:
+            /* Compare Hit - TEPND */
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TEPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TEIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        case NPCM7XX_CAPTURE_UNDERFLOW:
+            /* Underflow - TCPND */
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TCPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TCIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+    }
+
+    /* Capture input B. */
+    if (s->regs[R_NPCM7XX_MFT_MCTRL] & NPCM7XX_MFT_MCTRL_TBEN &&
+        s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C2CSEL) {
+        sel = s->regs[R_NPCM7XX_MFT_INBSEL] & NPCM7XX_MFT_INBSEL_SELB;
+        cpcfg = NPCM7XX_MFT_CPCFG_GET_B(s->regs[R_NPCM7XX_MFT_CPCFG]);
+        state = npcm7xx_mft_compute_cnt(s->clock_2,
+                                        sel ? s->max_rpm[3] : s->max_rpm[1],
+                                        sel ? s->duty[3] : s->duty[1],
+                                        s->regs[R_NPCM7XX_MFT_CPB],
+                                        cpcfg,
+                                        &s->regs[R_NPCM7XX_MFT_CNT2]);
+        switch (state) {
+        case NPCM7XX_CAPTURE_SUCCEED:
+            /* Interrupt on input capture on TBn transition - TBPND */
+            s->regs[R_NPCM7XX_MFT_CRB] = s->regs[R_NPCM7XX_MFT_CNT2];
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TBPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TBIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        case NPCM7XX_CAPTURE_COMPARE_HIT:
+            /* Compare Hit - TFPND */
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TFPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TFIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        case NPCM7XX_CAPTURE_UNDERFLOW:
+            /* Underflow - TDPND */
+            s->regs[R_NPCM7XX_MFT_ICTRL] |= NPCM7XX_MFT_ICTRL_TDPND;
+            if (s->regs[R_NPCM7XX_MFT_IEN] & NPCM7XX_MFT_IEN_TDIEN) {
+                irq_level = 1;
+            }
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+    }
+
+    trace_npcm7xx_mft_capture(DEVICE(s)->canonical_path, irq_level);
+    qemu_set_irq(s->irq, irq_level);
+}
+
+/* Update clock for counters. */
+static void npcm7xx_mft_update_clock(void *opaque, ClockEvent event)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
+    uint64_t prescaled_clock_period;
+
+    prescaled_clock_period = clock_get(s->clock_in) *
+        (s->regs[R_NPCM7XX_MFT_PRSC] + 1ULL);
+    trace_npcm7xx_mft_update_clock(s->clock_in->canonical_path,
+                                   s->regs[R_NPCM7XX_MFT_CKC],
+                                   clock_get(s->clock_in),
+                                   prescaled_clock_period);
+    /* Update clock 1 */
+    if (s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C1CSEL) {
+        /* Clock is prescaled. */
+        clock_update(s->clock_1, prescaled_clock_period);
+    } else {
+        /* Clock stopped. */
+        clock_update(s->clock_1, 0);
+    }
+    /* Update clock 2 */
+    if (s->regs[R_NPCM7XX_MFT_CKC] & NPCM7XX_MFT_CKC_C2CSEL) {
+        /* Clock is prescaled. */
+        clock_update(s->clock_2, prescaled_clock_period);
+    } else {
+        /* Clock stopped. */
+        clock_update(s->clock_2, 0);
+    }
+
+    npcm7xx_mft_capture(s);
+}
+
+static uint64_t npcm7xx_mft_read(void *opaque, hwaddr offset, unsigned size)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
+    uint16_t value = 0;
+
+    switch (offset) {
+    case A_NPCM7XX_MFT_ICLR:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: register @ 0x%04" HWADDR_PRIx " is write-only\n",
+                      __func__, offset);
+        break;
+
+    default:
+        value = s->regs[offset / 2];
+    }
+
+    trace_npcm7xx_mft_read(DEVICE(s)->canonical_path, offset, value);
+    return value;
+}
+
+static void npcm7xx_mft_write(void *opaque, hwaddr offset,
+                              uint64_t v, unsigned size)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
+
+    trace_npcm7xx_mft_write(DEVICE(s)->canonical_path, offset, v);
+    switch (offset) {
+    case A_NPCM7XX_MFT_ICLR:
+        npcm7xx_mft_clear_interrupt(s, v);
+        break;
+
+    case A_NPCM7XX_MFT_CKC:
+    case A_NPCM7XX_MFT_PRSC:
+        s->regs[offset / 2] = v;
+        npcm7xx_mft_update_clock(s, ClockUpdate);
+        break;
+
+    default:
+        s->regs[offset / 2] = v;
+        npcm7xx_mft_capture(s);
+        break;
+    }
+}
+
+static bool npcm7xx_mft_check_mem_op(void *opaque, hwaddr offset,
+                                     unsigned size, bool is_write,
+                                     MemTxAttrs attrs)
+{
+    switch (offset) {
+    /* 16-bit registers. Must be accessed with 16-bit read/write.*/
+    case A_NPCM7XX_MFT_CNT1:
+    case A_NPCM7XX_MFT_CRA:
+    case A_NPCM7XX_MFT_CRB:
+    case A_NPCM7XX_MFT_CNT2:
+    case A_NPCM7XX_MFT_CPA:
+    case A_NPCM7XX_MFT_CPB:
+        return size == 2;
+
+    /* 8-bit registers. Must be accessed with 8-bit read/write.*/
+    case A_NPCM7XX_MFT_PRSC:
+    case A_NPCM7XX_MFT_CKC:
+    case A_NPCM7XX_MFT_MCTRL:
+    case A_NPCM7XX_MFT_ICTRL:
+    case A_NPCM7XX_MFT_ICLR:
+    case A_NPCM7XX_MFT_IEN:
+    case A_NPCM7XX_MFT_CPCFG:
+    case A_NPCM7XX_MFT_INASEL:
+    case A_NPCM7XX_MFT_INBSEL:
+        return size == 1;
+
+    default:
+        /* Invalid registers. */
+        return false;
+    }
+}
+
+static void npcm7xx_mft_get_max_rpm(Object *obj, Visitor *v, const char *name,
+                                    void *opaque, Error **errp)
+{
+    visit_type_uint32(v, name, (uint32_t *)opaque, errp);
+}
+
+static void npcm7xx_mft_set_max_rpm(Object *obj, Visitor *v, const char *name,
+                                    void *opaque, Error **errp)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
+    uint32_t *max_rpm = opaque;
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    *max_rpm = value;
+    npcm7xx_mft_capture(s);
+}
+
+static void npcm7xx_mft_duty_handler(void *opaque, int n, int value)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(opaque);
+
+    trace_npcm7xx_mft_set_duty(DEVICE(s)->canonical_path, n, value);
+    s->duty[n] = value;
+    npcm7xx_mft_capture(s);
+}
+
+static const struct MemoryRegionOps npcm7xx_mft_ops = {
+    .read       = npcm7xx_mft_read,
+    .write      = npcm7xx_mft_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid      = {
+        .min_access_size        = 1,
+        .max_access_size        = 2,
+        .unaligned              = false,
+        .accepts                = npcm7xx_mft_check_mem_op,
+    },
+};
+
+static void npcm7xx_mft_enter_reset(Object *obj, ResetType type)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
+
+    npcm7xx_mft_reset(s);
+}
+
+static void npcm7xx_mft_hold_reset(Object *obj)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
+
+    qemu_irq_lower(s->irq);
+}
+
+static void npcm7xx_mft_init(Object *obj)
+{
+    NPCM7xxMFTState *s = NPCM7XX_MFT(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    DeviceState *dev = DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &npcm7xx_mft_ops, s,
+                          TYPE_NPCM7XX_MFT, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->clock_in = qdev_init_clock_in(dev, "clock-in", npcm7xx_mft_update_clock,
+                                     s, ClockUpdate);
+    s->clock_1 = qdev_init_clock_out(dev, "clock1");
+    s->clock_2 = qdev_init_clock_out(dev, "clock2");
+
+    for (int i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
+        object_property_add(obj, "max_rpm[*]", "uint32",
+                            npcm7xx_mft_get_max_rpm,
+                            npcm7xx_mft_set_max_rpm,
+                            NULL, &s->max_rpm[i]);
+    }
+    qdev_init_gpio_in_named(dev, npcm7xx_mft_duty_handler, "duty",
+                            NPCM7XX_MFT_FANIN_COUNT);
+}
+
+static const VMStateDescription vmstate_npcm7xx_mft = {
+    .name = "npcm7xx-mft-module",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(clock_in, NPCM7xxMFTState),
+        VMSTATE_CLOCK(clock_1, NPCM7xxMFTState),
+        VMSTATE_CLOCK(clock_2, NPCM7xxMFTState),
+        VMSTATE_UINT16_ARRAY(regs, NPCM7xxMFTState, NPCM7XX_MFT_NR_REGS),
+        VMSTATE_UINT32_ARRAY(max_rpm, NPCM7xxMFTState, NPCM7XX_MFT_FANIN_COUNT),
+        VMSTATE_UINT32_ARRAY(duty, NPCM7xxMFTState, NPCM7XX_MFT_FANIN_COUNT),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void npcm7xx_mft_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx MFT Controller";
+    dc->vmsd = &vmstate_npcm7xx_mft;
+    rc->phases.enter = npcm7xx_mft_enter_reset;
+    rc->phases.hold = npcm7xx_mft_hold_reset;
+}
+
+static const TypeInfo npcm7xx_mft_info = {
+    .name               = TYPE_NPCM7XX_MFT,
+    .parent             = TYPE_SYS_BUS_DEVICE,
+    .instance_size      = sizeof(NPCM7xxMFTState),
+    .class_init         = npcm7xx_mft_class_init,
+    .instance_init      = npcm7xx_mft_init,
+};
+
+static void npcm7xx_mft_register_type(void)
+{
+    type_register_static(&npcm7xx_mft_info);
+}
+type_init(npcm7xx_mft_register_type);
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MAINSTONE', if_true: files('mst_fpga.c'))
 softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
   'npcm7xx_clk.c',
   'npcm7xx_gcr.c',
+  'npcm7xx_mft.c',
   'npcm7xx_pwm.c',
   'npcm7xx_rng.c',
 ))
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_clk_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " valu
 npcm7xx_gcr_read(uint64_t offset, uint32_t value) " offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 npcm7xx_gcr_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 
+# npcm7xx_mft.c
+npcm7xx_mft_read(const char *name, uint64_t offset, uint16_t value) "%s: offset: 0x%04" PRIx64 " value: 0x%04" PRIx16
+npcm7xx_mft_write(const char *name, uint64_t offset, uint16_t value) "%s: offset: 0x%04" PRIx64 " value: 0x%04" PRIx16
+npcm7xx_mft_rpm(const char *clock, uint32_t clock_hz, int state, int32_t cnt, uint32_t rpm, uint32_t duty) " fan clk: %s clock_hz: %" PRIu32 ", state: %d, cnt: %" PRIi32 ", rpm: %" PRIu32 ", duty: %" PRIu32
+npcm7xx_mft_capture(const char *name, int irq_level) "%s: level: %d"
+npcm7xx_mft_update_clock(const char *name, uint16_t sel, uint64_t clock_period, uint64_t prescaled_clock_period) "%s: sel: 0x%02" PRIx16 ", period: %" PRIu64 ", prescaled: %" PRIu64
+npcm7xx_mft_set_duty(const char *name, int n, int value) "%s[%d]: %d"
+
 # npcm7xx_rng.c
 npcm7xx_rng_read(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
 npcm7xx_rng_write(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch adds the recently implemented MFT device to the NPCM7XX
SoC file.

Reviewed-by: Doug Evans <dje@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210311180855.149764-4-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst |  2 +-
 include/hw/arm/npcm7xx.h    |  2 ++
 hw/arm/npcm7xx.c            | 45 ++++++++++++++++++++++++++++++-------
 3 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Supported devices
  * Pulse Width Modulation (PWM)
  * SMBus controller (SMBF)
  * Ethernet controller (EMC)
+ * Tachometer
 
 Missing devices
 ---------------
@@ -XXX,XX +XXX,XX @@ Missing devices
  * Peripheral SPI controller (PSPI)
  * SD/MMC host
  * PECI interface
- * Tachometer
  * PCI and PCIe root complex and bridges
  * VDM and MCTP support
  * Serial I/O expansion
diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/npcm7xx.h
+++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/mem/npcm7xx_mc.h"
 #include "hw/misc/npcm7xx_clk.h"
 #include "hw/misc/npcm7xx_gcr.h"
+#include "hw/misc/npcm7xx_mft.h"
 #include "hw/misc/npcm7xx_pwm.h"
 #include "hw/misc/npcm7xx_rng.h"
 #include "hw/net/npcm7xx_emc.h"
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
     NPCM7xxTimerCtrlState tim[3];
     NPCM7xxADCState     adc;
     NPCM7xxPWMState     pwm[2];
+    NPCM7xxMFTState     mft[8];
     NPCM7xxOTPState     key_storage;
     NPCM7xxOTPState     fuse_array;
     NPCM7xxMCState      mc;
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
     NPCM7XX_SMBUS15_IRQ,
     NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
     NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
+    NPCM7XX_MFT0_IRQ            = 96,   /* MFT module 0 */
+    NPCM7XX_MFT1_IRQ,                   /* MFT module 1 */
+    NPCM7XX_MFT2_IRQ,                   /* MFT module 2 */
+    NPCM7XX_MFT3_IRQ,                   /* MFT module 3 */
+    NPCM7XX_MFT4_IRQ,                   /* MFT module 4 */
+    NPCM7XX_MFT5_IRQ,                   /* MFT module 5 */
+    NPCM7XX_MFT6_IRQ,                   /* MFT module 6 */
+    NPCM7XX_MFT7_IRQ,                   /* MFT module 7 */
     NPCM7XX_EMC2RX_IRQ          = 114,
     NPCM7XX_EMC2TX_IRQ,
     NPCM7XX_GPIO0_IRQ           = 116,
@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_pwm_addr[] = {
     0xf0104000,
 };
 
+/* Register base address for each MFT Module */
+static const hwaddr npcm7xx_mft_addr[] = {
+    0xf0180000,
+    0xf0181000,
+    0xf0182000,
+    0xf0183000,
+    0xf0184000,
+    0xf0185000,
+    0xf0186000,
+    0xf0187000,
+};
+
 /* Direct memory-mapped access to each SMBus Module. */
 static const hwaddr npcm7xx_smbus_addr[] = {
     0xf0080000,
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
         object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
     }
 
+    for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
+        object_initialize_child(obj, "mft[*]", &s->mft[i], TYPE_NPCM7XX_MFT);
+    }
+
     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
     }
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
         sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
     }
 
+    /* MFT Modules. Cannot fail. */
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_mft_addr) != ARRAY_SIZE(s->mft));
+    for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->mft[i]);
+
+        qdev_connect_clock_in(DEVICE(&s->mft[i]), "clock-in",
+                              qdev_get_clock_out(DEVICE(&s->clk),
+                                                 "apb4-clock"));
+        sysbus_realize(sbd, &error_abort);
+        sysbus_mmio_map(sbd, 0, npcm7xx_mft_addr[i]);
+        sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, NPCM7XX_MFT0_IRQ + i));
+    }
+
     /*
      * EMC Modules. Cannot fail.
      * The mapping of the device to its netdev backend works as follows:
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[0]",       0xf0180000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[1]",       0xf0181000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[2]",       0xf0182000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[3]",       0xf0183000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[4]",       0xf0184000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[5]",       0xf0185000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[6]",       0xf0186000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.mft[7]",       0xf0187000,   4 * KiB);
     create_unimplemented_device("npcm7xx.pspi1",        0xf0200000,   4 * KiB);
     create_unimplemented_device("npcm7xx.pspi2",        0xf0201000,   4 * KiB);
     create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch adds fan_splitters (split IRQs) in NPCM7XX boards. Each fan
splitter corresponds to 1 PWM output and can connect to multiple fan
inputs (MFT devices).
In NPCM7XX boards(NPCM750 EVB and Quanta GSJ boards), we initializes
these splitters and connect them to their corresponding modules
according their specific device trees.

Reviewed-by: Doug Evans <dje@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210311180855.149764-5-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/npcm7xx.h | 11 ++++-
 hw/arm/npcm7xx_boards.c  | 99 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 109 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/npcm7xx.h
+++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/boards.h"
 #include "hw/adc/npcm7xx_adc.h"
+#include "hw/core/split-irq.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/gpio/npcm7xx_gpio.h"
 #include "hw/i2c/npcm7xx_smbus.h"
@@ -XXX,XX +XXX,XX @@
 #define NPCM7XX_GIC_CPU_IF_ADDR         (0xf03fe100)  /* GIC within A9 */
 #define NPCM7XX_BOARD_SETUP_ADDR        (0xffff1000)  /* Boot ROM */
 
+#define NPCM7XX_NR_PWM_MODULES 2
+
 typedef struct NPCM7xxMachine {
     MachineState        parent;
+    /*
+     * PWM fan splitter. each splitter connects to one PWM output and
+     * multiple MFT inputs.
+     */
+    SplitIRQ            fan_splitter[NPCM7XX_NR_PWM_MODULES *
+                                     NPCM7XX_PWM_PER_MODULE];
 } NPCM7xxMachine;
 
 #define TYPE_NPCM7XX_MACHINE MACHINE_TYPE_NAME("npcm7xx")
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
     NPCM7xxCLKState     clk;
     NPCM7xxTimerCtrlState tim[3];
     NPCM7xxADCState     adc;
-    NPCM7xxPWMState     pwm[2];
+    NPCM7xxPWMState     pwm[NPCM7XX_NR_PWM_MODULES];
     NPCM7xxMFTState     mft[8];
     NPCM7xxOTPState     key_storage;
     NPCM7xxOTPState     fuse_array;
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/core/cpu.h"
 #include "hw/i2c/smbus_eeprom.h"
 #include "hw/loader.h"
+#include "hw/qdev-core.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_init(NPCM7xxState *soc, int bus, uint8_t addr,
     i2c_slave_realize_and_unref(i2c_dev, i2c_bus, &error_abort);
 }
 
+static void npcm7xx_init_pwm_splitter(NPCM7xxMachine *machine,
+                                      NPCM7xxState *soc, const int *fan_counts)
+{
+    SplitIRQ *splitters = machine->fan_splitter;
+
+    /*
+     * PWM 0~3 belong to module 0 output 0~3.
+     * PWM 4~7 belong to module 1 output 0~3.
+     */
+    for (int i = 0; i < NPCM7XX_NR_PWM_MODULES; ++i) {
+        for (int j = 0; j < NPCM7XX_PWM_PER_MODULE; ++j) {
+            int splitter_no = i * NPCM7XX_PWM_PER_MODULE + j;
+            DeviceState *splitter;
+
+            if (fan_counts[splitter_no] < 1) {
+                continue;
+            }
+            object_initialize_child(OBJECT(machine), "fan-splitter[*]",
+                                    &splitters[splitter_no], TYPE_SPLIT_IRQ);
+            splitter = DEVICE(&splitters[splitter_no]);
+            qdev_prop_set_uint16(splitter, "num-lines",
+                                 fan_counts[splitter_no]);
+            qdev_realize(splitter, NULL, &error_abort);
+            qdev_connect_gpio_out_named(DEVICE(&soc->pwm[i]), "duty-gpio-out",
+                                        j, qdev_get_gpio_in(splitter, 0));
+        }
+    }
+}
+
+static void npcm7xx_connect_pwm_fan(NPCM7xxState *soc, SplitIRQ *splitter,
+                                    int fan_no, int output_no)
+{
+    DeviceState *fan;
+    int fan_input;
+    qemu_irq fan_duty_gpio;
+
+    g_assert(fan_no >= 0 && fan_no <= NPCM7XX_MFT_MAX_FAN_INPUT);
+    /*
+     * Fan 0~1 belong to module 0 input 0~1.
+     * Fan 2~3 belong to module 1 input 0~1.
+     * ...
+     * Fan 14~15 belong to module 7 input 0~1.
+     * Fan 16~17 belong to module 0 input 2~3.
+     * Fan 18~19 belong to module 1 input 2~3.
+     */
+    if (fan_no < 16) {
+        fan = DEVICE(&soc->mft[fan_no / 2]);
+        fan_input = fan_no % 2;
+    } else {
+        fan = DEVICE(&soc->mft[(fan_no - 16) / 2]);
+        fan_input = fan_no % 2 + 2;
+    }
+
+    /* Connect the Fan to PWM module */
+    fan_duty_gpio = qdev_get_gpio_in_named(fan, "duty", fan_input);
+    qdev_connect_gpio_out(DEVICE(splitter), output_no, fan_duty_gpio);
+}
+
 static void npcm750_evb_i2c_init(NPCM7xxState *soc)
 {
     /* lm75 temperature sensor on SVB, tmp105 is compatible */
@@ -XXX,XX +XXX,XX @@ static void npcm750_evb_i2c_init(NPCM7xxState *soc)
     i2c_slave_create_simple(npcm7xx_i2c_get_bus(soc, 6), "tmp105", 0x48);
 }
 
+static void npcm750_evb_fan_init(NPCM7xxMachine *machine, NPCM7xxState *soc)
+{
+    SplitIRQ *splitter = machine->fan_splitter;
+    static const int fan_counts[] = {2, 2, 2, 2, 2, 2, 2, 2};
+
+    npcm7xx_init_pwm_splitter(machine, soc, fan_counts);
+    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x00, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x01, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x02, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x03, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x04, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x05, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[3], 0x06, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[3], 0x07, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[4], 0x08, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[4], 0x09, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[5], 0x0a, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[5], 0x0b, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[6], 0x0c, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[6], 0x0d, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[7], 0x0e, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[7], 0x0f, 1);
+}
+
 static void quanta_gsj_i2c_init(NPCM7xxState *soc)
 {
     /* GSJ machine have 4 max31725 temperature sensors, tmp105 is compatible. */
@@ -XXX,XX +XXX,XX @@ static void quanta_gsj_i2c_init(NPCM7xxState *soc)
     /* TODO: Add additional i2c devices. */
 }
 
+static void quanta_gsj_fan_init(NPCM7xxMachine *machine, NPCM7xxState *soc)
+{
+    SplitIRQ *splitter = machine->fan_splitter;
+    static const int fan_counts[] = {2, 2, 2, 0, 0, 0, 0, 0};
+
+    npcm7xx_init_pwm_splitter(machine, soc, fan_counts);
+    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x00, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[0], 0x01, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x02, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[1], 0x03, 1);
+    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x04, 0);
+    npcm7xx_connect_pwm_fan(soc, &splitter[2], 0x05, 1);
+}
+
 static void npcm750_evb_init(MachineState *machine)
 {
     NPCM7xxState *soc;
@@ -XXX,XX +XXX,XX @@ static void npcm750_evb_init(MachineState *machine)
     npcm7xx_load_bootrom(machine, soc);
     npcm7xx_connect_flash(&soc->fiu[0], 0, "w25q256", drive_get(IF_MTD, 0, 0));
     npcm750_evb_i2c_init(soc);
+    npcm750_evb_fan_init(NPCM7XX_MACHINE(machine), soc);
     npcm7xx_load_kernel(machine, soc);
 }
 
@@ -XXX,XX +XXX,XX @@ static void quanta_gsj_init(MachineState *machine)
     npcm7xx_connect_flash(&soc->fiu[0], 0, "mx25l25635e",
                           drive_get(IF_MTD, 0, 0));
     quanta_gsj_i2c_init(soc);
+    quanta_gsj_fan_init(NPCM7XX_MACHINE(machine), soc);
     npcm7xx_load_kernel(machine, soc);
 }
 
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch adds testing of PWM fan RPMs in the existing npcm7xx pwm
test. It tests whether the MFT module can measure correct fan values
for a PWM fan in NPCM7XX boards.

Reviewed-by: Doug Evans <dje@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210311180855.149764-6-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_pwm-test.c | 205 ++++++++++++++++++++++++++++++++-
 1 file changed, 199 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_pwm-test.c
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@
 #define PLL_FBDV(rv)    extract32((rv), 16, 12)
 #define PLL_OTDV1(rv)   extract32((rv), 8, 3)
 #define PLL_OTDV2(rv)   extract32((rv), 13, 3)
+#define APB4CKDIV(rv)   extract32((rv), 30, 2)
 #define APB3CKDIV(rv)   extract32((rv), 28, 2)
 #define CLK2CKDIV(rv)   extract32((rv), 0, 1)
 #define CLK4CKDIV(rv)   extract32((rv), 26, 2)
@@ -XXX,XX +XXX,XX @@
 
 #define MAX_DUTY        1000000
 
+/* MFT (PWM fan) related */
+#define MFT_BA(n)       (0xf0180000 + ((n) * 0x1000))
+#define MFT_IRQ(n)      (96 + (n))
+#define MFT_CNT1        0x00
+#define MFT_CRA         0x02
+#define MFT_CRB         0x04
+#define MFT_CNT2        0x06
+#define MFT_PRSC        0x08
+#define MFT_CKC         0x0a
+#define MFT_MCTRL       0x0c
+#define MFT_ICTRL       0x0e
+#define MFT_ICLR        0x10
+#define MFT_IEN         0x12
+#define MFT_CPA         0x14
+#define MFT_CPB         0x16
+#define MFT_CPCFG       0x18
+#define MFT_INASEL      0x1a
+#define MFT_INBSEL      0x1c
+
+#define MFT_MCTRL_ALL   0x64
+#define MFT_ICLR_ALL    0x3f
+#define MFT_IEN_ALL     0x3f
+#define MFT_CPCFG_EQ_MODE 0x44
+
+#define MFT_CKC_C2CSEL  BIT(3)
+#define MFT_CKC_C1CSEL  BIT(0)
+
+#define MFT_ICTRL_TFPND BIT(5)
+#define MFT_ICTRL_TEPND BIT(4)
+#define MFT_ICTRL_TDPND BIT(3)
+#define MFT_ICTRL_TCPND BIT(2)
+#define MFT_ICTRL_TBPND BIT(1)
+#define MFT_ICTRL_TAPND BIT(0)
+
+#define MFT_MAX_CNT     0xffff
+#define MFT_TIMEOUT     0x5000
+
+#define DEFAULT_RPM     19800
+#define DEFAULT_PRSC    255
+#define MFT_PULSE_PER_REVOLUTION 2
+
+#define MAX_ERROR       1
+
 typedef struct PWMModule {
     int irq;
     uint64_t base_addr;
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_get_duty(QTestState *qts, int module_index, int pwm_index)
     return pwm_qom_get(qts, path, name);
 }
 
+static void mft_qom_set(QTestState *qts, int index, const char *name,
+                        uint32_t value)
+{
+    QDict *response;
+    char *path = g_strdup_printf("/machine/soc/mft[%d]", index);
+
+    g_test_message("Setting properties %s of mft[%d] with value %u",
+                   name, index, value);
+    response = qtest_qmp(qts, "{ 'execute': 'qom-set',"
+            " 'arguments': { 'path': %s, "
+            " 'property': %s, 'value': %u}}",
+            path, name, value);
+    /* The qom set message returns successfully. */
+    g_assert_true(qdict_haskey(response, "return"));
+}
+
 static uint32_t get_pll(uint32_t con)
 {
     return REF_HZ * PLL_FBDV(con) / (PLL_INDV(con) * PLL_OTDV1(con)
             * PLL_OTDV2(con));
 }
 
-static uint64_t read_pclk(QTestState *qts)
+static uint64_t read_pclk(QTestState *qts, bool mft)
 {
     uint64_t freq = REF_HZ;
     uint32_t clksel = qtest_readl(qts, CLK_BA + CLKSEL);
     uint32_t pllcon;
     uint32_t clkdiv1 = qtest_readl(qts, CLK_BA + CLKDIV1);
     uint32_t clkdiv2 = qtest_readl(qts, CLK_BA + CLKDIV2);
+    uint32_t apbdiv = mft ? APB4CKDIV(clkdiv2) : APB3CKDIV(clkdiv2);
 
     switch (CPUCKSEL(clksel)) {
     case 0:
@@ -XXX,XX +XXX,XX @@ static uint64_t read_pclk(QTestState *qts)
         g_assert_not_reached();
     }
 
-    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + APB3CKDIV(clkdiv2));
+    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + apbdiv);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t pwm_selector(uint32_t csr)
 static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
         uint32_t cnr)
 {
-    return read_pclk(qts) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
+    return read_pclk(qts, false) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
 }
 
 static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
@@ -XXX,XX +XXX,XX @@ static void pwm_write(QTestState *qts, const TestData *td, unsigned offset,
     qtest_writel(qts, td->module->base_addr + offset, value);
 }
 
+static uint8_t mft_readb(QTestState *qts, int index, unsigned offset)
+{
+    return qtest_readb(qts, MFT_BA(index) + offset);
+}
+
+static uint16_t mft_readw(QTestState *qts, int index, unsigned offset)
+{
+    return qtest_readw(qts, MFT_BA(index) + offset);
+}
+
+static void mft_writeb(QTestState *qts, int index, unsigned offset,
+                        uint8_t value)
+{
+    qtest_writeb(qts, MFT_BA(index) + offset, value);
+}
+
+static void mft_writew(QTestState *qts, int index, unsigned offset,
+                        uint16_t value)
+{
+    return qtest_writew(qts, MFT_BA(index) + offset, value);
+}
+
 static uint32_t pwm_read_ppr(QTestState *qts, const TestData *td)
 {
     return extract32(pwm_read(qts, td, PPR), ppr_base[pwm_index(td->pwm)], 8);
@@ -XXX,XX +XXX,XX @@ static void pwm_write_cmr(QTestState *qts, const TestData *td, uint32_t value)
     pwm_write(qts, td, td->pwm->cmr_offset, value);
 }
 
+static int mft_compute_index(const TestData *td)
+{
+    int index = pwm_module_index(td->module) * ARRAY_SIZE(pwm_list) +
+                pwm_index(td->pwm);
+
+    g_assert_cmpint(index, <,
+                    ARRAY_SIZE(pwm_module_list) * ARRAY_SIZE(pwm_list));
+
+    return index;
+}
+
+static void mft_reset_counters(QTestState *qts, int index)
+{
+    mft_writew(qts, index, MFT_CNT1, MFT_MAX_CNT);
+    mft_writew(qts, index, MFT_CNT2, MFT_MAX_CNT);
+    mft_writew(qts, index, MFT_CRA, MFT_MAX_CNT);
+    mft_writew(qts, index, MFT_CRB, MFT_MAX_CNT);
+    mft_writew(qts, index, MFT_CPA, MFT_MAX_CNT - MFT_TIMEOUT);
+    mft_writew(qts, index, MFT_CPB, MFT_MAX_CNT - MFT_TIMEOUT);
+}
+
+static void mft_init(QTestState *qts, const TestData *td)
+{
+    int index = mft_compute_index(td);
+
+    /* Enable everything */
+    mft_writeb(qts, index, MFT_CKC, 0);
+    mft_writeb(qts, index, MFT_ICLR, MFT_ICLR_ALL);
+    mft_writeb(qts, index, MFT_MCTRL, MFT_MCTRL_ALL);
+    mft_writeb(qts, index, MFT_IEN, MFT_IEN_ALL);
+    mft_writeb(qts, index, MFT_INASEL, 0);
+    mft_writeb(qts, index, MFT_INBSEL, 0);
+
+    /* Set cpcfg to use EQ mode, same as kernel driver */
+    mft_writeb(qts, index, MFT_CPCFG, MFT_CPCFG_EQ_MODE);
+
+    /* Write default counters, timeout and prescaler */
+    mft_reset_counters(qts, index);
+    mft_writeb(qts, index, MFT_PRSC, DEFAULT_PRSC);
+
+    /* Write default max rpm via QMP */
+    mft_qom_set(qts, index, "max_rpm[0]", DEFAULT_RPM);
+    mft_qom_set(qts, index, "max_rpm[1]", DEFAULT_RPM);
+}
+
+static int32_t mft_compute_cnt(uint32_t rpm, uint64_t clk)
+{
+    uint64_t cnt;
+
+    if (rpm == 0) {
+        return -1;
+    }
+
+    cnt = clk * 60 / ((DEFAULT_PRSC + 1) * rpm * MFT_PULSE_PER_REVOLUTION);
+    if (cnt >= MFT_TIMEOUT) {
+        return -1;
+    }
+    return MFT_MAX_CNT - cnt;
+}
+
+static void mft_verify_rpm(QTestState *qts, const TestData *td, uint64_t duty)
+{
+    int index = mft_compute_index(td);
+    uint16_t cnt, cr;
+    uint32_t rpm = DEFAULT_RPM * duty / MAX_DUTY;
+    uint64_t clk = read_pclk(qts, true);
+    int32_t expected_cnt = mft_compute_cnt(rpm, clk);
+
+    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
+    g_test_message(
+        "verifying rpm for mft[%d]: clk: %lu, duty: %lu, rpm: %u, cnt: %d",
+        index, clk, duty, rpm, expected_cnt);
+
+    /* Verify rpm for fan A */
+    /* Stop capture */
+    mft_writeb(qts, index, MFT_CKC, 0);
+    mft_writeb(qts, index, MFT_ICLR, MFT_ICLR_ALL);
+    mft_reset_counters(qts, index);
+    g_assert_cmphex(mft_readw(qts, index, MFT_CNT1), ==, MFT_MAX_CNT);
+    g_assert_cmphex(mft_readw(qts, index, MFT_CRA), ==, MFT_MAX_CNT);
+    g_assert_cmphex(mft_readw(qts, index, MFT_CPA), ==,
+                    MFT_MAX_CNT - MFT_TIMEOUT);
+    /* Start capture */
+    mft_writeb(qts, index, MFT_CKC, MFT_CKC_C1CSEL);
+    g_assert_true(qtest_get_irq(qts, MFT_IRQ(index)));
+    if (expected_cnt == -1) {
+        g_assert_cmphex(mft_readb(qts, index, MFT_ICTRL), ==, MFT_ICTRL_TEPND);
+    } else {
+        g_assert_cmphex(mft_readb(qts, index, MFT_ICTRL), ==, MFT_ICTRL_TAPND);
+        cnt = mft_readw(qts, index, MFT_CNT1);
+        /*
+         * Due to error in clock measurement and rounding, we might have a small
+         * error in measuring RPM.
+         */
+        g_assert_cmphex(cnt + MAX_ERROR, >=, expected_cnt);
+        g_assert_cmphex(cnt, <=, expected_cnt + MAX_ERROR);
+        cr = mft_readw(qts, index, MFT_CRA);
+        g_assert_cmphex(cnt, ==, cr);
+    }
+
+    /* Verify rpm for fan B */
+
+    qtest_irq_intercept_out(qts, "/machine/soc/a9mpcore/gic");
+}
+
 /* Check pwm registers can be reset to default value */
 static void test_init(gconstpointer test_data)
 {
     const TestData *td = test_data;
-    QTestState *qts = qtest_init("-machine quanta-gsj");
+    QTestState *qts = qtest_init("-machine npcm750-evb");
     int module = pwm_module_index(td->module);
     int pwm = pwm_index(td->pwm);
 
@@ -XXX,XX +XXX,XX @@ static void test_init(gconstpointer test_data)
 static void test_oneshot(gconstpointer test_data)
 {
     const TestData *td = test_data;
-    QTestState *qts = qtest_init("-machine quanta-gsj");
+    QTestState *qts = qtest_init("-machine npcm750-evb");
     int module = pwm_module_index(td->module);
     int pwm = pwm_index(td->pwm);
     uint32_t ppr, csr, pcr;
@@ -XXX,XX +XXX,XX @@ static void test_oneshot(gconstpointer test_data)
 static void test_toggle(gconstpointer test_data)
 {
     const TestData *td = test_data;
-    QTestState *qts = qtest_init("-machine quanta-gsj");
+    QTestState *qts = qtest_init("-machine npcm750-evb");
     int module = pwm_module_index(td->module);
     int pwm = pwm_index(td->pwm);
     uint32_t ppr, csr, pcr, cnr, cmr;
     int i, j, k, l;
     uint64_t expected_freq, expected_duty;
 
+    mft_init(qts, td);
+
     pcr = CH_EN | CH_MOD;
     for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
         ppr = ppr_list[i];
@@ -XXX,XX +XXX,XX @@ static void test_toggle(gconstpointer test_data)
                                 ==, expected_freq);
                     }
 
+                    /* Test MFT's RPM is correct. */
+                    mft_verify_rpm(qts, td, expected_duty);
+
                     /* Test inverted mode */
                     expected_duty = pwm_compute_duty(cnr, cmr, true);
                     pwm_write_pcr(qts, td, pcr | CH_INV);
-- 
2.20.1

For a long time now the UI layer has guaranteed that the console
surface is always 32 bits per pixel. Remove the legacy dead
code from the pl110 display device which was handling the
possibility that the console surface was some other format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-2-peter.maydell@linaro.org
---
 hw/display/pl110.c | 53 +++++++---------------------------------------
 1 file changed, 8 insertions(+), 45 deletions(-)

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
     pl111_id
 };
 
-#define BITS 8
-#include "pl110_template.h"
-#define BITS 15
-#include "pl110_template.h"
-#define BITS 16
-#include "pl110_template.h"
-#define BITS 24
-#include "pl110_template.h"
 #define BITS 32
 #include "pl110_template.h"
 
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
     PL110State *s = (PL110State *)opaque;
     SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
-    drawfn* fntable;
     drawfn fn;
-    int dest_width;
     int src_width;
     int bpp_offset;
     int first;
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
 
     sbd = SYS_BUS_DEVICE(s);
 
-    switch (surface_bits_per_pixel(surface)) {
-    case 0:
-        return;
-    case 8:
-        fntable = pl110_draw_fn_8;
-        dest_width = 1;
-        break;
-    case 15:
-        fntable = pl110_draw_fn_15;
-        dest_width = 2;
-        break;
-    case 16:
-        fntable = pl110_draw_fn_16;
-        dest_width = 2;
-        break;
-    case 24:
-        fntable = pl110_draw_fn_24;
-        dest_width = 3;
-        break;
-    case 32:
-        fntable = pl110_draw_fn_32;
-        dest_width = 4;
-        break;
-    default:
-        fprintf(stderr, "pl110: Bad color depth\n");
-        exit(1);
-    }
     if (s->cr & PL110_CR_BGR)
         bpp_offset = 0;
     else
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
         }
     }
 
-    if (s->cr & PL110_CR_BEBO)
-        fn = fntable[s->bpp + 8 + bpp_offset];
-    else if (s->cr & PL110_CR_BEPO)
-        fn = fntable[s->bpp + 16 + bpp_offset];
-    else
-        fn = fntable[s->bpp + bpp_offset];
+    if (s->cr & PL110_CR_BEBO) {
+        fn = pl110_draw_fn_32[s->bpp + 8 + bpp_offset];
+    } else if (s->cr & PL110_CR_BEPO) {
+        fn = pl110_draw_fn_32[s->bpp + 16 + bpp_offset];
+    } else {
+        fn = pl110_draw_fn_32[s->bpp + bpp_offset];
+    }
 
     src_width = s->cols;
     switch (s->bpp) {
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
         src_width <<= 2;
         break;
     }
-    dest_width *= s->cols;
     first = 0;
     if (s->invalidate) {
         framebuffer_update_memory_section(&s->fbsection,
@@ -XXX,XX +XXX,XX @@ static void pl110_update_display(void *opaque)
 
     framebuffer_update_display(surface, &s->fbsection,
                                s->cols, s->rows,
-                               src_width, dest_width, 0,
+                               src_width, s->cols * 4, 0,
                                s->invalidate,
                                fn, s->palette,
                                &first, &last);
-- 
2.20.1

The pl110_template.h header has a doubly-nested multiple-include pattern:
 * pl110.c includes it once for each host bit depth (now always 32)
 * every time it is included, it includes itself 6 times, to account
   for multiple guest device pixel and byte orders

Now we only have to deal with 32-bit host bit depths, we can move the
code corresponding to the outer layer of this double-nesting to be
directly in pl110.c and reduce the template header to a single layer
of nesting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-3-peter.maydell@linaro.org
---
 hw/display/pl110_template.h | 100 +-----------------------------------
 hw/display/pl110.c          |  79 ++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+), 99 deletions(-)

diff --git a/hw/display/pl110_template.h b/hw/display/pl110_template.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110_template.h
+++ b/hw/display/pl110_template.h
@@ -XXX,XX +XXX,XX @@
  */
 
 #ifndef ORDER
-
-#if BITS == 8
-#define COPY_PIXEL(to, from) *(to++) = from
-#elif BITS == 15 || BITS == 16
-#define COPY_PIXEL(to, from) do { *(uint16_t *)to = from; to += 2; } while (0)
-#elif BITS == 24
-#define COPY_PIXEL(to, from)    \
-    do {                        \
-        *(to++) = from;         \
-        *(to++) = (from) >> 8;  \
-        *(to++) = (from) >> 16; \
-    } while (0)
-#elif BITS == 32
-#define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
-#else
-#error unknown bit depth
+#error "pl110_template.h is only for inclusion by pl110.c"
 #endif
 
-#undef RGB
-#define BORDER bgr
-#define ORDER 0
-#include "pl110_template.h"
-#define ORDER 1
-#include "pl110_template.h"
-#define ORDER 2
-#include "pl110_template.h"
-#undef BORDER
-#define RGB
-#define BORDER rgb
-#define ORDER 0
-#include "pl110_template.h"
-#define ORDER 1
-#include "pl110_template.h"
-#define ORDER 2
-#include "pl110_template.h"
-#undef BORDER
-
-static drawfn glue(pl110_draw_fn_,BITS)[48] =
-{
-    glue(pl110_draw_line1_lblp_bgr,BITS),
-    glue(pl110_draw_line2_lblp_bgr,BITS),
-    glue(pl110_draw_line4_lblp_bgr,BITS),
-    glue(pl110_draw_line8_lblp_bgr,BITS),
-    glue(pl110_draw_line16_555_lblp_bgr,BITS),
-    glue(pl110_draw_line32_lblp_bgr,BITS),
-    glue(pl110_draw_line16_lblp_bgr,BITS),
-    glue(pl110_draw_line12_lblp_bgr,BITS),
-
-    glue(pl110_draw_line1_bbbp_bgr,BITS),
-    glue(pl110_draw_line2_bbbp_bgr,BITS),
-    glue(pl110_draw_line4_bbbp_bgr,BITS),
-    glue(pl110_draw_line8_bbbp_bgr,BITS),
-    glue(pl110_draw_line16_555_bbbp_bgr,BITS),
-    glue(pl110_draw_line32_bbbp_bgr,BITS),
-    glue(pl110_draw_line16_bbbp_bgr,BITS),
-    glue(pl110_draw_line12_bbbp_bgr,BITS),
-
-    glue(pl110_draw_line1_lbbp_bgr,BITS),
-    glue(pl110_draw_line2_lbbp_bgr,BITS),
-    glue(pl110_draw_line4_lbbp_bgr,BITS),
-    glue(pl110_draw_line8_lbbp_bgr,BITS),
-    glue(pl110_draw_line16_555_lbbp_bgr,BITS),
-    glue(pl110_draw_line32_lbbp_bgr,BITS),
-    glue(pl110_draw_line16_lbbp_bgr,BITS),
-    glue(pl110_draw_line12_lbbp_bgr,BITS),
-
-    glue(pl110_draw_line1_lblp_rgb,BITS),
-    glue(pl110_draw_line2_lblp_rgb,BITS),
-    glue(pl110_draw_line4_lblp_rgb,BITS),
-    glue(pl110_draw_line8_lblp_rgb,BITS),
-    glue(pl110_draw_line16_555_lblp_rgb,BITS),
-    glue(pl110_draw_line32_lblp_rgb,BITS),
-    glue(pl110_draw_line16_lblp_rgb,BITS),
-    glue(pl110_draw_line12_lblp_rgb,BITS),
-
-    glue(pl110_draw_line1_bbbp_rgb,BITS),
-    glue(pl110_draw_line2_bbbp_rgb,BITS),
-    glue(pl110_draw_line4_bbbp_rgb,BITS),
-    glue(pl110_draw_line8_bbbp_rgb,BITS),
-    glue(pl110_draw_line16_555_bbbp_rgb,BITS),
-    glue(pl110_draw_line32_bbbp_rgb,BITS),
-    glue(pl110_draw_line16_bbbp_rgb,BITS),
-    glue(pl110_draw_line12_bbbp_rgb,BITS),
-
-    glue(pl110_draw_line1_lbbp_rgb,BITS),
-    glue(pl110_draw_line2_lbbp_rgb,BITS),
-    glue(pl110_draw_line4_lbbp_rgb,BITS),
-    glue(pl110_draw_line8_lbbp_rgb,BITS),
-    glue(pl110_draw_line16_555_lbbp_rgb,BITS),
-    glue(pl110_draw_line32_lbbp_rgb,BITS),
-    glue(pl110_draw_line16_lbbp_rgb,BITS),
-    glue(pl110_draw_line12_lbbp_rgb,BITS),
-};
-
-#undef BITS
-#undef COPY_PIXEL
-
-#else
-
 #if ORDER == 0
 #define NAME glue(glue(lblp_, BORDER), BITS)
 #ifdef HOST_WORDS_BIGENDIAN
@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line12_,NAME)(void *opaque, uint8_t *d, const uint8_
 #undef NAME
 #undef SWAP_WORDS
 #undef ORDER
-
-#endif
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
 };
 
 #define BITS 32
+#define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
+
+#undef RGB
+#define BORDER bgr
+#define ORDER 0
 #include "pl110_template.h"
+#define ORDER 1
+#include "pl110_template.h"
+#define ORDER 2
+#include "pl110_template.h"
+#undef BORDER
+#define RGB
+#define BORDER rgb
+#define ORDER 0
+#include "pl110_template.h"
+#define ORDER 1
+#include "pl110_template.h"
+#define ORDER 2
+#include "pl110_template.h"
+#undef BORDER
+
+static drawfn pl110_draw_fn_32[48] = {
+    pl110_draw_line1_lblp_bgr32,
+    pl110_draw_line2_lblp_bgr32,
+    pl110_draw_line4_lblp_bgr32,
+    pl110_draw_line8_lblp_bgr32,
+    pl110_draw_line16_555_lblp_bgr32,
+    pl110_draw_line32_lblp_bgr32,
+    pl110_draw_line16_lblp_bgr32,
+    pl110_draw_line12_lblp_bgr32,
+
+    pl110_draw_line1_bbbp_bgr32,
+    pl110_draw_line2_bbbp_bgr32,
+    pl110_draw_line4_bbbp_bgr32,
+    pl110_draw_line8_bbbp_bgr32,
+    pl110_draw_line16_555_bbbp_bgr32,
+    pl110_draw_line32_bbbp_bgr32,
+    pl110_draw_line16_bbbp_bgr32,
+    pl110_draw_line12_bbbp_bgr32,
+
+    pl110_draw_line1_lbbp_bgr32,
+    pl110_draw_line2_lbbp_bgr32,
+    pl110_draw_line4_lbbp_bgr32,
+    pl110_draw_line8_lbbp_bgr32,
+    pl110_draw_line16_555_lbbp_bgr32,
+    pl110_draw_line32_lbbp_bgr32,
+    pl110_draw_line16_lbbp_bgr32,
+    pl110_draw_line12_lbbp_bgr32,
+
+    pl110_draw_line1_lblp_rgb32,
+    pl110_draw_line2_lblp_rgb32,
+    pl110_draw_line4_lblp_rgb32,
+    pl110_draw_line8_lblp_rgb32,
+    pl110_draw_line16_555_lblp_rgb32,
+    pl110_draw_line32_lblp_rgb32,
+    pl110_draw_line16_lblp_rgb32,
+    pl110_draw_line12_lblp_rgb32,
+
+    pl110_draw_line1_bbbp_rgb32,
+    pl110_draw_line2_bbbp_rgb32,
+    pl110_draw_line4_bbbp_rgb32,
+    pl110_draw_line8_bbbp_rgb32,
+    pl110_draw_line16_555_bbbp_rgb32,
+    pl110_draw_line32_bbbp_rgb32,
+    pl110_draw_line16_bbbp_rgb32,
+    pl110_draw_line12_bbbp_rgb32,
+
+    pl110_draw_line1_lbbp_rgb32,
+    pl110_draw_line2_lbbp_rgb32,
+    pl110_draw_line4_lbbp_rgb32,
+    pl110_draw_line8_lbbp_rgb32,
+    pl110_draw_line16_555_lbbp_rgb32,
+    pl110_draw_line32_lbbp_rgb32,
+    pl110_draw_line16_lbbp_rgb32,
+    pl110_draw_line12_lbbp_rgb32,
+};
+
+#undef BITS
+#undef COPY_PIXEL
+
 
 static int pl110_enabled(PL110State *s)
 {
-- 
2.20.1

BITS is always 32, so remove all uses of it from the template header,
by dropping the trailing '32' from the draw function names and
not constructing the name of rgb_to_pixel32() via the glue() macro.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-4-peter.maydell@linaro.org
---
 hw/display/pl110_template.h |  20 +++----
 hw/display/pl110.c          | 113 ++++++++++++++++++------------------
 2 files changed, 65 insertions(+), 68 deletions(-)

diff --git a/hw/display/pl110_template.h b/hw/display/pl110_template.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110_template.h
+++ b/hw/display/pl110_template.h
@@ -XXX,XX +XXX,XX @@
 #endif
 
 #if ORDER == 0
-#define NAME glue(glue(lblp_, BORDER), BITS)
+#define NAME glue(lblp_, BORDER)
 #ifdef HOST_WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
 #elif ORDER == 1
-#define NAME glue(glue(bbbp_, BORDER), BITS)
+#define NAME glue(bbbp_, BORDER)
 #ifndef HOST_WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
 #else
 #define SWAP_PIXELS 1
-#define NAME glue(glue(lbbp_, BORDER), BITS)
+#define NAME glue(lbbp_, BORDER)
 #ifdef HOST_WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line16_,NAME)(void *opaque, uint8_t *d, const uint8_
         MSB = (data & 0x1f) << 3;
         data >>= 5;
 #endif
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
         LSB = (data & 0x1f) << 3;
         data >>= 5;
         g = (data & 0x3f) << 2;
         data >>= 6;
         MSB = (data & 0x1f) << 3;
         data >>= 5;
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
 #undef MSB
 #undef LSB
         width -= 2;
@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line32_,NAME)(void *opaque, uint8_t *d, const uint8_
         g = (data >> 16) & 0xff;
         MSB = (data >> 8) & 0xff;
 #endif
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
 #undef MSB
 #undef LSB
         width--;
@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line16_555_,NAME)(void *opaque, uint8_t *d, const ui
         data >>= 5;
         MSB = (data & 0x1f) << 3;
         data >>= 5;
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
         LSB = (data & 0x1f) << 3;
         data >>= 5;
         g = (data & 0x1f) << 3;
         data >>= 5;
         MSB = (data & 0x1f) << 3;
         data >>= 6;
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
 #undef MSB
 #undef LSB
         width -= 2;
@@ -XXX,XX +XXX,XX @@ static void glue(pl110_draw_line12_,NAME)(void *opaque, uint8_t *d, const uint8_
         data >>= 4;
         MSB = (data & 0xf) << 4;
         data >>= 8;
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
         LSB = (data & 0xf) << 4;
         data >>= 4;
         g = (data & 0xf) << 4;
         data >>= 4;
         MSB = (data & 0xf) << 4;
         data >>= 8;
-        COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+        COPY_PIXEL(d, rgb_to_pixel32(r, g, b));
 #undef MSB
 #undef LSB
         width -= 2;
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
     pl111_id
 };
 
-#define BITS 32
 #define COPY_PIXEL(to, from) do { *(uint32_t *)to = from; to += 4; } while (0)
 
 #undef RGB
@@ -XXX,XX +XXX,XX @@ static const unsigned char *idregs[] = {
 #include "pl110_template.h"
 #undef BORDER
 
-static drawfn pl110_draw_fn_32[48] = {
-    pl110_draw_line1_lblp_bgr32,
-    pl110_draw_line2_lblp_bgr32,
-    pl110_draw_line4_lblp_bgr32,
-    pl110_draw_line8_lblp_bgr32,
-    pl110_draw_line16_555_lblp_bgr32,
-    pl110_draw_line32_lblp_bgr32,
-    pl110_draw_line16_lblp_bgr32,
-    pl110_draw_line12_lblp_bgr32,
-
-    pl110_draw_line1_bbbp_bgr32,
-    pl110_draw_line2_bbbp_bgr32,
-    pl110_draw_line4_bbbp_bgr32,
-    pl110_draw_line8_bbbp_bgr32,
-    pl110_draw_line16_555_bbbp_bgr32,
-    pl110_draw_line32_bbbp_bgr32,
-    pl110_draw_line16_bbbp_bgr32,
-    pl110_draw_line12_bbbp_bgr32,
-
-    pl110_draw_line1_lbbp_bgr32,
-    pl110_draw_line2_lbbp_bgr32,
-    pl110_draw_line4_lbbp_bgr32,
-    pl110_draw_line8_lbbp_bgr32,
-    pl110_draw_line16_555_lbbp_bgr32,
-    pl110_draw_line32_lbbp_bgr32,
-    pl110_draw_line16_lbbp_bgr32,
-    pl110_draw_line12_lbbp_bgr32,
-
-    pl110_draw_line1_lblp_rgb32,
-    pl110_draw_line2_lblp_rgb32,
-    pl110_draw_line4_lblp_rgb32,
-    pl110_draw_line8_lblp_rgb32,
-    pl110_draw_line16_555_lblp_rgb32,
-    pl110_draw_line32_lblp_rgb32,
-    pl110_draw_line16_lblp_rgb32,
-    pl110_draw_line12_lblp_rgb32,
-
-    pl110_draw_line1_bbbp_rgb32,
-    pl110_draw_line2_bbbp_rgb32,
-    pl110_draw_line4_bbbp_rgb32,
-    pl110_draw_line8_bbbp_rgb32,
-    pl110_draw_line16_555_bbbp_rgb32,
-    pl110_draw_line32_bbbp_rgb32,
-    pl110_draw_line16_bbbp_rgb32,
-    pl110_draw_line12_bbbp_rgb32,
-
-    pl110_draw_line1_lbbp_rgb32,
-    pl110_draw_line2_lbbp_rgb32,
-    pl110_draw_line4_lbbp_rgb32,
-    pl110_draw_line8_lbbp_rgb32,
-    pl110_draw_line16_555_lbbp_rgb32,
-    pl110_draw_line32_lbbp_rgb32,
-    pl110_draw_line16_lbbp_rgb32,
-    pl110_draw_line12_lbbp_rgb32,
-};
-
-#undef BITS
 #undef COPY_PIXEL
 
+static drawfn pl110_draw_fn_32[48] = {
+    pl110_draw_line1_lblp_bgr,
+    pl110_draw_line2_lblp_bgr,
+    pl110_draw_line4_lblp_bgr,
+    pl110_draw_line8_lblp_bgr,
+    pl110_draw_line16_555_lblp_bgr,
+    pl110_draw_line32_lblp_bgr,
+    pl110_draw_line16_lblp_bgr,
+    pl110_draw_line12_lblp_bgr,
+
+    pl110_draw_line1_bbbp_bgr,
+    pl110_draw_line2_bbbp_bgr,
+    pl110_draw_line4_bbbp_bgr,
+    pl110_draw_line8_bbbp_bgr,
+    pl110_draw_line16_555_bbbp_bgr,
+    pl110_draw_line32_bbbp_bgr,
+    pl110_draw_line16_bbbp_bgr,
+    pl110_draw_line12_bbbp_bgr,
+
+    pl110_draw_line1_lbbp_bgr,
+    pl110_draw_line2_lbbp_bgr,
+    pl110_draw_line4_lbbp_bgr,
+    pl110_draw_line8_lbbp_bgr,
+    pl110_draw_line16_555_lbbp_bgr,
+    pl110_draw_line32_lbbp_bgr,
+    pl110_draw_line16_lbbp_bgr,
+    pl110_draw_line12_lbbp_bgr,
+
+    pl110_draw_line1_lblp_rgb,
+    pl110_draw_line2_lblp_rgb,
+    pl110_draw_line4_lblp_rgb,
+    pl110_draw_line8_lblp_rgb,
+    pl110_draw_line16_555_lblp_rgb,
+    pl110_draw_line32_lblp_rgb,
+    pl110_draw_line16_lblp_rgb,
+    pl110_draw_line12_lblp_rgb,
+
+    pl110_draw_line1_bbbp_rgb,
+    pl110_draw_line2_bbbp_rgb,
+    pl110_draw_line4_bbbp_rgb,
+    pl110_draw_line8_bbbp_rgb,
+    pl110_draw_line16_555_bbbp_rgb,
+    pl110_draw_line32_bbbp_rgb,
+    pl110_draw_line16_bbbp_rgb,
+    pl110_draw_line12_bbbp_rgb,
+
+    pl110_draw_line1_lbbp_rgb,
+    pl110_draw_line2_lbbp_rgb,
+    pl110_draw_line4_lbbp_rgb,
+    pl110_draw_line8_lbbp_rgb,
+    pl110_draw_line16_555_lbbp_rgb,
+    pl110_draw_line32_lbbp_rgb,
+    pl110_draw_line16_lbbp_rgb,
+    pl110_draw_line12_lbbp_rgb,
+};
 
 static int pl110_enabled(PL110State *s)
 {
-- 
2.20.1

For a long time now the UI layer has guaranteed that the console
surface is always 32 bits per pixel.  Remove the legacy dead code
from the pxa2xx_lcd display device which was handling the possibility
that the console surface was some other format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-5-peter.maydell@linaro.org
---
 hw/display/pxa2xx_lcd.c | 79 +++++++++--------------------------------
 1 file changed, 17 insertions(+), 62 deletions(-)

diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -XXX,XX +XXX,XX @@ struct PXA2xxLCDState {
 
     int invalidated;
     QemuConsole *con;
-    drawfn *line_fn[2];
     int dest_width;
     int xres, yres;
     int pal_for;
@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
 #define LDCMD_SOFINT	(1 << 22)
 #define LDCMD_PAL	(1 << 26)
 
+#define BITS 32
+#include "pxa2xx_template.h"
+
 /* Route internal interrupt lines to the global IC */
 static void pxa2xx_lcdc_int_update(PXA2xxLCDState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_palette_parse(PXA2xxLCDState *s, int ch, int bpp)
     }
 }
 
+static inline drawfn pxa2xx_drawfn(PXA2xxLCDState *s)
+{
+    if (s->transp) {
+        return pxa2xx_draw_fn_32t[s->bpp];
+    } else {
+        return pxa2xx_draw_fn_32[s->bpp];
+    }
+}
+
 static void pxa2xx_lcdc_dma0_redraw_rot0(PXA2xxLCDState *s,
                 hwaddr addr, int *miny, int *maxy)
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int src_width, dest_width;
-    drawfn fn = NULL;
-    if (s->dest_width)
-        fn = s->line_fn[s->transp][s->bpp];
+    drawfn fn = pxa2xx_drawfn(s);
     if (!fn)
         return;
 
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot90(PXA2xxLCDState *s,
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int src_width, dest_width;
-    drawfn fn = NULL;
-    if (s->dest_width)
-        fn = s->line_fn[s->transp][s->bpp];
+    drawfn fn = pxa2xx_drawfn(s);
     if (!fn)
         return;
 
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot180(PXA2xxLCDState *s,
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int src_width, dest_width;
-    drawfn fn = NULL;
-    if (s->dest_width) {
-        fn = s->line_fn[s->transp][s->bpp];
-    }
+    drawfn fn = pxa2xx_drawfn(s);
     if (!fn) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot270(PXA2xxLCDState *s,
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int src_width, dest_width;
-    drawfn fn = NULL;
-    if (s->dest_width) {
-        fn = s->line_fn[s->transp][s->bpp];
-    }
+    drawfn fn = pxa2xx_drawfn(s);
     if (!fn) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pxa2xx_lcdc = {
     }
 };
 
-#define BITS 8
-#include "pxa2xx_template.h"
-#define BITS 15
-#include "pxa2xx_template.h"
-#define BITS 16
-#include "pxa2xx_template.h"
-#define BITS 24
-#include "pxa2xx_template.h"
-#define BITS 32
-#include "pxa2xx_template.h"
-
 static const GraphicHwOps pxa2xx_ops = {
     .invalidate  = pxa2xx_invalidate_display,
     .gfx_update  = pxa2xx_update_display,
@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
                                  hwaddr base, qemu_irq irq)
 {
     PXA2xxLCDState *s;
-    DisplaySurface *surface;
 
     s = (PXA2xxLCDState *) g_malloc0(sizeof(PXA2xxLCDState));
     s->invalidated = 1;
@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     s->con = graphic_console_init(NULL, 0, &pxa2xx_ops, s);
-    surface = qemu_console_surface(s->con);
-
-    switch (surface_bits_per_pixel(surface)) {
-    case 0:
-        s->dest_width = 0;
-        break;
-    case 8:
-        s->line_fn[0] = pxa2xx_draw_fn_8;
-        s->line_fn[1] = pxa2xx_draw_fn_8t;
-        s->dest_width = 1;
-        break;
-    case 15:
-        s->line_fn[0] = pxa2xx_draw_fn_15;
-        s->line_fn[1] = pxa2xx_draw_fn_15t;
-        s->dest_width = 2;
-        break;
-    case 16:
-        s->line_fn[0] = pxa2xx_draw_fn_16;
-        s->line_fn[1] = pxa2xx_draw_fn_16t;
-        s->dest_width = 2;
-        break;
-    case 24:
-        s->line_fn[0] = pxa2xx_draw_fn_24;
-        s->line_fn[1] = pxa2xx_draw_fn_24t;
-        s->dest_width = 3;
-        break;
-    case 32:
-        s->line_fn[0] = pxa2xx_draw_fn_32;
-        s->line_fn[1] = pxa2xx_draw_fn_32t;
-        s->dest_width = 4;
-        break;
-    default:
-        fprintf(stderr, "%s: Bad color depth\n", __func__);
-        exit(1);
-    }
+    s->dest_width = 4;
 
     vmstate_register(NULL, 0, &vmstate_pxa2xx_lcdc, s);
 
-- 
2.20.1

Since the dest_width is now always 4 because the output surface is
32bpp, we can replace the dest_width state field with a constant.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-6-peter.maydell@linaro.org
---
 hw/display/pxa2xx_lcd.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
 #define LDCMD_SOFINT	(1 << 22)
 #define LDCMD_PAL	(1 << 26)
 
+/* Size of a pixel in the QEMU UI output surface, in bytes */
+#define DEST_PIXEL_WIDTH 4
+
 #define BITS 32
 #include "pxa2xx_template.h"
 
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot0(PXA2xxLCDState *s,
     else if (s->bpp > pxa_lcdc_8bpp)
         src_width *= 2;
 
-    dest_width = s->xres * s->dest_width;
+    dest_width = s->xres * DEST_PIXEL_WIDTH;
     *miny = 0;
     if (s->invalidated) {
         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
                                           addr, s->yres, src_width);
     }
     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
-                               src_width, dest_width, s->dest_width,
+                               src_width, dest_width, DEST_PIXEL_WIDTH,
                                s->invalidated,
                                fn, s->dma_ch[0].palette, miny, maxy);
 }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot90(PXA2xxLCDState *s,
     else if (s->bpp > pxa_lcdc_8bpp)
         src_width *= 2;
 
-    dest_width = s->yres * s->dest_width;
+    dest_width = s->yres * DEST_PIXEL_WIDTH;
     *miny = 0;
     if (s->invalidated) {
         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
                                           addr, s->yres, src_width);
     }
     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
-                               src_width, s->dest_width, -dest_width,
+                               src_width, DEST_PIXEL_WIDTH, -dest_width,
                                s->invalidated,
                                fn, s->dma_ch[0].palette,
                                miny, maxy);
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot180(PXA2xxLCDState *s,
         src_width *= 2;
     }
 
-    dest_width = s->xres * s->dest_width;
+    dest_width = s->xres * DEST_PIXEL_WIDTH;
     *miny = 0;
     if (s->invalidated) {
         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
                                           addr, s->yres, src_width);
     }
     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
-                               src_width, -dest_width, -s->dest_width,
+                               src_width, -dest_width, -DEST_PIXEL_WIDTH,
                                s->invalidated,
                                fn, s->dma_ch[0].palette, miny, maxy);
 }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_lcdc_dma0_redraw_rot270(PXA2xxLCDState *s,
         src_width *= 2;
     }
 
-    dest_width = s->yres * s->dest_width;
+    dest_width = s->yres * DEST_PIXEL_WIDTH;
     *miny = 0;
     if (s->invalidated) {
         framebuffer_update_memory_section(&s->fbsection, s->sysmem,
                                           addr, s->yres, src_width);
     }
     framebuffer_update_display(surface, &s->fbsection, s->xres, s->yres,
-                               src_width, -s->dest_width, dest_width,
+                               src_width, -DEST_PIXEL_WIDTH, dest_width,
                                s->invalidated,
                                fn, s->dma_ch[0].palette,
                                miny, maxy);
@@ -XXX,XX +XXX,XX @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     s->con = graphic_console_init(NULL, 0, &pxa2xx_ops, s);
-    s->dest_width = 4;
 
     vmstate_register(NULL, 0, &vmstate_pxa2xx_lcdc, s);
 
-- 
2.20.1

Now that BITS is always 32, expand out all its uses in the template
header, including removing now-useless uses of the glue() macro.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-7-peter.maydell@linaro.org
---
 hw/display/pxa2xx_template.h | 110 ++++++++++++++---------------------
 1 file changed, 45 insertions(+), 65 deletions(-)

diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_template.h
+++ b/hw/display/pxa2xx_template.h
@@ -XXX,XX +XXX,XX @@
  */
 
 # define SKIP_PIXEL(to)		to += deststep
-#if BITS == 8
-# define COPY_PIXEL(to, from)  do { *to = from; SKIP_PIXEL(to); } while (0)
-#elif BITS == 15 || BITS == 16
-# define COPY_PIXEL(to, from)    \
-    do {                         \
-        *(uint16_t *) to = from; \
-        SKIP_PIXEL(to);          \
-    } while (0)
-#elif BITS == 24
-# define COPY_PIXEL(to, from)     \
-    do {                          \
-        *(uint16_t *) to = from;  \
-        *(to + 2) = (from) >> 16; \
-        SKIP_PIXEL(to);           \
-    } while (0)
-#elif BITS == 32
 # define COPY_PIXEL(to, from)    \
     do {                         \
         *(uint32_t *) to = from; \
         SKIP_PIXEL(to);          \
     } while (0)
-#else
-# error unknown bit depth
-#endif
 
 #ifdef HOST_WORDS_BIGENDIAN
 # define SWAP_WORDS	1
@@ -XXX,XX +XXX,XX @@
 #define FN_2(x)		FN(x + 1) FN(x)
 #define FN_4(x)		FN_2(x + 2) FN_2(x)
 
-static void glue(pxa2xx_draw_line2_, BITS)(void *opaque,
+static void pxa2xx_draw_line2(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t *palette = opaque;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line2_, BITS)(void *opaque,
     }
 }
 
-static void glue(pxa2xx_draw_line4_, BITS)(void *opaque,
+static void pxa2xx_draw_line4(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t *palette = opaque;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line4_, BITS)(void *opaque,
     }
 }
 
-static void glue(pxa2xx_draw_line8_, BITS)(void *opaque,
+static void pxa2xx_draw_line8(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t *palette = opaque;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line8_, BITS)(void *opaque,
     }
 }
 
-static void glue(pxa2xx_draw_line16_, BITS)(void *opaque,
+static void pxa2xx_draw_line16(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16_, BITS)(void *opaque,
         data >>= 6;
         r = (data & 0x1f) << 3;
         data >>= 5;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         b = (data & 0x1f) << 3;
         data >>= 5;
         g = (data & 0x3f) << 2;
         data >>= 6;
         r = (data & 0x1f) << 3;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 2;
         src += 4;
     }
 }
 
-static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
+static void pxa2xx_draw_line16t(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
         if (data & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         data >>= 1;
         b = (data & 0x1f) << 3;
         data >>= 5;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line16t_, BITS)(void *opaque,
         if (data & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 2;
         src += 4;
     }
 }
 
-static void glue(pxa2xx_draw_line18_, BITS)(void *opaque,
+static void pxa2xx_draw_line18(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line18_, BITS)(void *opaque,
         g = (data & 0x3f) << 2;
         data >>= 6;
         r = (data & 0x3f) << 2;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 1;
         src += 4;
     }
 }
 
 /* The wicked packed format */
-static void glue(pxa2xx_draw_line18p_, BITS)(void *opaque,
+static void pxa2xx_draw_line18p(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data[3];
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line18p_, BITS)(void *opaque,
         data[0] >>= 6;
         r = (data[0] & 0x3f) << 2;
         data[0] >>= 12;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         b = (data[0] & 0x3f) << 2;
         data[0] >>= 6;
         g = ((data[1] & 0xf) << 4) | (data[0] << 2);
         data[1] >>= 4;
         r = (data[1] & 0x3f) << 2;
         data[1] >>= 12;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         b = (data[1] & 0x3f) << 2;
         data[1] >>= 6;
         g = (data[1] & 0x3f) << 2;
         data[1] >>= 6;
         r = ((data[2] & 0x3) << 6) | (data[1] << 2);
         data[2] >>= 8;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         b = (data[2] & 0x3f) << 2;
         data[2] >>= 6;
         g = (data[2] & 0x3f) << 2;
         data[2] >>= 6;
         r = data[2] << 2;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 4;
     }
 }
 
-static void glue(pxa2xx_draw_line19_, BITS)(void *opaque,
+static void pxa2xx_draw_line19(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19_, BITS)(void *opaque,
         if (data & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 1;
         src += 4;
     }
 }
 
 /* The wicked packed format */
-static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
+static void pxa2xx_draw_line19p(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data[3];
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
         if (data[0] & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         data[0] >>= 6;
         b = (data[0] & 0x3f) << 2;
         data[0] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
         if (data[1] & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         data[1] >>= 6;
         b = (data[1] & 0x3f) << 2;
         data[1] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
         if (data[2] & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         data[2] >>= 6;
         b = (data[2] & 0x3f) << 2;
         data[2] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line19p_, BITS)(void *opaque,
         if (data[2] & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 4;
     }
 }
 
-static void glue(pxa2xx_draw_line24_, BITS)(void *opaque,
+static void pxa2xx_draw_line24(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line24_, BITS)(void *opaque,
         g = data & 0xff;
         data >>= 8;
         r = data & 0xff;
-        COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 1;
         src += 4;
     }
 }
 
-static void glue(pxa2xx_draw_line24t_, BITS)(void *opaque,
+static void pxa2xx_draw_line24t(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line24t_, BITS)(void *opaque,
         if (data & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 1;
         src += 4;
     }
 }
 
-static void glue(pxa2xx_draw_line25_, BITS)(void *opaque,
+static void pxa2xx_draw_line25(void *opaque,
                 uint8_t *dest, const uint8_t *src, int width, int deststep)
 {
     uint32_t data;
@@ -XXX,XX +XXX,XX @@ static void glue(pxa2xx_draw_line25_, BITS)(void *opaque,
         if (data & 1)
             SKIP_PIXEL(dest);
         else
-            COPY_PIXEL(dest, glue(rgb_to_pixel, BITS)(r, g, b));
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
         width -= 1;
         src += 4;
     }
 }
 
 /* Overlay planes disabled, no transparency */
-static drawfn glue(pxa2xx_draw_fn_, BITS)[16] =
+static drawfn pxa2xx_draw_fn_32[16] =
 {
     [0 ... 0xf]       = NULL,
-    [pxa_lcdc_2bpp]   = glue(pxa2xx_draw_line2_, BITS),
-    [pxa_lcdc_4bpp]   = glue(pxa2xx_draw_line4_, BITS),
-    [pxa_lcdc_8bpp]   = glue(pxa2xx_draw_line8_, BITS),
-    [pxa_lcdc_16bpp]  = glue(pxa2xx_draw_line16_, BITS),
-    [pxa_lcdc_18bpp]  = glue(pxa2xx_draw_line18_, BITS),
-    [pxa_lcdc_18pbpp] = glue(pxa2xx_draw_line18p_, BITS),
-    [pxa_lcdc_24bpp]  = glue(pxa2xx_draw_line24_, BITS),
+    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
+    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
+    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
 };
 
 /* Overlay planes enabled, transparency used */
-static drawfn glue(glue(pxa2xx_draw_fn_, BITS), t)[16] =
+static drawfn pxa2xx_draw_fn_32t[16] =
 {
     [0 ... 0xf]       = NULL,
-    [pxa_lcdc_4bpp]   = glue(pxa2xx_draw_line4_, BITS),
-    [pxa_lcdc_8bpp]   = glue(pxa2xx_draw_line8_, BITS),
-    [pxa_lcdc_16bpp]  = glue(pxa2xx_draw_line16t_, BITS),
-    [pxa_lcdc_19bpp]  = glue(pxa2xx_draw_line19_, BITS),
-    [pxa_lcdc_19pbpp] = glue(pxa2xx_draw_line19p_, BITS),
-    [pxa_lcdc_24bpp]  = glue(pxa2xx_draw_line24t_, BITS),
-    [pxa_lcdc_25bpp]  = glue(pxa2xx_draw_line25_, BITS),
+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
+    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
+    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
+    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
 };
 
-#undef BITS
 #undef COPY_PIXEL
 #undef SKIP_PIXEL
 
-- 
2.20.1

We're about to move code from the template header into pxa2xx_lcd.c.
Before doing that, make coding style fixes so checkpatch doesn't
complain about the patch which moves the code. This commit fixes
missing braces in the SKIP_PIXEL() macro definition and in if()
statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-8-peter.maydell@linaro.org
---
 hw/display/pxa2xx_template.h | 47 +++++++++++++++++++++---------------
 1 file changed, 28 insertions(+), 19 deletions(-)

diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_template.h
+++ b/hw/display/pxa2xx_template.h
@@ -XXX,XX +XXX,XX @@
  * Framebuffer format conversion routines.
  */
 
-# define SKIP_PIXEL(to)		to += deststep
+# define SKIP_PIXEL(to) do { to += deststep; } while (0)
 # define COPY_PIXEL(to, from)    \
     do {                         \
         *(uint32_t *) to = from; \
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
         data >>= 5;
         r = (data & 0x1f) << 3;
         data >>= 5;
-        if (data & 1)
+        if (data & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         data >>= 1;
         b = (data & 0x1f) << 3;
         data >>= 5;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
         data >>= 5;
         r = (data & 0x1f) << 3;
         data >>= 5;
-        if (data & 1)
+        if (data & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         width -= 2;
         src += 4;
     }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19(void *opaque,
         data >>= 6;
         r = (data & 0x3f) << 2;
         data >>= 6;
-        if (data & 1)
+        if (data & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         width -= 1;
         src += 4;
     }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
         data[0] >>= 6;
         r = (data[0] & 0x3f) << 2;
         data[0] >>= 6;
-        if (data[0] & 1)
+        if (data[0] & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         data[0] >>= 6;
         b = (data[0] & 0x3f) << 2;
         data[0] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
         data[1] >>= 4;
         r = (data[1] & 0x3f) << 2;
         data[1] >>= 6;
-        if (data[1] & 1)
+        if (data[1] & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         data[1] >>= 6;
         b = (data[1] & 0x3f) << 2;
         data[1] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
         data[1] >>= 6;
         r = ((data[2] & 0x3) << 6) | (data[1] << 2);
         data[2] >>= 2;
-        if (data[2] & 1)
+        if (data[2] & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         data[2] >>= 6;
         b = (data[2] & 0x3f) << 2;
         data[2] >>= 6;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
         data[2] >>= 6;
         r = data[2] << 2;
         data[2] >>= 6;
-        if (data[2] & 1)
+        if (data[2] & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         width -= 4;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24t(void *opaque,
         data >>= 8;
         r = data & 0xff;
         data >>= 8;
-        if (data & 1)
+        if (data & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         width -= 1;
         src += 4;
     }
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line25(void *opaque,
         data >>= 8;
         r = data & 0xff;
         data >>= 8;
-        if (data & 1)
+        if (data & 1) {
             SKIP_PIXEL(dest);
-        else
+        } else {
             COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
         width -= 1;
         src += 4;
     }
-- 
2.20.1

We're about to move code from the template header into pxa2xx_lcd.c.
Before doing that, make coding style fixes so checkpatch doesn't
complain about the patch which moves the code. This commit is
whitespace changes only:
 * avoid hard-coded tabs
 * fix ident on function prototypes
 * no newline before open brace on array definitions

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-9-peter.maydell@linaro.org
---
 hw/display/pxa2xx_template.h | 66 +++++++++++++++++-------------------
 1 file changed, 32 insertions(+), 34 deletions(-)

diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_template.h
+++ b/hw/display/pxa2xx_template.h
@@ -XXX,XX +XXX,XX @@
     } while (0)
 
 #ifdef HOST_WORDS_BIGENDIAN
-# define SWAP_WORDS	1
+# define SWAP_WORDS 1
 #endif
 
-#define FN_2(x)		FN(x + 1) FN(x)
-#define FN_4(x)		FN_2(x + 2) FN_2(x)
+#define FN_2(x) FN(x + 1) FN(x)
+#define FN_4(x) FN_2(x + 2) FN_2(x)
 
-static void pxa2xx_draw_line2(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
 {
     uint32_t *palette = opaque;
     uint32_t data;
     while (width > 0) {
         data = *(uint32_t *) src;
-#define FN(x)		COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
 #ifdef SWAP_WORDS
         FN_4(12)
         FN_4(8)
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line2(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line4(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
 {
     uint32_t *palette = opaque;
     uint32_t data;
     while (width > 0) {
         data = *(uint32_t *) src;
-#define FN(x)		COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
 #ifdef SWAP_WORDS
         FN_2(6)
         FN_2(4)
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line4(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line8(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
 {
     uint32_t *palette = opaque;
     uint32_t data;
     while (width > 0) {
         data = *(uint32_t *) src;
-#define FN(x)		COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
+#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
 #ifdef SWAP_WORDS
         FN(24)
         FN(16)
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line8(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line16(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line16t(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line16t(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line18(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line18(void *opaque,
 }
 
 /* The wicked packed format */
-static void pxa2xx_draw_line18p(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
 {
     uint32_t data[3];
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line18p(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line19(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19(void *opaque,
 }
 
 /* The wicked packed format */
-static void pxa2xx_draw_line19p(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
 {
     uint32_t data[3];
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line19p(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line24(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line24t(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line24t(void *opaque,
     }
 }
 
-static void pxa2xx_draw_line25(void *opaque,
-                uint8_t *dest, const uint8_t *src, int width, int deststep)
+static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
 {
     uint32_t data;
     unsigned int r, g, b;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_draw_line25(void *opaque,
 }
 
 /* Overlay planes disabled, no transparency */
-static drawfn pxa2xx_draw_fn_32[16] =
-{
+static drawfn pxa2xx_draw_fn_32[16] = {
     [0 ... 0xf]       = NULL,
     [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
     [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
@@ -XXX,XX +XXX,XX @@ static drawfn pxa2xx_draw_fn_32[16] =
 };
 
 /* Overlay planes enabled, transparency used */
-static drawfn pxa2xx_draw_fn_32t[16] =
-{
+static drawfn pxa2xx_draw_fn_32t[16] = {
     [0 ... 0xf]       = NULL,
     [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
     [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-- 
2.20.1

The template header is now included only once; just inline its contents
in hw/display/pxa2xx_lcd.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20210211141515.8755-10-peter.maydell@linaro.org
---
 hw/display/pxa2xx_template.h | 434 -----------------------------------
 hw/display/pxa2xx_lcd.c      | 427 +++++++++++++++++++++++++++++++++-
 2 files changed, 425 insertions(+), 436 deletions(-)
 delete mode 100644 hw/display/pxa2xx_template.h

diff --git a/hw/display/pxa2xx_template.h b/hw/display/pxa2xx_template.h
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/hw/display/pxa2xx_template.h
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * Intel XScale PXA255/270 LCDC emulation.
- *
- * Copyright (c) 2006 Openedhand Ltd.
- * Written by Andrzej Zaborowski <balrog@zabor.org>
- *
- * This code is licensed under the GPLv2.
- *
- * Framebuffer format conversion routines.
- */
-
-# define SKIP_PIXEL(to) do { to += deststep; } while (0)
-# define COPY_PIXEL(to, from)    \
-    do {                         \
-        *(uint32_t *) to = from; \
-        SKIP_PIXEL(to);          \
-    } while (0)
-
-#ifdef HOST_WORDS_BIGENDIAN
-# define SWAP_WORDS 1
-#endif
-
-#define FN_2(x) FN(x + 1) FN(x)
-#define FN_4(x) FN_2(x + 2) FN_2(x)
-
-static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
-                              int width, int deststep)
-{
-    uint32_t *palette = opaque;
-    uint32_t data;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
-#ifdef SWAP_WORDS
-        FN_4(12)
-        FN_4(8)
-        FN_4(4)
-        FN_4(0)
-#else
-        FN_4(0)
-        FN_4(4)
-        FN_4(8)
-        FN_4(12)
-#endif
-#undef FN
-        width -= 16;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
-                              int width, int deststep)
-{
-    uint32_t *palette = opaque;
-    uint32_t data;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
-#ifdef SWAP_WORDS
-        FN_2(6)
-        FN_2(4)
-        FN_2(2)
-        FN_2(0)
-#else
-        FN_2(0)
-        FN_2(2)
-        FN_2(4)
-        FN_2(6)
-#endif
-#undef FN
-        width -= 8;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
-                              int width, int deststep)
-{
-    uint32_t *palette = opaque;
-    uint32_t data;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
-#ifdef SWAP_WORDS
-        FN(24)
-        FN(16)
-        FN(8)
-        FN(0)
-#else
-        FN(0)
-        FN(8)
-        FN(16)
-        FN(24)
-#endif
-#undef FN
-        width -= 4;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
-                               int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = (data & 0x1f) << 3;
-        data >>= 5;
-        g = (data & 0x3f) << 2;
-        data >>= 6;
-        r = (data & 0x1f) << 3;
-        data >>= 5;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        b = (data & 0x1f) << 3;
-        data >>= 5;
-        g = (data & 0x3f) << 2;
-        data >>= 6;
-        r = (data & 0x1f) << 3;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        width -= 2;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
-                                int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = (data & 0x1f) << 3;
-        data >>= 5;
-        g = (data & 0x1f) << 3;
-        data >>= 5;
-        r = (data & 0x1f) << 3;
-        data >>= 5;
-        if (data & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        data >>= 1;
-        b = (data & 0x1f) << 3;
-        data >>= 5;
-        g = (data & 0x1f) << 3;
-        data >>= 5;
-        r = (data & 0x1f) << 3;
-        data >>= 5;
-        if (data & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        width -= 2;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
-                               int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = (data & 0x3f) << 2;
-        data >>= 6;
-        g = (data & 0x3f) << 2;
-        data >>= 6;
-        r = (data & 0x3f) << 2;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        width -= 1;
-        src += 4;
-    }
-}
-
-/* The wicked packed format */
-static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
-                                int width, int deststep)
-{
-    uint32_t data[3];
-    unsigned int r, g, b;
-    while (width > 0) {
-        data[0] = *(uint32_t *) src;
-        src += 4;
-        data[1] = *(uint32_t *) src;
-        src += 4;
-        data[2] = *(uint32_t *) src;
-        src += 4;
-#ifdef SWAP_WORDS
-        data[0] = bswap32(data[0]);
-        data[1] = bswap32(data[1]);
-        data[2] = bswap32(data[2]);
-#endif
-        b = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        g = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        r = (data[0] & 0x3f) << 2;
-        data[0] >>= 12;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        b = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
-        data[1] >>= 4;
-        r = (data[1] & 0x3f) << 2;
-        data[1] >>= 12;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        b = (data[1] & 0x3f) << 2;
-        data[1] >>= 6;
-        g = (data[1] & 0x3f) << 2;
-        data[1] >>= 6;
-        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-        data[2] >>= 8;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        b = (data[2] & 0x3f) << 2;
-        data[2] >>= 6;
-        g = (data[2] & 0x3f) << 2;
-        data[2] >>= 6;
-        r = data[2] << 2;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        width -= 4;
-    }
-}
-
-static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
-                               int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = (data & 0x3f) << 2;
-        data >>= 6;
-        g = (data & 0x3f) << 2;
-        data >>= 6;
-        r = (data & 0x3f) << 2;
-        data >>= 6;
-        if (data & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        width -= 1;
-        src += 4;
-    }
-}
-
-/* The wicked packed format */
-static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
-                                int width, int deststep)
-{
-    uint32_t data[3];
-    unsigned int r, g, b;
-    while (width > 0) {
-        data[0] = *(uint32_t *) src;
-        src += 4;
-        data[1] = *(uint32_t *) src;
-        src += 4;
-        data[2] = *(uint32_t *) src;
-        src += 4;
-# ifdef SWAP_WORDS
-        data[0] = bswap32(data[0]);
-        data[1] = bswap32(data[1]);
-        data[2] = bswap32(data[2]);
-# endif
-        b = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        g = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        r = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        if (data[0] & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        data[0] >>= 6;
-        b = (data[0] & 0x3f) << 2;
-        data[0] >>= 6;
-        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
-        data[1] >>= 4;
-        r = (data[1] & 0x3f) << 2;
-        data[1] >>= 6;
-        if (data[1] & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        data[1] >>= 6;
-        b = (data[1] & 0x3f) << 2;
-        data[1] >>= 6;
-        g = (data[1] & 0x3f) << 2;
-        data[1] >>= 6;
-        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
-        data[2] >>= 2;
-        if (data[2] & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        data[2] >>= 6;
-        b = (data[2] & 0x3f) << 2;
-        data[2] >>= 6;
-        g = (data[2] & 0x3f) << 2;
-        data[2] >>= 6;
-        r = data[2] << 2;
-        data[2] >>= 6;
-        if (data[2] & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        width -= 4;
-    }
-}
-
-static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
-                               int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = data & 0xff;
-        data >>= 8;
-        g = data & 0xff;
-        data >>= 8;
-        r = data & 0xff;
-        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        width -= 1;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
-                                int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = (data & 0x7f) << 1;
-        data >>= 7;
-        g = data & 0xff;
-        data >>= 8;
-        r = data & 0xff;
-        data >>= 8;
-        if (data & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        width -= 1;
-        src += 4;
-    }
-}
-
-static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
-                               int width, int deststep)
-{
-    uint32_t data;
-    unsigned int r, g, b;
-    while (width > 0) {
-        data = *(uint32_t *) src;
-#ifdef SWAP_WORDS
-        data = bswap32(data);
-#endif
-        b = data & 0xff;
-        data >>= 8;
-        g = data & 0xff;
-        data >>= 8;
-        r = data & 0xff;
-        data >>= 8;
-        if (data & 1) {
-            SKIP_PIXEL(dest);
-        } else {
-            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
-        }
-        width -= 1;
-        src += 4;
-    }
-}
-
-/* Overlay planes disabled, no transparency */
-static drawfn pxa2xx_draw_fn_32[16] = {
-    [0 ... 0xf]       = NULL,
-    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
-    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
-    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
-    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
-    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
-};
-
-/* Overlay planes enabled, transparency used */
-static drawfn pxa2xx_draw_fn_32t[16] = {
-    [0 ... 0xf]       = NULL,
-    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
-    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
-    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
-    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
-    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
-    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
-    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
-};
-
-#undef COPY_PIXEL
-#undef SKIP_PIXEL
-
-#ifdef SWAP_WORDS
-# undef SWAP_WORDS
-#endif
diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -XXX,XX +XXX,XX @@ typedef struct QEMU_PACKED {
 /* Size of a pixel in the QEMU UI output surface, in bytes */
 #define DEST_PIXEL_WIDTH 4
 
-#define BITS 32
-#include "pxa2xx_template.h"
+/* Line drawing code to handle the various possible guest pixel formats */
+
+# define SKIP_PIXEL(to) do { to += deststep; } while (0)
+# define COPY_PIXEL(to, from)    \
+    do {                         \
+        *(uint32_t *) to = from; \
+        SKIP_PIXEL(to);          \
+    } while (0)
+
+#ifdef HOST_WORDS_BIGENDIAN
+# define SWAP_WORDS 1
+#endif
+
+#define FN_2(x) FN(x + 1) FN(x)
+#define FN_4(x) FN_2(x + 2) FN_2(x)
+
+static void pxa2xx_draw_line2(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
+{
+    uint32_t *palette = opaque;
+    uint32_t data;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 2)) & 3]);
+#ifdef SWAP_WORDS
+        FN_4(12)
+        FN_4(8)
+        FN_4(4)
+        FN_4(0)
+#else
+        FN_4(0)
+        FN_4(4)
+        FN_4(8)
+        FN_4(12)
+#endif
+#undef FN
+        width -= 16;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line4(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
+{
+    uint32_t *palette = opaque;
+    uint32_t data;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#define FN(x) COPY_PIXEL(dest, palette[(data >> ((x) * 4)) & 0xf]);
+#ifdef SWAP_WORDS
+        FN_2(6)
+        FN_2(4)
+        FN_2(2)
+        FN_2(0)
+#else
+        FN_2(0)
+        FN_2(2)
+        FN_2(4)
+        FN_2(6)
+#endif
+#undef FN
+        width -= 8;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line8(void *opaque, uint8_t *dest, const uint8_t *src,
+                              int width, int deststep)
+{
+    uint32_t *palette = opaque;
+    uint32_t data;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#define FN(x) COPY_PIXEL(dest, palette[(data >> (x)) & 0xff]);
+#ifdef SWAP_WORDS
+        FN(24)
+        FN(16)
+        FN(8)
+        FN(0)
+#else
+        FN(0)
+        FN(8)
+        FN(16)
+        FN(24)
+#endif
+#undef FN
+        width -= 4;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line16(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = (data & 0x1f) << 3;
+        data >>= 5;
+        g = (data & 0x3f) << 2;
+        data >>= 6;
+        r = (data & 0x1f) << 3;
+        data >>= 5;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        b = (data & 0x1f) << 3;
+        data >>= 5;
+        g = (data & 0x3f) << 2;
+        data >>= 6;
+        r = (data & 0x1f) << 3;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        width -= 2;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line16t(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = (data & 0x1f) << 3;
+        data >>= 5;
+        g = (data & 0x1f) << 3;
+        data >>= 5;
+        r = (data & 0x1f) << 3;
+        data >>= 5;
+        if (data & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        data >>= 1;
+        b = (data & 0x1f) << 3;
+        data >>= 5;
+        g = (data & 0x1f) << 3;
+        data >>= 5;
+        r = (data & 0x1f) << 3;
+        data >>= 5;
+        if (data & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        width -= 2;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line18(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = (data & 0x3f) << 2;
+        data >>= 6;
+        g = (data & 0x3f) << 2;
+        data >>= 6;
+        r = (data & 0x3f) << 2;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        width -= 1;
+        src += 4;
+    }
+}
+
+/* The wicked packed format */
+static void pxa2xx_draw_line18p(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
+{
+    uint32_t data[3];
+    unsigned int r, g, b;
+    while (width > 0) {
+        data[0] = *(uint32_t *) src;
+        src += 4;
+        data[1] = *(uint32_t *) src;
+        src += 4;
+        data[2] = *(uint32_t *) src;
+        src += 4;
+#ifdef SWAP_WORDS
+        data[0] = bswap32(data[0]);
+        data[1] = bswap32(data[1]);
+        data[2] = bswap32(data[2]);
+#endif
+        b = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        g = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        r = (data[0] & 0x3f) << 2;
+        data[0] >>= 12;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        b = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
+        data[1] >>= 4;
+        r = (data[1] & 0x3f) << 2;
+        data[1] >>= 12;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        b = (data[1] & 0x3f) << 2;
+        data[1] >>= 6;
+        g = (data[1] & 0x3f) << 2;
+        data[1] >>= 6;
+        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
+        data[2] >>= 8;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        b = (data[2] & 0x3f) << 2;
+        data[2] >>= 6;
+        g = (data[2] & 0x3f) << 2;
+        data[2] >>= 6;
+        r = data[2] << 2;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        width -= 4;
+    }
+}
+
+static void pxa2xx_draw_line19(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = (data & 0x3f) << 2;
+        data >>= 6;
+        g = (data & 0x3f) << 2;
+        data >>= 6;
+        r = (data & 0x3f) << 2;
+        data >>= 6;
+        if (data & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        width -= 1;
+        src += 4;
+    }
+}
+
+/* The wicked packed format */
+static void pxa2xx_draw_line19p(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
+{
+    uint32_t data[3];
+    unsigned int r, g, b;
+    while (width > 0) {
+        data[0] = *(uint32_t *) src;
+        src += 4;
+        data[1] = *(uint32_t *) src;
+        src += 4;
+        data[2] = *(uint32_t *) src;
+        src += 4;
+# ifdef SWAP_WORDS
+        data[0] = bswap32(data[0]);
+        data[1] = bswap32(data[1]);
+        data[2] = bswap32(data[2]);
+# endif
+        b = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        g = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        r = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        if (data[0] & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        data[0] >>= 6;
+        b = (data[0] & 0x3f) << 2;
+        data[0] >>= 6;
+        g = ((data[1] & 0xf) << 4) | (data[0] << 2);
+        data[1] >>= 4;
+        r = (data[1] & 0x3f) << 2;
+        data[1] >>= 6;
+        if (data[1] & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        data[1] >>= 6;
+        b = (data[1] & 0x3f) << 2;
+        data[1] >>= 6;
+        g = (data[1] & 0x3f) << 2;
+        data[1] >>= 6;
+        r = ((data[2] & 0x3) << 6) | (data[1] << 2);
+        data[2] >>= 2;
+        if (data[2] & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        data[2] >>= 6;
+        b = (data[2] & 0x3f) << 2;
+        data[2] >>= 6;
+        g = (data[2] & 0x3f) << 2;
+        data[2] >>= 6;
+        r = data[2] << 2;
+        data[2] >>= 6;
+        if (data[2] & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        width -= 4;
+    }
+}
+
+static void pxa2xx_draw_line24(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = data & 0xff;
+        data >>= 8;
+        g = data & 0xff;
+        data >>= 8;
+        r = data & 0xff;
+        COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        width -= 1;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line24t(void *opaque, uint8_t *dest, const uint8_t *src,
+                                int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = (data & 0x7f) << 1;
+        data >>= 7;
+        g = data & 0xff;
+        data >>= 8;
+        r = data & 0xff;
+        data >>= 8;
+        if (data & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        width -= 1;
+        src += 4;
+    }
+}
+
+static void pxa2xx_draw_line25(void *opaque, uint8_t *dest, const uint8_t *src,
+                               int width, int deststep)
+{
+    uint32_t data;
+    unsigned int r, g, b;
+    while (width > 0) {
+        data = *(uint32_t *) src;
+#ifdef SWAP_WORDS
+        data = bswap32(data);
+#endif
+        b = data & 0xff;
+        data >>= 8;
+        g = data & 0xff;
+        data >>= 8;
+        r = data & 0xff;
+        data >>= 8;
+        if (data & 1) {
+            SKIP_PIXEL(dest);
+        } else {
+            COPY_PIXEL(dest, rgb_to_pixel32(r, g, b));
+        }
+        width -= 1;
+        src += 4;
+    }
+}
+
+/* Overlay planes disabled, no transparency */
+static drawfn pxa2xx_draw_fn_32[16] = {
+    [0 ... 0xf]       = NULL,
+    [pxa_lcdc_2bpp]   = pxa2xx_draw_line2,
+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16,
+    [pxa_lcdc_18bpp]  = pxa2xx_draw_line18,
+    [pxa_lcdc_18pbpp] = pxa2xx_draw_line18p,
+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24,
+};
+
+/* Overlay planes enabled, transparency used */
+static drawfn pxa2xx_draw_fn_32t[16] = {
+    [0 ... 0xf]       = NULL,
+    [pxa_lcdc_4bpp]   = pxa2xx_draw_line4,
+    [pxa_lcdc_8bpp]   = pxa2xx_draw_line8,
+    [pxa_lcdc_16bpp]  = pxa2xx_draw_line16t,
+    [pxa_lcdc_19bpp]  = pxa2xx_draw_line19,
+    [pxa_lcdc_19pbpp] = pxa2xx_draw_line19p,
+    [pxa_lcdc_24bpp]  = pxa2xx_draw_line24t,
+    [pxa_lcdc_25bpp]  = pxa2xx_draw_line25,
+};
+
+#undef COPY_PIXEL
+#undef SKIP_PIXEL
+
+#ifdef SWAP_WORDS
+# undef SWAP_WORDS
+#endif
 
 /* Route internal interrupt lines to the global IC */
 static void pxa2xx_lcdc_int_update(PXA2xxLCDState *s)
-- 
2.20.1

Two small bugfixes, plus most of RTH's refactoring of cpregs
handling.

-- PMM

The following changes since commit 1fba9dc71a170b3a05b9d3272dd8ecfe7f26e215:

Merge tag 'pull-request-2022-05-04' of https://gitlab.com/thuth/qemu into staging (2022-05-04 08:07:02 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220505

for you to fetch changes up to 99a50d1a67c602126fc2b3a4812d3000eba9bf34:

target/arm: read access to performance counters from EL0 (2022-05-05 09:36:22 +0100)

----------------------------------------------------------------
target-arm queue:
 * Enable read access to performance counters from EL0
 * Enable SCTLR_EL1.BT0 for aarch64-linux-user
 * Refactoring of cpreg handling

----------------------------------------------------------------
Alex Zuepke (1):
      target/arm: read access to performance counters from EL0

Richard Henderson (22):
      target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
      target/arm: Split out cpregs.h
      target/arm: Reorg CPAccessResult and access_check_cp_reg
      target/arm: Replace sentinels with ARRAY_SIZE in cpregs.h
      target/arm: Make some more cpreg data static const
      target/arm: Reorg ARMCPRegInfo type field bits
      target/arm: Avoid bare abort() or assert(0)
      target/arm: Change cpreg access permissions to enum
      target/arm: Name CPState type
      target/arm: Name CPSecureState type
      target/arm: Drop always-true test in define_arm_vh_e2h_redirects_aliases
      target/arm: Store cpregs key in the hash table directly
      target/arm: Merge allocation of the cpreg and its name
      target/arm: Hoist computation of key in add_cpreg_to_hashtable
      target/arm: Consolidate cpreg updates in add_cpreg_to_hashtable
      target/arm: Use bool for is64 and ns in add_cpreg_to_hashtable
      target/arm: Hoist isbanked computation in add_cpreg_to_hashtable
      target/arm: Perform override check early in add_cpreg_to_hashtable
      target/arm: Reformat comments in add_cpreg_to_hashtable
      target/arm: Remove HOST_BIG_ENDIAN ifdef in add_cpreg_to_hashtable
      target/arm: Add isar predicates for FEAT_Debugv8p2
      target/arm: Add isar_feature_{aa64,any}_ras

From: Richard Henderson <richard.henderson@linaro.org>

This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
(indirect branch from register other than x16/x17).  The linux kernel
sets this in bti_enable().

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220427042312.294300-1-richard.henderson@linaro.org
[PMM: remove stray change to makefile comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c                  |  2 ++
 tests/tcg/aarch64/bti-3.c         | 42 +++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  6 ++---
 3 files changed, 47 insertions(+), 3 deletions(-)
 create mode 100644 tests/tcg/aarch64/bti-3.c

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         /* Enable all PAC keys.  */
         env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |
                                   SCTLR_EnDA | SCTLR_EnDB);
+        /* Trap on btype=3 for PACIxSP. */
+        env->cp15.sctlr_el[1] |= SCTLR_BT0;
         /* and to the FP/Neon instructions */
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3);
         /* and to the SVE instructions */
diff --git a/tests/tcg/aarch64/bti-3.c b/tests/tcg/aarch64/bti-3.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/bti-3.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * BTI vs PACIASP
+ */
+
+#include "bti-crt.inc.c"
+
+static void skip2_sigill(int sig, siginfo_t *info, ucontext_t *uc)
+{
+    uc->uc_mcontext.pc += 8;
+    uc->uc_mcontext.pstate = 1;
+}
+
+#define BTYPE_1() \
+    asm("mov %0,#1; adr x16, 1f; br x16; 1: hint #25; mov %0,#0" \
+        : "=r"(skipped) : : "x16", "x30")
+
+#define BTYPE_2() \
+    asm("mov %0,#1; adr x16, 1f; blr x16; 1: hint #25; mov %0,#0" \
+        : "=r"(skipped) : : "x16", "x30")
+
+#define BTYPE_3() \
+    asm("mov %0,#1; adr x15, 1f; br x15; 1: hint #25; mov %0,#0" \
+        : "=r"(skipped) : : "x15", "x30")
+
+#define TEST(WHICH, EXPECT) \
+    do { WHICH(); fail += skipped ^ EXPECT; } while (0)
+
+int main()
+{
+    int fail = 0;
+    int skipped;
+
+    /* Signal-like with SA_SIGINFO.  */
+    signal_info(SIGILL, skip2_sigill);
+
+    /* With SCTLR_EL1.BT0 set, PACIASP is not compatible with type=3. */
+    TEST(BTYPE_1, 0);
+    TEST(BTYPE_2, 0);
+    TEST(BTYPE_3, 1);
+
+    return fail;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 # BTI Tests
 # bti-1 tests the elf notes, so we require special compiler support.
 ifneq ($(CROSS_CC_HAS_ARMV8_BTI),)
-AARCH64_TESTS += bti-1
-bti-1: CFLAGS += -mbranch-protection=standard
-bti-1: LDFLAGS += -nostdlib
+AARCH64_TESTS += bti-1 bti-3
+bti-1 bti-3: CFLAGS += -mbranch-protection=standard
+bti-1 bti-3: LDFLAGS += -nostdlib
 endif
 # bti-2 tests PROT_BTI, so no special compiler support required.
 AARCH64_TESTS += bti-2
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move ARMCPRegInfo and all related declarations to a new
internal header, out of the public cpu.h.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h        | 413 +++++++++++++++++++++++++++++++++++++
 target/arm/cpu.h           | 368 ---------------------------------
 hw/arm/pxa2xx.c            |   1 +
 hw/arm/pxa2xx_pic.c        |   1 +
 hw/intc/arm_gicv3_cpuif.c  |   1 +
 hw/intc/arm_gicv3_kvm.c    |   2 +
 target/arm/cpu.c           |   1 +
 target/arm/cpu64.c         |   1 +
 target/arm/cpu_tcg.c       |   1 +
 target/arm/gdbstub.c       |   3 +-
 target/arm/helper.c        |   1 +
 target/arm/op_helper.c     |   1 +
 target/arm/translate-a64.c |   4 +-
 target/arm/translate.c     |   3 +-
 14 files changed, 427 insertions(+), 374 deletions(-)
 create mode 100644 target/arm/cpregs.h

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARM CP Register access and descriptions
+ *
+ * Copyright (c) 2022 Linaro Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see
+ * <http://www.gnu.org/licenses/gpl-2.0.html>
+ */
+
+#ifndef TARGET_ARM_CPREGS_H
+#define TARGET_ARM_CPREGS_H
+
+/*
+ * ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
+ * special-behaviour cp reg and bits [11..8] indicate what behaviour
+ * it has. Otherwise it is a simple cp reg, where CONST indicates that
+ * TCG can assume the value to be constant (ie load at translate time)
+ * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
+ * indicates that the TB should not be ended after a write to this register
+ * (the default is that the TB ends after cp writes). OVERRIDE permits
+ * a register definition to override a previous definition for the
+ * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
+ * old must have the OVERRIDE bit set.
+ * ALIAS indicates that this register is an alias view of some underlying
+ * state which is also visible via another register, and that the other
+ * register is handling migration and reset; registers marked ALIAS will not be
+ * migrated but may have their state set by syncing of register state from KVM.
+ * NO_RAW indicates that this register has no underlying state and does not
+ * support raw access for state saving/loading; it will not be used for either
+ * migration or KVM state synchronization. (Typically this is for "registers"
+ * which are actually used as instructions for cache maintenance and so on.)
+ * IO indicates that this register does I/O and therefore its accesses
+ * need to be marked with gen_io_start() and also end the TB. In particular,
+ * registers which implement clocks or timers require this.
+ * RAISES_EXC is for when the read or write hook might raise an exception;
+ * the generated code will synchronize the CPU state before calling the hook
+ * so that it is safe for the hook to call raise_exception().
+ * NEWEL is for writes to registers that might change the exception
+ * level - typically on older ARM chips. For those cases we need to
+ * re-read the new el when recomputing the translation flags.
+ */
+#define ARM_CP_SPECIAL           0x0001
+#define ARM_CP_CONST             0x0002
+#define ARM_CP_64BIT             0x0004
+#define ARM_CP_SUPPRESS_TB_END   0x0008
+#define ARM_CP_OVERRIDE          0x0010
+#define ARM_CP_ALIAS             0x0020
+#define ARM_CP_IO                0x0040
+#define ARM_CP_NO_RAW            0x0080
+#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
+#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
+#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
+#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
+#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
+#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
+#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
+#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
+#define ARM_CP_FPU               0x1000
+#define ARM_CP_SVE               0x2000
+#define ARM_CP_NO_GDB            0x4000
+#define ARM_CP_RAISES_EXC        0x8000
+#define ARM_CP_NEWEL             0x10000
+/* Used only as a terminator for ARMCPRegInfo lists */
+#define ARM_CP_SENTINEL          0xfffff
+/* Mask of only the flag bits in a type field */
+#define ARM_CP_FLAG_MASK         0x1f0ff
+
+/*
+ * Valid values for ARMCPRegInfo state field, indicating which of
+ * the AArch32 and AArch64 execution states this register is visible in.
+ * If the reginfo doesn't explicitly specify then it is AArch32 only.
+ * If the reginfo is declared to be visible in both states then a second
+ * reginfo is synthesised for the AArch32 view of the AArch64 register,
+ * such that the AArch32 view is the lower 32 bits of the AArch64 one.
+ * Note that we rely on the values of these enums as we iterate through
+ * the various states in some places.
+ */
+enum {
+    ARM_CP_STATE_AA32 = 0,
+    ARM_CP_STATE_AA64 = 1,
+    ARM_CP_STATE_BOTH = 2,
+};
+
+/*
+ * ARM CP register secure state flags.  These flags identify security state
+ * attributes for a given CP register entry.
+ * The existence of both or neither secure and non-secure flags indicates that
+ * the register has both a secure and non-secure hash entry.  A single one of
+ * these flags causes the register to only be hashed for the specified
+ * security state.
+ * Although definitions may have any combination of the S/NS bits, each
+ * registered entry will only have one to identify whether the entry is secure
+ * or non-secure.
+ */
+enum {
+    ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
+    ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
+};
+
+/*
+ * Return true if cptype is a valid type field. This is used to try to
+ * catch errors where the sentinel has been accidentally left off the end
+ * of a list of registers.
+ */
+static inline bool cptype_valid(int cptype)
+{
+    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
+        || ((cptype & ARM_CP_SPECIAL) &&
+            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
+}
+
+/*
+ * Access rights:
+ * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
+ * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and
+ * PL2 (hyp). The other level which has Read and Write bits is Secure PL1
+ * (ie any of the privileged modes in Secure state, or Monitor mode).
+ * If a register is accessible in one privilege level it's always accessible
+ * in higher privilege levels too. Since "Secure PL1" also follows this rule
+ * (ie anything visible in PL2 is visible in S-PL1, some things are only
+ * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the
+ * terminology a little and call this PL3.
+ * In AArch64 things are somewhat simpler as the PLx bits line up exactly
+ * with the ELx exception levels.
+ *
+ * If access permissions for a register are more complex than can be
+ * described with these bits, then use a laxer set of restrictions, and
+ * do the more restrictive/complex check inside a helper function.
+ */
+#define PL3_R 0x80
+#define PL3_W 0x40
+#define PL2_R (0x20 | PL3_R)
+#define PL2_W (0x10 | PL3_W)
+#define PL1_R (0x08 | PL2_R)
+#define PL1_W (0x04 | PL2_W)
+#define PL0_R (0x02 | PL1_R)
+#define PL0_W (0x01 | PL1_W)
+
+/*
+ * For user-mode some registers are accessible to EL0 via a kernel
+ * trap-and-emulate ABI. In this case we define the read permissions
+ * as actually being PL0_R. However some bits of any given register
+ * may still be masked.
+ */
+#ifdef CONFIG_USER_ONLY
+#define PL0U_R PL0_R
+#else
+#define PL0U_R PL1_R
+#endif
+
+#define PL3_RW (PL3_R | PL3_W)
+#define PL2_RW (PL2_R | PL2_W)
+#define PL1_RW (PL1_R | PL1_W)
+#define PL0_RW (PL0_R | PL0_W)
+
+typedef enum CPAccessResult {
+    /* Access is permitted */
+    CP_ACCESS_OK = 0,
+    /*
+     * Access fails due to a configurable trap or enable which would
+     * result in a categorized exception syndrome giving information about
+     * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
+     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
+     * PL1 if in EL0, otherwise to the current EL).
+     */
+    CP_ACCESS_TRAP = 1,
+    /*
+     * Access fails and results in an exception syndrome 0x0 ("uncategorized").
+     * Note that this is not a catch-all case -- the set of cases which may
+     * result in this failure is specifically defined by the architecture.
+     */
+    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
+    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
+    CP_ACCESS_TRAP_EL2 = 3,
+    CP_ACCESS_TRAP_EL3 = 4,
+    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
+    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
+    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
+} CPAccessResult;
+
+typedef struct ARMCPRegInfo ARMCPRegInfo;
+
+/*
+ * Access functions for coprocessor registers. These cannot fail and
+ * may not raise exceptions.
+ */
+typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
+typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
+                       uint64_t value);
+/* Access permission check functions for coprocessor registers. */
+typedef CPAccessResult CPAccessFn(CPUARMState *env,
+                                  const ARMCPRegInfo *opaque,
+                                  bool isread);
+/* Hook function for register reset */
+typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
+
+#define CP_ANY 0xff
+
+/* Definition of an ARM coprocessor register */
+struct ARMCPRegInfo {
+    /* Name of register (useful mainly for debugging, need not be unique) */
+    const char *name;
+    /*
+     * Location of register: coprocessor number and (crn,crm,opc1,opc2)
+     * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a
+     * 'wildcard' field -- any value of that field in the MRC/MCR insn
+     * will be decoded to this register. The register read and write
+     * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2
+     * used by the program, so it is possible to register a wildcard and
+     * then behave differently on read/write if necessary.
+     * For 64 bit registers, only crm and opc1 are relevant; crn and opc2
+     * must both be zero.
+     * For AArch64-visible registers, opc0 is also used.
+     * Since there are no "coprocessors" in AArch64, cp is purely used as a
+     * way to distinguish (for KVM's benefit) guest-visible system registers
+     * from demuxed ones provided to preserve the "no side effects on
+     * KVM register read/write from QEMU" semantics. cp==0x13 is guest
+     * visible (to match KVM's encoding); cp==0 will be converted to
+     * cp==0x13 when the ARMCPRegInfo is registered, for convenience.
+     */
+    uint8_t cp;
+    uint8_t crn;
+    uint8_t crm;
+    uint8_t opc0;
+    uint8_t opc1;
+    uint8_t opc2;
+    /* Execution state in which this register is visible: ARM_CP_STATE_* */
+    int state;
+    /* Register type: ARM_CP_* bits/values */
+    int type;
+    /* Access rights: PL*_[RW] */
+    int access;
+    /* Security state: ARM_CP_SECSTATE_* bits/values */
+    int secure;
+    /*
+     * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
+     * this register was defined: can be used to hand data through to the
+     * register read/write functions, since they are passed the ARMCPRegInfo*.
+     */
+    void *opaque;
+    /*
+     * Value of this register, if it is ARM_CP_CONST. Otherwise, if
+     * fieldoffset is non-zero, the reset value of the register.
+     */
+    uint64_t resetvalue;
+    /*
+     * Offset of the field in CPUARMState for this register.
+     * This is not needed if either:
+     *  1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs
+     *  2. both readfn and writefn are specified
+     */
+    ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */
+
+    /*
+     * Offsets of the secure and non-secure fields in CPUARMState for the
+     * register if it is banked.  These fields are only used during the static
+     * registration of a register.  During hashing the bank associated
+     * with a given security state is copied to fieldoffset which is used from
+     * there on out.
+     *
+     * It is expected that register definitions use either fieldoffset or
+     * bank_fieldoffsets in the definition but not both.  It is also expected
+     * that both bank offsets are set when defining a banked register.  This
+     * use indicates that a register is banked.
+     */
+    ptrdiff_t bank_fieldoffsets[2];
+
+    /*
+     * Function for making any access checks for this register in addition to
+     * those specified by the 'access' permissions bits. If NULL, no extra
+     * checks required. The access check is performed at runtime, not at
+     * translate time.
+     */
+    CPAccessFn *accessfn;
+    /*
+     * Function for handling reads of this register. If NULL, then reads
+     * will be done by loading from the offset into CPUARMState specified
+     * by fieldoffset.
+     */
+    CPReadFn *readfn;
+    /*
+     * Function for handling writes of this register. If NULL, then writes
+     * will be done by writing to the offset into CPUARMState specified
+     * by fieldoffset.
+     */
+    CPWriteFn *writefn;
+    /*
+     * Function for doing a "raw" read; used when we need to copy
+     * coprocessor state to the kernel for KVM or out for
+     * migration. This only needs to be provided if there is also a
+     * readfn and it has side effects (for instance clear-on-read bits).
+     */
+    CPReadFn *raw_readfn;
+    /*
+     * Function for doing a "raw" write; used when we need to copy KVM
+     * kernel coprocessor state into userspace, or for inbound
+     * migration. This only needs to be provided if there is also a
+     * writefn and it masks out "unwritable" bits or has write-one-to-clear
+     * or similar behaviour.
+     */
+    CPWriteFn *raw_writefn;
+    /*
+     * Function for resetting the register. If NULL, then reset will be done
+     * by writing resetvalue to the field specified in fieldoffset. If
+     * fieldoffset is 0 then no reset will be done.
+     */
+    CPResetFn *resetfn;
+
+    /*
+     * "Original" writefn and readfn.
+     * For ARMv8.1-VHE register aliases, we overwrite the read/write
+     * accessor functions of various EL1/EL0 to perform the runtime
+     * check for which sysreg should actually be modified, and then
+     * forwards the operation.  Before overwriting the accessors,
+     * the original function is copied here, so that accesses that
+     * really do go to the EL1/EL0 version proceed normally.
+     * (The corresponding EL2 register is linked via opaque.)
+     */
+    CPReadFn *orig_readfn;
+    CPWriteFn *orig_writefn;
+};
+
+/*
+ * Macros which are lvalues for the field in CPUARMState for the
+ * ARMCPRegInfo *ri.
+ */
+#define CPREG_FIELD32(env, ri) \
+    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
+#define CPREG_FIELD64(env, ri) \
+    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
+
+#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
+
+void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
+                                    const ARMCPRegInfo *regs, void *opaque);
+void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
+                                       const ARMCPRegInfo *regs, void *opaque);
+static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
+{
+    define_arm_cp_regs_with_opaque(cpu, regs, 0);
+}
+static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
+{
+    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
+}
+const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
+
+/*
+ * Definition of an ARM co-processor register as viewed from
+ * userspace. This is used for presenting sanitised versions of
+ * registers to userspace when emulating the Linux AArch64 CPU
+ * ID/feature ABI (advertised as HWCAP_CPUID).
+ */
+typedef struct ARMCPRegUserSpaceInfo {
+    /* Name of register */
+    const char *name;
+
+    /* Is the name actually a glob pattern */
+    bool is_glob;
+
+    /* Only some bits are exported to user space */
+    uint64_t exported_bits;
+
+    /* Fixed bits are applied after the mask */
+    uint64_t fixed_bits;
+} ARMCPRegUserSpaceInfo;
+
+#define REGUSERINFO_SENTINEL { .name = NULL }
+
+void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
+
+/* CPWriteFn that can be used to implement writes-ignored behaviour */
+void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value);
+/* CPReadFn that can be used for read-as-zero behaviour */
+uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
+
+/*
+ * CPResetFn that does nothing, for use if no reset is required even
+ * if fieldoffset is non zero.
+ */
+void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
+
+/*
+ * Return true if this reginfo struct's field in the cpu state struct
+ * is 64 bits wide.
+ */
+static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
+{
+    return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
+}
+
+static inline bool cp_access_ok(int current_el,
+                                const ARMCPRegInfo *ri, int isread)
+{
+    return (ri->access >> ((current_el * 2) + isread)) & 1;
+}
+
+/* Raw read of a coprocessor register (as needed for migration, etc) */
+uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri);
+
+#endif /* TARGET_ARM_CPREGS_H */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
     return kvmid;
 }
 
-/* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
- * special-behaviour cp reg and bits [11..8] indicate what behaviour
- * it has. Otherwise it is a simple cp reg, where CONST indicates that
- * TCG can assume the value to be constant (ie load at translate time)
- * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
- * indicates that the TB should not be ended after a write to this register
- * (the default is that the TB ends after cp writes). OVERRIDE permits
- * a register definition to override a previous definition for the
- * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
- * old must have the OVERRIDE bit set.
- * ALIAS indicates that this register is an alias view of some underlying
- * state which is also visible via another register, and that the other
- * register is handling migration and reset; registers marked ALIAS will not be
- * migrated but may have their state set by syncing of register state from KVM.
- * NO_RAW indicates that this register has no underlying state and does not
- * support raw access for state saving/loading; it will not be used for either
- * migration or KVM state synchronization. (Typically this is for "registers"
- * which are actually used as instructions for cache maintenance and so on.)
- * IO indicates that this register does I/O and therefore its accesses
- * need to be marked with gen_io_start() and also end the TB. In particular,
- * registers which implement clocks or timers require this.
- * RAISES_EXC is for when the read or write hook might raise an exception;
- * the generated code will synchronize the CPU state before calling the hook
- * so that it is safe for the hook to call raise_exception().
- * NEWEL is for writes to registers that might change the exception
- * level - typically on older ARM chips. For those cases we need to
- * re-read the new el when recomputing the translation flags.
- */
-#define ARM_CP_SPECIAL           0x0001
-#define ARM_CP_CONST             0x0002
-#define ARM_CP_64BIT             0x0004
-#define ARM_CP_SUPPRESS_TB_END   0x0008
-#define ARM_CP_OVERRIDE          0x0010
-#define ARM_CP_ALIAS             0x0020
-#define ARM_CP_IO                0x0040
-#define ARM_CP_NO_RAW            0x0080
-#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
-#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
-#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
-#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
-#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
-#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
-#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
-#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
-#define ARM_CP_FPU               0x1000
-#define ARM_CP_SVE               0x2000
-#define ARM_CP_NO_GDB            0x4000
-#define ARM_CP_RAISES_EXC        0x8000
-#define ARM_CP_NEWEL             0x10000
-/* Used only as a terminator for ARMCPRegInfo lists */
-#define ARM_CP_SENTINEL          0xfffff
-/* Mask of only the flag bits in a type field */
-#define ARM_CP_FLAG_MASK         0x1f0ff
-
-/* Valid values for ARMCPRegInfo state field, indicating which of
- * the AArch32 and AArch64 execution states this register is visible in.
- * If the reginfo doesn't explicitly specify then it is AArch32 only.
- * If the reginfo is declared to be visible in both states then a second
- * reginfo is synthesised for the AArch32 view of the AArch64 register,
- * such that the AArch32 view is the lower 32 bits of the AArch64 one.
- * Note that we rely on the values of these enums as we iterate through
- * the various states in some places.
- */
-enum {
-    ARM_CP_STATE_AA32 = 0,
-    ARM_CP_STATE_AA64 = 1,
-    ARM_CP_STATE_BOTH = 2,
-};
-
-/* ARM CP register secure state flags.  These flags identify security state
- * attributes for a given CP register entry.
- * The existence of both or neither secure and non-secure flags indicates that
- * the register has both a secure and non-secure hash entry.  A single one of
- * these flags causes the register to only be hashed for the specified
- * security state.
- * Although definitions may have any combination of the S/NS bits, each
- * registered entry will only have one to identify whether the entry is secure
- * or non-secure.
- */
-enum {
-    ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
-    ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
-};
-
-/* Return true if cptype is a valid type field. This is used to try to
- * catch errors where the sentinel has been accidentally left off the end
- * of a list of registers.
- */
-static inline bool cptype_valid(int cptype)
-{
-    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
-        || ((cptype & ARM_CP_SPECIAL) &&
-            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
-}
-
-/* Access rights:
- * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
- * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and
- * PL2 (hyp). The other level which has Read and Write bits is Secure PL1
- * (ie any of the privileged modes in Secure state, or Monitor mode).
- * If a register is accessible in one privilege level it's always accessible
- * in higher privilege levels too. Since "Secure PL1" also follows this rule
- * (ie anything visible in PL2 is visible in S-PL1, some things are only
- * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the
- * terminology a little and call this PL3.
- * In AArch64 things are somewhat simpler as the PLx bits line up exactly
- * with the ELx exception levels.
- *
- * If access permissions for a register are more complex than can be
- * described with these bits, then use a laxer set of restrictions, and
- * do the more restrictive/complex check inside a helper function.
- */
-#define PL3_R 0x80
-#define PL3_W 0x40
-#define PL2_R (0x20 | PL3_R)
-#define PL2_W (0x10 | PL3_W)
-#define PL1_R (0x08 | PL2_R)
-#define PL1_W (0x04 | PL2_W)
-#define PL0_R (0x02 | PL1_R)
-#define PL0_W (0x01 | PL1_W)
-
-/*
- * For user-mode some registers are accessible to EL0 via a kernel
- * trap-and-emulate ABI. In this case we define the read permissions
- * as actually being PL0_R. However some bits of any given register
- * may still be masked.
- */
-#ifdef CONFIG_USER_ONLY
-#define PL0U_R PL0_R
-#else
-#define PL0U_R PL1_R
-#endif
-
-#define PL3_RW (PL3_R | PL3_W)
-#define PL2_RW (PL2_R | PL2_W)
-#define PL1_RW (PL1_R | PL1_W)
-#define PL0_RW (PL0_R | PL0_W)
-
 /* Return the highest implemented Exception Level */
 static inline int arm_highest_el(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static inline int arm_current_el(CPUARMState *env)
     }
 }
 
-typedef struct ARMCPRegInfo ARMCPRegInfo;
-
-typedef enum CPAccessResult {
-    /* Access is permitted */
-    CP_ACCESS_OK = 0,
-    /* Access fails due to a configurable trap or enable which would
-     * result in a categorized exception syndrome giving information about
-     * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
-     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
-     * PL1 if in EL0, otherwise to the current EL).
-     */
-    CP_ACCESS_TRAP = 1,
-    /* Access fails and results in an exception syndrome 0x0 ("uncategorized").
-     * Note that this is not a catch-all case -- the set of cases which may
-     * result in this failure is specifically defined by the architecture.
-     */
-    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
-    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
-    CP_ACCESS_TRAP_EL2 = 3,
-    CP_ACCESS_TRAP_EL3 = 4,
-    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
-    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
-    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
-} CPAccessResult;
-
-/* Access functions for coprocessor registers. These cannot fail and
- * may not raise exceptions.
- */
-typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
-typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
-                       uint64_t value);
-/* Access permission check functions for coprocessor registers. */
-typedef CPAccessResult CPAccessFn(CPUARMState *env,
-                                  const ARMCPRegInfo *opaque,
-                                  bool isread);
-/* Hook function for register reset */
-typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
-
-#define CP_ANY 0xff
-
-/* Definition of an ARM coprocessor register */
-struct ARMCPRegInfo {
-    /* Name of register (useful mainly for debugging, need not be unique) */
-    const char *name;
-    /* Location of register: coprocessor number and (crn,crm,opc1,opc2)
-     * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a
-     * 'wildcard' field -- any value of that field in the MRC/MCR insn
-     * will be decoded to this register. The register read and write
-     * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2
-     * used by the program, so it is possible to register a wildcard and
-     * then behave differently on read/write if necessary.
-     * For 64 bit registers, only crm and opc1 are relevant; crn and opc2
-     * must both be zero.
-     * For AArch64-visible registers, opc0 is also used.
-     * Since there are no "coprocessors" in AArch64, cp is purely used as a
-     * way to distinguish (for KVM's benefit) guest-visible system registers
-     * from demuxed ones provided to preserve the "no side effects on
-     * KVM register read/write from QEMU" semantics. cp==0x13 is guest
-     * visible (to match KVM's encoding); cp==0 will be converted to
-     * cp==0x13 when the ARMCPRegInfo is registered, for convenience.
-     */
-    uint8_t cp;
-    uint8_t crn;
-    uint8_t crm;
-    uint8_t opc0;
-    uint8_t opc1;
-    uint8_t opc2;
-    /* Execution state in which this register is visible: ARM_CP_STATE_* */
-    int state;
-    /* Register type: ARM_CP_* bits/values */
-    int type;
-    /* Access rights: PL*_[RW] */
-    int access;
-    /* Security state: ARM_CP_SECSTATE_* bits/values */
-    int secure;
-    /* The opaque pointer passed to define_arm_cp_regs_with_opaque() when
-     * this register was defined: can be used to hand data through to the
-     * register read/write functions, since they are passed the ARMCPRegInfo*.
-     */
-    void *opaque;
-    /* Value of this register, if it is ARM_CP_CONST. Otherwise, if
-     * fieldoffset is non-zero, the reset value of the register.
-     */
-    uint64_t resetvalue;
-    /* Offset of the field in CPUARMState for this register.
-     *
-     * This is not needed if either:
-     *  1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs
-     *  2. both readfn and writefn are specified
-     */
-    ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */
-
-    /* Offsets of the secure and non-secure fields in CPUARMState for the
-     * register if it is banked.  These fields are only used during the static
-     * registration of a register.  During hashing the bank associated
-     * with a given security state is copied to fieldoffset which is used from
-     * there on out.
-     *
-     * It is expected that register definitions use either fieldoffset or
-     * bank_fieldoffsets in the definition but not both.  It is also expected
-     * that both bank offsets are set when defining a banked register.  This
-     * use indicates that a register is banked.
-     */
-    ptrdiff_t bank_fieldoffsets[2];
-
-    /* Function for making any access checks for this register in addition to
-     * those specified by the 'access' permissions bits. If NULL, no extra
-     * checks required. The access check is performed at runtime, not at
-     * translate time.
-     */
-    CPAccessFn *accessfn;
-    /* Function for handling reads of this register. If NULL, then reads
-     * will be done by loading from the offset into CPUARMState specified
-     * by fieldoffset.
-     */
-    CPReadFn *readfn;
-    /* Function for handling writes of this register. If NULL, then writes
-     * will be done by writing to the offset into CPUARMState specified
-     * by fieldoffset.
-     */
-    CPWriteFn *writefn;
-    /* Function for doing a "raw" read; used when we need to copy
-     * coprocessor state to the kernel for KVM or out for
-     * migration. This only needs to be provided if there is also a
-     * readfn and it has side effects (for instance clear-on-read bits).
-     */
-    CPReadFn *raw_readfn;
-    /* Function for doing a "raw" write; used when we need to copy KVM
-     * kernel coprocessor state into userspace, or for inbound
-     * migration. This only needs to be provided if there is also a
-     * writefn and it masks out "unwritable" bits or has write-one-to-clear
-     * or similar behaviour.
-     */
-    CPWriteFn *raw_writefn;
-    /* Function for resetting the register. If NULL, then reset will be done
-     * by writing resetvalue to the field specified in fieldoffset. If
-     * fieldoffset is 0 then no reset will be done.
-     */
-    CPResetFn *resetfn;
-
-    /*
-     * "Original" writefn and readfn.
-     * For ARMv8.1-VHE register aliases, we overwrite the read/write
-     * accessor functions of various EL1/EL0 to perform the runtime
-     * check for which sysreg should actually be modified, and then
-     * forwards the operation.  Before overwriting the accessors,
-     * the original function is copied here, so that accesses that
-     * really do go to the EL1/EL0 version proceed normally.
-     * (The corresponding EL2 register is linked via opaque.)
-     */
-    CPReadFn *orig_readfn;
-    CPWriteFn *orig_writefn;
-};
-
-/* Macros which are lvalues for the field in CPUARMState for the
- * ARMCPRegInfo *ri.
- */
-#define CPREG_FIELD32(env, ri) \
-    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
-#define CPREG_FIELD64(env, ri) \
-    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
-
-#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
-
-void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
-                                    const ARMCPRegInfo *regs, void *opaque);
-void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
-                                       const ARMCPRegInfo *regs, void *opaque);
-static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
-{
-    define_arm_cp_regs_with_opaque(cpu, regs, 0);
-}
-static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
-{
-    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
-}
-const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
-
-/*
- * Definition of an ARM co-processor register as viewed from
- * userspace. This is used for presenting sanitised versions of
- * registers to userspace when emulating the Linux AArch64 CPU
- * ID/feature ABI (advertised as HWCAP_CPUID).
- */
-typedef struct ARMCPRegUserSpaceInfo {
-    /* Name of register */
-    const char *name;
-
-    /* Is the name actually a glob pattern */
-    bool is_glob;
-
-    /* Only some bits are exported to user space */
-    uint64_t exported_bits;
-
-    /* Fixed bits are applied after the mask */
-    uint64_t fixed_bits;
-} ARMCPRegUserSpaceInfo;
-
-#define REGUSERINFO_SENTINEL { .name = NULL }
-
-void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
-
-/* CPWriteFn that can be used to implement writes-ignored behaviour */
-void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value);
-/* CPReadFn that can be used for read-as-zero behaviour */
-uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
-
-/* CPResetFn that does nothing, for use if no reset is required even
- * if fieldoffset is non zero.
- */
-void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
-
-/* Return true if this reginfo struct's field in the cpu state struct
- * is 64 bits wide.
- */
-static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
-{
-    return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
-}
-
-static inline bool cp_access_ok(int current_el,
-                                const ARMCPRegInfo *ri, int isread)
-{
-    return (ri->access >> ((current_el * 2) + isread)) & 1;
-}
-
-/* Raw read of a coprocessor register (as needed for migration, etc) */
-uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri);
-
 /**
  * write_list_to_cpustate
  * @cpu: ARMCPU
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/cutils.h"
 #include "qemu/log.h"
 #include "qom/object.h"
+#include "target/arm/cpregs.h"
 
 static struct {
     hwaddr io_base;
diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qom/object.h"
+#include "target/arm/cpregs.h"
 
 #define ICIP	0x00	/* Interrupt Controller IRQ Pending register */
 #define ICMR	0x04	/* Interrupt Controller Mask register */
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
 #include "gicv3_internal.h"
 #include "hw/irq.h"
 #include "cpu.h"
+#include "target/arm/cpregs.h"
 
 /*
  * Special case return value from hppvi_index(); must be larger than
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "vgic_common.h"
 #include "migration/blocker.h"
 #include "qom/object.h"
+#include "target/arm/cpregs.h"
+
 
 #ifdef DEBUG_GICV3_KVM
 #define DPRINTF(fmt, ...) \
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_arm.h"
 #include "disas/capstone.h"
 #include "fpu/softfloat.h"
+#include "cpregs.h"
 
 static void arm_cpu_set_pc(CPUState *cs, vaddr value)
 {
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "hvf_arm.h"
 #include "qapi/visitor.h"
 #include "hw/qdev-properties.h"
+#include "cpregs.h"
 
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/boards.h"
 #endif
+#include "cpregs.h"
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "internals.h"
 #include "exec/gdbstub.h"
+#include "internals.h"
+#include "cpregs.h"
 
 typedef struct RegisterSysregXmlParam {
     CPUState *cs;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu_ldst.h"
 #include "semihosting/common-semi.h"
 #endif
+#include "cpregs.h"
 
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
 #define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
+#include "cpregs.h"
 
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@
 #include "translate.h"
 #include "internals.h"
 #include "qemu/host-utils.h"
-
 #include "semihosting/semihost.h"
 #include "exec/gen-icount.h"
-
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 #include "exec/log.h"
-
+#include "cpregs.h"
 #include "translate-a64.h"
 #include "qemu/atomic128.h"
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "arm_ldst.h"
 #include "semihosting/semihost.h"
-
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
-
 #include "exec/log.h"
+#include "cpregs.h"
 
 
 #define ENABLE_ARCH_4T    arm_dc_feature(s, ARM_FEATURE_V4T)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rearrange the values of the enumerators of CPAccessResult
so that we may directly extract the target el. For the two
special cases in access_check_cp_reg, use CPAccessResult.

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ static inline bool cptype_valid(int cptype)
 typedef enum CPAccessResult {
     /* Access is permitted */
     CP_ACCESS_OK = 0,
+
+    /*
+     * Combined with one of the following, the low 2 bits indicate the
+     * target exception level.  If 0, the exception is taken to the usual
+     * target EL (EL1 or PL1 if in EL0, otherwise to the current EL).
+     */
+    CP_ACCESS_EL_MASK = 3,
+
     /*
      * Access fails due to a configurable trap or enable which would
      * result in a categorized exception syndrome giving information about
      * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
-     * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or
-     * PL1 if in EL0, otherwise to the current EL).
+     * 0xc or 0x18).
      */
-    CP_ACCESS_TRAP = 1,
+    CP_ACCESS_TRAP = (1 << 2),
+    CP_ACCESS_TRAP_EL2 = CP_ACCESS_TRAP | 2,
+    CP_ACCESS_TRAP_EL3 = CP_ACCESS_TRAP | 3,
+
     /*
      * Access fails and results in an exception syndrome 0x0 ("uncategorized").
      * Note that this is not a catch-all case -- the set of cases which may
      * result in this failure is specifically defined by the architecture.
      */
-    CP_ACCESS_TRAP_UNCATEGORIZED = 2,
-    /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */
-    CP_ACCESS_TRAP_EL2 = 3,
-    CP_ACCESS_TRAP_EL3 = 4,
-    /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */
-    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5,
-    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6,
+    CP_ACCESS_TRAP_UNCATEGORIZED = (2 << 2),
+    CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = CP_ACCESS_TRAP_UNCATEGORIZED | 2,
+    CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = CP_ACCESS_TRAP_UNCATEGORIZED | 3,
 } CPAccessResult;
 
 typedef struct ARMCPRegInfo ARMCPRegInfo;
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
                                  uint32_t isread)
 {
     const ARMCPRegInfo *ri = rip;
+    CPAccessResult res = CP_ACCESS_OK;
     int target_el;
 
     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
-        raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
+        res = CP_ACCESS_TRAP;
+        goto fail;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
         mask &= ~((1 << 4) | (1 << 14));
 
         if (env->cp15.hstr_el2 & mask) {
-            target_el = 2;
-            goto exept;
+            res = CP_ACCESS_TRAP_EL2;
+            goto fail;
         }
     }
 
-    if (!ri->accessfn) {
+    if (ri->accessfn) {
+        res = ri->accessfn(env, ri, isread);
+    }
+    if (likely(res == CP_ACCESS_OK)) {
         return;
     }
 
-    switch (ri->accessfn(env, ri, isread)) {
-    case CP_ACCESS_OK:
-        return;
+ fail:
+    switch (res & ~CP_ACCESS_EL_MASK) {
     case CP_ACCESS_TRAP:
-        target_el = exception_target_el(env);
-        break;
-    case CP_ACCESS_TRAP_EL2:
-        /* Requesting a trap to EL2 when we're in EL3 is
-         * a bug in the access function.
-         */
-        assert(arm_current_el(env) != 3);
-        target_el = 2;
-        break;
-    case CP_ACCESS_TRAP_EL3:
-        target_el = 3;
         break;
     case CP_ACCESS_TRAP_UNCATEGORIZED:
-        target_el = exception_target_el(env);
-        syndrome = syn_uncategorized();
-        break;
-    case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
-        target_el = 2;
-        syndrome = syn_uncategorized();
-        break;
-    case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
-        target_el = 3;
         syndrome = syn_uncategorized();
         break;
     default:
         g_assert_not_reached();
     }
 
-exept:
+    target_el = res & CP_ACCESS_EL_MASK;
+    switch (target_el) {
+    case 0:
+        target_el = exception_target_el(env);
+        break;
+    case 2:
+        assert(arm_current_el(env) != 3);
+        assert(arm_is_el2_enabled(env));
+        break;
+    case 3:
+        assert(arm_feature(env, ARM_FEATURE_EL3));
+        break;
+    default:
+        /* No "direct" traps to EL1 */
+        g_assert_not_reached();
+    }
+
     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove a possible source of error by removing REGINFO_SENTINEL
and using ARRAY_SIZE (convinently hidden inside a macro) to
find the end of the set of regs being registered or modified.

The space saved by not having the extra array element reduces
the executable's .data.rel.ro section by about 9k.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h       |  53 +++++++++---------
 hw/arm/pxa2xx.c           |   1 -
 hw/arm/pxa2xx_pic.c       |   1 -
 hw/intc/arm_gicv3_cpuif.c |   5 --
 hw/intc/arm_gicv3_kvm.c   |   1 -
 target/arm/cpu64.c        |   1 -
 target/arm/cpu_tcg.c      |   4 --
 target/arm/helper.c       | 111 ++++++++------------------------------
 8 files changed, 48 insertions(+), 129 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@
 #define ARM_CP_NO_GDB            0x4000
 #define ARM_CP_RAISES_EXC        0x8000
 #define ARM_CP_NEWEL             0x10000
-/* Used only as a terminator for ARMCPRegInfo lists */
-#define ARM_CP_SENTINEL          0xfffff
 /* Mask of only the flag bits in a type field */
 #define ARM_CP_FLAG_MASK         0x1f0ff
 
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
 };
 
-/*
- * Return true if cptype is a valid type field. This is used to try to
- * catch errors where the sentinel has been accidentally left off the end
- * of a list of registers.
- */
-static inline bool cptype_valid(int cptype)
-{
-    return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
-        || ((cptype & ARM_CP_SPECIAL) &&
-            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
-}
-
 /*
  * Access rights:
  * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
 #define CPREG_FIELD64(env, ri) \
     (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 
-#define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL }
+void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, const ARMCPRegInfo *reg,
+                                       void *opaque);
 
-void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
-                                    const ARMCPRegInfo *regs, void *opaque);
-void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
-                                       const ARMCPRegInfo *regs, void *opaque);
-static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs)
-{
-    define_arm_cp_regs_with_opaque(cpu, regs, 0);
-}
 static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
 {
-    define_one_arm_cp_reg_with_opaque(cpu, regs, 0);
+    define_one_arm_cp_reg_with_opaque(cpu, regs, NULL);
 }
+
+void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
+                                        void *opaque, size_t len);
+
+#define define_arm_cp_regs_with_opaque(CPU, REGS, OPAQUE)               \
+    do {                                                                \
+        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
+        define_arm_cp_regs_with_opaque_len(CPU, REGS, OPAQUE,           \
+                                           ARRAY_SIZE(REGS));           \
+    } while (0)
+
+#define define_arm_cp_regs(CPU, REGS) \
+    define_arm_cp_regs_with_opaque(CPU, REGS, NULL)
+
 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
 
 /*
@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPRegUserSpaceInfo {
     uint64_t fixed_bits;
 } ARMCPRegUserSpaceInfo;
 
-#define REGUSERINFO_SENTINEL { .name = NULL }
+void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
+                                 const ARMCPRegUserSpaceInfo *mods,
+                                 size_t mods_len);
 
-void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
+#define modify_arm_cp_regs(REGS, MODS)                                  \
+    do {                                                                \
+        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
+        QEMU_BUILD_BUG_ON(ARRAY_SIZE(MODS) == 0);                       \
+        modify_arm_cp_regs_with_len(REGS, ARRAY_SIZE(REGS),             \
+                                    MODS, ARRAY_SIZE(MODS));            \
+    } while (0)
 
 /* CPWriteFn that can be used to implement writes-ignored behaviour */
 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pxa_cp_reginfo[] = {
     { .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
       .access = PL1_RW, .type = ARM_CP_IO,
       .readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
-    REGINFO_SENTINEL
 };
 
 static void pxa2xx_setup_cp14(PXA2xxState *s)
diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pxa_pic_cp_reginfo[] = {
     REGINFO_FOR_PIC_CP("ICLR2", 8),
     REGINFO_FOR_PIC_CP("ICFP2", 9),
     REGINFO_FOR_PIC_CP("ICPR2", 0xa),
-    REGINFO_SENTINEL
 };
 
 static const MemoryRegionOps pxa2xx_pic_ops = {
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
       .readfn = icc_igrpen1_el3_read,
       .writefn = icc_igrpen1_el3_write,
     },
-    REGINFO_SENTINEL
 };
 
 static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
       .readfn = ich_vmcr_read,
       .writefn = ich_vmcr_write,
     },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
       .readfn = ich_ap_read,
       .writefn = ich_ap_write,
     },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
       .readfn = ich_ap_read,
       .writefn = ich_ap_write,
     },
-    REGINFO_SENTINEL
 };
 
 static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
@@ -XXX,XX +XXX,XX @@ void gicv3_init_cpuif(GICv3State *s)
                       .readfn = ich_lr_read,
                       .writefn = ich_lr_write,
                     },
-                    REGINFO_SENTINEL
                 };
                 define_arm_cp_regs(cpu, lr_regset);
             }
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
        */
       .resetfn = arm_gicv3_icc_reset,
     },
-    REGINFO_SENTINEL
 };
 
 /**
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
     { .name = "L2MERRSR",
       .cp = 15, .opc1 = 3, .crm = 15,
       .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static void aarch64_a57_initfn(Object *obj)
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa8_cp_reginfo[] = {
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "L2AUXCR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2,
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static void cortex_a8_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa9_cp_reginfo[] = {
       .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST },
     { .name = "TLB_ATTR", .cp = 15, .crn = 15, .crm = 7, .opc1 = 5, .opc2 = 2,
       .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST },
-    REGINFO_SENTINEL
 };
 
 static void cortex_a9_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
 #endif
     { .name = "L2ECTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 3,
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static void cortex_a7_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
       .access = PL1_RW, .type = ARM_CP_CONST },
     { .name = "DCACHE_INVAL", .cp = 15, .opc1 = 0, .crn = 15, .crm = 5,
       .opc2 = 0, .access = PL1_W, .type = ARM_CP_NOP },
-    REGINFO_SENTINEL
 };
 
 static void cortex_r5_initfn(Object *obj)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cp_reginfo[] = {
       .secure = ARM_CP_SECSTATE_S,
       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v8_cp_reginfo[] = {
     { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
       .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v6_cp_reginfo[] = {
      */
     { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
       .access = PL1_W, .type = ARM_CP_WFI },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo not_v7_cp_reginfo[] = {
       .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
     { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
       .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
-    REGINFO_SENTINEL
 };
 
 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
       .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
-    REGINFO_SENTINEL
 };
 
 typedef struct pm_event {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
       .writefn = tlbimvaa_write },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7mp_cp_reginfo[] = {
     { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
       .writefn = tlbimvaa_is_write },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
       .writefn = pmovsset_write,
       .raw_writefn = raw_write },
-    REGINFO_SENTINEL
 };
 
 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo t2ee_cp_reginfo[] = {
     { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
       .accessfn = teehbr_access, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo v6k_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
                              offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
       .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
     },
-    REGINFO_SENTINEL
 };
 
 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
       .readfn = gt_virt_cnt_read,
     },
-    REGINFO_SENTINEL
 };
 
 #endif
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vapa_cp_reginfo[] = {
       .access = PL1_W, .accessfn = ats_access,
       .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
 #endif
-    REGINFO_SENTINEL
 };
 
 /* Return basic MPU access permission bits.  */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
       .writefn = pmsav7_rgnr_write,
       .resetfn = arm_cp_reset_ignore },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
     { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
-    REGINFO_SENTINEL
 };
 
 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
       .resetvalue = 0, },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       /* No offsetoflow32 -- pass the entire TCR to writefn/raw_writefn. */
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.tcr_el[3]),
                              offsetof(CPUARMState, cp15.tcr_el[1])} },
-    REGINFO_SENTINEL
 };
 
 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo omap_cp_reginfo[] = {
     { .name = "C9", .cp = 15, .crn = 9,
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
       .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo xscale_cp_reginfo[] = {
     { .name = "XSCALE_UNLOCK_DCACHE",
       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
       .access = PL1_W, .type = ARM_CP_NOP },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
       .access = PL1_RW,
       .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
       .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
     { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
       .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
     { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
     { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
       .resetvalue = (1 << 30) },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo strongarm_cp_reginfo[] = {
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
       .access = PL1_RW, .resetvalue = 0,
       .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
-    REGINFO_SENTINEL
 };
 
 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
                              offsetof(CPUARMState, cp15.ttbr1_ns) },
       .writefn = vmsa_ttbr_write, },
-    REGINFO_SENTINEL
 };
 
 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
       .writefn = sdcr_write,
       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
-    REGINFO_SENTINEL
 };
 
 /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
       .type = ARM_CP_CONST,
       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
       .access = PL2_RW, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 /* Ditto, but for registers which exist in ARMv8 but not v7 */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
       .access = PL2_RW,
       .type = ARM_CP_CONST, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
       .access = PL2_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
       .access = PL2_RW,
       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
       .writefn = hcr_writehigh },
-    REGINFO_SENTINEL
 };
 
 static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
       .access = PL2_RW, .accessfn = sel2_access,
       .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
-    REGINFO_SENTINEL
 };
 
 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae3_write },
-    REGINFO_SENTINEL
 };
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 /* Return the exception level to which exceptions should be taken
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
               .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
               .writefn = dbgbcr_write, .raw_writefn = raw_write
             },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, dbgregs);
     }
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
               .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
               .writefn = dbgwcr_write, .raw_writefn = raw_write
             },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, dbgregs);
     }
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
               .type = ARM_CP_IO,
               .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
               .raw_writefn = pmevtyper_rawwrite },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, pmev_regs);
         g_free(pmevcntr_name);
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
               .resetvalue = extract64(cpu->pmceid1, 32, 32) },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, v81_pmu_regs);
     }
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lor_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
       .access = PL1_R, .accessfn = access_lor_ns,
       .type = ARM_CP_CONST, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 #ifdef TARGET_AARCH64
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pauth_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
       .access = PL1_RW, .accessfn = access_pauth,
       .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo tlbirange_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae3_write },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo tlbios_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae3is_write },
-    REGINFO_SENTINEL
 };
 
 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo rndr_reginfo[] = {
       .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
       .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
       .access = PL0_R, .readfn = rndr_readfn },
-    REGINFO_SENTINEL
 };
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dcpop_reg[] = {
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1,
       .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
       .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo dcpodp_reg[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo dcpodp_reg[] = {
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1,
       .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
       .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
-    REGINFO_SENTINEL
 };
 #endif /*CONFIG_USER_ONLY*/
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_reginfo[] = {
     { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6,
       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo mte_tco_ro_reginfo[] = {
     { .name = "TCO", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7,
       .type = ARM_CP_CONST, .access = PL0_RW, },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
       .accessfn = aa64_zva_access,
 #endif
     },
-    REGINFO_SENTINEL
 };
 
 #endif
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
-    REGINFO_SENTINEL
 };
 
 static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ccsidr2_reginfo[] = {
       .access = PL1_R,
       .accessfn = access_aa64_tid2,
       .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
-    REGINFO_SENTINEL
 };
 
 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo jazelle_regs[] = {
       .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0,
       .accessfn = access_joscr_jmcr,
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo vhe_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .access = PL2_RW, .accessfn = e2h_access,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
-    REGINFO_SENTINEL
 };
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ats1e1_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .writefn = ats_write64 },
-    REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo ats1cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ats1cp_reginfo[] = {
       .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .writefn = ats_write },
-    REGINFO_SENTINEL
 };
 #endif
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = {
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
-    REGINFO_SENTINEL
 };
 
 void register_cp_regs_for_features(ARMCPU *cpu)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, v6_idregs);
         define_arm_cp_regs(cpu, v6_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
               .resetvalue = cpu->pmceid1 },
-            REGINFO_SENTINEL
         };
 #ifdef CONFIG_USER_ONLY
         ARMCPRegUserSpaceInfo v8_user_idregs[] = {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .exported_bits = 0x000000f0ffffffff },
             { .name = "ID_AA64ISAR*_EL1_RESERVED",
               .is_glob = true                     },
-            REGUSERINFO_SENTINEL
         };
         modify_arm_cp_regs(v8_idregs, v8_user_idregs);
 #endif
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL2_RW,
               .resetvalue = vmpidr_def,
               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, vpidr_regs);
         define_arm_cp_regs(cpu, el2_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                   .access = PL2_RW, .accessfn = access_el3_aa32ns,
                   .type = ARM_CP_NO_RAW,
                   .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
-                REGINFO_SENTINEL
             };
             define_arm_cp_regs(cpu, vpidr_regs);
             define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .raw_writefn = raw_write, .writefn = sctlr_write,
               .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
               .resetvalue = cpu->reset_sctlr },
-            REGINFO_SENTINEL
         };
 
         define_arm_cp_regs(cpu, el3_regs);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "DUMMY",
               .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
-            REGINFO_SENTINEL
         };
         ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
             { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R,
               .accessfn = access_aa64_tid1,
               .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
-            REGINFO_SENTINEL
         };
         ARMCPRegInfo id_cp_reginfo[] = {
             /* These are common to v8 and pre-v8 */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R,
               .accessfn = access_aa32_tid1,
               .type = ARM_CP_CONST, .resetvalue = 0 },
-            REGINFO_SENTINEL
         };
         /* TLBTR is specific to VMSA */
         ARMCPRegInfo id_tlbtr_reginfo = {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "MIDR_EL1",
               .exported_bits = 0x00000000ffffffff },
             { .name = "REVIDR_EL1"                },
-            REGUSERINFO_SENTINEL
         };
         modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
 #endif
         if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
             arm_feature(env, ARM_FEATURE_STRONGARM)) {
-            ARMCPRegInfo *r;
+            size_t i;
             /* Register the blanket "writes ignored" value first to cover the
              * whole space. Then update the specific ID registers to allow write
              * access, so that they ignore writes rather than causing them to
              * UNDEF.
              */
             define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
-            for (r = id_pre_v8_midr_cp_reginfo;
-                 r->type != ARM_CP_SENTINEL; r++) {
-                r->access = PL1_RW;
+            for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) {
+                id_pre_v8_midr_cp_reginfo[i].access = PL1_RW;
             }
-            for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
-                r->access = PL1_RW;
+            for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) {
+                id_cp_reginfo[i].access = PL1_RW;
             }
             id_mpuir_reginfo.access = PL1_RW;
             id_tlbtr_reginfo.access = PL1_RW;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
               .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
-            REGINFO_SENTINEL
         };
 #ifdef CONFIG_USER_ONLY
         ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
             { .name = "MPIDR_EL1",
               .fixed_bits = 0x0000000080000000 },
-            REGUSERINFO_SENTINEL
         };
         modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
 #endif
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
               .access = PL3_RW, .type = ARM_CP_CONST,
               .resetvalue = 0 },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, auxcr_reginfo);
         if (cpu_isar_feature(aa32_ac2, cpu)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                   .type = ARM_CP_CONST,
                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
                   .access = PL1_R, .resetvalue = cpu->reset_cbar },
-                REGINFO_SENTINEL
             };
             /* We don't implement a r/w 64 bit CBAR currently */
             assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
                                      offsetof(CPUARMState, cp15.vbar_ns) },
               .resetvalue = 0 },
-            REGINFO_SENTINEL
         };
         define_arm_cp_regs(cpu, vbar_cp_reginfo);
     }
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                    r->writefn);
         }
     }
-    /* Bad type field probably means missing sentinel at end of reg list */
-    assert(cptype_valid(r->type));
+
     for (crm = crmmin; crm <= crmmax; crm++) {
         for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
             for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
     }
 }
 
-void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
-                                    const ARMCPRegInfo *regs, void *opaque)
+/* Define a whole list of registers */
+void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
+                                        void *opaque, size_t len)
 {
-    /* Define a whole list of registers */
-    const ARMCPRegInfo *r;
-    for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
-        define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
+    size_t i;
+    for (i = 0; i < len; ++i) {
+        define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
  * user-space cannot alter any values and dynamic values pertaining to
  * execution state are hidden from user space view anyway.
  */
-void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
+void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
+                                 const ARMCPRegUserSpaceInfo *mods,
+                                 size_t mods_len)
 {
-    const ARMCPRegUserSpaceInfo *m;
-    ARMCPRegInfo *r;
-
-    for (m = mods; m->name; m++) {
+    for (size_t mi = 0; mi < mods_len; ++mi) {
+        const ARMCPRegUserSpaceInfo *m = mods + mi;
         GPatternSpec *pat = NULL;
+
         if (m->is_glob) {
             pat = g_pattern_spec_new(m->name);
         }
-        for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
+        for (size_t ri = 0; ri < regs_len; ++ri) {
+            ARMCPRegInfo *r = regs + ri;
+
             if (pat && g_pattern_match_string(pat, r->name)) {
                 r->type = ARM_CP_CONST;
                 r->access = PL0U_R;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These particular data structures are not modified at runtime.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .resetvalue = cpu->pmceid1 },
         };
 #ifdef CONFIG_USER_ONLY
-        ARMCPRegUserSpaceInfo v8_user_idregs[] = {
+        static const ARMCPRegUserSpaceInfo v8_user_idregs[] = {
             { .name = "ID_AA64PFR0_EL1",
               .exported_bits = 0x000f000f00ff0000,
               .fixed_bits    = 0x0000000000000011 },
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      */
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
-            ARMCPRegInfo nsacr = {
+            static const ARMCPRegInfo nsacr = {
                 .name = "NSACR", .type = ARM_CP_CONST,
                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
                 .access = PL1_RW, .accessfn = nsacr_access,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             };
             define_one_arm_cp_reg(cpu, &nsacr);
         } else {
-            ARMCPRegInfo nsacr = {
+            static const ARMCPRegInfo nsacr = {
                 .name = "NSACR",
                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
                 .access = PL3_RW | PL1_R,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         }
     } else {
         if (arm_feature(env, ARM_FEATURE_V8)) {
-            ARMCPRegInfo nsacr = {
+            static const ARMCPRegInfo nsacr = {
                 .name = "NSACR", .type = ARM_CP_CONST,
                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
                 .access = PL1_R,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .resetvalue = cpu->pmsav7_dregion << 8
         };
-        ARMCPRegInfo crn0_wi_reginfo = {
+        static const ARMCPRegInfo crn0_wi_reginfo = {
             .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
         };
 #ifdef CONFIG_USER_ONLY
-        ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
+        static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
             { .name = "MIDR_EL1",
               .exported_bits = 0x00000000ffffffff },
             { .name = "REVIDR_EL1"                },
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
         };
 #ifdef CONFIG_USER_ONLY
-        ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
+        static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
             { .name = "MPIDR_EL1",
               .fixed_bits = 0x0000000080000000 },
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     if (arm_feature(env, ARM_FEATURE_VBAR)) {
-        ARMCPRegInfo vbar_cp_reginfo[] = {
+        static const ARMCPRegInfo vbar_cp_reginfo[] = {
             { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
               .access = PL1_RW, .writefn = vbar_write,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Instead of defining ARM_CP_FLAG_MASK to remove flags,
define ARM_CP_SPECIAL_MASK to isolate special cases.
Sort the specials to the low bits. Use an enum.

Split the large comment block so as to document each
value separately.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h        | 130 +++++++++++++++++++++++--------------
 target/arm/cpu.c           |   4 +-
 target/arm/helper.c        |   4 +-
 target/arm/translate-a64.c |   6 +-
 target/arm/translate.c     |   6 +-
 5 files changed, 92 insertions(+), 58 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_ARM_CPREGS_H
 
 /*
- * ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
- * special-behaviour cp reg and bits [11..8] indicate what behaviour
- * it has. Otherwise it is a simple cp reg, where CONST indicates that
- * TCG can assume the value to be constant (ie load at translate time)
- * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
- * indicates that the TB should not be ended after a write to this register
- * (the default is that the TB ends after cp writes). OVERRIDE permits
- * a register definition to override a previous definition for the
- * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
- * old must have the OVERRIDE bit set.
- * ALIAS indicates that this register is an alias view of some underlying
- * state which is also visible via another register, and that the other
- * register is handling migration and reset; registers marked ALIAS will not be
- * migrated but may have their state set by syncing of register state from KVM.
- * NO_RAW indicates that this register has no underlying state and does not
- * support raw access for state saving/loading; it will not be used for either
- * migration or KVM state synchronization. (Typically this is for "registers"
- * which are actually used as instructions for cache maintenance and so on.)
- * IO indicates that this register does I/O and therefore its accesses
- * need to be marked with gen_io_start() and also end the TB. In particular,
- * registers which implement clocks or timers require this.
- * RAISES_EXC is for when the read or write hook might raise an exception;
- * the generated code will synchronize the CPU state before calling the hook
- * so that it is safe for the hook to call raise_exception().
- * NEWEL is for writes to registers that might change the exception
- * level - typically on older ARM chips. For those cases we need to
- * re-read the new el when recomputing the translation flags.
+ * ARMCPRegInfo type field bits:
  */
-#define ARM_CP_SPECIAL           0x0001
-#define ARM_CP_CONST             0x0002
-#define ARM_CP_64BIT             0x0004
-#define ARM_CP_SUPPRESS_TB_END   0x0008
-#define ARM_CP_OVERRIDE          0x0010
-#define ARM_CP_ALIAS             0x0020
-#define ARM_CP_IO                0x0040
-#define ARM_CP_NO_RAW            0x0080
-#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
-#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
-#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
-#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
-#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
-#define ARM_CP_DC_GVA            (ARM_CP_SPECIAL | 0x0600)
-#define ARM_CP_DC_GZVA           (ARM_CP_SPECIAL | 0x0700)
-#define ARM_LAST_SPECIAL         ARM_CP_DC_GZVA
-#define ARM_CP_FPU               0x1000
-#define ARM_CP_SVE               0x2000
-#define ARM_CP_NO_GDB            0x4000
-#define ARM_CP_RAISES_EXC        0x8000
-#define ARM_CP_NEWEL             0x10000
-/* Mask of only the flag bits in a type field */
-#define ARM_CP_FLAG_MASK         0x1f0ff
+enum {
+    /*
+     * Register must be handled specially during translation.
+     * The method is one of the values below:
+     */
+    ARM_CP_SPECIAL_MASK          = 0x000f,
+    /* Special: no change to PE state: writes ignored, reads ignored. */
+    ARM_CP_NOP                   = 0x0001,
+    /* Special: sysreg is WFI, for v5 and v6. */
+    ARM_CP_WFI                   = 0x0002,
+    /* Special: sysreg is NZCV. */
+    ARM_CP_NZCV                  = 0x0003,
+    /* Special: sysreg is CURRENTEL. */
+    ARM_CP_CURRENTEL             = 0x0004,
+    /* Special: sysreg is DC ZVA or similar. */
+    ARM_CP_DC_ZVA                = 0x0005,
+    ARM_CP_DC_GVA                = 0x0006,
+    ARM_CP_DC_GZVA               = 0x0007,
+
+    /* Flag: reads produce resetvalue; writes ignored. */
+    ARM_CP_CONST                 = 1 << 4,
+    /* Flag: For ARM_CP_STATE_AA32, sysreg is 64-bit. */
+    ARM_CP_64BIT                 = 1 << 5,
+    /*
+     * Flag: TB should not be ended after a write to this register
+     * (the default is that the TB ends after cp writes).
+     */
+    ARM_CP_SUPPRESS_TB_END       = 1 << 6,
+    /*
+     * Flag: Permit a register definition to override a previous definition
+     * for the same (cp, is64, crn, crm, opc1, opc2) tuple: either the new
+     * or the old must have the ARM_CP_OVERRIDE bit set.
+     */
+    ARM_CP_OVERRIDE              = 1 << 7,
+    /*
+     * Flag: Register is an alias view of some underlying state which is also
+     * visible via another register, and that the other register is handling
+     * migration and reset; registers marked ARM_CP_ALIAS will not be migrated
+     * but may have their state set by syncing of register state from KVM.
+     */
+    ARM_CP_ALIAS                 = 1 << 8,
+    /*
+     * Flag: Register does I/O and therefore its accesses need to be marked
+     * with gen_io_start() and also end the TB. In particular, registers which
+     * implement clocks or timers require this.
+     */
+    ARM_CP_IO                    = 1 << 9,
+    /*
+     * Flag: Register has no underlying state and does not support raw access
+     * for state saving/loading; it will not be used for either migration or
+     * KVM state synchronization. Typically this is for "registers" which are
+     * actually used as instructions for cache maintenance and so on.
+     */
+    ARM_CP_NO_RAW                = 1 << 10,
+    /*
+     * Flag: The read or write hook might raise an exception; the generated
+     * code will synchronize the CPU state before calling the hook so that it
+     * is safe for the hook to call raise_exception().
+     */
+    ARM_CP_RAISES_EXC            = 1 << 11,
+    /*
+     * Flag: Writes to the sysreg might change the exception level - typically
+     * on older ARM chips. For those cases we need to re-read the new el when
+     * recomputing the translation flags.
+     */
+    ARM_CP_NEWEL                 = 1 << 12,
+    /*
+     * Flag: Access check for this sysreg is identical to accessing FPU state
+     * from an instruction: use translation fp_access_check().
+     */
+    ARM_CP_FPU                   = 1 << 13,
+    /*
+     * Flag: Access check for this sysreg is identical to accessing SVE state
+     * from an instruction: use translation sve_access_check().
+     */
+    ARM_CP_SVE                   = 1 << 14,
+    /* Flag: Do not expose in gdb sysreg xml. */
+    ARM_CP_NO_GDB                = 1 << 15,
+};
 
 /*
  * Valid values for ARMCPRegInfo state field, indicating which of
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
     ARMCPRegInfo *ri = value;
     ARMCPU *cpu = opaque;
 
-    if (ri->type & (ARM_CP_SPECIAL | ARM_CP_ALIAS)) {
+    if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cp_reg_check_reset(gpointer key, gpointer value,  gpointer opaque)
     ARMCPU *cpu = opaque;
     uint64_t oldvalue, newvalue;
 
-    if (ri->type & (ARM_CP_SPECIAL | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
+    if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
         return;
     }
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      * multiple times. Special registers (ie NOP/WFI) are
      * never migratable and not even raw-accessible.
      */
-    if ((r->type & ARM_CP_SPECIAL)) {
+    if (r->type & ARM_CP_SPECIAL_MASK) {
         r2->type |= ARM_CP_NO_RAW;
     }
     if (((r->crm == CP_ANY) && crm != 0) ||
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
     /* Check that the register definition has enough info to handle
      * reads and writes if they are permitted.
      */
-    if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
+    if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) {
         if (r->access & PL3_R) {
             assert((r->fieldoffset ||
                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
     }
 
     /* Handle special cases first */
-    switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
+    switch (ri->type & ARM_CP_SPECIAL_MASK) {
+    case 0:
+        break;
     case ARM_CP_NOP:
         return;
     case ARM_CP_NZCV:
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
         }
         return;
     default:
-        break;
+        g_assert_not_reached();
     }
     if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
         return;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
         }
 
         /* Handle special cases first */
-        switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
+        switch (ri->type & ARM_CP_SPECIAL_MASK) {
+        case 0:
+            break;
         case ARM_CP_NOP:
             return;
         case ARM_CP_WFI:
@@ -XXX,XX +XXX,XX @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
             s->base.is_jmp = DISAS_WFI;
             return;
         default:
-            break;
+            g_assert_not_reached();
         }
 
         if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Standardize on g_assert_not_reached() for "should not happen".
Retain abort() when preceeded by fprintf or error_report.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c         | 7 +++----
 target/arm/hvf/hvf.c        | 2 +-
 target/arm/kvm-stub.c       | 4 ++--
 target/arm/kvm.c            | 4 ++--
 target/arm/machine.c        | 4 ++--
 target/arm/translate-a64.c  | 4 ++--
 target/arm/translate-neon.c | 2 +-
 target/arm/translate.c      | 4 ++--
 8 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
             break;
         default:
             /* broken reginfo with out-of-range opc1 */
-            assert(false);
-            break;
+            g_assert_not_reached();
         }
         /* assert our permissions are not too lax (stricter is fine) */
         assert((r->access & ~mask) == 0);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
             break;
         default:
             /* Never happens, but compiler isn't smart enough to tell.  */
-            abort();
+            g_assert_not_reached();
         }
     }
     *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
             break;
         default:
             /* Never happens, but compiler isn't smart enough to tell.  */
-            abort();
+            g_assert_not_reached();
         }
     }
     if (domain_prot == 3) {
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
         /* we got kicked, no exit to process */
         return 0;
     default:
-        assert(0);
+        g_assert_not_reached();
     }
 
     hvf_sync_vtimer(cpu);
diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -XXX,XX +XXX,XX @@
 
 bool write_kvmstate_to_list(ARMCPU *cpu)
 {
-    abort();
+    g_assert_not_reached();
 }
 
 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
 {
-    abort();
+    g_assert_not_reached();
 }
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool write_kvmstate_to_list(ARMCPU *cpu)
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
             break;
         default:
-            abort();
+            g_assert_not_reached();
         }
         if (ret) {
             ok = false;
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
             r.addr = (uintptr_t)(cpu->cpreg_values + i);
             break;
         default:
-            abort();
+            g_assert_not_reached();
         }
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
         if (ret) {
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
     if (kvm_enabled()) {
         if (!write_kvmstate_to_list(cpu)) {
             /* This should never fail */
-            abort();
+            g_assert_not_reached();
         }
 
         /*
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
     } else {
         if (!write_cpustate_to_list(cpu, false)) {
             /* This should never fail. */
-            abort();
+            g_assert_not_reached();
         }
     }
 
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         gen_helper_advsimd_rinth(tcg_res, tcg_op, fpst);
         break;
     default:
-        abort();
+        g_assert_not_reached();
     }
 
     write_fp_sreg(s, rd, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_fcvt(DisasContext *s, int opcode,
         break;
     }
     default:
-        abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/target/arm/translate-neon.c b/target/arm/translate-neon.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c
+++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
         }
         break;
     default:
-        abort();
+        g_assert_not_reached();
     }
     if ((vd + a->stride * (nregs - 1)) > 31) {
         /*
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
         offset = 4;
         break;
     default:
-        abort();
+        g_assert_not_reached();
     }
     tcg_gen_addi_i32(addr, addr, offset);
     tmp = load_reg(s, 14);
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
             offset = 0;
             break;
         default:
-            abort();
+            g_assert_not_reached();
         }
         tcg_gen_addi_i32(addr, addr, offset);
         gen_helper_set_r13_banked(cpu_env, tcg_constant_i32(mode), addr);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a typedef as well, and use it in ARMCPRegInfo.
This won't be perfect for debugging, but it'll nicely
display the most common cases.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 44 +++++++++++++++++++++++---------------------
 target/arm/helper.c |  2 +-
 2 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
  * described with these bits, then use a laxer set of restrictions, and
  * do the more restrictive/complex check inside a helper function.
  */
-#define PL3_R 0x80
-#define PL3_W 0x40
-#define PL2_R (0x20 | PL3_R)
-#define PL2_W (0x10 | PL3_W)
-#define PL1_R (0x08 | PL2_R)
-#define PL1_W (0x04 | PL2_W)
-#define PL0_R (0x02 | PL1_R)
-#define PL0_W (0x01 | PL1_W)
+typedef enum {
+    PL3_R = 0x80,
+    PL3_W = 0x40,
+    PL2_R = 0x20 | PL3_R,
+    PL2_W = 0x10 | PL3_W,
+    PL1_R = 0x08 | PL2_R,
+    PL1_W = 0x04 | PL2_W,
+    PL0_R = 0x02 | PL1_R,
+    PL0_W = 0x01 | PL1_W,
 
-/*
- * For user-mode some registers are accessible to EL0 via a kernel
- * trap-and-emulate ABI. In this case we define the read permissions
- * as actually being PL0_R. However some bits of any given register
- * may still be masked.
- */
+    /*
+     * For user-mode some registers are accessible to EL0 via a kernel
+     * trap-and-emulate ABI. In this case we define the read permissions
+     * as actually being PL0_R. However some bits of any given register
+     * may still be masked.
+     */
 #ifdef CONFIG_USER_ONLY
-#define PL0U_R PL0_R
+    PL0U_R = PL0_R,
 #else
-#define PL0U_R PL1_R
+    PL0U_R = PL1_R,
 #endif
 
-#define PL3_RW (PL3_R | PL3_W)
-#define PL2_RW (PL2_R | PL2_W)
-#define PL1_RW (PL1_R | PL1_W)
-#define PL0_RW (PL0_R | PL0_W)
+    PL3_RW = PL3_R | PL3_W,
+    PL2_RW = PL2_R | PL2_W,
+    PL1_RW = PL1_R | PL1_W,
+    PL0_RW = PL0_R | PL0_W,
+} CPAccessRights;
 
 typedef enum CPAccessResult {
     /* Access is permitted */
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
     /* Register type: ARM_CP_* bits/values */
     int type;
     /* Access rights: PL*_[RW] */
-    int access;
+    CPAccessRights access;
     /* Security state: ARM_CP_SECSTATE_* bits/values */
     int secure;
     /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
      * to encompass the generic architectural permission check.
      */
     if (r->state != ARM_CP_STATE_AA32) {
-        int mask = 0;
+        CPAccessRights mask;
         switch (r->opc1) {
         case 0:
             /* min_EL EL1, but some accessible to EL0 via kernel ABI */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Give this enum a name and use in ARMCPRegInfo,
add_cpreg_to_hashtable and define_one_arm_cp_reg_with_opaque.

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
  * Note that we rely on the values of these enums as we iterate through
  * the various states in some places.
  */
-enum {
+typedef enum {
     ARM_CP_STATE_AA32 = 0,
     ARM_CP_STATE_AA64 = 1,
     ARM_CP_STATE_BOTH = 2,
-};
+} CPState;
 
 /*
  * ARM CP register secure state flags.  These flags identify security state
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
     uint8_t opc1;
     uint8_t opc2;
     /* Execution state in which this register is visible: ARM_CP_STATE_* */
-    int state;
+    CPState state;
     /* Register type: ARM_CP_* bits/values */
     int type;
     /* Access rights: PL*_[RW] */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
 }
 
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-                                   void *opaque, int state, int secstate,
+                                   void *opaque, CPState state, int secstate,
                                    int crm, int opc1, int opc2,
                                    const char *name)
 {
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
      * the register, if any.
      */
-    int crm, opc1, opc2, state;
+    int crm, opc1, opc2;
     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
+    CPState state;
+
     /* 64 bit registers have only CRm and Opc1 fields */
     assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
     /* op0 only exists in the AArch64 encodings */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Give this enum a name and use in ARMCPRegInfo and add_cpreg_to_hashtable.
Add the enumerator ARM_CP_SECSTATE_BOTH to clarify how 0
is handled in define_one_arm_cp_reg_with_opaque.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 7 ++++---
 target/arm/helper.c | 7 +++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
  * registered entry will only have one to identify whether the entry is secure
  * or non-secure.
  */
-enum {
+typedef enum {
+    ARM_CP_SECSTATE_BOTH = 0,       /* define one cpreg for each secstate */
     ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
     ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
-};
+} CPSecureState;
 
 /*
  * Access rights:
@@ -XXX,XX +XXX,XX @@ struct ARMCPRegInfo {
     /* Access rights: PL*_[RW] */
     CPAccessRights access;
     /* Security state: ARM_CP_SECSTATE_* bits/values */
-    int secure;
+    CPSecureState secure;
     /*
      * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
      * this register was defined: can be used to hand data through to the
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
 }
 
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-                                   void *opaque, CPState state, int secstate,
+                                   void *opaque, CPState state,
+                                   CPSecureState secstate,
                                    int crm, int opc1, int opc2,
                                    const char *name)
 {
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                                                    r->secure, crm, opc1, opc2,
                                                    r->name);
                             break;
-                        default:
+                        case ARM_CP_SECSTATE_BOTH:
                             name = g_strdup_printf("%s_S", r->name);
                             add_cpreg_to_hashtable(cpu, r, opaque, state,
                                                    ARM_CP_SECSTATE_S,
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                                                    ARM_CP_SECSTATE_NS,
                                                    crm, opc1, opc2, r->name);
                             break;
+                        default:
+                            g_assert_not_reached();
                         }
                     } else {
                         /* AArch64 registers get mapped to non-secure instance
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The new_key field is always non-zero -- drop the if.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-11-richard.henderson@linaro.org
[PMM: reinstated dropped PL3_RW mask]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
 
     for (i = 0; i < ARRAY_SIZE(aliases); i++) {
         const struct E2HAlias *a = &aliases[i];
-        ARMCPRegInfo *src_reg, *dst_reg;
+        ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
+        uint32_t *new_key;
+        bool ok;
 
         if (a->feature && !a->feature(&cpu->isar)) {
             continue;
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
         g_assert(src_reg->opaque == NULL);
 
         /* Create alias before redirection so we dup the right data. */
-        if (a->new_key) {
-            ARMCPRegInfo *new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
-            uint32_t *new_key = g_memdup(&a->new_key, sizeof(uint32_t));
-            bool ok;
+        new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
+        new_key = g_memdup(&a->new_key, sizeof(uint32_t));
 
-            new_reg->name = a->new_name;
-            new_reg->type |= ARM_CP_ALIAS;
-            /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
-            new_reg->access &= PL2_RW | PL3_RW;
+        new_reg->name = a->new_name;
+        new_reg->type |= ARM_CP_ALIAS;
+        /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
+        new_reg->access &= PL2_RW | PL3_RW;
 
-            ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
-            g_assert(ok);
-        }
+        ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
+        g_assert(ok);
 
         src_reg->opaque = dst_reg;
         src_reg->orig_readfn = src_reg->readfn ?: raw_read;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Cast the uint32_t key into a gpointer directly, which
allows us to avoid allocating storage for each key.

Use g_hash_table_lookup when we already have a gpointer
(e.g. for callbacks like count_cpreg), or when using
get_arm_cp_reginfo would require casting away const.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c     |  4 ++--
 target/arm/gdbstub.c |  2 +-
 target/arm/helper.c  | 41 ++++++++++++++++++-----------------------
 3 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     ARMCPU *cpu = ARM_CPU(obj);
 
     cpu_set_cpustate_pointers(cpu);
-    cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
-                                         g_free, cpreg_hashtable_data_destroy);
+    cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
+                                         NULL, cpreg_hashtable_data_destroy);
 
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static void arm_gen_one_xml_sysreg_tag(GString *s, DynamicGDBXMLInfo *dyn_xml,
 static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
                                         gpointer p)
 {
-    uint32_t ri_key = *(uint32_t *)key;
+    uint32_t ri_key = (uintptr_t)key;
     ARMCPRegInfo *ri = value;
     RegisterSysregXmlParam *param = (RegisterSysregXmlParam *)p;
     GString *s = param->s;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu)
 static void add_cpreg_to_list(gpointer key, gpointer opaque)
 {
     ARMCPU *cpu = opaque;
-    uint64_t regidx;
-    const ARMCPRegInfo *ri;
-
-    regidx = *(uint32_t *)key;
-    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
+    uint32_t regidx = (uintptr_t)key;
+    const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 
     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
         cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_list(gpointer key, gpointer opaque)
 static void count_cpreg(gpointer key, gpointer opaque)
 {
     ARMCPU *cpu = opaque;
-    uint64_t regidx;
     const ARMCPRegInfo *ri;
 
-    regidx = *(uint32_t *)key;
-    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
+    ri = g_hash_table_lookup(cpu->cp_regs, key);
 
     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
         cpu->cpreg_array_len++;
@@ -XXX,XX +XXX,XX @@ static void count_cpreg(gpointer key, gpointer opaque)
 
 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
 {
-    uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
-    uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
+    uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a);
+    uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b);
 
     if (aidx > bidx) {
         return 1;
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
     for (i = 0; i < ARRAY_SIZE(aliases); i++) {
         const struct E2HAlias *a = &aliases[i];
         ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
-        uint32_t *new_key;
         bool ok;
 
         if (a->feature && !a->feature(&cpu->isar)) {
             continue;
         }
 
-        src_reg = g_hash_table_lookup(cpu->cp_regs, &a->src_key);
-        dst_reg = g_hash_table_lookup(cpu->cp_regs, &a->dst_key);
+        src_reg = g_hash_table_lookup(cpu->cp_regs,
+                                      (gpointer)(uintptr_t)a->src_key);
+        dst_reg = g_hash_table_lookup(cpu->cp_regs,
+                                      (gpointer)(uintptr_t)a->dst_key);
         g_assert(src_reg != NULL);
         g_assert(dst_reg != NULL);
 
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
 
         /* Create alias before redirection so we dup the right data. */
         new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
-        new_key = g_memdup(&a->new_key, sizeof(uint32_t));
 
         new_reg->name = a->new_name;
         new_reg->type |= ARM_CP_ALIAS;
         /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
         new_reg->access &= PL2_RW | PL3_RW;
 
-        ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg);
+        ok = g_hash_table_insert(cpu->cp_regs,
+                                 (gpointer)(uintptr_t)a->new_key, new_reg);
         g_assert(ok);
 
         src_reg->opaque = dst_reg;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     /* Private utility function for define_one_arm_cp_reg_with_opaque():
      * add a single reginfo struct to the hash table.
      */
-    uint32_t *key = g_new(uint32_t, 1);
+    uint32_t key;
     ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
             r2->cp = CP_REG_ARM64_SYSREG_CP;
         }
-        *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
-                                  r2->opc0, opc1, opc2);
+        key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
+                                 r2->opc0, opc1, opc2);
     } else {
-        *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
+        key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
     }
     if (opaque) {
         r2->opaque = opaque;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      * requested.
      */
     if (!(r->type & ARM_CP_OVERRIDE)) {
-        ARMCPRegInfo *oldreg;
-        oldreg = g_hash_table_lookup(cpu->cp_regs, key);
+        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
         if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
             fprintf(stderr, "Register redefined: cp=%d %d bit "
                     "crn=%d crm=%d opc1=%d opc2=%d, "
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
             g_assert_not_reached();
         }
     }
-    g_hash_table_insert(cpu->cp_regs, key, r2);
+    g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
 }
 
 
@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
 
 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
 {
-    return g_hash_table_lookup(cpregs, &encoded_cp);
+    return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp);
 }
 
 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Simplify freeing cp_regs hash table entries by using a single
allocation for the entire value.

This fixes a theoretical bug if we were to ever free the entire
hash table, because we've been installing string literal constants
into the cpreg structure in define_arm_vh_e2h_redirects_aliases.
However, at present we only free entries created for AArch32
wildcard cpregs which get overwritten by more specific cpregs,
so this bug is never exposed.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c    | 16 +---------------
 target/arm/helper.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz)
     return (Aff1 << ARM_AFF1_SHIFT) | Aff0;
 }
 
-static void cpreg_hashtable_data_destroy(gpointer data)
-{
-    /*
-     * Destroy function for cpu->cp_regs hashtable data entries.
-     * We must free the name string because it was g_strdup()ed in
-     * add_cpreg_to_hashtable(). It's OK to cast away the 'const'
-     * from r->name because we know we definitely allocated it.
-     */
-    ARMCPRegInfo *r = data;
-
-    g_free((void *)r->name);
-    g_free(r);
-}
-
 static void arm_cpu_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
     cpu_set_cpustate_pointers(cpu);
     cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
-                                         NULL, cpreg_hashtable_data_destroy);
+                                         NULL, g_free);
 
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      * add a single reginfo struct to the hash table.
      */
     uint32_t key;
-    ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
+    ARMCPRegInfo *r2;
     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
+    size_t name_len;
+
+    /* Combine cpreg and name into one allocation. */
+    name_len = strlen(name) + 1;
+    r2 = g_malloc(sizeof(*r2) + name_len);
+    *r2 = *r;
+    r2->name = memcpy(r2 + 1, name, name_len);
 
-    r2->name = g_strdup(name);
     /* Reset the secure state to the specific incoming state.  This is
      * necessary as the register may have been defined with both states.
      */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the computation of key to the top of the function.
Hoist the resolution of cp as well, as an input to the
computation of key.

This will be required by a subsequent patch.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 49 +++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     ARMCPRegInfo *r2;
     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
+    int cp = r->cp;
     size_t name_len;
 
+    switch (state) {
+    case ARM_CP_STATE_AA32:
+        /* We assume it is a cp15 register if the .cp field is left unset. */
+        if (cp == 0 && r->state == ARM_CP_STATE_BOTH) {
+            cp = 15;
+        }
+        key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
+        break;
+    case ARM_CP_STATE_AA64:
+        /*
+         * To allow abbreviation of ARMCPRegInfo definitions, we treat
+         * cp == 0 as equivalent to the value for "standard guest-visible
+         * sysreg".  STATE_BOTH definitions are also always "standard sysreg"
+         * in their AArch64 view (the .cp value may be non-zero for the
+         * benefit of the AArch32 view).
+         */
+        if (cp == 0 || r->state == ARM_CP_STATE_BOTH) {
+            cp = CP_REG_ARM64_SYSREG_CP;
+        }
+        key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
     /* Combine cpreg and name into one allocation. */
     name_len = strlen(name) + 1;
     r2 = g_malloc(sizeof(*r2) + name_len);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
 
         if (r->state == ARM_CP_STATE_BOTH) {
-            /* We assume it is a cp15 register if the .cp field is left unset.
-             */
-            if (r2->cp == 0) {
-                r2->cp = 15;
-            }
-
 #if HOST_BIG_ENDIAN
             if (r2->fieldoffset) {
                 r2->fieldoffset += sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 #endif
         }
     }
-    if (state == ARM_CP_STATE_AA64) {
-        /* To allow abbreviation of ARMCPRegInfo
-         * definitions, we treat cp == 0 as equivalent to
-         * the value for "standard guest-visible sysreg".
-         * STATE_BOTH definitions are also always "standard
-         * sysreg" in their AArch64 view (the .cp value may
-         * be non-zero for the benefit of the AArch32 view).
-         */
-        if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
-            r2->cp = CP_REG_ARM64_SYSREG_CP;
-        }
-        key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
-                                 r2->opc0, opc1, opc2);
-    } else {
-        key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
-    }
     if (opaque) {
         r2->opaque = opaque;
     }
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     /* Make sure reginfo passed to helpers for wildcarded regs
      * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
      */
+    r2->cp = cp;
     r2->crm = crm;
     r2->opc1 = opc1;
     r2->opc2 = opc2;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Put most of the value writeback to the same place,
and improve the comment that goes with them.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     *r2 = *r;
     r2->name = memcpy(r2 + 1, name, name_len);
 
-    /* Reset the secure state to the specific incoming state.  This is
-     * necessary as the register may have been defined with both states.
+    /*
+     * Update fields to match the instantiation, overwiting wildcards
+     * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
      */
+    r2->cp = cp;
+    r2->crm = crm;
+    r2->opc1 = opc1;
+    r2->opc2 = opc2;
+    r2->state = state;
     r2->secure = secstate;
+    if (opaque) {
+        r2->opaque = opaque;
+    }
 
     if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
         /* Register is banked (using both entries in array).
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 #endif
         }
     }
-    if (opaque) {
-        r2->opaque = opaque;
-    }
-    /* reginfo passed to helpers is correct for the actual access,
-     * and is never ARM_CP_STATE_BOTH:
-     */
-    r2->state = state;
-    /* Make sure reginfo passed to helpers for wildcarded regs
-     * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
-     */
-    r2->cp = cp;
-    r2->crm = crm;
-    r2->opc1 = opc1;
-    r2->opc2 = opc2;
+
     /* By convention, for wildcarded registers only the first
      * entry is used for migration; the others are marked as
      * ALIAS so we don't try to transfer the register
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Computing isbanked only once makes the code
a bit easier to read.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Perform the override check early, so that it is still done
even when we decide to discard an unreachable cpreg.

Use assert not printf+abort.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         g_assert_not_reached();
     }
 
+    /* Overriding of an existing definition must be explicitly requested. */
+    if (!(r->type & ARM_CP_OVERRIDE)) {
+        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
+        if (oldreg) {
+            assert(oldreg->type & ARM_CP_OVERRIDE);
+        }
+    }
+
     /* Combine cpreg and name into one allocation. */
     name_len = strlen(name) + 1;
     r2 = g_malloc(sizeof(*r2) + name_len);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         assert(!raw_accessors_invalid(r2));
     }
 
-    /* Overriding of an existing definition must be explicitly
-     * requested.
-     */
-    if (!(r->type & ARM_CP_OVERRIDE)) {
-        const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
-        if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
-            fprintf(stderr, "Register redefined: cp=%d %d bit "
-                    "crn=%d crm=%d opc1=%d opc2=%d, "
-                    "was %s, now %s\n", r2->cp, 32 + 32 * is64,
-                    r2->crn, r2->crm, r2->opc1, r2->opc2,
-                    oldreg->name, r2->name);
-            g_assert_not_reached();
-        }
-    }
     g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Put the block comments into the current coding style.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 
+/*
+ * Private utility function for define_one_arm_cp_reg_with_opaque():
+ * add a single reginfo struct to the hash table.
+ */
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                    void *opaque, CPState state,
                                    CPSecureState secstate,
                                    int crm, int opc1, int opc2,
                                    const char *name)
 {
-    /* Private utility function for define_one_arm_cp_reg_with_opaque():
-     * add a single reginfo struct to the hash table.
-     */
     uint32_t key;
     ARMCPRegInfo *r2;
     bool is64 = r->type & ARM_CP_64BIT;
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 
     isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
     if (isbanked) {
-        /* Register is banked (using both entries in array).
+        /*
+         * Register is banked (using both entries in array).
          * Overwriting fieldoffset as the array is only used to define
          * banked registers but later only fieldoffset is used.
          */
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 
     if (state == ARM_CP_STATE_AA32) {
         if (isbanked) {
-            /* If the register is banked then we don't need to migrate or
+            /*
+             * If the register is banked then we don't need to migrate or
              * reset the 32-bit instance in certain cases:
              *
              * 1) If the register has both 32-bit and 64-bit instances then we
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                 r2->type |= ARM_CP_ALIAS;
             }
         } else if ((secstate != r->secure) && !ns) {
-            /* The register is not banked so we only want to allow migration of
-             * the non-secure instance.
+            /*
+             * The register is not banked so we only want to allow migration
+             * of the non-secure instance.
              */
             r2->type |= ARM_CP_ALIAS;
         }
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
     }
 
-    /* By convention, for wildcarded registers only the first
+    /*
+     * By convention, for wildcarded registers only the first
      * entry is used for migration; the others are marked as
      * ALIAS so we don't try to transfer the register
      * multiple times. Special registers (ie NOP/WFI) are
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
     }
 
-    /* Check that raw accesses are either forbidden or handled. Note that
+    /*
+     * Check that raw accesses are either forbidden or handled. Note that
      * we can't assert this earlier because the setup of fieldoffset for
      * banked registers has to be done first.
      */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Since e03b56863d2bc, our host endian indicator is unconditionally
set, which means that we can use a normal C condition.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220501055028.646596-20-richard.henderson@linaro.org
[PMM: quote correct git hash in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
             r2->type |= ARM_CP_ALIAS;
         }
 
-        if (r->state == ARM_CP_STATE_BOTH) {
-#if HOST_BIG_ENDIAN
-            if (r2->fieldoffset) {
-                r2->fieldoffset += sizeof(uint32_t);
-            }
-#endif
+        if (HOST_BIG_ENDIAN &&
+            r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
+            r2->fieldoffset += sizeof(uint32_t);
         }
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
     return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
 }
 
+static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ssbs(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SSBS) != 0;
 }
 
+static inline bool isar_feature_aa64_debugv8p2(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, DEBUGVER) >= 8;
+}
+
 static inline bool isar_feature_aa64_sve2(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SVEVER) != 0;
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_tts2uxn(const ARMISARegisters *id)
     return isar_feature_aa64_tts2uxn(id) || isar_feature_aa32_tts2uxn(id);
 }
 
+static inline bool isar_feature_any_debugv8p2(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_debugv8p2(id) || isar_feature_aa32_debugv8p2(id);
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Add the aa64 predicate for detecting RAS support from id registers.
We already have the aa32 version from the M-profile work.
Add the 'any' predicate for testing both aa64 and aa32.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220501055028.646596-34-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
 }
 
+static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
+}
+
 static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_debugv8p2(const ARMISARegisters *id)
     return isar_feature_aa64_debugv8p2(id) || isar_feature_aa32_debugv8p2(id);
 }
 
+static inline bool isar_feature_any_ras(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_ras(id) || isar_feature_aa32_ras(id);
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
-- 
2.25.1

From: Alex Zuepke <alex.zuepke@tum.de>

The ARMv8 manual defines that PMUSERENR_EL0.ER enables read-access
to both PMXEVCNTR_EL0 and PMEVCNTR<n>_EL0 registers, however,
we only use it for PMXEVCNTR_EL0. Extend to PMEVCNTR<n>_EL0 as well.

Signed-off-by: Alex Zuepke <alex.zuepke@tum.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220428132717.84190-1-alex.zuepke@tum.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
               .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
               .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
               .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-              .accessfn = pmreg_access },
+              .accessfn = pmreg_access_xevcntr },
             { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
-              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
+              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr,
               .type = ARM_CP_IO,
               .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
               .raw_readfn = pmevcntr_rawread,
-- 
2.25.1