Series comparison

-[PULL 00/14] target-arm queue
+[PULL 00/25] target-arm queue
-arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
+The following changes since commit b11728dc3ae67ddedf34b7a4f318170e7092803c:
 patches, which are somewhere between a bugfix and a new feature.
-thanks
+  Merge tag 'pull-riscv-to-apply-20230224' of github.com:palmer-dabbelt/qemu into staging (2023-02-26 20:14:46 +0000)
 -- PMM
 The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
   Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
+  https://git.linaro.org/people/pmaydell/qemu-arm.git pull-target-arm-20230227
-for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
+for you to fetch changes up to e844f0c5d0bd2c4d8d3c1622eb2a88586c9c4677:
-  hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
+  hw: Replace qemu_or_irq typedef by OrIRQState (2023-02-27 13:27:05 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/smmuv3: Check 31st bit to see if CD is valid
+ * Various code cleanups
- * qemu-options.hx: Fix formatting of -machine memory-backend option
+ * More refactoring working towards allowing a build
- * hw: aspeed_gpio: Fix memory size
+   without CONFIG_TCG
  * hw/arm/nseries: Display hexadecimal value with '0x' prefix
  * Add sve-default-vector-length cpu property
  * docs: Update path that mentions deprecated.rst
  * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
  * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
  * target/arm: Report M-profile alignment faults correctly to the guest
  * target/arm: Add missing 'return's after calling v7m_exception_taken()
  * target/arm: Enforce that M-profile SP low 2 bits are always zero
 ----------------------------------------------------------------
-Joe Komlodi (1):
+Claudio Fontana (2):
-      hw/arm/smmuv3: Check 31st bit to see if CD is valid
+      target/arm: move helpers to tcg/
       target/arm: Move psci.c into the tcg directory
-Joel Stanley (1):
+Fabiano Rosas (9):
-      hw: aspeed_gpio: Fix memory size
+      target/arm: Wrap breakpoint/watchpoint updates with tcg_enabled
       target/arm: Wrap TCG-only code in debug_helper.c
       target/arm: move translate modules to tcg/
       target/arm: Wrap arm_rebuild_hflags calls with tcg_enabled
       target/arm: Move hflags code into the tcg directory
       target/arm: Move regime_using_lpae_format into internal.h
       target/arm: Don't access TCG code when debugging with KVM
       cpu-defs.h: Expose CPUTLBEntryFull to non-TCG code
       tests/avocado: add machine:none tag to version.py
-Mao Zhongyi (1):
+Philippe Mathieu-Daudé (13):
-      docs: Update path that mentions deprecated.rst
+      hw/gpio/max7310: Simplify max7310_realize()
       hw/char/pl011: Un-inline pl011_create()
       hw/char/pl011: Open-code pl011_luminary_create()
       hw/char/xilinx_uartlite: Expose XILINX_UARTLITE QOM type
       hw/char/xilinx_uartlite: Open-code xilinx_uartlite_create()
       hw/char/cmsdk-apb-uart: Open-code cmsdk_apb_uart_create()
       hw/timer/cmsdk-apb-timer: Remove unused 'qdev-properties.h' header
       hw/intc/armv7m_nvic: Use QOM cast CPU() macro
       hw/arm/musicpal: Remove unused dummy MemoryRegion
       iothread: Remove unused IOThreadClass / IOTHREAD_CLASS
       hw/irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
       hw/or-irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
       hw: Replace qemu_or_irq typedef by OrIRQState
-Peter Maydell (7):
+Thomas Huth (1):
-      qemu-options.hx: Fix formatting of -machine memory-backend option
+      include/hw/arm/allwinner-a10.h: Remove superfluous includes from the header
       target/arm: Enforce that M-profile SP low 2 bits are always zero
       target/arm: Add missing 'return's after calling v7m_exception_taken()
       target/arm: Report M-profile alignment faults correctly to the guest
       hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
       hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
       hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
-Philippe Mathieu-Daudé (1):
+ MAINTAINERS                              |   1 +
-      hw/arm/nseries: Display hexadecimal value with '0x' prefix
+ include/exec/cpu-defs.h                  |   6 +
  include/hw/arm/allwinner-a10.h           |   2 -
  include/hw/arm/armsse.h                  |   6 +-
  include/hw/arm/bcm2835_peripherals.h     |   2 +-
  include/hw/arm/exynos4210.h              |   4 +-
  include/hw/arm/stm32f205_soc.h           |   2 +-
  include/hw/arm/stm32f405_soc.h           |   2 +-
  include/hw/arm/xlnx-versal.h             |   6 +-
  include/hw/arm/xlnx-zynqmp.h             |   2 +-
  include/hw/char/cmsdk-apb-uart.h         |  34 ---
  include/hw/char/pl011.h                  |  36 +--
  include/hw/char/xilinx_uartlite.h        |  22 +-
  include/hw/or-irq.h                      |   5 +-
  include/hw/timer/cmsdk-apb-timer.h       |   1 -
  target/arm/internals.h                   |  23 +-
  target/arm/{ => tcg}/translate-a64.h     |   0
  target/arm/{ => tcg}/translate.h         |   0
  target/arm/{ => tcg}/vec_internal.h      |   0
  target/arm/{ => tcg}/a32-uncond.decode   |   0
  target/arm/{ => tcg}/a32.decode          |   0
  target/arm/{ => tcg}/m-nocp.decode       |   0
  target/arm/{ => tcg}/mve.decode          |   0
  target/arm/{ => tcg}/neon-dp.decode      |   0
  target/arm/{ => tcg}/neon-ls.decode      |   0
  target/arm/{ => tcg}/neon-shared.decode  |   0
  target/arm/{ => tcg}/sme-fa64.decode     |   0
  target/arm/{ => tcg}/sme.decode          |   0
  target/arm/{ => tcg}/sve.decode          |   0
  target/arm/{ => tcg}/t16.decode          |   0
  target/arm/{ => tcg}/t32.decode          |   0
  target/arm/{ => tcg}/vfp-uncond.decode   |   0
  target/arm/{ => tcg}/vfp.decode          |   0
  hw/arm/allwinner-a10.c                   |   1 +
  hw/arm/boot.c                            |   6 +-
  hw/arm/exynos4210.c                      |   4 +-
  hw/arm/mps2-tz.c                         |   2 +-
  hw/arm/mps2.c                            |  41 ++-
  hw/arm/musicpal.c                        |   4 -
  hw/arm/stellaris.c                       |  11 +-
  hw/char/pl011.c                          |  17 ++
  hw/char/xilinx_uartlite.c                |   4 +-
  hw/core/irq.c                            |   9 +-
  hw/core/or-irq.c                         |  18 +-
  hw/gpio/max7310.c                        |   5 +-
  hw/intc/armv7m_nvic.c                    |  26 +-
  hw/microblaze/petalogix_s3adsp1800_mmu.c |   7 +-
  hw/pci-host/raven.c                      |   2 +-
  iothread.c                               |   4 -
  target/arm/arm-powerctl.c                |   7 +-
  target/arm/cpu.c                         |   9 +-
  target/arm/debug_helper.c                | 490 ++++++++++++++++---------------
  target/arm/helper.c                      | 411 +-------------------------
  target/arm/machine.c                     |  12 +-
  target/arm/ptw.c                         |   4 +
  target/arm/tcg-stubs.c                   |  27 ++
  target/arm/{ => tcg}/crypto_helper.c     |   0
  target/arm/{ => tcg}/helper-a64.c        |   0
  target/arm/tcg/hflags.c                  | 403 +++++++++++++++++++++++++
  target/arm/{ => tcg}/iwmmxt_helper.c     |   0
  target/arm/{ => tcg}/m_helper.c          |   0
  target/arm/{ => tcg}/mte_helper.c        |   0
  target/arm/{ => tcg}/mve_helper.c        |   0
  target/arm/{ => tcg}/neon_helper.c       |   0
  target/arm/{ => tcg}/op_helper.c         |   0
  target/arm/{ => tcg}/pauth_helper.c      |   0
  target/arm/{ => tcg}/psci.c              |   0
  target/arm/{ => tcg}/sme_helper.c        |   0
  target/arm/{ => tcg}/sve_helper.c        |   0
  target/arm/{ => tcg}/tlb_helper.c        |  18 --
  target/arm/{ => tcg}/translate-a64.c     |   0
  target/arm/{ => tcg}/translate-m-nocp.c  |   0
  target/arm/{ => tcg}/translate-mve.c     |   0
  target/arm/{ => tcg}/translate-neon.c    |   0
  target/arm/{ => tcg}/translate-sme.c     |   0
  target/arm/{ => tcg}/translate-sve.c     |   0
  target/arm/{ => tcg}/translate-vfp.c     |   0
  target/arm/{ => tcg}/translate.c         |   0
  target/arm/{ => tcg}/vec_helper.c        |   0
  target/arm/meson.build                   |  46 +--
  target/arm/tcg/meson.build               |  50 ++++
  tests/avocado/version.py                 |   1 +
 files changed, 918 insertions(+), 875 deletions(-)
  rename target/arm/{ => tcg}/translate-a64.h (100%)
  rename target/arm/{ => tcg}/translate.h (100%)
  rename target/arm/{ => tcg}/vec_internal.h (100%)
  rename target/arm/{ => tcg}/a32-uncond.decode (100%)
  rename target/arm/{ => tcg}/a32.decode (100%)
  rename target/arm/{ => tcg}/m-nocp.decode (100%)
  rename target/arm/{ => tcg}/mve.decode (100%)
  rename target/arm/{ => tcg}/neon-dp.decode (100%)
  rename target/arm/{ => tcg}/neon-ls.decode (100%)
  rename target/arm/{ => tcg}/neon-shared.decode (100%)
  rename target/arm/{ => tcg}/sme-fa64.decode (100%)
  rename target/arm/{ => tcg}/sme.decode (100%)
  rename target/arm/{ => tcg}/sve.decode (100%)
  rename target/arm/{ => tcg}/t16.decode (100%)
  rename target/arm/{ => tcg}/t32.decode (100%)
  rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
  rename target/arm/{ => tcg}/vfp.decode (100%)
  create mode 100644 target/arm/tcg-stubs.c
  rename target/arm/{ => tcg}/crypto_helper.c (100%)
  rename target/arm/{ => tcg}/helper-a64.c (100%)
  create mode 100644 target/arm/tcg/hflags.c
  rename target/arm/{ => tcg}/iwmmxt_helper.c (100%)
  rename target/arm/{ => tcg}/m_helper.c (100%)
  rename target/arm/{ => tcg}/mte_helper.c (100%)
  rename target/arm/{ => tcg}/mve_helper.c (100%)
  rename target/arm/{ => tcg}/neon_helper.c (100%)
  rename target/arm/{ => tcg}/op_helper.c (100%)
  rename target/arm/{ => tcg}/pauth_helper.c (100%)
  rename target/arm/{ => tcg}/psci.c (100%)
  rename target/arm/{ => tcg}/sme_helper.c (100%)
  rename target/arm/{ => tcg}/sve_helper.c (100%)
  rename target/arm/{ => tcg}/tlb_helper.c (94%)
  rename target/arm/{ => tcg}/translate-a64.c (100%)
  rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
  rename target/arm/{ => tcg}/translate-mve.c (100%)
  rename target/arm/{ => tcg}/translate-neon.c (100%)
  rename target/arm/{ => tcg}/translate-sme.c (100%)
  rename target/arm/{ => tcg}/translate-sve.c (100%)
  rename target/arm/{ => tcg}/translate-vfp.c (100%)
  rename target/arm/{ => tcg}/translate.c (100%)
  rename target/arm/{ => tcg}/vec_helper.c (100%)
  create mode 100644 target/arm/tcg/meson.build
-Richard Henderson (3):
-      target/arm: Correctly bound length in sve_zcr_get_valid_len
-      target/arm: Export aarch64_sve_zcr_get_valid_len
-      target/arm: Add sve-default-vector-length cpu property
- docs/system/arm/cpu-features.rst | 15 ++++++++++
- configure                        |  2 +-
- hw/arm/smmuv3-internal.h         |  2 +-
- target/arm/cpu.h                 |  5 ++++
- target/arm/internals.h           | 10 +++++++
- hw/arm/nseries.c                 |  2 +-
- hw/gpio/aspeed_gpio.c            |  3 +-
- hw/intc/armv7m_nvic.c            | 40 +++++++++++++++++++--------
- target/arm/cpu.c                 | 14 ++++++++--
- target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++++++++++
- target/arm/gdbstub.c             |  4 +++
- target/arm/helper.c              |  8 ++++--
- target/arm/m_helper.c            | 24 ++++++++++++----
- target/arm/translate.c           |  3 ++
- target/i386/cpu.c                |  2 +-
- MAINTAINERS                      |  2 +-
- qemu-options.hx                  | 30 +++++++++++---------
-files changed, 183 insertions(+), 43 deletions(-)

-New patch
+[PULL 01/25] include/hw/arm/allwinner-a10.h: Remove superfluous includes from the header
+From: Thomas Huth <thuth@redhat.com>
+pci_device.h is not needed at all in allwinner-a10.h, and serial.h
+is only needed by the corresponding .c file.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230215152233.210024-1-thuth@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/allwinner-a10.h | 2 --
+ hw/arm/allwinner-a10.c         | 1 +
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/allwinner-a10.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef HW_ARM_ALLWINNER_A10_H
+ #define HW_ARM_ALLWINNER_A10_H
+-#include "hw/char/serial.h"
+ #include "hw/arm/boot.h"
+-#include "hw/pci/pci_device.h"
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
+ #include "hw/net/allwinner_emac.h"
+diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/allwinner-a10.c
++++ b/hw/arm/allwinner-a10.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/module.h"
++#include "hw/char/serial.h"
+ #include "hw/sysbus.h"
+ #include "hw/arm/allwinner-a10.h"
+ #include "hw/misc/unimp.h"
+--
+.34.1

-[PULL 12/14] target/arm: Add sve-default-vector-length cpu property
+[PULL 02/25] target/arm: Wrap breakpoint/watchpoint updates with tcg_enabled
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Mirror the behavour of /proc/sys/abi/sve_default_vector_length
+This is in preparation for restricting compilation of some parts of
-under the real linux kernel.  We have no way of passing along
+debug_helper.c to TCG only.
 a real default across exec like the kernel can, but this is a
 decent way of adjusting the startup vector length of a process.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
 [PMM: tweaked docs formatting, document -1 special-case,
  added fixup patch from RTH mentioning QEMU's maximum veclen.]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/cpu-features.rst | 15 ++++++++
+ target/arm/cpu.c          |  6 ++++--
- target/arm/cpu.h                 |  5 +++
+ target/arm/debug_helper.c | 16 ++++++++++++----
- target/arm/cpu.c                 | 14 ++++++--
+ target/arm/machine.c      |  7 +++++--
- target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
+files changed, 21 insertions(+), 8 deletions(-)
 files changed, 92 insertions(+), 2 deletions(-)
-diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/cpu-features.rst
-+++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
- lengths is to explicitly enable each desired length.  Therefore only
- example's (1), (4), and (6) exhibit recommended uses of the properties.
-+SVE User-mode Default Vector Length Property
-+--------------------------------------------
-+
-+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
-+defined to mirror the Linux kernel parameter file
-+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
-+is in units of bytes and must be between 16 and 8192.
-+If not specified, the default vector length is 64.
-+
-+If the default length is larger than the maximum vector length enabled,
-+the actual vector length will be reduced.  Note that the maximum vector
-+length supported by QEMU is 256.
-+
-+If this property is set to ``-1`` then the default vector length
-+is set to the maximum possible length.
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-     /* Used to set the maximum vector length the cpu will support.  */
-     uint32_t sve_max_vq;
-+#ifdef CONFIG_USER_ONLY
-+    /* Used to set the default vector length at process start. */
-+    uint32_t sve_default_vq;
-+#endif
-+
-     /*
-      * In sve_vq_map each set bit is a supported vector length of
-      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
-         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
+     }
-         /* with reasonable vector length */
+ #endif
-         if (cpu_isar_feature(aa64_sve, cpu)) {
--            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+-    hw_breakpoint_update_all(cpu);
-+            env->vfp.zcr_el[1] =
+-    hw_watchpoint_update_all(cpu);
-+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
++    if (tcg_enabled()) {
-         }
++        hw_breakpoint_update_all(cpu);
-         /*
++        hw_watchpoint_update_all(cpu);
-          * Enable TBI0 but not TBI1.
++    }
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+     arm_rebuild_hflags(env);
-     QLIST_INIT(&cpu->pre_el_change_hooks);
+ }
-     QLIST_INIT(&cpu->el_change_hooks);
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_USER_ONLY
 +# ifdef TARGET_AARCH64
 +    /*
 +     * The linux kernel defaults to 512-bit vectors, when sve is supported.
 +     * See documentation for /proc/sys/abi/sve_default_vector_length, and
 +     * our corresponding sve-default-vector-length cpu property.
 +     */
 +    cpu->sve_default_vq = 4;
 +# endif
 +#else
      /* Our inbound IRQ and FIQ lines */
      if (kvm_enabled()) {
          /* VIRQ and VFIQ are unused with KVM but we add them to maintain
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/target/arm/debug_helper.c
-+++ b/target/arm/cpu64.c
++++ b/target/arm/debug_helper.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     cpu->isar.id_aa64pfr0 = t;
+     value &= ~3ULL;
      raw_write(env, ri, value);
 -    hw_watchpoint_update(cpu, i);
 +    if (tcg_enabled()) {
 +        hw_watchpoint_update(cpu, i);
 +    }
  }
-+#ifdef CONFIG_USER_ONLY
+ static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+@@ -XXX,XX +XXX,XX @@ static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+     int i = ri->crm;
-+                                            const char *name, void *opaque,
-+                                            Error **errp)
+     raw_write(env, ri, value);
-+{
+-    hw_watchpoint_update(cpu, i);
-+    ARMCPU *cpu = ARM_CPU(obj);
++    if (tcg_enabled()) {
-+    int32_t default_len, default_vq, remainder;
++        hw_watchpoint_update(cpu, i);
 +
 +    if (!visit_type_int32(v, name, &default_len, errp)) {
 +        return;
 +    }
-+
+ }
-+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
-+    if (default_len == -1) {
+ void hw_breakpoint_update(ARMCPU *cpu, int n)
-+        cpu->sve_default_vq = ARM_MAX_VQ;
+@@ -XXX,XX +XXX,XX @@ static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+        return;
+     int i = ri->crm;
      raw_write(env, ri, value);
 -    hw_breakpoint_update(cpu, i);
 +    if (tcg_enabled()) {
 +        hw_breakpoint_update(cpu, i);
 +    }
-+
+ }
-+    default_vq = default_len / 16;
-+    remainder = default_len % 16;
+ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+
+@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+    /*
+     value = deposit64(value, 8, 1, extract64(value, 7, 1));
-+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
-+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     raw_write(env, ri, value);
-+     */
+-    hw_breakpoint_update(cpu, i);
-+    if (remainder || default_vq < 1 || default_vq > 512) {
++    if (tcg_enabled()) {
-+        error_setg(errp, "cannot set sve-default-vector-length");
++        hw_breakpoint_update(cpu, i);
 +        if (remainder) {
 +            error_append_hint(errp, "Vector length not a multiple of 16\n");
 +        } else if (default_vq < 1) {
 +            error_append_hint(errp, "Vector length smaller than 16\n");
 +        } else {
 +            error_append_hint(errp, "Vector length larger than %d\n",
 +                              512 * 16);
 +        }
 +        return;
 +    }
-+
+ }
-+    cpu->sve_default_vq = default_vq;
-+}
+ void define_debug_regs(ARMCPU *cpu)
-+
+diff --git a/target/arm/machine.c b/target/arm/machine.c
-+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+index XXXXXXX..XXXXXXX 100644
-+                                            const char *name, void *opaque,
+--- a/target/arm/machine.c
-+                                            Error **errp)
++++ b/target/arm/machine.c
-+{
+@@ -XXX,XX +XXX,XX @@
-+    ARMCPU *cpu = ARM_CPU(obj);
+ #include "cpu.h"
-+    int32_t value = cpu->sve_default_vq * 16;
+ #include "qemu/error-report.h"
-+
+ #include "sysemu/kvm.h"
-+    visit_type_int32(v, name, &value, errp);
++#include "sysemu/tcg.h"
-+}
+ #include "kvm_arm.h"
-+#endif
+ #include "internals.h"
-+
+ #include "migration/cpu.h"
- void aarch64_add_sve_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
- {
+         return -1;
      uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
          object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                              cpu_arm_set_sve_vq, NULL, NULL);
      }
-+
-+#ifdef CONFIG_USER_ONLY
+-    hw_breakpoint_update_all(cpu);
-+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+-    hw_watchpoint_update_all(cpu);
-+    object_property_add(obj, "sve-default-vector-length", "int32",
++    if (tcg_enabled()) {
-+                        cpu_arm_get_sve_default_vec_len,
++        hw_breakpoint_update_all(cpu);
-+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
++        hw_watchpoint_update_all(cpu);
-+#endif
++    }
- }
+     /*
- void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+      * TCG gen_update_fp_context() relies on the invariant that
 --
-.20.1
+.34.1

-New patch
+[PULL 03/25] target/arm: Wrap TCG-only code in debug_helper.c
+From: Fabiano Rosas <farosas@suse.de>
+The next few patches will move helpers under CONFIG_TCG. We'd prefer
+to keep the debug helpers and debug registers close together, so
+rearrange the file a bit to be able to wrap the helpers with a TCG
+ifdef.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/debug_helper.c | 476 +++++++++++++++++++-------------------
+file changed, 239 insertions(+), 237 deletions(-)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpregs.h"
+ #include "exec/exec-all.h"
+ #include "exec/helper-proto.h"
++#include "sysemu/tcg.h"
+-
++#ifdef CONFIG_TCG
+ /* Return the Exception Level targeted by debug exceptions. */
+ static int arm_debug_target_el(CPUARMState *env)
+ {
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
+     raise_exception_debug(env, EXCP_UDEF, syndrome);
+ }
++void hw_watchpoint_update(ARMCPU *cpu, int n)
++{
++    CPUARMState *env = &cpu->env;
++    vaddr len = 0;
++    vaddr wvr = env->cp15.dbgwvr[n];
++    uint64_t wcr = env->cp15.dbgwcr[n];
++    int mask;
++    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
++
++    if (env->cpu_watchpoint[n]) {
++        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
++        env->cpu_watchpoint[n] = NULL;
++    }
++
++    if (!FIELD_EX64(wcr, DBGWCR, E)) {
++        /* E bit clear : watchpoint disabled */
++        return;
++    }
++
++    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
++    case 0:
++        /* LSC 00 is reserved and must behave as if the wp is disabled */
++        return;
++    case 1:
++        flags |= BP_MEM_READ;
++        break;
++    case 2:
++        flags |= BP_MEM_WRITE;
++        break;
++    case 3:
++        flags |= BP_MEM_ACCESS;
++        break;
++    }
++
++    /*
++     * Attempts to use both MASK and BAS fields simultaneously are
++     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
++     * thus generating a watchpoint for every byte in the masked region.
++     */
++    mask = FIELD_EX64(wcr, DBGWCR, MASK);
++    if (mask == 1 || mask == 2) {
++        /*
++         * Reserved values of MASK; we must act as if the mask value was
++         * some non-reserved value, or as if the watchpoint were disabled.
++         * We choose the latter.
++         */
++        return;
++    } else if (mask) {
++        /* Watchpoint covers an aligned area up to 2GB in size */
++        len = 1ULL << mask;
++        /*
++         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
++         * whether the watchpoint fires when the unmasked bits match; we opt
++         * to generate the exceptions.
++         */
++        wvr &= ~(len - 1);
++    } else {
++        /* Watchpoint covers bytes defined by the byte address select bits */
++        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
++        int basstart;
++
++        if (extract64(wvr, 2, 1)) {
++            /*
++             * Deprecated case of an only 4-aligned address. BAS[7:4] are
++             * ignored, and BAS[3:0] define which bytes to watch.
++             */
++            bas &= 0xf;
++        }
++
++        if (bas == 0) {
++            /* This must act as if the watchpoint is disabled */
++            return;
++        }
++
++        /*
++         * The BAS bits are supposed to be programmed to indicate a contiguous
++         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
++         * we fire for each byte in the word/doubleword addressed by the WVR.
++         * We choose to ignore any non-zero bits after the first range of 1s.
++         */
++        basstart = ctz32(bas);
++        len = cto32(bas >> basstart);
++        wvr += basstart;
++    }
++
++    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
++                          &env->cpu_watchpoint[n]);
++}
++
++void hw_watchpoint_update_all(ARMCPU *cpu)
++{
++    int i;
++    CPUARMState *env = &cpu->env;
++
++    /*
++     * Completely clear out existing QEMU watchpoints and our array, to
++     * avoid possible stale entries following migration load.
++     */
++    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
++    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
++
++    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
++        hw_watchpoint_update(cpu, i);
++    }
++}
++
++void hw_breakpoint_update(ARMCPU *cpu, int n)
++{
++    CPUARMState *env = &cpu->env;
++    uint64_t bvr = env->cp15.dbgbvr[n];
++    uint64_t bcr = env->cp15.dbgbcr[n];
++    vaddr addr;
++    int bt;
++    int flags = BP_CPU;
++
++    if (env->cpu_breakpoint[n]) {
++        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
++        env->cpu_breakpoint[n] = NULL;
++    }
++
++    if (!extract64(bcr, 0, 1)) {
++        /* E bit clear : watchpoint disabled */
++        return;
++    }
++
++    bt = extract64(bcr, 20, 4);
++
++    switch (bt) {
++    case 4: /* unlinked address mismatch (reserved if AArch64) */
++    case 5: /* linked address mismatch (reserved if AArch64) */
++        qemu_log_mask(LOG_UNIMP,
++                      "arm: address mismatch breakpoint types not implemented\n");
++        return;
++    case 0: /* unlinked address match */
++    case 1: /* linked address match */
++    {
++        /*
++         * Bits [1:0] are RES0.
++         *
++         * It is IMPLEMENTATION DEFINED whether bits [63:49]
++         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
++         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
++         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
++         * whether the RESS bits are ignored when comparing an address.
++         * Therefore we are allowed to compare the entire register, which
++         * lets us avoid considering whether FEAT_LVA is actually enabled.
++         *
++         * The BAS field is used to allow setting breakpoints on 16-bit
++         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
++         * a bp will fire if the addresses covered by the bp and the addresses
++         * covered by the insn overlap but the insn doesn't start at the
++         * start of the bp address range. We choose to require the insn and
++         * the bp to have the same address. The constraints on writing to
++         * BAS enforced in dbgbcr_write mean we have only four cases:
++         *  0b0000  => no breakpoint
++         *  0b0011  => breakpoint on addr
++         *  0b1100  => breakpoint on addr + 2
++         *  0b1111  => breakpoint on addr
++         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
++         */
++        int bas = extract64(bcr, 5, 4);
++        addr = bvr & ~3ULL;
++        if (bas == 0) {
++            return;
++        }
++        if (bas == 0xc) {
++            addr += 2;
++        }
++        break;
++    }
++    case 2: /* unlinked context ID match */
++    case 8: /* unlinked VMID match (reserved if no EL2) */
++    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
++        qemu_log_mask(LOG_UNIMP,
++                      "arm: unlinked context breakpoint types not implemented\n");
++        return;
++    case 9: /* linked VMID match (reserved if no EL2) */
++    case 11: /* linked context ID and VMID match (reserved if no EL2) */
++    case 3: /* linked context ID match */
++    default:
++        /*
++         * We must generate no events for Linked context matches (unless
++         * they are linked to by some other bp/wp, which is handled in
++         * updates for the linking bp/wp). We choose to also generate no events
++         * for reserved values.
++         */
++        return;
++    }
++
++    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
++}
++
++void hw_breakpoint_update_all(ARMCPU *cpu)
++{
++    int i;
++    CPUARMState *env = &cpu->env;
++
++    /*
++     * Completely clear out existing QEMU breakpoints and our array, to
++     * avoid possible stale entries following migration load.
++     */
++    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
++    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
++
++    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
++        hw_breakpoint_update(cpu, i);
++    }
++}
++
++#if !defined(CONFIG_USER_ONLY)
++
++vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
++{
++    ARMCPU *cpu = ARM_CPU(cs);
++    CPUARMState *env = &cpu->env;
++
++    /*
++     * In BE32 system mode, target memory is stored byteswapped (on a
++     * little-endian host system), and by the time we reach here (via an
++     * opcode helper) the addresses of subword accesses have been adjusted
++     * to account for that, which means that watchpoints will not match.
++     * Undo the adjustment here.
++     */
++    if (arm_sctlr_b(env)) {
++        if (len == 1) {
++            addr ^= 3;
++        } else if (len == 2) {
++            addr ^= 2;
++        }
++    }
++
++    return addr;
++}
++
++#endif /* !CONFIG_USER_ONLY */
++#endif /* CONFIG_TCG */
++
+ /*
+  * Check for traps to "powerdown debug" registers, which are controlled
+  * by MDCR.TDOSA
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
+       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+ };
+-void hw_watchpoint_update(ARMCPU *cpu, int n)
+-{
+-    CPUARMState *env = &cpu->env;
+-    vaddr len = 0;
+-    vaddr wvr = env->cp15.dbgwvr[n];
+-    uint64_t wcr = env->cp15.dbgwcr[n];
+-    int mask;
+-    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
+-
+-    if (env->cpu_watchpoint[n]) {
+-        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
+-        env->cpu_watchpoint[n] = NULL;
+-    }
+-
+-    if (!FIELD_EX64(wcr, DBGWCR, E)) {
+-        /* E bit clear : watchpoint disabled */
+-        return;
+-    }
+-
+-    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
+-    case 0:
+-        /* LSC 00 is reserved and must behave as if the wp is disabled */
+-        return;
+-    case 1:
+-        flags |= BP_MEM_READ;
+-        break;
+-    case 2:
+-        flags |= BP_MEM_WRITE;
+-        break;
+-    case 3:
+-        flags |= BP_MEM_ACCESS;
+-        break;
+-    }
+-
+-    /*
+-     * Attempts to use both MASK and BAS fields simultaneously are
+-     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
+-     * thus generating a watchpoint for every byte in the masked region.
+-     */
+-    mask = FIELD_EX64(wcr, DBGWCR, MASK);
+-    if (mask == 1 || mask == 2) {
+-        /*
+-         * Reserved values of MASK; we must act as if the mask value was
+-         * some non-reserved value, or as if the watchpoint were disabled.
+-         * We choose the latter.
+-         */
+-        return;
+-    } else if (mask) {
+-        /* Watchpoint covers an aligned area up to 2GB in size */
+-        len = 1ULL << mask;
+-        /*
+-         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
+-         * whether the watchpoint fires when the unmasked bits match; we opt
+-         * to generate the exceptions.
+-         */
+-        wvr &= ~(len - 1);
+-    } else {
+-        /* Watchpoint covers bytes defined by the byte address select bits */
+-        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
+-        int basstart;
+-
+-        if (extract64(wvr, 2, 1)) {
+-            /*
+-             * Deprecated case of an only 4-aligned address. BAS[7:4] are
+-             * ignored, and BAS[3:0] define which bytes to watch.
+-             */
+-            bas &= 0xf;
+-        }
+-
+-        if (bas == 0) {
+-            /* This must act as if the watchpoint is disabled */
+-            return;
+-        }
+-
+-        /*
+-         * The BAS bits are supposed to be programmed to indicate a contiguous
+-         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
+-         * we fire for each byte in the word/doubleword addressed by the WVR.
+-         * We choose to ignore any non-zero bits after the first range of 1s.
+-         */
+-        basstart = ctz32(bas);
+-        len = cto32(bas >> basstart);
+-        wvr += basstart;
+-    }
+-
+-    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
+-                          &env->cpu_watchpoint[n]);
+-}
+-
+-void hw_watchpoint_update_all(ARMCPU *cpu)
+-{
+-    int i;
+-    CPUARMState *env = &cpu->env;
+-
+-    /*
+-     * Completely clear out existing QEMU watchpoints and our array, to
+-     * avoid possible stale entries following migration load.
+-     */
+-    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
+-    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
+-
+-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
+-        hw_watchpoint_update(cpu, i);
+-    }
+-}
+-
+ static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                          uint64_t value)
+ {
+@@ -XXX,XX +XXX,XX @@ static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     }
+ }
+-void hw_breakpoint_update(ARMCPU *cpu, int n)
+-{
+-    CPUARMState *env = &cpu->env;
+-    uint64_t bvr = env->cp15.dbgbvr[n];
+-    uint64_t bcr = env->cp15.dbgbcr[n];
+-    vaddr addr;
+-    int bt;
+-    int flags = BP_CPU;
+-
+-    if (env->cpu_breakpoint[n]) {
+-        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
+-        env->cpu_breakpoint[n] = NULL;
+-    }
+-
+-    if (!extract64(bcr, 0, 1)) {
+-        /* E bit clear : watchpoint disabled */
+-        return;
+-    }
+-
+-    bt = extract64(bcr, 20, 4);
+-
+-    switch (bt) {
+-    case 4: /* unlinked address mismatch (reserved if AArch64) */
+-    case 5: /* linked address mismatch (reserved if AArch64) */
+-        qemu_log_mask(LOG_UNIMP,
+-                      "arm: address mismatch breakpoint types not implemented\n");
+-        return;
+-    case 0: /* unlinked address match */
+-    case 1: /* linked address match */
+-    {
+-        /*
+-         * Bits [1:0] are RES0.
+-         *
+-         * It is IMPLEMENTATION DEFINED whether bits [63:49]
+-         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
+-         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
+-         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
+-         * whether the RESS bits are ignored when comparing an address.
+-         * Therefore we are allowed to compare the entire register, which
+-         * lets us avoid considering whether FEAT_LVA is actually enabled.
+-         *
+-         * The BAS field is used to allow setting breakpoints on 16-bit
+-         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
+-         * a bp will fire if the addresses covered by the bp and the addresses
+-         * covered by the insn overlap but the insn doesn't start at the
+-         * start of the bp address range. We choose to require the insn and
+-         * the bp to have the same address. The constraints on writing to
+-         * BAS enforced in dbgbcr_write mean we have only four cases:
+-         *  0b0000  => no breakpoint
+-         *  0b0011  => breakpoint on addr
+-         *  0b1100  => breakpoint on addr + 2
+-         *  0b1111  => breakpoint on addr
+-         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
+-         */
+-        int bas = extract64(bcr, 5, 4);
+-        addr = bvr & ~3ULL;
+-        if (bas == 0) {
+-            return;
+-        }
+-        if (bas == 0xc) {
+-            addr += 2;
+-        }
+-        break;
+-    }
+-    case 2: /* unlinked context ID match */
+-    case 8: /* unlinked VMID match (reserved if no EL2) */
+-    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
+-        qemu_log_mask(LOG_UNIMP,
+-                      "arm: unlinked context breakpoint types not implemented\n");
+-        return;
+-    case 9: /* linked VMID match (reserved if no EL2) */
+-    case 11: /* linked context ID and VMID match (reserved if no EL2) */
+-    case 3: /* linked context ID match */
+-    default:
+-        /*
+-         * We must generate no events for Linked context matches (unless
+-         * they are linked to by some other bp/wp, which is handled in
+-         * updates for the linking bp/wp). We choose to also generate no events
+-         * for reserved values.
+-         */
+-        return;
+-    }
+-
+-    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
+-}
+-
+-void hw_breakpoint_update_all(ARMCPU *cpu)
+-{
+-    int i;
+-    CPUARMState *env = &cpu->env;
+-
+-    /*
+-     * Completely clear out existing QEMU breakpoints and our array, to
+-     * avoid possible stale entries following migration load.
+-     */
+-    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
+-    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
+-
+-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
+-        hw_breakpoint_update(cpu, i);
+-    }
+-}
+-
+ static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                          uint64_t value)
+ {
+@@ -XXX,XX +XXX,XX @@ void define_debug_regs(ARMCPU *cpu)
+         g_free(dbgwcr_el1_name);
+     }
+ }
+-
+-#if !defined(CONFIG_USER_ONLY)
+-
+-vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+-{
+-    ARMCPU *cpu = ARM_CPU(cs);
+-    CPUARMState *env = &cpu->env;
+-
+-    /*
+-     * In BE32 system mode, target memory is stored byteswapped (on a
+-     * little-endian host system), and by the time we reach here (via an
+-     * opcode helper) the addresses of subword accesses have been adjusted
+-     * to account for that, which means that watchpoints will not match.
+-     * Undo the adjustment here.
+-     */
+-    if (arm_sctlr_b(env)) {
+-        if (len == 1) {
+-            addr ^= 3;
+-        } else if (len == 2) {
+-            addr ^= 2;
+-        }
+-    }
+-
+-    return addr;
+-}
+-
+-#endif
+--
+.34.1

-[PULL 09/14] docs: Update path that mentions deprecated.rst
+[PULL 04/25] target/arm: move translate modules to tcg/
-From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+From: Fabiano Rosas <farosas@suse.de>
-Missed in commit f3478392 "docs: Move deprecation, build
+Introduce the target/arm/tcg directory. Its purpose is to hold the TCG
-and license info out of system/"
+code that is selected by CONFIG_TCG.
-Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- configure         | 2 +-
+ MAINTAINERS                             |  1 +
- target/i386/cpu.c | 2 +-
+ target/arm/{ => tcg}/translate-a64.h    |  0
- MAINTAINERS       | 2 +-
+ target/arm/{ => tcg}/translate.h        |  0
-files changed, 3 insertions(+), 3 deletions(-)
+ target/arm/{ => tcg}/a32-uncond.decode  |  0
+ target/arm/{ => tcg}/a32.decode         |  0
-diff --git a/configure b/configure
+ target/arm/{ => tcg}/m-nocp.decode      |  0
-index XXXXXXX..XXXXXXX 100755
+ target/arm/{ => tcg}/mve.decode         |  0
---- a/configure
+ target/arm/{ => tcg}/neon-dp.decode     |  0
-+++ b/configure
+ target/arm/{ => tcg}/neon-ls.decode     |  0
-@@ -XXX,XX +XXX,XX @@ fi
+ target/arm/{ => tcg}/neon-shared.decode |  0
+ target/arm/{ => tcg}/sme-fa64.decode    |  0
- if test -n "${deprecated_features}"; then
+ target/arm/{ => tcg}/sme.decode         |  0
-     echo "Warning, deprecated features enabled."
+ target/arm/{ => tcg}/sve.decode         |  0
--    echo "Please see docs/system/deprecated.rst"
+ target/arm/{ => tcg}/t16.decode         |  0
-+    echo "Please see docs/about/deprecated.rst"
+ target/arm/{ => tcg}/t32.decode         |  0
-     echo "  features: ${deprecated_features}"
+ target/arm/{ => tcg}/vfp-uncond.decode  |  0
- fi
+ target/arm/{ => tcg}/vfp.decode         |  0
+ target/arm/{ => tcg}/translate-a64.c    |  0
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+ target/arm/{ => tcg}/translate-m-nocp.c |  0
-index XXXXXXX..XXXXXXX 100644
+ target/arm/{ => tcg}/translate-mve.c    |  0
---- a/target/i386/cpu.c
+ target/arm/{ => tcg}/translate-neon.c   |  0
-+++ b/target/i386/cpu.c
+ target/arm/{ => tcg}/translate-sme.c    |  0
-@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
+ target/arm/{ => tcg}/translate-sve.c    |  0
-  * none", but this is just for compatibility while libvirt isn't
+ target/arm/{ => tcg}/translate-vfp.c    |  0
-  * adapted to resolve CPU model versions before creating VMs.
+ target/arm/{ => tcg}/translate.c        |  0
-  * See "Runnability guarantee of CPU models" at
+ target/arm/meson.build                  | 30 +++---------------
-- * docs/system/deprecated.rst.
+ target/arm/{ => tcg}/meson.build        | 41 +------------------------
-+ * docs/about/deprecated.rst.
+files changed, 6 insertions(+), 66 deletions(-)
-  */
+ rename target/arm/{ => tcg}/translate-a64.h (100%)
- X86CPUVersion default_cpu_version = 1;
+ rename target/arm/{ => tcg}/translate.h (100%)
+ rename target/arm/{ => tcg}/a32-uncond.decode (100%)
  rename target/arm/{ => tcg}/a32.decode (100%)
  rename target/arm/{ => tcg}/m-nocp.decode (100%)
  rename target/arm/{ => tcg}/mve.decode (100%)
  rename target/arm/{ => tcg}/neon-dp.decode (100%)
  rename target/arm/{ => tcg}/neon-ls.decode (100%)
  rename target/arm/{ => tcg}/neon-shared.decode (100%)
  rename target/arm/{ => tcg}/sme-fa64.decode (100%)
  rename target/arm/{ => tcg}/sme.decode (100%)
  rename target/arm/{ => tcg}/sve.decode (100%)
  rename target/arm/{ => tcg}/t16.decode (100%)
  rename target/arm/{ => tcg}/t32.decode (100%)
  rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
  rename target/arm/{ => tcg}/vfp.decode (100%)
  rename target/arm/{ => tcg}/translate-a64.c (100%)
  rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
  rename target/arm/{ => tcg}/translate-mve.c (100%)
  rename target/arm/{ => tcg}/translate-neon.c (100%)
  rename target/arm/{ => tcg}/translate-sme.c (100%)
  rename target/arm/{ => tcg}/translate-sve.c (100%)
  rename target/arm/{ => tcg}/translate-vfp.c (100%)
  rename target/arm/{ => tcg}/translate.c (100%)
  copy target/arm/{ => tcg}/meson.build (64%)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
+@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
+ L: qemu-arm@nongnu.org
- Incompatible changes
+ S: Maintained
- R: libvir-list@redhat.com
+ F: target/arm/
--F: docs/system/deprecated.rst
++F: target/arm/tcg/
-+F: docs/about/deprecated.rst
+ F: tests/tcg/arm/
+ F: tests/tcg/aarch64/
- Build System
+ F: tests/qtest/arm-cpu-features.c
- ------------
+diff --git a/target/arm/translate-a64.h b/target/arm/tcg/translate-a64.h
 similarity index 100%
 rename from target/arm/translate-a64.h
 rename to target/arm/tcg/translate-a64.h
 diff --git a/target/arm/translate.h b/target/arm/tcg/translate.h
 similarity index 100%
 rename from target/arm/translate.h
 rename to target/arm/tcg/translate.h
 diff --git a/target/arm/a32-uncond.decode b/target/arm/tcg/a32-uncond.decode
 similarity index 100%
 rename from target/arm/a32-uncond.decode
 rename to target/arm/tcg/a32-uncond.decode
 diff --git a/target/arm/a32.decode b/target/arm/tcg/a32.decode
 similarity index 100%
 rename from target/arm/a32.decode
 rename to target/arm/tcg/a32.decode
 diff --git a/target/arm/m-nocp.decode b/target/arm/tcg/m-nocp.decode
 similarity index 100%
 rename from target/arm/m-nocp.decode
 rename to target/arm/tcg/m-nocp.decode
 diff --git a/target/arm/mve.decode b/target/arm/tcg/mve.decode
 similarity index 100%
 rename from target/arm/mve.decode
 rename to target/arm/tcg/mve.decode
 diff --git a/target/arm/neon-dp.decode b/target/arm/tcg/neon-dp.decode
 similarity index 100%
 rename from target/arm/neon-dp.decode
 rename to target/arm/tcg/neon-dp.decode
 diff --git a/target/arm/neon-ls.decode b/target/arm/tcg/neon-ls.decode
 similarity index 100%
 rename from target/arm/neon-ls.decode
 rename to target/arm/tcg/neon-ls.decode
 diff --git a/target/arm/neon-shared.decode b/target/arm/tcg/neon-shared.decode
 similarity index 100%
 rename from target/arm/neon-shared.decode
 rename to target/arm/tcg/neon-shared.decode
 diff --git a/target/arm/sme-fa64.decode b/target/arm/tcg/sme-fa64.decode
 similarity index 100%
 rename from target/arm/sme-fa64.decode
 rename to target/arm/tcg/sme-fa64.decode
 diff --git a/target/arm/sme.decode b/target/arm/tcg/sme.decode
 similarity index 100%
 rename from target/arm/sme.decode
 rename to target/arm/tcg/sme.decode
 diff --git a/target/arm/sve.decode b/target/arm/tcg/sve.decode
 similarity index 100%
 rename from target/arm/sve.decode
 rename to target/arm/tcg/sve.decode
 diff --git a/target/arm/t16.decode b/target/arm/tcg/t16.decode
 similarity index 100%
 rename from target/arm/t16.decode
 rename to target/arm/tcg/t16.decode
 diff --git a/target/arm/t32.decode b/target/arm/tcg/t32.decode
 similarity index 100%
 rename from target/arm/t32.decode
 rename to target/arm/tcg/t32.decode
 diff --git a/target/arm/vfp-uncond.decode b/target/arm/tcg/vfp-uncond.decode
 similarity index 100%
 rename from target/arm/vfp-uncond.decode
 rename to target/arm/tcg/vfp-uncond.decode
 diff --git a/target/arm/vfp.decode b/target/arm/tcg/vfp.decode
 similarity index 100%
 rename from target/arm/vfp.decode
 rename to target/arm/tcg/vfp.decode
 diff --git a/target/arm/translate-a64.c b/target/arm/tcg/translate-a64.c
 similarity index 100%
 rename from target/arm/translate-a64.c
 rename to target/arm/tcg/translate-a64.c
 diff --git a/target/arm/translate-m-nocp.c b/target/arm/tcg/translate-m-nocp.c
 similarity index 100%
 rename from target/arm/translate-m-nocp.c
 rename to target/arm/tcg/translate-m-nocp.c
 diff --git a/target/arm/translate-mve.c b/target/arm/tcg/translate-mve.c
 similarity index 100%
 rename from target/arm/translate-mve.c
 rename to target/arm/tcg/translate-mve.c
 diff --git a/target/arm/translate-neon.c b/target/arm/tcg/translate-neon.c
 similarity index 100%
 rename from target/arm/translate-neon.c
 rename to target/arm/tcg/translate-neon.c
 diff --git a/target/arm/translate-sme.c b/target/arm/tcg/translate-sme.c
 similarity index 100%
 rename from target/arm/translate-sme.c
 rename to target/arm/tcg/translate-sme.c
 diff --git a/target/arm/translate-sve.c b/target/arm/tcg/translate-sve.c
 similarity index 100%
 rename from target/arm/translate-sve.c
 rename to target/arm/tcg/translate-sve.c
 diff --git a/target/arm/translate-vfp.c b/target/arm/tcg/translate-vfp.c
 similarity index 100%
 rename from target/arm/translate-vfp.c
 rename to target/arm/tcg/translate-vfp.c
 diff --git a/target/arm/translate.c b/target/arm/tcg/translate.c
 similarity index 100%
 rename from target/arm/translate.c
 rename to target/arm/tcg/translate.c
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
 -gen = [
 -  decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
 -  decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
 -  decodetree.process('sme-fa64.decode', extra_args: '--static-decode=disas_sme_fa64'),
 -  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
 -  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
 -  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
 -  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
 -  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
 -  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
 -  decodetree.process('mve.decode', extra_args: '--decode=disas_mve'),
 -  decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
 -  decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
 -  decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
 -  decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
 -]
 -
  arm_ss = ss.source_set()
 -arm_ss.add(gen)
  arm_ss.add(files(
    'cpu.c',
    'crypto_helper.c',
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'neon_helper.c',
    'op_helper.c',
    'tlb_helper.c',
 -  'translate.c',
 -  'translate-m-nocp.c',
 -  'translate-mve.c',
 -  'translate-neon.c',
 -  'translate-vfp.c',
    'vec_helper.c',
    'vfp_helper.c',
    'cpu_tcg.c',
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
    'pauth_helper.c',
    'sve_helper.c',
    'sme_helper.c',
 -  'translate-a64.c',
 -  'translate-sve.c',
 -  'translate-sme.c',
  ))
  arm_softmmu_ss = ss.source_set()
@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
  subdir('hvf')
 +if 'CONFIG_TCG' in config_all
 +   subdir('tcg')
 +endif
 +
  target_arch += {'arm': arm_ss}
  target_softmmu_arch += {'arm': arm_softmmu_ss}
 diff --git a/target/arm/meson.build b/target/arm/tcg/meson.build
 similarity index 64%
 copy from target/arm/meson.build
 copy to target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
    decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
  ]
 -arm_ss = ss.source_set()
  arm_ss.add(gen)
 +
  arm_ss.add(files(
 -  'cpu.c',
 -  'crypto_helper.c',
 -  'debug_helper.c',
 -  'gdbstub.c',
 -  'helper.c',
 -  'iwmmxt_helper.c',
 -  'm_helper.c',
 -  'mve_helper.c',
 -  'neon_helper.c',
 -  'op_helper.c',
 -  'tlb_helper.c',
    'translate.c',
    'translate-m-nocp.c',
    'translate-mve.c',
    'translate-neon.c',
    'translate-vfp.c',
 -  'vec_helper.c',
 -  'vfp_helper.c',
 -  'cpu_tcg.c',
  ))
 -arm_ss.add(zlib)
 -
 -arm_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c', 'kvm64.c'), if_false: files('kvm-stub.c'))
  arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 -  'cpu64.c',
 -  'gdbstub64.c',
 -  'helper-a64.c',
 -  'mte_helper.c',
 -  'pauth_helper.c',
 -  'sve_helper.c',
 -  'sme_helper.c',
    'translate-a64.c',
    'translate-sve.c',
    'translate-sme.c',
  ))
 -
 -arm_softmmu_ss = ss.source_set()
 -arm_softmmu_ss.add(files(
 -  'arch_dump.c',
 -  'arm-powerctl.c',
 -  'machine.c',
 -  'monitor.c',
 -  'psci.c',
 -  'ptw.c',
 -))
 -
 -subdir('hvf')
 -
 -target_arch += {'arm': arm_ss}
 -target_softmmu_arch += {'arm': arm_softmmu_ss}
 --
-.20.1
+.34.1

-New patch
+[PULL 05/25] target/arm: move helpers to tcg/
+From: Claudio Fontana <cfontana@suse.de>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/{ => tcg}/vec_internal.h  |  0
  target/arm/tcg-stubs.c               | 23 +++++++++++++++++++++++
  target/arm/{ => tcg}/crypto_helper.c |  0
  target/arm/{ => tcg}/helper-a64.c    |  0
  target/arm/{ => tcg}/iwmmxt_helper.c |  0
  target/arm/{ => tcg}/m_helper.c      |  0
  target/arm/{ => tcg}/mte_helper.c    |  0
  target/arm/{ => tcg}/mve_helper.c    |  0
  target/arm/{ => tcg}/neon_helper.c   |  0
  target/arm/{ => tcg}/op_helper.c     |  0
  target/arm/{ => tcg}/pauth_helper.c  |  0
  target/arm/{ => tcg}/sme_helper.c    |  0
  target/arm/{ => tcg}/sve_helper.c    |  0
  target/arm/{ => tcg}/tlb_helper.c    |  0
  target/arm/{ => tcg}/vec_helper.c    |  0
  target/arm/meson.build               | 15 ++-------------
  target/arm/tcg/meson.build           | 13 +++++++++++++
 files changed, 38 insertions(+), 13 deletions(-)
  rename target/arm/{ => tcg}/vec_internal.h (100%)
  create mode 100644 target/arm/tcg-stubs.c
  rename target/arm/{ => tcg}/crypto_helper.c (100%)
  rename target/arm/{ => tcg}/helper-a64.c (100%)
  rename target/arm/{ => tcg}/iwmmxt_helper.c (100%)
  rename target/arm/{ => tcg}/m_helper.c (100%)
  rename target/arm/{ => tcg}/mte_helper.c (100%)
  rename target/arm/{ => tcg}/mve_helper.c (100%)
  rename target/arm/{ => tcg}/neon_helper.c (100%)
  rename target/arm/{ => tcg}/op_helper.c (100%)
  rename target/arm/{ => tcg}/pauth_helper.c (100%)
  rename target/arm/{ => tcg}/sme_helper.c (100%)
  rename target/arm/{ => tcg}/sve_helper.c (100%)
  rename target/arm/{ => tcg}/tlb_helper.c (100%)
  rename target/arm/{ => tcg}/vec_helper.c (100%)
 diff --git a/target/arm/vec_internal.h b/target/arm/tcg/vec_internal.h
 similarity index 100%
 rename from target/arm/vec_internal.h
 rename to target/arm/tcg/vec_internal.h
 diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/tcg-stubs.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU ARM stubs for some TCG helper functions
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "internals.h"
 +
 +void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
 +{
 +    g_assert_not_reached();
 +}
 +
 +void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
 +                        uint32_t target_el, uintptr_t ra)
 +{
 +    g_assert_not_reached();
 +}
 diff --git a/target/arm/crypto_helper.c b/target/arm/tcg/crypto_helper.c
 similarity index 100%
 rename from target/arm/crypto_helper.c
 rename to target/arm/tcg/crypto_helper.c
 diff --git a/target/arm/helper-a64.c b/target/arm/tcg/helper-a64.c
 similarity index 100%
 rename from target/arm/helper-a64.c
 rename to target/arm/tcg/helper-a64.c
 diff --git a/target/arm/iwmmxt_helper.c b/target/arm/tcg/iwmmxt_helper.c
 similarity index 100%
 rename from target/arm/iwmmxt_helper.c
 rename to target/arm/tcg/iwmmxt_helper.c
 diff --git a/target/arm/m_helper.c b/target/arm/tcg/m_helper.c
 similarity index 100%
 rename from target/arm/m_helper.c
 rename to target/arm/tcg/m_helper.c
 diff --git a/target/arm/mte_helper.c b/target/arm/tcg/mte_helper.c
 similarity index 100%
 rename from target/arm/mte_helper.c
 rename to target/arm/tcg/mte_helper.c
 diff --git a/target/arm/mve_helper.c b/target/arm/tcg/mve_helper.c
 similarity index 100%
 rename from target/arm/mve_helper.c
 rename to target/arm/tcg/mve_helper.c
 diff --git a/target/arm/neon_helper.c b/target/arm/tcg/neon_helper.c
 similarity index 100%
 rename from target/arm/neon_helper.c
 rename to target/arm/tcg/neon_helper.c
 diff --git a/target/arm/op_helper.c b/target/arm/tcg/op_helper.c
 similarity index 100%
 rename from target/arm/op_helper.c
 rename to target/arm/tcg/op_helper.c
 diff --git a/target/arm/pauth_helper.c b/target/arm/tcg/pauth_helper.c
 similarity index 100%
 rename from target/arm/pauth_helper.c
 rename to target/arm/tcg/pauth_helper.c
 diff --git a/target/arm/sme_helper.c b/target/arm/tcg/sme_helper.c
 similarity index 100%
 rename from target/arm/sme_helper.c
 rename to target/arm/tcg/sme_helper.c
 diff --git a/target/arm/sve_helper.c b/target/arm/tcg/sve_helper.c
 similarity index 100%
 rename from target/arm/sve_helper.c
 rename to target/arm/tcg/sve_helper.c
 diff --git a/target/arm/tlb_helper.c b/target/arm/tcg/tlb_helper.c
 similarity index 100%
 rename from target/arm/tlb_helper.c
 rename to target/arm/tcg/tlb_helper.c
 diff --git a/target/arm/vec_helper.c b/target/arm/tcg/vec_helper.c
 similarity index 100%
 rename from target/arm/vec_helper.c
 rename to target/arm/tcg/vec_helper.c
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
  arm_ss = ss.source_set()
  arm_ss.add(files(
    'cpu.c',
 -  'crypto_helper.c',
    'debug_helper.c',
    'gdbstub.c',
    'helper.c',
 -  'iwmmxt_helper.c',
 -  'm_helper.c',
 -  'mve_helper.c',
 -  'neon_helper.c',
 -  'op_helper.c',
 -  'tlb_helper.c',
 -  'vec_helper.c',
    'vfp_helper.c',
    'cpu_tcg.c',
  ))
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c', 'kvm64.c'), if_false: fil
  arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
    'cpu64.c',
    'gdbstub64.c',
 -  'helper-a64.c',
 -  'mte_helper.c',
 -  'pauth_helper.c',
 -  'sve_helper.c',
 -  'sme_helper.c',
  ))
  arm_softmmu_ss = ss.source_set()
@@ -XXX,XX +XXX,XX @@ subdir('hvf')
  if 'CONFIG_TCG' in config_all
     subdir('tcg')
 +else
 +    arm_ss.add(files('tcg-stubs.c'))
  endif
  target_arch += {'arm': arm_ss}
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'translate-mve.c',
    'translate-neon.c',
    'translate-vfp.c',
 +  'crypto_helper.c',
 +  'iwmmxt_helper.c',
 +  'm_helper.c',
 +  'mve_helper.c',
 +  'neon_helper.c',
 +  'op_helper.c',
 +  'tlb_helper.c',
 +  'vec_helper.c',
  ))
  arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
    'translate-a64.c',
    'translate-sve.c',
    'translate-sme.c',
 +  'helper-a64.c',
 +  'mte_helper.c',
 +  'pauth_helper.c',
 +  'sme_helper.c',
 +  'sve_helper.c',
  ))
 --
 .34.1

-New patch
+[PULL 06/25] target/arm: Move psci.c into the tcg directory
+From: Claudio Fontana <cfontana@suse.de>
+Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/{ => tcg}/psci.c | 0
+ target/arm/meson.build      | 1 -
+ target/arm/tcg/meson.build  | 4 ++++
+files changed, 4 insertions(+), 1 deletion(-)
+ rename target/arm/{ => tcg}/psci.c (100%)
+diff --git a/target/arm/psci.c b/target/arm/tcg/psci.c
+similarity index 100%
+rename from target/arm/psci.c
+rename to target/arm/tcg/psci.c
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
+   'arm-powerctl.c',
+   'machine.c',
+   'monitor.c',
+-  'psci.c',
+   'ptw.c',
+ ))
+diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/meson.build
++++ b/target/arm/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+   'sme_helper.c',
+   'sve_helper.c',
+ ))
++
++arm_softmmu_ss.add(files(
++  'psci.c',
++))
+--
+.34.1

-[PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len
+[PULL 07/25] target/arm: Wrap arm_rebuild_hflags calls with tcg_enabled
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Currently, our only caller is sve_zcr_len_for_el, which has
+This is in preparation to moving the hflags code into its own file
-already masked the length extracted from ZCR_ELx, so the
+under the tcg/ directory.
-masking done here is a nop.  But we will shortly have uses
-from other locations, where the length will be unmasked.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Saturate the length to ARM_MAX_VQ instead of truncating to
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 the low 4 bits.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 4 +++-
+ hw/arm/boot.c             |  6 +++++-
-file changed, 3 insertions(+), 1 deletion(-)
+ hw/intc/armv7m_nvic.c     | 20 +++++++++++++-------
+ target/arm/arm-powerctl.c |  7 +++++--
  target/arm/cpu.c          |  3 ++-
  target/arm/helper.c       | 18 +++++++++++++-----
  target/arm/machine.c      |  5 ++++-
 files changed, 42 insertions(+), 17 deletions(-)
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/boot.h"
  #include "hw/arm/linux-boot-if.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/tcg.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/numa.h"
  #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                  info->secondary_cpu_reset_hook(cpu, info);
              }
          }
 -        arm_rebuild_hflags(env);
 +
 +        if (tcg_enabled()) {
 +            arm_rebuild_hflags(env);
 +        }
      }
  }
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/intc/armv7m_nvic.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
 +#include "sysemu/tcg.h"
  #include "sysemu/runstate.h"
  #include "target/arm/cpu.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
      /* This is UNPREDICTABLE; treat as RAZ/WI */
   exit_ok:
 -    /* Ensure any changes made are reflected in the cached hflags.  */
 -    arm_rebuild_hflags(&s->cpu->env);
 +    if (tcg_enabled()) {
 +        /* Ensure any changes made are reflected in the cached hflags. */
 +        arm_rebuild_hflags(&s->cpu->env);
 +    }
      return MEMTX_OK;
  }
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
          }
      }
 -    /*
 -     * We updated state that affects the CPU's MMUidx and thus its hflags;
 -     * and we can't guarantee that we run before the CPU reset function.
 -     */
 -    arm_rebuild_hflags(&s->cpu->env);
 +    if (tcg_enabled()) {
 +        /*
 +         * We updated state that affects the CPU's MMUidx and thus its
 +         * hflags; and we can't guarantee that we run before the CPU
 +         * reset function.
 +         */
 +        arm_rebuild_hflags(&s->cpu->env);
 +    }
  }
  static void nvic_systick_trigger(void *opaque, int n, int level)
 diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-powerctl.c
 +++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@
  #include "arm-powerctl.h"
  #include "qemu/log.h"
  #include "qemu/main-loop.h"
 +#include "sysemu/tcg.h"
  #ifndef DEBUG_ARM_POWERCTL
  #define DEBUG_ARM_POWERCTL 0
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
          target_cpu->env.regs[0] = info->context_id;
      }
 -    /* CP15 update requires rebuilding hflags */
 -    arm_rebuild_hflags(&target_cpu->env);
 +    if (tcg_enabled()) {
 +        /* CP15 update requires rebuilding hflags */
 +        arm_rebuild_hflags(&target_cpu->env);
 +    }
      /* Start the new CPU at the requested address */
      cpu_set_pc(target_cpu_state, info->entry);
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
      if (tcg_enabled()) {
          hw_breakpoint_update_all(cpu);
          hw_watchpoint_update_all(cpu);
 +
 +        arm_rebuild_hflags(env);
      }
 -    arm_rebuild_hflags(env);
  }
  #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
+     /* This may enable/disable the MMU, so do a TLB flush.  */
-     uint32_t end_len;
+     tlb_flush(CPU(cpu));
--    end_len = start_len &= 0xf;
+-    if (ri->type & ARM_CP_SUPPRESS_TB_END) {
-+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
++    if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) {
-+    end_len = start_len;
+         /*
-+
+          * Normally we would always end the TB on an SCTLR write; see the
-     if (!test_bit(start_len, cpu->sve_vq_map)) {
+          * comment in ARMCPRegInfo sctlr initialization below for why Xscale
-         end_len = find_last_bit(cpu->sve_vq_map, start_len);
+@@ -XXX,XX +XXX,XX @@ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
-         assert(end_len < start_len);
+         memset(env->zarray, 0, sizeof(env->zarray));
      }
 -    arm_rebuild_hflags(env);
 +    if (tcg_enabled()) {
 +        arm_rebuild_hflags(env);
 +    }
  }
  static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
      }
      mask &= ~CACHED_CPSR_BITS;
      env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 -    if (rebuild_hflags) {
 +    if (tcg_enabled() && rebuild_hflags) {
          arm_rebuild_hflags(env);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
          env->regs[14] = env->regs[15] + offset;
      }
      env->regs[15] = newpc;
 -    arm_rebuild_hflags(env);
 +
 +    if (tcg_enabled()) {
 +        arm_rebuild_hflags(env);
 +    }
  }
  static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
      pstate_write(env, PSTATE_DAIF | new_mode);
      env->aarch64 = true;
      aarch64_restore_sp(env, new_el);
 -    helper_rebuild_hflags_a64(env, new_el);
 +
 +    if (tcg_enabled()) {
 +        helper_rebuild_hflags_a64(env, new_el);
 +    }
      env->pc = addr;
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
      if (!kvm_enabled()) {
          pmu_op_finish(&cpu->env);
      }
 -    arm_rebuild_hflags(&cpu->env);
 +
 +    if (tcg_enabled()) {
 +        arm_rebuild_hflags(&cpu->env);
 +    }
      return 0;
  }
 --
-.20.1
+.34.1

-[PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len
+[PULL 08/25] target/arm: Move hflags code into the tcg directory
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Rename from sve_zcr_get_valid_len and make accessible
+The hflags are used only for TCG code, so introduce a new file
-from outside of helper.c.
+hflags.c to keep that code.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/internals.h     |   2 +
- target/arm/helper.c    |  4 ++--
+ target/arm/helper.c        | 393 +-----------------------------------
-files changed, 12 insertions(+), 2 deletions(-)
+ target/arm/tcg-stubs.c     |   4 +
  target/arm/tcg/hflags.c    | 403 +++++++++++++++++++++++++++++++++++++
  target/arm/tcg/meson.build |   1 +
 files changed, 411 insertions(+), 392 deletions(-)
  create mode 100644 target/arm/tcg/hflags.c
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
- void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
- #endif /* CONFIG_TCG */
+ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
+ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
-+/**
++int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx);
-+ * aarch64_sve_zcr_get_valid_len:
-+ * @cpu: cpu context
+ /* Determine if allocation tags are available.  */
-+ * @start_len: maximum len to consider
+ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
-+ *
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_fgt_active(CPUARMState *env, int el)
-+ * Return the maximum supported sve vector length <= @start_len.
+         (!arm_feature(env, ARM_FEATURE_EL3) || (env->cp15.scr_el3 & SCR_FGTEN));
-+ * Note that both @start_len and the return value are in units
+ }
-+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
-+ */
++void assert_hflags_rebuild_correctly(CPUARMState *env);
-+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
+ #endif
  enum arm_fprounding {
      FPROUNDING_TIEEVEN,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
+@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
      return 0;
  }
--static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+-/* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */
-+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+-static bool sme_fa64(CPUARMState *env, int el)
 -{
 -    if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) {
 -        return false;
 -    }
 -
 -    if (el <= 1 && !el_is_in_host(env, el)) {
 -        if (!FIELD_EX64(env->vfp.smcr_el[1], SMCR, FA64)) {
 -            return false;
 -        }
 -    }
 -    if (el <= 2 && arm_is_el2_enabled(env)) {
 -        if (!FIELD_EX64(env->vfp.smcr_el[2], SMCR, FA64)) {
 -            return false;
 -        }
 -    }
 -    if (arm_feature(env, ARM_FEATURE_EL3)) {
 -        if (!FIELD_EX64(env->vfp.smcr_el[3], SMCR, FA64)) {
 -            return false;
 -        }
 -    }
 -
 -    return true;
 -}
 -
  /*
   * Given that SVE is enabled, return the vector length for EL.
   */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
      }
  }
 -static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
 +int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
  {
-     uint32_t end_len;
+     if (regime_has_2_ranges(mmu_idx)) {
+         return extract64(tcr, 57, 2);
-@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
+@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
-         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+     return arm_mmu_idx_el(env, arm_current_el(env));
      }
 -    return sve_zcr_get_valid_len(cpu, zcr_len);
 +    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
  }
- static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+-static inline bool fgt_svc(CPUARMState *env, int el)
 -{
 -    /*
 -     * Assuming fine-grained-traps are active, return true if we
 -     * should be trapping on SVC instructions. Only AArch64 can
 -     * trap on an SVC at EL1, but we don't need to special-case this
 -     * because if this is AArch32 EL1 then arm_fgt_active() is false.
 -     * We also know el is 0 or 1.
 -     */
 -    return el == 0 ?
 -        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL0) :
 -        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL1);
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
 -                                           ARMMMUIdx mmu_idx,
 -                                           CPUARMTBFlags flags)
 -{
 -    DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
 -    DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
 -
 -    if (arm_singlestep_active(env)) {
 -        DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
 -    }
 -
 -    return flags;
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
 -                                              ARMMMUIdx mmu_idx,
 -                                              CPUARMTBFlags flags)
 -{
 -    bool sctlr_b = arm_sctlr_b(env);
 -
 -    if (sctlr_b) {
 -        DP_TBFLAG_A32(flags, SCTLR__B, 1);
 -    }
 -    if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
 -        DP_TBFLAG_ANY(flags, BE_DATA, 1);
 -    }
 -    DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
 -
 -    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
 -                                        ARMMMUIdx mmu_idx)
 -{
 -    CPUARMTBFlags flags = {};
 -    uint32_t ccr = env->v7m.ccr[env->v7m.secure];
 -
 -    /* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
 -    if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
 -        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 -    }
 -
 -    if (arm_v7m_is_handler_mode(env)) {
 -        DP_TBFLAG_M32(flags, HANDLER, 1);
 -    }
 -
 -    /*
 -     * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
 -     * is suppressing them because the requested execution priority
 -     * is less than 0.
 -     */
 -    if (arm_feature(env, ARM_FEATURE_V8) &&
 -        !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
 -          (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
 -        DP_TBFLAG_M32(flags, STACKCHECK, 1);
 -    }
 -
 -    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
 -        DP_TBFLAG_M32(flags, SECURE, 1);
 -    }
 -
 -    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
 -                                        ARMMMUIdx mmu_idx)
 -{
 -    CPUARMTBFlags flags = {};
 -    int el = arm_current_el(env);
 -
 -    if (arm_sctlr(env, el) & SCTLR_A) {
 -        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 -    }
 -
 -    if (arm_el_is_aa64(env, 1)) {
 -        DP_TBFLAG_A32(flags, VFPEN, 1);
 -    }
 -
 -    if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) &&
 -        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 -        DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
 -    }
 -
 -    if (arm_fgt_active(env, el)) {
 -        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
 -        if (fgt_svc(env, el)) {
 -            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
 -        }
 -    }
 -
 -    if (env->uncached_cpsr & CPSR_IL) {
 -        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
 -    }
 -
 -    /*
 -     * The SME exception we are testing for is raised via
 -     * AArch64.CheckFPAdvSIMDEnabled(), as called from
 -     * AArch32.CheckAdvSIMDOrFPEnabled().
 -     */
 -    if (el == 0
 -        && FIELD_EX64(env->svcr, SVCR, SM)
 -        && (!arm_is_el2_enabled(env)
 -            || (arm_el_is_aa64(env, 2) && !(env->cp15.hcr_el2 & HCR_TGE)))
 -        && arm_el_is_aa64(env, 1)
 -        && !sme_fa64(env, el)) {
 -        DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1);
 -    }
 -
 -    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
 -                                        ARMMMUIdx mmu_idx)
 -{
 -    CPUARMTBFlags flags = {};
 -    ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
 -    uint64_t tcr = regime_tcr(env, mmu_idx);
 -    uint64_t sctlr;
 -    int tbii, tbid;
 -
 -    DP_TBFLAG_ANY(flags, AARCH64_STATE, 1);
 -
 -    /* Get control bits for tagged addresses.  */
 -    tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
 -    tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
 -
 -    DP_TBFLAG_A64(flags, TBII, tbii);
 -    DP_TBFLAG_A64(flags, TBID, tbid);
 -
 -    if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
 -        int sve_el = sve_exception_el(env, el);
 -
 -        /*
 -         * If either FP or SVE are disabled, translator does not need len.
 -         * If SVE EL > FP EL, FP exception has precedence, and translator
 -         * does not need SVE EL.  Save potential re-translations by forcing
 -         * the unneeded data to zero.
 -         */
 -        if (fp_el != 0) {
 -            if (sve_el > fp_el) {
 -                sve_el = 0;
 -            }
 -        } else if (sve_el == 0) {
 -            DP_TBFLAG_A64(flags, VL, sve_vqm1_for_el(env, el));
 -        }
 -        DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
 -    }
 -    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
 -        int sme_el = sme_exception_el(env, el);
 -        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
 -
 -        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
 -        if (sme_el == 0) {
 -            /* Similarly, do not compute SVL if SME is disabled. */
 -            int svl = sve_vqm1_for_el_sm(env, el, true);
 -            DP_TBFLAG_A64(flags, SVL, svl);
 -            if (sm) {
 -                /* If SVE is disabled, we will not have set VL above. */
 -                DP_TBFLAG_A64(flags, VL, svl);
 -            }
 -        }
 -        if (sm) {
 -            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
 -            DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
 -        }
 -        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
 -    }
 -
 -    sctlr = regime_sctlr(env, stage1);
 -
 -    if (sctlr & SCTLR_A) {
 -        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 -    }
 -
 -    if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
 -        DP_TBFLAG_ANY(flags, BE_DATA, 1);
 -    }
 -
 -    if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
 -        /*
 -         * In order to save space in flags, we record only whether
 -         * pauth is "inactive", meaning all insns are implemented as
 -         * a nop, or "active" when some action must be performed.
 -         * The decision of which action to take is left to a helper.
 -         */
 -        if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
 -            DP_TBFLAG_A64(flags, PAUTH_ACTIVE, 1);
 -        }
 -    }
 -
 -    if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
 -        /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
 -        if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
 -            DP_TBFLAG_A64(flags, BT, 1);
 -        }
 -    }
 -
 -    /* Compute the condition for using AccType_UNPRIV for LDTR et al. */
 -    if (!(env->pstate & PSTATE_UAO)) {
 -        switch (mmu_idx) {
 -        case ARMMMUIdx_E10_1:
 -        case ARMMMUIdx_E10_1_PAN:
 -            /* TODO: ARMv8.3-NV */
 -            DP_TBFLAG_A64(flags, UNPRIV, 1);
 -            break;
 -        case ARMMMUIdx_E20_2:
 -        case ARMMMUIdx_E20_2_PAN:
 -            /*
 -             * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
 -             * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
 -             */
 -            if (env->cp15.hcr_el2 & HCR_TGE) {
 -                DP_TBFLAG_A64(flags, UNPRIV, 1);
 -            }
 -            break;
 -        default:
 -            break;
 -        }
 -    }
 -
 -    if (env->pstate & PSTATE_IL) {
 -        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
 -    }
 -
 -    if (arm_fgt_active(env, el)) {
 -        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
 -        if (FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, ERET)) {
 -            DP_TBFLAG_A64(flags, FGT_ERET, 1);
 -        }
 -        if (fgt_svc(env, el)) {
 -            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
 -        }
 -    }
 -
 -    if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
 -        /*
 -         * Set MTE_ACTIVE if any access may be Checked, and leave clear
 -         * if all accesses must be Unchecked:
 -         * 1) If no TBI, then there are no tags in the address to check,
 -         * 2) If Tag Check Override, then all accesses are Unchecked,
 -         * 3) If Tag Check Fail == 0, then Checked access have no effect,
 -         * 4) If no Allocation Tag Access, then all accesses are Unchecked.
 -         */
 -        if (allocation_tag_access_enabled(env, el, sctlr)) {
 -            DP_TBFLAG_A64(flags, ATA, 1);
 -            if (tbid
 -                && !(env->pstate & PSTATE_TCO)
 -                && (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {
 -                DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);
 -            }
 -        }
 -        /* And again for unprivileged accesses, if required.  */
 -        if (EX_TBFLAG_A64(flags, UNPRIV)
 -            && tbid
 -            && !(env->pstate & PSTATE_TCO)
 -            && (sctlr & SCTLR_TCF0)
 -            && allocation_tag_access_enabled(env, 0, sctlr)) {
 -            DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);
 -        }
 -        /* Cache TCMA as well as TBI. */
 -        DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
 -    }
 -
 -    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 -}
 -
 -static CPUARMTBFlags rebuild_hflags_internal(CPUARMState *env)
 -{
 -    int el = arm_current_el(env);
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -
 -    if (is_a64(env)) {
 -        return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 -    } else if (arm_feature(env, ARM_FEATURE_M)) {
 -        return rebuild_hflags_m32(env, fp_el, mmu_idx);
 -    } else {
 -        return rebuild_hflags_a32(env, fp_el, mmu_idx);
 -    }
 -}
 -
 -void arm_rebuild_hflags(CPUARMState *env)
 -{
 -    env->hflags = rebuild_hflags_internal(env);
 -}
 -
 -/*
 - * If we have triggered a EL state change we can't rely on the
 - * translator having passed it to us, we need to recompute.
 - */
 -void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
 -{
 -    int el = arm_current_el(env);
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -
 -    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
 -}
 -
 -void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
 -{
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -
 -    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
 -}
 -
 -/*
 - * If we have triggered a EL state change we can't rely on the
 - * translator having passed it to us, we need to recompute.
 - */
 -void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
 -{
 -    int el = arm_current_el(env);
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
 -}
 -
 -void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
 -{
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -
 -    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
 -}
 -
 -void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
 -{
 -    int fp_el = fp_exception_el(env, el);
 -    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 -
 -    env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 -}
 -
 -static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
 -{
 -#ifdef CONFIG_DEBUG_TCG
 -    CPUARMTBFlags c = env->hflags;
 -    CPUARMTBFlags r = rebuild_hflags_internal(env);
 -
 -    if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
 -        fprintf(stderr, "TCG hflags mismatch "
 -                        "(current:(0x%08x,0x" TARGET_FMT_lx ")"
 -                        " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
 -                c.flags, c.flags2, r.flags, r.flags2);
 -        abort();
 -    }
 -#endif
 -}
 -
  static bool mve_no_pred(CPUARMState *env)
  {
      /*
 diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg-stubs.c
 +++ b/target/arm/tcg-stubs.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
  {
      g_assert_not_reached();
  }
 +/* Temporarily while cpu_get_tb_cpu_state() is still in common code */
 +void assert_hflags_rebuild_correctly(CPUARMState *env)
 +{
 +}
 diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM hflags
 + *
 + * This code is licensed under the GNU GPL v2 or later.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "internals.h"
 +#include "exec/helper-proto.h"
 +#include "cpregs.h"
 +
 +static inline bool fgt_svc(CPUARMState *env, int el)
 +{
 +    /*
 +     * Assuming fine-grained-traps are active, return true if we
 +     * should be trapping on SVC instructions. Only AArch64 can
 +     * trap on an SVC at EL1, but we don't need to special-case this
 +     * because if this is AArch32 EL1 then arm_fgt_active() is false.
 +     * We also know el is 0 or 1.
 +     */
 +    return el == 0 ?
 +        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL0) :
 +        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL1);
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
 +                                           ARMMMUIdx mmu_idx,
 +                                           CPUARMTBFlags flags)
 +{
 +    DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
 +    DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
 +
 +    if (arm_singlestep_active(env)) {
 +        DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
 +    }
 +
 +    return flags;
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
 +                                              ARMMMUIdx mmu_idx,
 +                                              CPUARMTBFlags flags)
 +{
 +    bool sctlr_b = arm_sctlr_b(env);
 +
 +    if (sctlr_b) {
 +        DP_TBFLAG_A32(flags, SCTLR__B, 1);
 +    }
 +    if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
 +        DP_TBFLAG_ANY(flags, BE_DATA, 1);
 +    }
 +    DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
 +
 +    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
 +                                        ARMMMUIdx mmu_idx)
 +{
 +    CPUARMTBFlags flags = {};
 +    uint32_t ccr = env->v7m.ccr[env->v7m.secure];
 +
 +    /* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
 +    if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
 +        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 +    }
 +
 +    if (arm_v7m_is_handler_mode(env)) {
 +        DP_TBFLAG_M32(flags, HANDLER, 1);
 +    }
 +
 +    /*
 +     * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
 +     * is suppressing them because the requested execution priority
 +     * is less than 0.
 +     */
 +    if (arm_feature(env, ARM_FEATURE_V8) &&
 +        !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
 +          (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
 +        DP_TBFLAG_M32(flags, STACKCHECK, 1);
 +    }
 +
 +    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
 +        DP_TBFLAG_M32(flags, SECURE, 1);
 +    }
 +
 +    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 +}
 +
 +/* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */
 +static bool sme_fa64(CPUARMState *env, int el)
 +{
 +    if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) {
 +        return false;
 +    }
 +
 +    if (el <= 1 && !el_is_in_host(env, el)) {
 +        if (!FIELD_EX64(env->vfp.smcr_el[1], SMCR, FA64)) {
 +            return false;
 +        }
 +    }
 +    if (el <= 2 && arm_is_el2_enabled(env)) {
 +        if (!FIELD_EX64(env->vfp.smcr_el[2], SMCR, FA64)) {
 +            return false;
 +        }
 +    }
 +    if (arm_feature(env, ARM_FEATURE_EL3)) {
 +        if (!FIELD_EX64(env->vfp.smcr_el[3], SMCR, FA64)) {
 +            return false;
 +        }
 +    }
 +
 +    return true;
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
 +                                        ARMMMUIdx mmu_idx)
 +{
 +    CPUARMTBFlags flags = {};
 +    int el = arm_current_el(env);
 +
 +    if (arm_sctlr(env, el) & SCTLR_A) {
 +        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 +    }
 +
 +    if (arm_el_is_aa64(env, 1)) {
 +        DP_TBFLAG_A32(flags, VFPEN, 1);
 +    }
 +
 +    if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) &&
 +        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 +        DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
 +    }
 +
 +    if (arm_fgt_active(env, el)) {
 +        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
 +        if (fgt_svc(env, el)) {
 +            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
 +        }
 +    }
 +
 +    if (env->uncached_cpsr & CPSR_IL) {
 +        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
 +    }
 +
 +    /*
 +     * The SME exception we are testing for is raised via
 +     * AArch64.CheckFPAdvSIMDEnabled(), as called from
 +     * AArch32.CheckAdvSIMDOrFPEnabled().
 +     */
 +    if (el == 0
 +        && FIELD_EX64(env->svcr, SVCR, SM)
 +        && (!arm_is_el2_enabled(env)
 +            || (arm_el_is_aa64(env, 2) && !(env->cp15.hcr_el2 & HCR_TGE)))
 +        && arm_el_is_aa64(env, 1)
 +        && !sme_fa64(env, el)) {
 +        DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1);
 +    }
 +
 +    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
 +                                        ARMMMUIdx mmu_idx)
 +{
 +    CPUARMTBFlags flags = {};
 +    ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
 +    uint64_t sctlr;
 +    int tbii, tbid;
 +
 +    DP_TBFLAG_ANY(flags, AARCH64_STATE, 1);
 +
 +    /* Get control bits for tagged addresses.  */
 +    tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
 +    tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
 +
 +    DP_TBFLAG_A64(flags, TBII, tbii);
 +    DP_TBFLAG_A64(flags, TBID, tbid);
 +
 +    if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
 +        int sve_el = sve_exception_el(env, el);
 +
 +        /*
 +         * If either FP or SVE are disabled, translator does not need len.
 +         * If SVE EL > FP EL, FP exception has precedence, and translator
 +         * does not need SVE EL.  Save potential re-translations by forcing
 +         * the unneeded data to zero.
 +         */
 +        if (fp_el != 0) {
 +            if (sve_el > fp_el) {
 +                sve_el = 0;
 +            }
 +        } else if (sve_el == 0) {
 +            DP_TBFLAG_A64(flags, VL, sve_vqm1_for_el(env, el));
 +        }
 +        DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
 +    }
 +    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
 +        int sme_el = sme_exception_el(env, el);
 +        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
 +
 +        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
 +        if (sme_el == 0) {
 +            /* Similarly, do not compute SVL if SME is disabled. */
 +            int svl = sve_vqm1_for_el_sm(env, el, true);
 +            DP_TBFLAG_A64(flags, SVL, svl);
 +            if (sm) {
 +                /* If SVE is disabled, we will not have set VL above. */
 +                DP_TBFLAG_A64(flags, VL, svl);
 +            }
 +        }
 +        if (sm) {
 +            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
 +            DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
 +        }
 +        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
 +    }
 +
 +    sctlr = regime_sctlr(env, stage1);
 +
 +    if (sctlr & SCTLR_A) {
 +        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
 +    }
 +
 +    if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
 +        DP_TBFLAG_ANY(flags, BE_DATA, 1);
 +    }
 +
 +    if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
 +        /*
 +         * In order to save space in flags, we record only whether
 +         * pauth is "inactive", meaning all insns are implemented as
 +         * a nop, or "active" when some action must be performed.
 +         * The decision of which action to take is left to a helper.
 +         */
 +        if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
 +            DP_TBFLAG_A64(flags, PAUTH_ACTIVE, 1);
 +        }
 +    }
 +
 +    if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
 +        /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
 +        if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
 +            DP_TBFLAG_A64(flags, BT, 1);
 +        }
 +    }
 +
 +    /* Compute the condition for using AccType_UNPRIV for LDTR et al. */
 +    if (!(env->pstate & PSTATE_UAO)) {
 +        switch (mmu_idx) {
 +        case ARMMMUIdx_E10_1:
 +        case ARMMMUIdx_E10_1_PAN:
 +            /* TODO: ARMv8.3-NV */
 +            DP_TBFLAG_A64(flags, UNPRIV, 1);
 +            break;
 +        case ARMMMUIdx_E20_2:
 +        case ARMMMUIdx_E20_2_PAN:
 +            /*
 +             * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
 +             * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
 +             */
 +            if (env->cp15.hcr_el2 & HCR_TGE) {
 +                DP_TBFLAG_A64(flags, UNPRIV, 1);
 +            }
 +            break;
 +        default:
 +            break;
 +        }
 +    }
 +
 +    if (env->pstate & PSTATE_IL) {
 +        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
 +    }
 +
 +    if (arm_fgt_active(env, el)) {
 +        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
 +        if (FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, ERET)) {
 +            DP_TBFLAG_A64(flags, FGT_ERET, 1);
 +        }
 +        if (fgt_svc(env, el)) {
 +            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
 +        }
 +    }
 +
 +    if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
 +        /*
 +         * Set MTE_ACTIVE if any access may be Checked, and leave clear
 +         * if all accesses must be Unchecked:
 +         * 1) If no TBI, then there are no tags in the address to check,
 +         * 2) If Tag Check Override, then all accesses are Unchecked,
 +         * 3) If Tag Check Fail == 0, then Checked access have no effect,
 +         * 4) If no Allocation Tag Access, then all accesses are Unchecked.
 +         */
 +        if (allocation_tag_access_enabled(env, el, sctlr)) {
 +            DP_TBFLAG_A64(flags, ATA, 1);
 +            if (tbid
 +                && !(env->pstate & PSTATE_TCO)
 +                && (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {
 +                DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);
 +            }
 +        }
 +        /* And again for unprivileged accesses, if required.  */
 +        if (EX_TBFLAG_A64(flags, UNPRIV)
 +            && tbid
 +            && !(env->pstate & PSTATE_TCO)
 +            && (sctlr & SCTLR_TCF0)
 +            && allocation_tag_access_enabled(env, 0, sctlr)) {
 +            DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);
 +        }
 +        /* Cache TCMA as well as TBI. */
 +        DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
 +    }
 +
 +    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 +}
 +
 +static CPUARMTBFlags rebuild_hflags_internal(CPUARMState *env)
 +{
 +    int el = arm_current_el(env);
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +
 +    if (is_a64(env)) {
 +        return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 +    } else if (arm_feature(env, ARM_FEATURE_M)) {
 +        return rebuild_hflags_m32(env, fp_el, mmu_idx);
 +    } else {
 +        return rebuild_hflags_a32(env, fp_el, mmu_idx);
 +    }
 +}
 +
 +void arm_rebuild_hflags(CPUARMState *env)
 +{
 +    env->hflags = rebuild_hflags_internal(env);
 +}
 +
 +/*
 + * If we have triggered a EL state change we can't rely on the
 + * translator having passed it to us, we need to recompute.
 + */
 +void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
 +{
 +    int el = arm_current_el(env);
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +
 +    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
 +}
 +
 +void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
 +{
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +
 +    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
 +}
 +
 +/*
 + * If we have triggered a EL state change we can't rely on the
 + * translator having passed it to us, we need to recompute.
 + */
 +void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
 +{
 +    int el = arm_current_el(env);
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
 +}
 +
 +void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
 +{
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +
 +    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
 +}
 +
 +void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
 +{
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +
 +    env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 +}
 +
 +void assert_hflags_rebuild_correctly(CPUARMState *env)
 +{
 +#ifdef CONFIG_DEBUG_TCG
 +    CPUARMTBFlags c = env->hflags;
 +    CPUARMTBFlags r = rebuild_hflags_internal(env);
 +
 +    if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
 +        fprintf(stderr, "TCG hflags mismatch "
 +                        "(current:(0x%08x,0x" TARGET_FMT_lx ")"
 +                        " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
 +                c.flags, c.flags2, r.flags, r.flags2);
 +        abort();
 +    }
 +#endif
 +}
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
    'translate-neon.c',
    'translate-vfp.c',
    'crypto_helper.c',
 +  'hflags.c',
    'iwmmxt_helper.c',
    'm_helper.c',
    'mve_helper.c',
 --
-.20.1
+.34.1

-[PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
+[PULL 09/25] target/arm: Move regime_using_lpae_format into internal.h
-In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
+From: Fabiano Rosas <farosas@suse.de>
 the register is accessed NonSecure and the highest priority pending
 enabled exception (that would be returned in the VECTPENDING field)
 targets Secure, then the VECTPENDING field must read 1 rather than
 the exception number of the pending exception. Implement this.
+This function is needed by common code (ptw.c), so move it along with
+the other regime_* functions in internal.h. When we enable the build
+without TCG, the tlb_helper.c file will not be present.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
+ target/arm/internals.h      | 21 ++++++++++++++++++---
-file changed, 24 insertions(+), 7 deletions(-)
+ target/arm/tcg/tlb_helper.c | 18 ------------------
 files changed, 18 insertions(+), 21 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/internals.h
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
-     nvic_irq_update(s);
+ /* Return the MMU index for a v7M CPU in the specified security state */
  ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
 -/* Return true if the translation regime is using LPAE format page tables */
 -bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
 -
  /*
   * Return true if the stage 1 translation regime is using LPAE
   * format page tables
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
      return env->cp15.tcr_el[regime_el(env, mmu_idx)];
  }
-+static bool vectpending_targets_secure(NVICState *s)
++/* Return true if the translation regime is using LPAE format page tables */
 +static inline bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 +{
-+    /* Return true if s->vectpending targets Secure state */
++    int el = regime_el(env, mmu_idx);
-+    if (s->vectpending_is_s_banked) {
++    if (el == 2 || arm_el_is_aa64(env, el)) {
 +        return true;
 +    }
-+    return !exc_is_banked(s->vectpending) &&
++    if (arm_feature(env, ARM_FEATURE_PMSA) &&
-+        exc_targets_secure(s, s->vectpending);
++        arm_feature(env, ARM_FEATURE_V8)) {
 +        return true;
 +    }
 +    if (arm_feature(env, ARM_FEATURE_LPAE)
 +        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
 +        return true;
 +    }
 +    return false;
 +}
 +
- void armv7m_nvic_get_pending_irq_info(void *opaque,
+ /**
-                                       int *pirq, bool *ptargets_secure)
+  * arm_num_brps: Return number of implemented breakpoints.
- {
+  * Note that the ID register BRPS field is "number of bps - 1",
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
+diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
+index XXXXXXX..XXXXXXX 100644
-     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
+--- a/target/arm/tcg/tlb_helper.c
++++ b/target/arm/tcg/tlb_helper.c
--    if (s->vectpending_is_s_banked) {
+@@ -XXX,XX +XXX,XX @@
--        targets_secure = true;
+ #include "exec/helper-proto.h"
--    } else {
--        targets_secure = !exc_is_banked(pending) &&
--            exc_targets_secure(s, pending);
+-/* Return true if the translation regime is using LPAE format page tables */
 -bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 -{
 -    int el = regime_el(env, mmu_idx);
 -    if (el == 2 || arm_el_is_aa64(env, el)) {
 -        return true;
 -    }
-+    targets_secure = vectpending_targets_secure(s);
+-    if (arm_feature(env, ARM_FEATURE_PMSA) &&
+-        arm_feature(env, ARM_FEATURE_V8)) {
-     trace_nvic_get_pending_irq_info(pending, targets_secure);
+-        return true;
+-    }
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+-    if (arm_feature(env, ARM_FEATURE_LPAE)
-         /* VECTACTIVE */
+-        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
-         val = cpu->env.v7m.exception;
+-        return true;
-         /* VECTPENDING */
+-    }
--        val |= (s->vectpending & 0x1ff) << 12;
+-    return false;
-+        if (s->vectpending) {
+-}
-+            /*
+-
-+             * From v8.1M VECTPENDING must read as 1 if accessed as
+ /*
-+             * NonSecure and the highest priority pending and enabled
+  * Returns true if the stage 1 translation regime is using LPAE format page
-+             * exception targets Secure.
+  * tables. Used when raising alignment exceptions, whose FSR changes depending
 +             */
 +            int vp = s->vectpending;
 +            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
 +                vectpending_targets_secure(s)) {
 +                vp = 1;
 +            }
 +            val |= (vp & 0x1ff) << 12;
 +        }
          /* ISRPENDING - set if any external IRQ is pending */
          if (nvic_isrpending(s)) {
              val |= (1 << 22);
 --
-.20.1
+.34.1

-New patch
+[PULL 10/25] target/arm: Don't access TCG code when debugging with KVM
+From: Fabiano Rosas <farosas@suse.de>
+When TCG is disabled this part of the code should not be reachable, so
+wrap it with an ifdef for now.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
+         ptw->out_host = NULL;
+         ptw->out_rw = false;
+     } else {
++#ifdef CONFIG_TCG
+         CPUTLBEntryFull *full;
+         int flags;
+@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
+         ptw->out_rw = full->prot & PAGE_WRITE;
+         pte_attrs = full->pte_attrs;
+         pte_secure = full->attrs.secure;
++#else
++        g_assert_not_reached();
++#endif
+     }
+     if (regime_is_stage2(s2_mmu_idx)) {
+--
+.34.1

-New patch
+[PULL 11/25] cpu-defs.h: Expose CPUTLBEntryFull to non-TCG code
+From: Fabiano Rosas <farosas@suse.de>
+This struct has no dependencies on TCG code and it is being used in
+target/arm/ptw.c to simplify the passing around of page table walk
+results. Those routines can be reached by KVM code via the gdbstub
+breakpoint code, so take the structure out of CONFIG_TCG to make it
+visible when building with --disable-tcg.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/exec/cpu-defs.h | 6 ++++++
+file changed, 6 insertions(+)
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-defs.h
++++ b/include/exec/cpu-defs.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
+ QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
++
++#endif  /* !CONFIG_USER_ONLY && CONFIG_TCG */
++
++#if !defined(CONFIG_USER_ONLY)
+ /*
+  * The full TLB entry, which is not accessed by generated TCG code,
+  * so the layout is not as critical as that of CPUTLBEntry. This is
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
+     TARGET_PAGE_ENTRY_EXTRA
+ #endif
+ } CPUTLBEntryFull;
++#endif  /* !CONFIG_USER_ONLY */
++#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+ /*
+  * Data elements that are per MMU mode, minus the bits accessed by
+  * the TCG fast path.
+--
+.34.1

-New patch
+[PULL 12/25] tests/avocado: add machine:none tag to version.py
+From: Fabiano Rosas <farosas@suse.de>
+This test currently fails when run on a host for which the QEMU target
+has no default machine set:
+ERROR| Output: qemu-system-aarch64: No machine specified, and there is
+no default
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ tests/avocado/version.py | 1 +
+file changed, 1 insertion(+)
+diff --git a/tests/avocado/version.py b/tests/avocado/version.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/avocado/version.py
++++ b/tests/avocado/version.py
+@@ -XXX,XX +XXX,XX @@
+ class Version(QemuSystemTest):
+     """
+     :avocado: tags=quick
++    :avocado: tags=machine:none
+     """
+     def test_qmp_human_info_version(self):
+         self.vm.add_args('-nodefaults')
+--
+.34.1

-New patch
+[PULL 13/25] hw/gpio/max7310: Simplify max7310_realize()
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Since &I2C_SLAVE(dev)->qdev == dev, no need to go back and
+forth with QOM type casting. Directly use 'dev'.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230220115114.25237-2-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/gpio/max7310.c | 5 ++---
+file changed, 2 insertions(+), 3 deletions(-)
+diff --git a/hw/gpio/max7310.c b/hw/gpio/max7310.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/gpio/max7310.c
++++ b/hw/gpio/max7310.c
+@@ -XXX,XX +XXX,XX @@ static void max7310_gpio_set(void *opaque, int line, int level)
+  * but also accepts sequences that are not SMBus so return an I2C device.  */
+ static void max7310_realize(DeviceState *dev, Error **errp)
+ {
+-    I2CSlave *i2c = I2C_SLAVE(dev);
+     MAX7310State *s = MAX7310(dev);
+-    qdev_init_gpio_in(&i2c->qdev, max7310_gpio_set, 8);
+-    qdev_init_gpio_out(&i2c->qdev, s->handler, 8);
++    qdev_init_gpio_in(dev, max7310_gpio_set, ARRAY_SIZE(s->handler));
++    qdev_init_gpio_out(dev, s->handler, ARRAY_SIZE(s->handler));
+ }
+ static void max7310_class_init(ObjectClass *klass, void *data)
+--
+.34.1

-New patch
+[PULL 14/25] hw/char/pl011: Un-inline pl011_create()
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+pl011_create() is only used in DeviceRealize handlers,
+not a hot-path. Inlining is not justified.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230220115114.25237-3-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/pl011.h | 19 +------------------
+ hw/char/pl011.c         | 17 +++++++++++++++++
+files changed, 18 insertions(+), 18 deletions(-)
+diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/pl011.h
++++ b/include/hw/char/pl011.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef HW_PL011_H
+ #define HW_PL011_H
+-#include "hw/qdev-properties.h"
+ #include "hw/sysbus.h"
+ #include "chardev/char-fe.h"
+-#include "qapi/error.h"
+ #include "qom/object.h"
+ #define TYPE_PL011 "pl011"
+@@ -XXX,XX +XXX,XX @@ struct PL011State {
+     const unsigned char *id;
+ };
+-static inline DeviceState *pl011_create(hwaddr addr,
+-                                        qemu_irq irq,
+-                                        Chardev *chr)
+-{
+-    DeviceState *dev;
+-    SysBusDevice *s;
+-
+-    dev = qdev_new("pl011");
+-    s = SYS_BUS_DEVICE(dev);
+-    qdev_prop_set_chr(dev, "chardev", chr);
+-    sysbus_realize_and_unref(s, &error_fatal);
+-    sysbus_mmio_map(s, 0, addr);
+-    sysbus_connect_irq(s, 0, irq);
+-
+-    return dev;
+-}
++DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr);
+ static inline DeviceState *pl011_luminary_create(hwaddr addr,
+                                                  qemu_irq irq,
+diff --git a/hw/char/pl011.c b/hw/char/pl011.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/pl011.c
++++ b/hw/char/pl011.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
++#include "qapi/error.h"
+ #include "hw/char/pl011.h"
+ #include "hw/irq.h"
+ #include "hw/sysbus.h"
+ #include "hw/qdev-clock.h"
++#include "hw/qdev-properties.h"
+ #include "hw/qdev-properties-system.h"
+ #include "migration/vmstate.h"
+ #include "chardev/char-fe.h"
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/module.h"
+ #include "trace.h"
++DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr)
++{
++    DeviceState *dev;
++    SysBusDevice *s;
++
++    dev = qdev_new("pl011");
++    s = SYS_BUS_DEVICE(dev);
++    qdev_prop_set_chr(dev, "chardev", chr);
++    sysbus_realize_and_unref(s, &error_fatal);
++    sysbus_mmio_map(s, 0, addr);
++    sysbus_connect_irq(s, 0, irq);
++
++    return dev;
++}
++
+ #define PL011_INT_TX 0x20
+ #define PL011_INT_RX 0x10
+--
+.34.1

-New patch
+[PULL 15/25] hw/char/pl011: Open-code pl011_luminary_create()
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+pl011_luminary_create() is only used for the Stellaris board,
+open-code it.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230220115114.25237-4-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/pl011.h | 17 -----------------
+ hw/arm/stellaris.c      | 11 ++++++++---
+files changed, 8 insertions(+), 20 deletions(-)
+diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/pl011.h
++++ b/include/hw/char/pl011.h
+@@ -XXX,XX +XXX,XX @@ struct PL011State {
+ DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr);
+-static inline DeviceState *pl011_luminary_create(hwaddr addr,
+-                                                 qemu_irq irq,
+-                                                 Chardev *chr)
+-{
+-    DeviceState *dev;
+-    SysBusDevice *s;
+-
+-    dev = qdev_new("pl011_luminary");
+-    s = SYS_BUS_DEVICE(dev);
+-    qdev_prop_set_chr(dev, "chardev", chr);
+-    sysbus_realize_and_unref(s, &error_fatal);
+-    sysbus_mmio_map(s, 0, addr);
+-    sysbus_connect_irq(s, 0, irq);
+-
+-    return dev;
+-}
+-
+ #endif
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+     for (i = 0; i < 4; i++) {
+         if (board->dc2 & (1 << i)) {
+-            pl011_luminary_create(0x4000c000 + i * 0x1000,
+-                                  qdev_get_gpio_in(nvic, uart_irq[i]),
+-                                  serial_hd(i));
++            SysBusDevice *sbd;
++
++            dev = qdev_new("pl011_luminary");
++            sbd = SYS_BUS_DEVICE(dev);
++            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
++            sysbus_realize_and_unref(sbd, &error_fatal);
++            sysbus_mmio_map(sbd, 0, 0x4000c000 + i * 0x1000);
++            sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
+         }
+     }
+     if (board->dc2 & (1 << 4)) {
+--
+.34.1

-[PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest
+[PULL 16/25] hw/char/xilinx_uartlite: Expose XILINX_UARTLITE QOM type
-For M-profile, we weren't reporting alignment faults triggered by the
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 generic TCG code correctly to the guest.  These get passed into
 arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
 style exception.fsr value of 1.  We didn't check for this, and so
 they fell through into the default of "assume this is an MPU fault"
 and were reported to the guest as a data access violation MPU fault.
-Report these alignment faults as UsageFaults which set the UNALIGNED
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-bit in the UFSR.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230220115114.25237-5-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/char/xilinx_uartlite.h | 6 +++++-
  hw/char/xilinx_uartlite.c         | 4 +---
 files changed, 6 insertions(+), 4 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/include/hw/char/xilinx_uartlite.h b/include/hw/char/xilinx_uartlite.h
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
 ---
  target/arm/m_helper.c | 8 ++++++++
 file changed, 8 insertions(+)
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/hw/char/xilinx_uartlite.h
-+++ b/target/arm/m_helper.c
++++ b/include/hw/char/xilinx_uartlite.h
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@
-         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
+ #include "hw/qdev-properties.h"
-         break;
+ #include "hw/sysbus.h"
-     case EXCP_UNALIGNED:
+ #include "qapi/error.h"
-+        /* Unaligned faults reported by M-profile aware code */
++#include "qom/object.h"
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
++
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
++#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
-         break;
++OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-             }
+ static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
-             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+                                         qemu_irq irq,
-             break;
+@@ -XXX,XX +XXX,XX @@ static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
-+        case 0x1: /* Alignment fault reported by generic code */
+     DeviceState *dev;
-+            qemu_log_mask(CPU_LOG_INT,
+     SysBusDevice *s;
-+                          "...really UsageFault with UFSR.UNALIGNED\n");
-+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+-    dev = qdev_new("xlnx.xps-uartlite");
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
++    dev = qdev_new(TYPE_XILINX_UARTLITE);
-+                                    env->v7m.secure);
+     s = SYS_BUS_DEVICE(dev);
-+            break;
+     qdev_prop_set_chr(dev, "chardev", chr);
-         default:
+     sysbus_realize_and_unref(s, &error_fatal);
-             /*
+diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
-              * All other FSR values are either MPU faults or "can't happen
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/xilinx_uartlite.c
 +++ b/hw/char/xilinx_uartlite.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/log.h"
 +#include "hw/char/xilinx_uartlite.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
  #include "hw/qdev-properties-system.h"
@@ -XXX,XX +XXX,XX @@
  #define CONTROL_RST_RX    0x02
  #define CONTROL_IE        0x10
 -#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
 -OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
 -
  struct XilinxUARTLite {
      SysBusDevice parent_obj;
 --
-.20.1
+.34.1

-[PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken()
+[PULL 17/25] hw/char/xilinx_uartlite: Open-code xilinx_uartlite_create()
-In do_v7m_exception_exit(), we perform various checks as part of
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 performing the exception return.  If one of these checks fails, the
 architecture requires that we take an appropriate exception on the
 existing stackframe.  We implement this by calling
 v7m_exception_taken() to set up to take the new exception, and then
 immediately returning from do_v7m_exception_exit() without proceeding
 any further with the unstack-and-exception-return process.
-In a couple of checks that are new in v8.1M, we forgot the "return"
+Open-code the single use of xilinx_uartlite_create().
 statement, with the effect that if bad code in the guest tripped over
 these checks we would set up to take a UsageFault exception but then
 blunder on trying to also unstack and return from the original
 exception, with the probable result that the guest would crash.
-Add the missing return statements.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230220115114.25237-6-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/char/xilinx_uartlite.h        | 20 --------------------
  hw/microblaze/petalogix_s3adsp1800_mmu.c |  7 +++++--
 files changed, 5 insertions(+), 22 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/include/hw/char/xilinx_uartlite.h b/include/hw/char/xilinx_uartlite.h
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
 ---
  target/arm/m_helper.c | 2 ++
 file changed, 2 insertions(+)
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/hw/char/xilinx_uartlite.h
-+++ b/target/arm/m_helper.c
++++ b/include/hw/char/xilinx_uartlite.h
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@
-                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+ #ifndef XILINX_UARTLITE_H
-                         "stackframe: NSACR prevents clearing FPU registers\n");
+ #define XILINX_UARTLITE_H
-                     v7m_exception_taken(cpu, excret, true, false);
-+                    return;
+-#include "hw/qdev-properties.h"
-                 } else if (!cpacr_pass) {
+-#include "hw/sysbus.h"
-                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+-#include "qapi/error.h"
-                                             exc_secure);
+ #include "qom/object.h"
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+ #define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
-                         "stackframe: CPACR prevents clearing FPU registers\n");
+ OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
-                     v7m_exception_taken(cpu, excret, true, false);
-+                    return;
+-static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
-                 }
+-                                        qemu_irq irq,
-             }
+-                                        Chardev *chr)
-             /* Clear s0..s15, FPSCR and VPR */
+-{
 -    DeviceState *dev;
 -    SysBusDevice *s;
 -
 -    dev = qdev_new(TYPE_XILINX_UARTLITE);
 -    s = SYS_BUS_DEVICE(dev);
 -    qdev_prop_set_chr(dev, "chardev", chr);
 -    sysbus_realize_and_unref(s, &error_fatal);
 -    sysbus_mmio_map(s, 0, addr);
 -    sysbus_connect_irq(s, 0, irq);
 -
 -    return dev;
 -}
 -
  #endif
 diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
 +++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -XXX,XX +XXX,XX @@ petalogix_s3adsp1800_init(MachineState *machine)
          irq[i] = qdev_get_gpio_in(dev, i);
      }
 -    xilinx_uartlite_create(UARTLITE_BASEADDR, irq[UARTLITE_IRQ],
 -                           serial_hd(0));
 +    dev = qdev_new(TYPE_XILINX_UARTLITE);
 +    qdev_prop_set_chr(dev, "chardev", serial_hd(0));
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, UARTLITE_BASEADDR);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[UARTLITE_IRQ]);
      /* 2 timers at irq 2 @ 62 Mhz.  */
      dev = qdev_new("xlnx.xps-timer");
 --
-.20.1
+.34.1

-[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero
+[PULL 18/25] hw/char/cmsdk-apb-uart: Open-code cmsdk_apb_uart_create()
-For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 RES0H, which is to say that they must be hardwired to zero so that
 guest attempts to write non-zero values to them are ignored.
-Implement this behaviour by masking out the low bits:
+cmsdk_apb_uart_create() is only used twice in the same
- * for writes to r13 by the gdbstub
+file. Open-code it.
  * for writes to any of the various flavours of SP via MSR
  * for writes to r13 via store_reg() in generated code
-Note that all the direct uses of cpu_R[] in translate.c are in places
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-where the register is definitely not r13 (usually because that has
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
+Message-id: 20230220115114.25237-7-philmd@linaro.org
-UNDEF).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/char/cmsdk-apb-uart.h | 34 --------------------------
  hw/arm/mps2.c                    | 41 +++++++++++++++++++++-----------
 files changed, 27 insertions(+), 48 deletions(-)
-All the other writes to regs[13] in C code are either:
+diff --git a/include/hw/char/cmsdk-apb-uart.h b/include/hw/char/cmsdk-apb-uart.h
  * A-profile only code
  * writes of values we can guarantee to be aligned, such as
    - writes of previous-SP-value plus or minus a 4-aligned constant
    - writes of the value in an SP limit register (which we already
      enforce to be aligned)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
 ---
  target/arm/gdbstub.c   |  4 ++++
  target/arm/m_helper.c  | 14 ++++++++------
  target/arm/translate.c |  3 +++
 files changed, 15 insertions(+), 6 deletions(-)
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
+--- a/include/hw/char/cmsdk-apb-uart.h
-+++ b/target/arm/gdbstub.c
++++ b/include/hw/char/cmsdk-apb-uart.h
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+@@ -XXX,XX +XXX,XX @@
+ #ifndef CMSDK_APB_UART_H
-     if (n < 16) {
+ #define CMSDK_APB_UART_H
-         /* Core integer register.  */
-+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+-#include "hw/qdev-properties.h"
-+            /* M profile SP low bits are always 0 */
+ #include "hw/sysbus.h"
-+            tmp &= ~3;
+ #include "chardev/char-fe.h"
-+        }
+-#include "qapi/error.h"
-         env->regs[n] = tmp;
+ #include "qom/object.h"
-         return 4;
-     }
+ #define TYPE_CMSDK_APB_UART "cmsdk-apb-uart"
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBUART {
      uint8_t rxbuf;
  };
 -/**
 - * cmsdk_apb_uart_create - convenience function to create TYPE_CMSDK_APB_UART
 - * @addr: location in system memory to map registers
 - * @chr: Chardev backend to connect UART to, or NULL if no backend
 - * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
 - */
 -static inline DeviceState *cmsdk_apb_uart_create(hwaddr addr,
 -                                                 qemu_irq txint,
 -                                                 qemu_irq rxint,
 -                                                 qemu_irq txovrint,
 -                                                 qemu_irq rxovrint,
 -                                                 qemu_irq uartint,
 -                                                 Chardev *chr,
 -                                                 uint32_t pclk_frq)
 -{
 -    DeviceState *dev;
 -    SysBusDevice *s;
 -
 -    dev = qdev_new(TYPE_CMSDK_APB_UART);
 -    s = SYS_BUS_DEVICE(dev);
 -    qdev_prop_set_chr(dev, "chardev", chr);
 -    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
 -    sysbus_realize_and_unref(s, &error_fatal);
 -    sysbus_mmio_map(s, 0, addr);
 -    sysbus_connect_irq(s, 0, txint);
 -    sysbus_connect_irq(s, 1, rxint);
 -    sysbus_connect_irq(s, 2, txovrint);
 -    sysbus_connect_irq(s, 3, rxovrint);
 -    sysbus_connect_irq(s, 4, uartint);
 -    return dev;
 -}
 -
  #endif
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/hw/arm/mps2.c
-+++ b/target/arm/m_helper.c
++++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+@@ -XXX,XX +XXX,XX @@
-             if (!env->v7m.secure) {
+ #include "hw/boards.h"
-                 return;
+ #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 +#include "hw/qdev-properties.h"
  #include "hw/misc/unimp.h"
  #include "hw/char/cmsdk-apb-uart.h"
  #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
          qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
          for (i = 0; i < 5; i++) {
 +            DeviceState *dev;
 +            SysBusDevice *s;
 +
              static const hwaddr uartbase[] = {0x40004000, 0x40005000,
 x40006000, 0x40007000,
 x40009000};
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                  rxovrint = qdev_get_gpio_in(orgate_dev, i * 2 + 1);
              }
--            env->v7m.other_ss_msp = val;
-+            env->v7m.other_ss_msp = val & ~3;
+-            cmsdk_apb_uart_create(uartbase[i],
-             return;
+-                                  qdev_get_gpio_in(armv7m, uartirq[i] + 1),
-         case 0x89: /* PSP_NS */
+-                                  qdev_get_gpio_in(armv7m, uartirq[i]),
-             if (!env->v7m.secure) {
+-                                  txovrint, rxovrint,
-                 return;
+-                                  NULL,
-             }
+-                                  serial_hd(i), SYSCLK_FRQ);
--            env->v7m.other_ss_psp = val;
++            dev = qdev_new(TYPE_CMSDK_APB_UART);
-+            env->v7m.other_ss_psp = val & ~3;
++            s = SYS_BUS_DEVICE(dev);
-             return;
++            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
-         case 0x8a: /* MSPLIM_NS */
++            qdev_prop_set_uint32(dev, "pclk-frq", SYSCLK_FRQ);
-             if (!env->v7m.secure) {
++            sysbus_realize_and_unref(s, &error_fatal);
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
++            sysbus_mmio_map(s, 0, uartbase[i]);
++            sysbus_connect_irq(s, 0, qdev_get_gpio_in(armv7m, uartirq[i] + 1));
-             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
++            sysbus_connect_irq(s, 1, qdev_get_gpio_in(armv7m, uartirq[i]));
++            sysbus_connect_irq(s, 2, txovrint);
-+            val &= ~0x3;
++            sysbus_connect_irq(s, 3, rxovrint);
 +
              if (val < limit) {
                  raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
              }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
          break;
      case 8: /* MSP */
          if (v7m_using_psp(env)) {
 -            env->v7m.other_sp = val;
 +            env->v7m.other_sp = val & ~3;
          } else {
 -            env->regs[13] = val;
 +            env->regs[13] = val & ~3;
          }
          break;
-     case 9: /* PSP */
+     }
-         if (v7m_using_psp(env)) {
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
--            env->regs[13] = val;
+x4002c000, 0x4002d000,
-+            env->regs[13] = val & ~3;
+x4002e000};
-         } else {
+             Object *txrx_orgate;
--            env->v7m.other_sp = val;
+-            DeviceState *txrx_orgate_dev;
-+            env->v7m.other_sp = val & ~3;
++            DeviceState *txrx_orgate_dev, *dev;
 +            SysBusDevice *s;
              txrx_orgate = object_new(TYPE_OR_IRQ);
              object_property_set_int(txrx_orgate, "num-lines", 2, &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
              txrx_orgate_dev = DEVICE(txrx_orgate);
              qdev_connect_gpio_out(txrx_orgate_dev, 0,
                                    qdev_get_gpio_in(armv7m, uart_txrx_irqno[i]));
 -            cmsdk_apb_uart_create(uartbase[i],
 -                                  qdev_get_gpio_in(txrx_orgate_dev, 0),
 -                                  qdev_get_gpio_in(txrx_orgate_dev, 1),
 -                                  qdev_get_gpio_in(orgate_dev, i * 2),
 -                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
 -                                  NULL,
 -                                  serial_hd(i), SYSCLK_FRQ);
 +
 +            dev = qdev_new(TYPE_CMSDK_APB_UART);
 +            s = SYS_BUS_DEVICE(dev);
 +            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
 +            qdev_prop_set_uint32(dev, "pclk-frq", SYSCLK_FRQ);
 +            sysbus_realize_and_unref(s, &error_fatal);
 +            sysbus_mmio_map(s, 0, uartbase[i]);
 +            sysbus_connect_irq(s, 0, qdev_get_gpio_in(txrx_orgate_dev, 0));
 +            sysbus_connect_irq(s, 1, qdev_get_gpio_in(txrx_orgate_dev, 1));
 +            sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
 +            sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
          }
          break;
-     case 10: /* MSPLIM */
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
-          */
-         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
-         s->base.is_jmp = DISAS_JUMP;
-+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
-+        /* For M-profile SP bits [1:0] are always zero */
-+        tcg_gen_andi_i32(var, var, ~3);
      }
-     tcg_gen_mov_i32(cpu_R[reg], var);
-     tcg_temp_free_i32(var);
 --
-.20.1
+.34.1

-[PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option
+[PULL 19/25] hw/timer/cmsdk-apb-timer: Remove unused 'qdev-properties.h' header
-The documentation of the -machine memory-backend has some minor
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 formatting errors:
  * Misindentation of the initial line meant that the whole option
    section is incorrectly indented in the HTML output compared to
    the other -machine options
  * The examples weren't indented, which meant that they were formatted
    as plain run-on text including outputting the "::" as text.
  * The a) b) list has no rst-format markup so it is rendered as
    a single run-on paragraph
-Fix the formatting.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20230220115114.25237-8-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/timer/cmsdk-apb-timer.h | 1 -
 file changed, 1 deletion(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
 ---
  qemu-options.hx | 30 +++++++++++++++++-------------
 file changed, 17 insertions(+), 13 deletions(-)
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/include/hw/timer/cmsdk-apb-timer.h
-+++ b/qemu-options.hx
++++ b/include/hw/timer/cmsdk-apb-timer.h
-@@ -XXX,XX +XXX,XX @@ SRST
+@@ -XXX,XX +XXX,XX @@
-         Enables or disables ACPI Heterogeneous Memory Attribute Table
+ #ifndef CMSDK_APB_TIMER_H
-         (HMAT) support. The default is off.
+ #define CMSDK_APB_TIMER_H
--     ``memory-backend='id'``
+-#include "hw/qdev-properties.h"
-+    ``memory-backend='id'``
+ #include "hw/sysbus.h"
-         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
+ #include "hw/ptimer.h"
-         Allows to use a memory backend as main RAM.
+ #include "hw/clock.h"
          For example:
          ::
 -        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
 -        -machine memory-backend=pc.ram
 -        -m 512M
 +
 +            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
 +            -machine memory-backend=pc.ram
 +            -m 512M
          Migration compatibility note:
 -        a) as backend id one shall use value of 'default-ram-id', advertised by
 -        machine type (available via ``query-machines`` QMP command), if migration
 -        to/from old QEMU (<5.0) is expected.
 -        b) for machine types 4.0 and older, user shall
 -        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
 -        if migration to/from old QEMU (<5.0) is expected.
 +
 +        * as backend id one shall use value of 'default-ram-id', advertised by
 +          machine type (available via ``query-machines`` QMP command), if migration
 +          to/from old QEMU (<5.0) is expected.
 +        * for machine types 4.0 and older, user shall
 +          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
 +          if migration to/from old QEMU (<5.0) is expected.
 +
          For example:
          ::
 -        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
 -        -machine memory-backend=pc.ram
 -        -m 512M
 +
 +            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
 +            -machine memory-backend=pc.ram
 +            -m 512M
  ERST
  HXCOMM Deprecated by -machine
 --
-.20.1
+.34.1

-[PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
+[PULL 20/25] hw/intc/armv7m_nvic: Use QOM cast CPU() macro
-The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 the register.  We were incorrectly masking it to 8 bits, so it would
 report the wrong value if the pending exception was greater than 256.
 Fix the bug.
+Avoid accessing 'parent_obj' directly.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230220115114.25237-9-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 2 +-
+ hw/intc/armv7m_nvic.c | 6 +++---
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
-         /* VECTACTIVE */
+              * which saves having to have an extra argument is_terminal
-         val = cpu->env.v7m.exception;
+              * that we'd only use in one place.
-         /* VECTPENDING */
+              */
--        val |= (s->vectpending & 0xff) << 12;
+-            cpu_abort(&s->cpu->parent_obj,
-+        val |= (s->vectpending & 0x1ff) << 12;
++            cpu_abort(CPU(s->cpu),
-         /* ISRPENDING - set if any external IRQ is pending */
+                       "Lockup: can't take terminal derived exception "
-         if (nvic_isrpending(s)) {
+                       "(original exception priority %d)\n",
-             val |= (1 << 22);
+                       s->vectpending_prio);
@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
                   * Lockup condition due to a guest bug. We don't model
                   * Lockup, so report via cpu_abort() instead.
                   */
 -                cpu_abort(&s->cpu->parent_obj,
 +                cpu_abort(CPU(s->cpu),
                            "Lockup: can't escalate %d to HardFault "
                            "(current priority %d)\n", irq, running);
              }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure)
               * We want to escalate to HardFault but the context the
               * FP state belongs to prevents the exception pre-empting.
               */
 -            cpu_abort(&s->cpu->parent_obj,
 +            cpu_abort(CPU(s->cpu),
                        "Lockup: can't escalate to HardFault during "
                        "lazy FP register stacking\n");
          }
 --
-.20.1
+.34.1

-[PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix
+[PULL 21/25] hw/arm/musicpal: Remove unused dummy MemoryRegion
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210726150953.1218690-1-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/nseries.c | 2 +-
+ hw/arm/musicpal.c | 4 ----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 4 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/hw/arm/musicpal.c
-+++ b/hw/arm/nseries.c
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
+@@ -XXX,XX +XXX,XX @@ struct musicpal_key_state {
-     default:
+     SysBusDevice parent_obj;
-     bad_cmd:
+     /*< public >*/
-         qemu_log_mask(LOG_GUEST_ERROR,
--                      "%s: unknown command %02x\n", __func__, s->cmd);
+-    MemoryRegion iomem;
-+                      "%s: unknown command 0x%02x\n", __func__, s->cmd);
+     uint32_t kbd_extended;
-         break;
+     uint32_t pressed_keys;
-     }
+     qemu_irq out[8];
@@ -XXX,XX +XXX,XX @@ static void musicpal_key_init(Object *obj)
      DeviceState *dev = DEVICE(sbd);
      musicpal_key_state *s = MUSICPAL_KEY(dev);
 -    memory_region_init(&s->iomem, obj, "dummy", 0);
 -    sysbus_init_mmio(sbd, &s->iomem);
 -
      s->kbd_extended = 0;
      s->pressed_keys = 0;
 --
-.20.1
+.34.1

-[PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid
+[PULL 22/25] iothread: Remove unused IOThreadClass / IOTHREAD_CLASS
-From: Joe Komlodi <joe.komlodi@xilinx.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The bit to see if a CD is valid is the last bit of the first word of the CD.
+Since commit be8d853766 ("iothread: add I/O thread object") we
 never used IOThreadClass / IOTHREAD_CLASS() / IOTHREAD_GET_CLASS(),
 remove these definitions.
-Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20230113200138.52869-2-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 2 +-
+ iothread.c | 4 ----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 4 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/iothread.c b/iothread.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/iothread.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/iothread.c
-@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/rcu.h"
- /* CD fields */
+ #include "qemu/main-loop.h"
--#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
+-typedef ObjectClass IOThreadClass;
-+#define CD_VALID(x)   extract32((x)->word[0], 31, 1)
+-
- #define CD_ASID(x)    extract32((x)->word[1], 16, 16)
+-DECLARE_CLASS_CHECKERS(IOThreadClass, IOTHREAD,
- #define CD_TTB(x, sel)                                      \
+-                       TYPE_IOTHREAD)
-     ({                                                      \
  #ifdef CONFIG_POSIX
  /* Benchmark results from 2016 on NVMe SSD drives show max polling times around
 --
-.20.1
+.34.1

-[PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+[PULL 23/25] hw/irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
-The ISCR.ISRPENDING bit is set when an external interrupt is pending.
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 This is true whether that external interrupt is enabled or not.
 This means that we can't use 's->vectpending == 0' as a shortcut to
 "ISRPENDING is zero", because s->vectpending indicates only the
 highest priority pending enabled interrupt.
-Remove the incorrect optimization so that if there is no pending
+QOM *DECLARE* macros expect a typedef as first argument,
-enabled interrupt we fall through to scanning through the whole
+not a structure. Replace 'struct IRQState' by 'IRQState'
-interrupt array.
+to avoid when modifying the macros:
+  ../hw/core/irq.c:29:1: error: declaration of anonymous struct must be a definition
+  DECLARE_INSTANCE_CHECKER(struct IRQState, IRQ,
+  ^
+Use OBJECT_DECLARE_SIMPLE_TYPE instead of DECLARE_INSTANCE_CHECKER.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20230113200138.52869-3-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 9 ++++-----
+ hw/core/irq.c | 9 ++++-----
 file changed, 4 insertions(+), 5 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/hw/core/irq.c b/hw/core/irq.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/hw/core/irq.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/hw/core/irq.c
-@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
+@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "qom/object.h"
 -DECLARE_INSTANCE_CHECKER(struct IRQState, IRQ,
 -                         TYPE_IRQ)
 +OBJECT_DECLARE_SIMPLE_TYPE(IRQState, IRQ)
  struct IRQState {
      Object parent_obj;
@@ -XXX,XX +XXX,XX @@ qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n)
  qemu_irq qemu_allocate_irq(qemu_irq_handler handler, void *opaque, int n)
  {
-     int irq;
+-    struct IRQState *irq;
++    IRQState *irq;
--    /* We can shortcut if the highest priority pending interrupt
--     * happens to be external or if there is nothing pending.
+     irq = IRQ(object_new(TYPE_IRQ));
-+    /*
+     irq->handler = handler;
-+     * We can shortcut if the highest priority pending interrupt
+@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq)
-+     * happens to be external; if not we need to check the whole
-+     * vectors[] array.
+ static void qemu_notirq(void *opaque, int line, int level)
-      */
+ {
-     if (s->vectpending > NVIC_FIRST_IRQ) {
+-    struct IRQState *irq = opaque;
-         return true;
++    IRQState *irq = opaque;
-     }
--    if (s->vectpending == 0) {
+     irq->handler(irq->opaque, irq->n, !level);
--        return false;
+ }
--    }
+@@ -XXX,XX +XXX,XX @@ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
+ static const TypeInfo irq_type_info = {
-     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
+    .name = TYPE_IRQ,
-         if (s->vectors[irq].pending) {
+    .parent = TYPE_OBJECT,
 -   .instance_size = sizeof(struct IRQState),
 +   .instance_size = sizeof(IRQState),
  };
  static void irq_register_types(void)
 --
-.20.1
+.34.1

-[PULL 14/14] hw: aspeed_gpio: Fix memory size
+[PULL 24/25] hw/or-irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
-From: Joel Stanley <joel@jms.id.au>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The macro used to calculate the maximum memory size of the MMIO region
+Missed during automatic conversion from commit 8063396bf3
-had a mistake, causing all GPIO models to create a mapping of 0x9D8.
+("Use OBJECT_DECLARE_SIMPLE_TYPE when possible").
 The intent was to have it be 0x9D8 - 0x800.
-This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-region set aside for the GPIO controller.
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
+Message-id: 20230113200138.52869-4-philmd@linaro.org
 regions would overlap. Worse was the 1.8V controller would map over the
 top of the following peripheral, which happens to be the RTC.
 The mmio region used by each device is a maximum of 2KB, so avoid the
 calculations and hard code this as the maximum.
 Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20210713065854.134634-2-joel@jms.id.au
 [PMM: fix autocorrect error in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/gpio/aspeed_gpio.c | 3 +--
+ include/hw/or-irq.h | 3 +--
 file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
+diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/aspeed_gpio.c
+--- a/include/hw/or-irq.h
-+++ b/hw/gpio/aspeed_gpio.c
++++ b/include/hw/or-irq.h
 @@ -XXX,XX +XXX,XX @@
- #define GPIO_1_8V_MEM_SIZE            0x9D8
- #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
+ typedef struct OrIRQState qemu_or_irq;
-                                       GPIO_1_8V_REG_OFFSET) >> 2)
--#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
+-DECLARE_INSTANCE_CHECKER(qemu_or_irq, OR_IRQ,
+-                         TYPE_OR_IRQ)
- static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
++OBJECT_DECLARE_SIMPLE_TYPE(OrIRQState, OR_IRQ)
- {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
+ struct OrIRQState {
-     }
+     DeviceState parent_obj;
      memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
 -            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
 +            TYPE_ASPEED_GPIO, 0x800);
      sysbus_init_mmio(sbd, &s->iomem);
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 25/25] hw: Replace qemu_or_irq typedef by OrIRQState
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 OBJECT_DECLARE_SIMPLE_TYPE() macro provides the OrIRQState
 declaration for free. Besides, the QOM code style is to use
 the structure name as typedef, and QEMU style is to use Camel
 Case, so rename qemu_or_irq as OrIRQState.
 Mechanical change using:
   $ sed -i -e 's/qemu_or_irq/OrIRQState/g' $(git grep -l qemu_or_irq)
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20230113200138.52869-5-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/armsse.h              |  6 +++---
  include/hw/arm/bcm2835_peripherals.h |  2 +-
  include/hw/arm/exynos4210.h          |  4 ++--
  include/hw/arm/stm32f205_soc.h       |  2 +-
  include/hw/arm/stm32f405_soc.h       |  2 +-
  include/hw/arm/xlnx-versal.h         |  6 +++---
  include/hw/arm/xlnx-zynqmp.h         |  2 +-
  include/hw/or-irq.h                  |  2 --
  hw/arm/exynos4210.c                  |  4 ++--
  hw/arm/mps2-tz.c                     |  2 +-
  hw/core/or-irq.c                     | 18 +++++++++---------
  hw/pci-host/raven.c                  |  2 +-
 files changed, 25 insertions(+), 27 deletions(-)
 diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/armsse.h
 +++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
      TZPPC apb_ppc[NUM_INTERNAL_PPCS];
      TZMPC mpc[IOTS_NUM_MPC];
      CMSDKAPBTimer timer[3];
 -    qemu_or_irq ppc_irq_orgate;
 +    OrIRQState ppc_irq_orgate;
      SplitIRQ sec_resp_splitter;
      SplitIRQ ppc_irq_splitter[NUM_PPCS];
      SplitIRQ mpc_irq_splitter[IOTS_NUM_EXP_MPC + IOTS_NUM_MPC];
 -    qemu_or_irq mpc_irq_orgate;
 -    qemu_or_irq nmi_orgate;
 +    OrIRQState mpc_irq_orgate;
 +    OrIRQState nmi_orgate;
      SplitIRQ cpu_irq_splitter[NUM_SSE_IRQS];
 diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/bcm2835_peripherals.h
 +++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
      BCM2835AuxState aux;
      BCM2835FBState fb;
      BCM2835DMAState dma;
 -    qemu_or_irq orgated_dma_irq;
 +    OrIRQState orgated_dma_irq;
      BCM2835ICState ic;
      BCM2835PropertyState property;
      BCM2835RngState rng;
 diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/exynos4210.h
 +++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      MemoryRegion boot_secondary;
      MemoryRegion bootreg_mem;
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 -    qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
 -    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
 +    OrIRQState pl330_irq_orgate[EXYNOS4210_NUM_DMA];
 +    OrIRQState cpu_irq_orgate[EXYNOS4210_NCPUS];
      A9MPPrivState a9mpcore;
      Exynos4210GicState ext_gic;
      Exynos4210CombinerState int_combiner;
 diff --git a/include/hw/arm/stm32f205_soc.h b/include/hw/arm/stm32f205_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/stm32f205_soc.h
 +++ b/include/hw/arm/stm32f205_soc.h
@@ -XXX,XX +XXX,XX @@ struct STM32F205State {
      STM32F2XXADCState adc[STM_NUM_ADCS];
      STM32F2XXSPIState spi[STM_NUM_SPIS];
 -    qemu_or_irq *adc_irqs;
 +    OrIRQState *adc_irqs;
      MemoryRegion sram;
      MemoryRegion flash;
 diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/stm32f405_soc.h
 +++ b/include/hw/arm/stm32f405_soc.h
@@ -XXX,XX +XXX,XX @@ struct STM32F405State {
      STM32F4xxExtiState exti;
      STM32F2XXUsartState usart[STM_NUM_USARTS];
      STM32F2XXTimerState timer[STM_NUM_TIMERS];
 -    qemu_or_irq adc_irqs;
 +    OrIRQState adc_irqs;
      STM32F2XXADCState adc[STM_NUM_ADCS];
      STM32F2XXSPIState spi[STM_NUM_SPIS];
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/xlnx-versal.h
 +++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ struct Versal {
          } rpu;
          struct {
 -            qemu_or_irq irq_orgate;
 +            OrIRQState irq_orgate;
              XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
          } xram;
@@ -XXX,XX +XXX,XX @@ struct Versal {
                  XlnxCSUDMA dma_src;
                  XlnxCSUDMA dma_dst;
                  MemoryRegion linear_mr;
 -                qemu_or_irq irq_orgate;
 +                OrIRQState irq_orgate;
              } ospi;
          } iou;
@@ -XXX,XX +XXX,XX @@ struct Versal {
          XlnxVersalEFuseCtrl efuse_ctrl;
          XlnxVersalEFuseCache efuse_cache;
 -        qemu_or_irq apb_irq_orgate;
 +        OrIRQState apb_irq_orgate;
      } pmc;
      struct {
 diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/xlnx-zynqmp.h
 +++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
      XlnxZDMA gdma[XLNX_ZYNQMP_NUM_GDMA_CH];
      XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
      XlnxCSUDMA qspi_dma;
 -    qemu_or_irq qspi_irq_orgate;
 +    OrIRQState qspi_irq_orgate;
      XlnxZynqMPAPUCtrl apu_ctrl;
      XlnxZynqMPCRF crf;
      CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
 diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/or-irq.h
 +++ b/include/hw/or-irq.h
@@ -XXX,XX +XXX,XX @@
   */
  #define MAX_OR_LINES      48
 -typedef struct OrIRQState qemu_or_irq;
 -
  OBJECT_DECLARE_SIMPLE_TYPE(OrIRQState, OR_IRQ)
  struct OrIRQState {
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
 -static DeviceState *pl330_create(uint32_t base, qemu_or_irq *orgate,
 +static DeviceState *pl330_create(uint32_t base, OrIRQState *orgate,
                                   qemu_irq irq, int nreq, int nevents, int width)
  {
      SysBusDevice *busdev;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
      for (i = 0; i < ARRAY_SIZE(s->pl330_irq_orgate); i++) {
          char *name = g_strdup_printf("pl330-irq-orgate%d", i);
 -        qemu_or_irq *orgate = &s->pl330_irq_orgate[i];
 +        OrIRQState *orgate = &s->pl330_irq_orgate[i];
          object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
          g_free(name);
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
      TZMSC msc[4];
      CMSDKAPBUART uart[6];
      SplitIRQ sec_resp_splitter;
 -    qemu_or_irq uart_irq_orgate;
 +    OrIRQState uart_irq_orgate;
      DeviceState *lan9118;
      SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
      Clock *sysclk;
 diff --git a/hw/core/or-irq.c b/hw/core/or-irq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/or-irq.c
 +++ b/hw/core/or-irq.c
@@ -XXX,XX +XXX,XX @@
  static void or_irq_handler(void *opaque, int n, int level)
  {
 -    qemu_or_irq *s = OR_IRQ(opaque);
 +    OrIRQState *s = OR_IRQ(opaque);
      int or_level = 0;
      int i;
@@ -XXX,XX +XXX,XX @@ static void or_irq_handler(void *opaque, int n, int level)
  static void or_irq_reset(DeviceState *dev)
  {
 -    qemu_or_irq *s = OR_IRQ(dev);
 +    OrIRQState *s = OR_IRQ(dev);
      int i;
      for (i = 0; i < MAX_OR_LINES; i++) {
@@ -XXX,XX +XXX,XX @@ static void or_irq_reset(DeviceState *dev)
  static void or_irq_realize(DeviceState *dev, Error **errp)
  {
 -    qemu_or_irq *s = OR_IRQ(dev);
 +    OrIRQState *s = OR_IRQ(dev);
      assert(s->num_lines <= MAX_OR_LINES);
@@ -XXX,XX +XXX,XX @@ static void or_irq_realize(DeviceState *dev, Error **errp)
  static void or_irq_init(Object *obj)
  {
 -    qemu_or_irq *s = OR_IRQ(obj);
 +    OrIRQState *s = OR_IRQ(obj);
      qdev_init_gpio_out(DEVICE(obj), &s->out_irq, 1);
  }
@@ -XXX,XX +XXX,XX @@ static void or_irq_init(Object *obj)
  static bool vmstate_extras_needed(void *opaque)
  {
 -    qemu_or_irq *s = OR_IRQ(opaque);
 +    OrIRQState *s = OR_IRQ(opaque);
      return s->num_lines >= OLD_MAX_OR_LINES;
  }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq_extras = {
      .minimum_version_id = 1,
      .needed = vmstate_extras_needed,
      .fields = (VMStateField[]) {
 -        VMSTATE_VARRAY_UINT16_UNSAFE(levels, qemu_or_irq, num_lines, 0,
 +        VMSTATE_VARRAY_UINT16_UNSAFE(levels, OrIRQState, num_lines, 0,
                                       vmstate_info_bool, bool),
          VMSTATE_END_OF_LIST(),
      },
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq = {
      .version_id = 1,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
 -        VMSTATE_BOOL_SUB_ARRAY(levels, qemu_or_irq, 0, OLD_MAX_OR_LINES),
 +        VMSTATE_BOOL_SUB_ARRAY(levels, OrIRQState, 0, OLD_MAX_OR_LINES),
          VMSTATE_END_OF_LIST(),
      },
      .subsections = (const VMStateDescription*[]) {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq = {
  };
  static Property or_irq_properties[] = {
 -    DEFINE_PROP_UINT16("num-lines", qemu_or_irq, num_lines, 1),
 +    DEFINE_PROP_UINT16("num-lines", OrIRQState, num_lines, 1),
      DEFINE_PROP_END_OF_LIST(),
  };
@@ -XXX,XX +XXX,XX @@ static void or_irq_class_init(ObjectClass *klass, void *data)
  static const TypeInfo or_irq_type_info = {
     .name = TYPE_OR_IRQ,
     .parent = TYPE_DEVICE,
 -   .instance_size = sizeof(qemu_or_irq),
 +   .instance_size = sizeof(OrIRQState),
     .instance_init = or_irq_init,
     .class_init = or_irq_class_init,
  };
 diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/pci-host/raven.c
 +++ b/hw/pci-host/raven.c
@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(PREPPCIState, RAVEN_PCI_HOST_BRIDGE,
  struct PRePPCIState {
      PCIHostState parent_obj;
 -    qemu_or_irq *or_irq;
 +    OrIRQState *or_irq;
      qemu_irq pci_irqs[PCI_NUM_PINS];
      PCIBus pci_bus;
      AddressSpace pci_io_as;
 --
 .34.1

arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
patches, which are somewhere between a bugfix and a new feature.

thanks
-- PMM

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Check 31st bit to see if CD is valid
 * qemu-options.hx: Fix formatting of -machine memory-backend option
 * hw: aspeed_gpio: Fix memory size
 * hw/arm/nseries: Display hexadecimal value with '0x' prefix
 * Add sve-default-vector-length cpu property
 * docs: Update path that mentions deprecated.rst
 * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
 * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
 * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
 * target/arm: Report M-profile alignment faults correctly to the guest
 * target/arm: Add missing 'return's after calling v7m_exception_taken()
 * target/arm: Enforce that M-profile SP low 2 bits are always zero

----------------------------------------------------------------
Joe Komlodi (1):
      hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):
      hw: aspeed_gpio: Fix memory size

Mao Zhongyi (1):
      docs: Update path that mentions deprecated.rst

Peter Maydell (7):
      qemu-options.hx: Fix formatting of -machine memory-backend option
      target/arm: Enforce that M-profile SP low 2 bits are always zero
      target/arm: Add missing 'return's after calling v7m_exception_taken()
      target/arm: Report M-profile alignment faults correctly to the guest
      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

Philippe Mathieu-Daudé (1):
      hw/arm/nseries: Display hexadecimal value with '0x' prefix

Richard Henderson (3):
      target/arm: Correctly bound length in sve_zcr_get_valid_len
      target/arm: Export aarch64_sve_zcr_get_valid_len
      target/arm: Add sve-default-vector-length cpu property

The documentation of the -machine memory-backend has some minor
formatting errors:
 * Misindentation of the initial line meant that the whole option
   section is incorrectly indented in the HTML output compared to
   the other -machine options
 * The examples weren't indented, which meant that they were formatted
   as plain run-on text including outputting the "::" as text.
 * The a) b) list has no rst-format markup so it is rendered as
   a single run-on paragraph

Fix the formatting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
---
 qemu-options.hx | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
-     ``memory-backend='id'``
+    ``memory-backend='id'``
         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
         Allows to use a memory backend as main RAM.
 
         For example:
         ::
-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+            -machine memory-backend=pc.ram
+            -m 512M
 
         Migration compatibility note:
-        a) as backend id one shall use value of 'default-ram-id', advertised by
-        machine type (available via ``query-machines`` QMP command), if migration
-        to/from old QEMU (<5.0) is expected.
-        b) for machine types 4.0 and older, user shall
-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-        if migration to/from old QEMU (<5.0) is expected.
+
+        * as backend id one shall use value of 'default-ram-id', advertised by
+          machine type (available via ``query-machines`` QMP command), if migration
+          to/from old QEMU (<5.0) is expected.
+        * for machine types 4.0 and older, user shall
+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+          if migration to/from old QEMU (<5.0) is expected.
+
         For example:
         ::
-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+            -machine memory-backend=pc.ram
+            -m 512M
 ERST
 
 HXCOMM Deprecated by -machine
-- 
2.20.1

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:
 * for writes to r13 by the gdbstub
 * for writes to any of the various flavours of SP via MSR
 * for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).

All the other writes to regs[13] in C code are either:
 * A-profile only code
 * writes of values we can guarantee to be aligned, such as
   - writes of previous-SP-value plus or minus a 4-aligned constant
   - writes of the value in an SP limit register (which we already
     enforce to be aligned)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
 target/arm/gdbstub.c   |  4 ++++
 target/arm/m_helper.c  | 14 ++++++++------
 target/arm/translate.c |  3 +++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 16) {
         /* Core integer register.  */
+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+            /* M profile SP low bits are always 0 */
+            tmp &= ~3;
+        }
         env->regs[n] = tmp;
         return 4;
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_msp = val;
+            env->v7m.other_ss_msp = val & ~3;
             return;
         case 0x89: /* PSP_NS */
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_psp = val;
+            env->v7m.other_ss_psp = val & ~3;
             return;
         case 0x8a: /* MSPLIM_NS */
             if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
 
             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 
+            val &= ~0x3;
+
             if (val < limit) {
                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
             }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         break;
     case 8: /* MSP */
         if (v7m_using_psp(env)) {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         } else {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         }
         break;
     case 9: /* PSP */
         if (v7m_using_psp(env)) {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         } else {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         }
         break;
     case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
          */
         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
         s->base.is_jmp = DISAS_JUMP;
+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* For M-profile SP bits [1:0] are always zero */
+        tcg_gen_andi_i32(var, var, ~3);
     }
     tcg_gen_mov_i32(cpu_R[reg], var);
     tcg_temp_free_i32(var);
-- 
2.20.1

In do_v7m_exception_exit(), we perform various checks as part of
performing the exception return.  If one of these checks fails, the
architecture requires that we take an appropriate exception on the
existing stackframe.  We implement this by calling
v7m_exception_taken() to set up to take the new exception, and then
immediately returning from do_v7m_exception_exit() without proceeding
any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"
statement, with the effect that if bad code in the guest tripped over
these checks we would set up to take a UsageFault exception but then
blunder on trying to also unstack and return from the original
exception, with the probable result that the guest would crash.

Add the missing return statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: NSACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 } else if (!cpacr_pass) {
                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                             exc_secure);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: CPACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 }
             }
             /* Clear s0..s15, FPSCR and VPR */
-- 
2.20.1

For M-profile, we weren't reporting alignment faults triggered by the
generic TCG code correctly to the guest.  These get passed into
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
style exception.fsr value of 1.  We didn't check for this, and so
they fell through into the default of "assume this is an MPU fault"
and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED
bit in the UFSR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
         break;
     case EXCP_UNALIGNED:
+        /* Unaligned faults reported by M-profile aware code */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
         break;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
             break;
+        case 0x1: /* Alignment fault reported by generic code */
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really UsageFault with UFSR.UNALIGNED\n");
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            break;
         default:
             /*
              * All other FSR values are either MPU faults or "can't happen
-- 
2.20.1

The ISCR.ISRPENDING bit is set when an external interrupt is pending.
This is true whether that external interrupt is enabled or not.
This means that we can't use 's->vectpending == 0' as a shortcut to
"ISRPENDING is zero", because s->vectpending indicates only the
highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending
enabled interrupt we fall through to scanning through the whole
interrupt array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
 {
     int irq;
 
-    /* We can shortcut if the highest priority pending interrupt
-     * happens to be external or if there is nothing pending.
+    /*
+     * We can shortcut if the highest priority pending interrupt
+     * happens to be external; if not we need to check the whole
+     * vectors[] array.
      */
     if (s->vectpending > NVIC_FIRST_IRQ) {
         return true;
     }
-    if (s->vectpending == 0) {
-        return false;
-    }
 
     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
         if (s->vectors[irq].pending) {
-- 
2.20.1

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
the register.  We were incorrectly masking it to 8 bits, so it would
report the wrong value if the pending exception was greater than 256.
Fix the bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0xff) << 12;
+        val |= (s->vectpending & 0x1ff) << 12;
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
the register is accessed NonSecure and the highest priority pending
enabled exception (that would be returned in the VECTPENDING field)
targets Secure, then the VECTPENDING field must read 1 rather than
the exception number of the pending exception. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
+static bool vectpending_targets_secure(NVICState *s)
+{
+    /* Return true if s->vectpending targets Secure state */
+    if (s->vectpending_is_s_banked) {
+        return true;
+    }
+    return !exc_is_banked(s->vectpending) &&
+        exc_targets_secure(s, s->vectpending);
+}
+
 void armv7m_nvic_get_pending_irq_info(void *opaque,
                                       int *pirq, bool *ptargets_secure)
 {
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
 
     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
 
-    if (s->vectpending_is_s_banked) {
-        targets_secure = true;
-    } else {
-        targets_secure = !exc_is_banked(pending) &&
-            exc_targets_secure(s, pending);
-    }
+    targets_secure = vectpending_targets_secure(s);
 
     trace_nvic_get_pending_irq_info(pending, targets_secure);
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0x1ff) << 12;
+        if (s->vectpending) {
+            /*
+             * From v8.1M VECTPENDING must read as 1 if accessed as
+             * NonSecure and the highest priority pending and enabled
+             * exception targets Secure.
+             */
+            int vp = s->vectpending;
+            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
+                vectpending_targets_secure(s)) {
+                vp = 1;
+            }
+            val |= (vp & 0x1ff) << 12;
+        }
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>

Missed in commit f3478392 "docs: Move deprecation, build
and license info out of system/"

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure         | 2 +-
 target/i386/cpu.c | 2 +-
 MAINTAINERS       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 
 if test -n "${deprecated_features}"; then
     echo "Warning, deprecated features enabled."
-    echo "Please see docs/system/deprecated.rst"
+    echo "Please see docs/about/deprecated.rst"
     echo "  features: ${deprecated_features}"
 fi
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
  * none", but this is just for compatibility while libvirt isn't
  * adapted to resolve CPU model versions before creating VMs.
  * See "Runnability guarantee of CPU models" at
- * docs/system/deprecated.rst.
+ * docs/about/deprecated.rst.
  */
 X86CPUVersion default_cpu_version = 1;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
 
 Incompatible changes
 R: libvir-list@redhat.com
-F: docs/system/deprecated.rst
+F: docs/about/deprecated.rst
 
 Build System
 ------------
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Currently, our only caller is sve_zcr_len_for_el, which has
already masked the length extracted from ZCR_ELx, so the
masking done here is a nop.  But we will shortly have uses
from other locations, where the length will be unmasked.

Saturate the length to ARM_MAX_VQ instead of truncating to
the low 4 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
-    end_len = start_len &= 0xf;
+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+    end_len = start_len;
+
     if (!test_bit(start_len, cpu->sve_vq_map)) {
         end_len = find_last_bit(cpu->sve_vq_map, start_len);
         assert(end_len < start_len);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from sve_zcr_get_valid_len and make accessible
from outside of helper.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 #endif /* CONFIG_TCG */
 
+/**
+ * aarch64_sve_zcr_get_valid_len:
+ * @cpu: cpu context
+ * @start_len: maximum len to consider
+ *
+ * Return the maximum supported sve vector length <= @start_len.
+ * Note that both @start_len and the return value are in units
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
+ */
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
 
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    return sve_zcr_get_valid_len(cpu, zcr_len);
+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the behavour of /proc/sys/abi/sve_default_vector_length
under the real linux kernel.  We have no way of passing along
a real default across exec like the kernel can, but this is a
decent way of adjusting the startup vector length of a process.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
[PMM: tweaked docs formatting, document -1 special-case,
 added fixup patch from RTH mentioning QEMU's maximum veclen.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 15 ++++++++
 target/arm/cpu.h                 |  5 +++
 target/arm/cpu.c                 | 14 ++++++--
 target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SVE User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 64.
+
+If the default length is larger than the maximum vector length enabled,
+the actual vector length will be reduced.  Note that the maximum vector
+length supported by QEMU is 256.
+
+If this property is set to ``-1`` then the default vector length
+is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
 
+#ifdef CONFIG_USER_ONLY
+    /* Used to set the default vector length at process start. */
+    uint32_t sve_default_vq;
+#endif
+
     /*
      * In sve_vq_map each set bit is a supported vector length of
      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         /* with reasonable vector length */
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+            env->vfp.zcr_el[1] =
+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
          * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+# ifdef TARGET_AARCH64
+    /*
+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+     * our corresponding sve-default-vector-length cpu property.
+     */
+    cpu->sve_default_vq = 4;
+# endif
+#else
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+#ifdef CONFIG_USER_ONLY
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t default_len, default_vq, remainder;
+
+    if (!visit_type_int32(v, name, &default_len, errp)) {
+        return;
+    }
+
+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+    if (default_len == -1) {
+        cpu->sve_default_vq = ARM_MAX_VQ;
+        return;
+    }
+
+    default_vq = default_len / 16;
+    remainder = default_len % 16;
+
+    /*
+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     */
+    if (remainder || default_vq < 1 || default_vq > 512) {
+        error_setg(errp, "cannot set sve-default-vector-length");
+        if (remainder) {
+            error_append_hint(errp, "Vector length not a multiple of 16\n");
+        } else if (default_vq < 1) {
+            error_append_hint(errp, "Vector length smaller than 16\n");
+        } else {
+            error_append_hint(errp, "Vector length larger than %d\n",
+                              512 * 16);
+        }
+        return;
+    }
+
+    cpu->sve_default_vq = default_vq;
+}
+
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t value = cpu->sve_default_vq * 16;
+
+    visit_type_int32(v, name, &value, errp);
+}
+#endif
+
 void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
         object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                             cpu_arm_set_sve_vq, NULL, NULL);
     }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+    object_property_add(obj, "sve-default-vector-length", "int32",
+                        cpu_arm_get_sve_default_vec_len,
+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+#endif
 }
 
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The macro used to calculate the maximum memory size of the MMIO region
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
The intent was to have it be 0x9D8 - 0x800.

This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
region set aside for the GPIO controller.

On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
regions would overlap. Worse was the 1.8V controller would map over the
top of the following peripheral, which happens to be the RTC.

The mmio region used by each device is a maximum of 2KB, so avoid the
calculations and hard code this as the maximum.

Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210713065854.134634-2-joel@jms.id.au
[PMM: fix autocorrect error in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_1_8V_MEM_SIZE            0x9D8
 #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
                                       GPIO_1_8V_REG_OFFSET) >> 2)
-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+            TYPE_ASPEED_GPIO, 0x800);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.20.1

The following changes since commit b11728dc3ae67ddedf34b7a4f318170e7092803c:

Merge tag 'pull-riscv-to-apply-20230224' of github.com:palmer-dabbelt/qemu into staging (2023-02-26 20:14:46 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git pull-target-arm-20230227

for you to fetch changes up to e844f0c5d0bd2c4d8d3c1622eb2a88586c9c4677:

hw: Replace qemu_or_irq typedef by OrIRQState (2023-02-27 13:27:05 +0000)

----------------------------------------------------------------
target-arm queue:
 * Various code cleanups
 * More refactoring working towards allowing a build
   without CONFIG_TCG

----------------------------------------------------------------
Claudio Fontana (2):
      target/arm: move helpers to tcg/
      target/arm: Move psci.c into the tcg directory

Fabiano Rosas (9):
      target/arm: Wrap breakpoint/watchpoint updates with tcg_enabled
      target/arm: Wrap TCG-only code in debug_helper.c
      target/arm: move translate modules to tcg/
      target/arm: Wrap arm_rebuild_hflags calls with tcg_enabled
      target/arm: Move hflags code into the tcg directory
      target/arm: Move regime_using_lpae_format into internal.h
      target/arm: Don't access TCG code when debugging with KVM
      cpu-defs.h: Expose CPUTLBEntryFull to non-TCG code
      tests/avocado: add machine:none tag to version.py

Philippe Mathieu-Daudé (13):
      hw/gpio/max7310: Simplify max7310_realize()
      hw/char/pl011: Un-inline pl011_create()
      hw/char/pl011: Open-code pl011_luminary_create()
      hw/char/xilinx_uartlite: Expose XILINX_UARTLITE QOM type
      hw/char/xilinx_uartlite: Open-code xilinx_uartlite_create()
      hw/char/cmsdk-apb-uart: Open-code cmsdk_apb_uart_create()
      hw/timer/cmsdk-apb-timer: Remove unused 'qdev-properties.h' header
      hw/intc/armv7m_nvic: Use QOM cast CPU() macro
      hw/arm/musicpal: Remove unused dummy MemoryRegion
      iothread: Remove unused IOThreadClass / IOTHREAD_CLASS
      hw/irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
      hw/or-irq: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
      hw: Replace qemu_or_irq typedef by OrIRQState

Thomas Huth (1):
      include/hw/arm/allwinner-a10.h: Remove superfluous includes from the header

MAINTAINERS                              |   1 +
 include/exec/cpu-defs.h                  |   6 +
 include/hw/arm/allwinner-a10.h           |   2 -
 include/hw/arm/armsse.h                  |   6 +-
 include/hw/arm/bcm2835_peripherals.h     |   2 +-
 include/hw/arm/exynos4210.h              |   4 +-
 include/hw/arm/stm32f205_soc.h           |   2 +-
 include/hw/arm/stm32f405_soc.h           |   2 +-
 include/hw/arm/xlnx-versal.h             |   6 +-
 include/hw/arm/xlnx-zynqmp.h             |   2 +-
 include/hw/char/cmsdk-apb-uart.h         |  34 ---
 include/hw/char/pl011.h                  |  36 +--
 include/hw/char/xilinx_uartlite.h        |  22 +-
 include/hw/or-irq.h                      |   5 +-
 include/hw/timer/cmsdk-apb-timer.h       |   1 -
 target/arm/internals.h                   |  23 +-
 target/arm/{ => tcg}/translate-a64.h     |   0
 target/arm/{ => tcg}/translate.h         |   0
 target/arm/{ => tcg}/vec_internal.h      |   0
 target/arm/{ => tcg}/a32-uncond.decode   |   0
 target/arm/{ => tcg}/a32.decode          |   0
 target/arm/{ => tcg}/m-nocp.decode       |   0
 target/arm/{ => tcg}/mve.decode          |   0
 target/arm/{ => tcg}/neon-dp.decode      |   0
 target/arm/{ => tcg}/neon-ls.decode      |   0
 target/arm/{ => tcg}/neon-shared.decode  |   0
 target/arm/{ => tcg}/sme-fa64.decode     |   0
 target/arm/{ => tcg}/sme.decode          |   0
 target/arm/{ => tcg}/sve.decode          |   0
 target/arm/{ => tcg}/t16.decode          |   0
 target/arm/{ => tcg}/t32.decode          |   0
 target/arm/{ => tcg}/vfp-uncond.decode   |   0
 target/arm/{ => tcg}/vfp.decode          |   0
 hw/arm/allwinner-a10.c                   |   1 +
 hw/arm/boot.c                            |   6 +-
 hw/arm/exynos4210.c                      |   4 +-
 hw/arm/mps2-tz.c                         |   2 +-
 hw/arm/mps2.c                            |  41 ++-
 hw/arm/musicpal.c                        |   4 -
 hw/arm/stellaris.c                       |  11 +-
 hw/char/pl011.c                          |  17 ++
 hw/char/xilinx_uartlite.c                |   4 +-
 hw/core/irq.c                            |   9 +-
 hw/core/or-irq.c                         |  18 +-
 hw/gpio/max7310.c                        |   5 +-
 hw/intc/armv7m_nvic.c                    |  26 +-
 hw/microblaze/petalogix_s3adsp1800_mmu.c |   7 +-
 hw/pci-host/raven.c                      |   2 +-
 iothread.c                               |   4 -
 target/arm/arm-powerctl.c                |   7 +-
 target/arm/cpu.c                         |   9 +-
 target/arm/debug_helper.c                | 490 ++++++++++++++++---------------
 target/arm/helper.c                      | 411 +-------------------------
 target/arm/machine.c                     |  12 +-
 target/arm/ptw.c                         |   4 +
 target/arm/tcg-stubs.c                   |  27 ++
 target/arm/{ => tcg}/crypto_helper.c     |   0
 target/arm/{ => tcg}/helper-a64.c        |   0
 target/arm/tcg/hflags.c                  | 403 +++++++++++++++++++++++++
 target/arm/{ => tcg}/iwmmxt_helper.c     |   0
 target/arm/{ => tcg}/m_helper.c          |   0
 target/arm/{ => tcg}/mte_helper.c        |   0
 target/arm/{ => tcg}/mve_helper.c        |   0
 target/arm/{ => tcg}/neon_helper.c       |   0
 target/arm/{ => tcg}/op_helper.c         |   0
 target/arm/{ => tcg}/pauth_helper.c      |   0
 target/arm/{ => tcg}/psci.c              |   0
 target/arm/{ => tcg}/sme_helper.c        |   0
 target/arm/{ => tcg}/sve_helper.c        |   0
 target/arm/{ => tcg}/tlb_helper.c        |  18 --
 target/arm/{ => tcg}/translate-a64.c     |   0
 target/arm/{ => tcg}/translate-m-nocp.c  |   0
 target/arm/{ => tcg}/translate-mve.c     |   0
 target/arm/{ => tcg}/translate-neon.c    |   0
 target/arm/{ => tcg}/translate-sme.c     |   0
 target/arm/{ => tcg}/translate-sve.c     |   0
 target/arm/{ => tcg}/translate-vfp.c     |   0
 target/arm/{ => tcg}/translate.c         |   0
 target/arm/{ => tcg}/vec_helper.c        |   0
 target/arm/meson.build                   |  46 +--
 target/arm/tcg/meson.build               |  50 ++++
 tests/avocado/version.py                 |   1 +
 82 files changed, 918 insertions(+), 875 deletions(-)
 rename target/arm/{ => tcg}/translate-a64.h (100%)
 rename target/arm/{ => tcg}/translate.h (100%)
 rename target/arm/{ => tcg}/vec_internal.h (100%)
 rename target/arm/{ => tcg}/a32-uncond.decode (100%)
 rename target/arm/{ => tcg}/a32.decode (100%)
 rename target/arm/{ => tcg}/m-nocp.decode (100%)
 rename target/arm/{ => tcg}/mve.decode (100%)
 rename target/arm/{ => tcg}/neon-dp.decode (100%)
 rename target/arm/{ => tcg}/neon-ls.decode (100%)
 rename target/arm/{ => tcg}/neon-shared.decode (100%)
 rename target/arm/{ => tcg}/sme-fa64.decode (100%)
 rename target/arm/{ => tcg}/sme.decode (100%)
 rename target/arm/{ => tcg}/sve.decode (100%)
 rename target/arm/{ => tcg}/t16.decode (100%)
 rename target/arm/{ => tcg}/t32.decode (100%)
 rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
 rename target/arm/{ => tcg}/vfp.decode (100%)
 create mode 100644 target/arm/tcg-stubs.c
 rename target/arm/{ => tcg}/crypto_helper.c (100%)
 rename target/arm/{ => tcg}/helper-a64.c (100%)
 create mode 100644 target/arm/tcg/hflags.c
 rename target/arm/{ => tcg}/iwmmxt_helper.c (100%)
 rename target/arm/{ => tcg}/m_helper.c (100%)
 rename target/arm/{ => tcg}/mte_helper.c (100%)
 rename target/arm/{ => tcg}/mve_helper.c (100%)
 rename target/arm/{ => tcg}/neon_helper.c (100%)
 rename target/arm/{ => tcg}/op_helper.c (100%)
 rename target/arm/{ => tcg}/pauth_helper.c (100%)
 rename target/arm/{ => tcg}/psci.c (100%)
 rename target/arm/{ => tcg}/sme_helper.c (100%)
 rename target/arm/{ => tcg}/sve_helper.c (100%)
 rename target/arm/{ => tcg}/tlb_helper.c (94%)
 rename target/arm/{ => tcg}/translate-a64.c (100%)
 rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
 rename target/arm/{ => tcg}/translate-mve.c (100%)
 rename target/arm/{ => tcg}/translate-neon.c (100%)
 rename target/arm/{ => tcg}/translate-sme.c (100%)
 rename target/arm/{ => tcg}/translate-sve.c (100%)
 rename target/arm/{ => tcg}/translate-vfp.c (100%)
 rename target/arm/{ => tcg}/translate.c (100%)
 rename target/arm/{ => tcg}/vec_helper.c (100%)
 create mode 100644 target/arm/tcg/meson.build

From: Thomas Huth <thuth@redhat.com>

pci_device.h is not needed at all in allwinner-a10.h, and serial.h
is only needed by the corresponding .c file.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230215152233.210024-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-a10.h | 2 --
 hw/arm/allwinner-a10.c         | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_ARM_ALLWINNER_A10_H
 #define HW_ARM_ALLWINNER_A10_H
 
-#include "hw/char/serial.h"
 #include "hw/arm/boot.h"
-#include "hw/pci/pci_device.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "hw/char/serial.h"
 #include "hw/sysbus.h"
 #include "hw/arm/allwinner-a10.h"
 #include "hw/misc/unimp.h"
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

This is in preparation for restricting compilation of some parts of
debug_helper.c to TCG only.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c          |  6 ++++--
 target/arm/debug_helper.c | 16 ++++++++++++----
 target/arm/machine.c      |  7 +++++--
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
     }
 #endif
 
-    hw_breakpoint_update_all(cpu);
-    hw_watchpoint_update_all(cpu);
+    if (tcg_enabled()) {
+        hw_breakpoint_update_all(cpu);
+        hw_watchpoint_update_all(cpu);
+    }
     arm_rebuild_hflags(env);
 }
 
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     value &= ~3ULL;
 
     raw_write(env, ri, value);
-    hw_watchpoint_update(cpu, i);
+    if (tcg_enabled()) {
+        hw_watchpoint_update(cpu, i);
+    }
 }
 
 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     int i = ri->crm;
 
     raw_write(env, ri, value);
-    hw_watchpoint_update(cpu, i);
+    if (tcg_enabled()) {
+        hw_watchpoint_update(cpu, i);
+    }
 }
 
 void hw_breakpoint_update(ARMCPU *cpu, int n)
@@ -XXX,XX +XXX,XX @@ static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     int i = ri->crm;
 
     raw_write(env, ri, value);
-    hw_breakpoint_update(cpu, i);
+    if (tcg_enabled()) {
+        hw_breakpoint_update(cpu, i);
+    }
 }
 
 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     value = deposit64(value, 8, 1, extract64(value, 7, 1));
 
     raw_write(env, ri, value);
-    hw_breakpoint_update(cpu, i);
+    if (tcg_enabled()) {
+        hw_breakpoint_update(cpu, i);
+    }
 }
 
 void define_debug_regs(ARMCPU *cpu)
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm_arm.h"
 #include "internals.h"
 #include "migration/cpu.h"
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
         return -1;
     }
 
-    hw_breakpoint_update_all(cpu);
-    hw_watchpoint_update_all(cpu);
+    if (tcg_enabled()) {
+        hw_breakpoint_update_all(cpu);
+        hw_watchpoint_update_all(cpu);
+    }
 
     /*
      * TCG gen_update_fp_context() relies on the invariant that
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

The next few patches will move helpers under CONFIG_TCG. We'd prefer
to keep the debug helpers and debug registers close together, so
rearrange the file a bit to be able to wrap the helpers with a TCG
ifdef.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 476 +++++++++++++++++++-------------------
 1 file changed, 239 insertions(+), 237 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpregs.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
+#include "sysemu/tcg.h"
 
-
+#ifdef CONFIG_TCG
 /* Return the Exception Level targeted by debug exceptions. */
 static int arm_debug_target_el(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
     raise_exception_debug(env, EXCP_UDEF, syndrome);
 }
 
+void hw_watchpoint_update(ARMCPU *cpu, int n)
+{
+    CPUARMState *env = &cpu->env;
+    vaddr len = 0;
+    vaddr wvr = env->cp15.dbgwvr[n];
+    uint64_t wcr = env->cp15.dbgwcr[n];
+    int mask;
+    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
+
+    if (env->cpu_watchpoint[n]) {
+        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
+        env->cpu_watchpoint[n] = NULL;
+    }
+
+    if (!FIELD_EX64(wcr, DBGWCR, E)) {
+        /* E bit clear : watchpoint disabled */
+        return;
+    }
+
+    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
+    case 0:
+        /* LSC 00 is reserved and must behave as if the wp is disabled */
+        return;
+    case 1:
+        flags |= BP_MEM_READ;
+        break;
+    case 2:
+        flags |= BP_MEM_WRITE;
+        break;
+    case 3:
+        flags |= BP_MEM_ACCESS;
+        break;
+    }
+
+    /*
+     * Attempts to use both MASK and BAS fields simultaneously are
+     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
+     * thus generating a watchpoint for every byte in the masked region.
+     */
+    mask = FIELD_EX64(wcr, DBGWCR, MASK);
+    if (mask == 1 || mask == 2) {
+        /*
+         * Reserved values of MASK; we must act as if the mask value was
+         * some non-reserved value, or as if the watchpoint were disabled.
+         * We choose the latter.
+         */
+        return;
+    } else if (mask) {
+        /* Watchpoint covers an aligned area up to 2GB in size */
+        len = 1ULL << mask;
+        /*
+         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
+         * whether the watchpoint fires when the unmasked bits match; we opt
+         * to generate the exceptions.
+         */
+        wvr &= ~(len - 1);
+    } else {
+        /* Watchpoint covers bytes defined by the byte address select bits */
+        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
+        int basstart;
+
+        if (extract64(wvr, 2, 1)) {
+            /*
+             * Deprecated case of an only 4-aligned address. BAS[7:4] are
+             * ignored, and BAS[3:0] define which bytes to watch.
+             */
+            bas &= 0xf;
+        }
+
+        if (bas == 0) {
+            /* This must act as if the watchpoint is disabled */
+            return;
+        }
+
+        /*
+         * The BAS bits are supposed to be programmed to indicate a contiguous
+         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
+         * we fire for each byte in the word/doubleword addressed by the WVR.
+         * We choose to ignore any non-zero bits after the first range of 1s.
+         */
+        basstart = ctz32(bas);
+        len = cto32(bas >> basstart);
+        wvr += basstart;
+    }
+
+    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
+                          &env->cpu_watchpoint[n]);
+}
+
+void hw_watchpoint_update_all(ARMCPU *cpu)
+{
+    int i;
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * Completely clear out existing QEMU watchpoints and our array, to
+     * avoid possible stale entries following migration load.
+     */
+    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
+    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
+
+    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
+        hw_watchpoint_update(cpu, i);
+    }
+}
+
+void hw_breakpoint_update(ARMCPU *cpu, int n)
+{
+    CPUARMState *env = &cpu->env;
+    uint64_t bvr = env->cp15.dbgbvr[n];
+    uint64_t bcr = env->cp15.dbgbcr[n];
+    vaddr addr;
+    int bt;
+    int flags = BP_CPU;
+
+    if (env->cpu_breakpoint[n]) {
+        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
+        env->cpu_breakpoint[n] = NULL;
+    }
+
+    if (!extract64(bcr, 0, 1)) {
+        /* E bit clear : watchpoint disabled */
+        return;
+    }
+
+    bt = extract64(bcr, 20, 4);
+
+    switch (bt) {
+    case 4: /* unlinked address mismatch (reserved if AArch64) */
+    case 5: /* linked address mismatch (reserved if AArch64) */
+        qemu_log_mask(LOG_UNIMP,
+                      "arm: address mismatch breakpoint types not implemented\n");
+        return;
+    case 0: /* unlinked address match */
+    case 1: /* linked address match */
+    {
+        /*
+         * Bits [1:0] are RES0.
+         *
+         * It is IMPLEMENTATION DEFINED whether bits [63:49]
+         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
+         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
+         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
+         * whether the RESS bits are ignored when comparing an address.
+         * Therefore we are allowed to compare the entire register, which
+         * lets us avoid considering whether FEAT_LVA is actually enabled.
+         *
+         * The BAS field is used to allow setting breakpoints on 16-bit
+         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
+         * a bp will fire if the addresses covered by the bp and the addresses
+         * covered by the insn overlap but the insn doesn't start at the
+         * start of the bp address range. We choose to require the insn and
+         * the bp to have the same address. The constraints on writing to
+         * BAS enforced in dbgbcr_write mean we have only four cases:
+         *  0b0000  => no breakpoint
+         *  0b0011  => breakpoint on addr
+         *  0b1100  => breakpoint on addr + 2
+         *  0b1111  => breakpoint on addr
+         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
+         */
+        int bas = extract64(bcr, 5, 4);
+        addr = bvr & ~3ULL;
+        if (bas == 0) {
+            return;
+        }
+        if (bas == 0xc) {
+            addr += 2;
+        }
+        break;
+    }
+    case 2: /* unlinked context ID match */
+    case 8: /* unlinked VMID match (reserved if no EL2) */
+    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
+        qemu_log_mask(LOG_UNIMP,
+                      "arm: unlinked context breakpoint types not implemented\n");
+        return;
+    case 9: /* linked VMID match (reserved if no EL2) */
+    case 11: /* linked context ID and VMID match (reserved if no EL2) */
+    case 3: /* linked context ID match */
+    default:
+        /*
+         * We must generate no events for Linked context matches (unless
+         * they are linked to by some other bp/wp, which is handled in
+         * updates for the linking bp/wp). We choose to also generate no events
+         * for reserved values.
+         */
+        return;
+    }
+
+    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
+}
+
+void hw_breakpoint_update_all(ARMCPU *cpu)
+{
+    int i;
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * Completely clear out existing QEMU breakpoints and our array, to
+     * avoid possible stale entries following migration load.
+     */
+    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
+    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
+
+    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
+        hw_breakpoint_update(cpu, i);
+    }
+}
+
+#if !defined(CONFIG_USER_ONLY)
+
+vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * In BE32 system mode, target memory is stored byteswapped (on a
+     * little-endian host system), and by the time we reach here (via an
+     * opcode helper) the addresses of subword accesses have been adjusted
+     * to account for that, which means that watchpoints will not match.
+     * Undo the adjustment here.
+     */
+    if (arm_sctlr_b(env)) {
+        if (len == 1) {
+            addr ^= 3;
+        } else if (len == 2) {
+            addr ^= 2;
+        }
+    }
+
+    return addr;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+#endif /* CONFIG_TCG */
+
 /*
  * Check for traps to "powerdown debug" registers, which are controlled
  * by MDCR.TDOSA
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 };
 
-void hw_watchpoint_update(ARMCPU *cpu, int n)
-{
-    CPUARMState *env = &cpu->env;
-    vaddr len = 0;
-    vaddr wvr = env->cp15.dbgwvr[n];
-    uint64_t wcr = env->cp15.dbgwcr[n];
-    int mask;
-    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
-
-    if (env->cpu_watchpoint[n]) {
-        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
-        env->cpu_watchpoint[n] = NULL;
-    }
-
-    if (!FIELD_EX64(wcr, DBGWCR, E)) {
-        /* E bit clear : watchpoint disabled */
-        return;
-    }
-
-    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
-    case 0:
-        /* LSC 00 is reserved and must behave as if the wp is disabled */
-        return;
-    case 1:
-        flags |= BP_MEM_READ;
-        break;
-    case 2:
-        flags |= BP_MEM_WRITE;
-        break;
-    case 3:
-        flags |= BP_MEM_ACCESS;
-        break;
-    }
-
-    /*
-     * Attempts to use both MASK and BAS fields simultaneously are
-     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
-     * thus generating a watchpoint for every byte in the masked region.
-     */
-    mask = FIELD_EX64(wcr, DBGWCR, MASK);
-    if (mask == 1 || mask == 2) {
-        /*
-         * Reserved values of MASK; we must act as if the mask value was
-         * some non-reserved value, or as if the watchpoint were disabled.
-         * We choose the latter.
-         */
-        return;
-    } else if (mask) {
-        /* Watchpoint covers an aligned area up to 2GB in size */
-        len = 1ULL << mask;
-        /*
-         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
-         * whether the watchpoint fires when the unmasked bits match; we opt
-         * to generate the exceptions.
-         */
-        wvr &= ~(len - 1);
-    } else {
-        /* Watchpoint covers bytes defined by the byte address select bits */
-        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
-        int basstart;
-
-        if (extract64(wvr, 2, 1)) {
-            /*
-             * Deprecated case of an only 4-aligned address. BAS[7:4] are
-             * ignored, and BAS[3:0] define which bytes to watch.
-             */
-            bas &= 0xf;
-        }
-
-        if (bas == 0) {
-            /* This must act as if the watchpoint is disabled */
-            return;
-        }
-
-        /*
-         * The BAS bits are supposed to be programmed to indicate a contiguous
-         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
-         * we fire for each byte in the word/doubleword addressed by the WVR.
-         * We choose to ignore any non-zero bits after the first range of 1s.
-         */
-        basstart = ctz32(bas);
-        len = cto32(bas >> basstart);
-        wvr += basstart;
-    }
-
-    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
-                          &env->cpu_watchpoint[n]);
-}
-
-void hw_watchpoint_update_all(ARMCPU *cpu)
-{
-    int i;
-    CPUARMState *env = &cpu->env;
-
-    /*
-     * Completely clear out existing QEMU watchpoints and our array, to
-     * avoid possible stale entries following migration load.
-     */
-    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
-    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
-
-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
-        hw_watchpoint_update(cpu, i);
-    }
-}
-
 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 }
 
-void hw_breakpoint_update(ARMCPU *cpu, int n)
-{
-    CPUARMState *env = &cpu->env;
-    uint64_t bvr = env->cp15.dbgbvr[n];
-    uint64_t bcr = env->cp15.dbgbcr[n];
-    vaddr addr;
-    int bt;
-    int flags = BP_CPU;
-
-    if (env->cpu_breakpoint[n]) {
-        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
-        env->cpu_breakpoint[n] = NULL;
-    }
-
-    if (!extract64(bcr, 0, 1)) {
-        /* E bit clear : watchpoint disabled */
-        return;
-    }
-
-    bt = extract64(bcr, 20, 4);
-
-    switch (bt) {
-    case 4: /* unlinked address mismatch (reserved if AArch64) */
-    case 5: /* linked address mismatch (reserved if AArch64) */
-        qemu_log_mask(LOG_UNIMP,
-                      "arm: address mismatch breakpoint types not implemented\n");
-        return;
-    case 0: /* unlinked address match */
-    case 1: /* linked address match */
-    {
-        /*
-         * Bits [1:0] are RES0.
-         *
-         * It is IMPLEMENTATION DEFINED whether bits [63:49]
-         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
-         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
-         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
-         * whether the RESS bits are ignored when comparing an address.
-         * Therefore we are allowed to compare the entire register, which
-         * lets us avoid considering whether FEAT_LVA is actually enabled.
-         *
-         * The BAS field is used to allow setting breakpoints on 16-bit
-         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
-         * a bp will fire if the addresses covered by the bp and the addresses
-         * covered by the insn overlap but the insn doesn't start at the
-         * start of the bp address range. We choose to require the insn and
-         * the bp to have the same address. The constraints on writing to
-         * BAS enforced in dbgbcr_write mean we have only four cases:
-         *  0b0000  => no breakpoint
-         *  0b0011  => breakpoint on addr
-         *  0b1100  => breakpoint on addr + 2
-         *  0b1111  => breakpoint on addr
-         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
-         */
-        int bas = extract64(bcr, 5, 4);
-        addr = bvr & ~3ULL;
-        if (bas == 0) {
-            return;
-        }
-        if (bas == 0xc) {
-            addr += 2;
-        }
-        break;
-    }
-    case 2: /* unlinked context ID match */
-    case 8: /* unlinked VMID match (reserved if no EL2) */
-    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
-        qemu_log_mask(LOG_UNIMP,
-                      "arm: unlinked context breakpoint types not implemented\n");
-        return;
-    case 9: /* linked VMID match (reserved if no EL2) */
-    case 11: /* linked context ID and VMID match (reserved if no EL2) */
-    case 3: /* linked context ID match */
-    default:
-        /*
-         * We must generate no events for Linked context matches (unless
-         * they are linked to by some other bp/wp, which is handled in
-         * updates for the linking bp/wp). We choose to also generate no events
-         * for reserved values.
-         */
-        return;
-    }
-
-    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
-}
-
-void hw_breakpoint_update_all(ARMCPU *cpu)
-{
-    int i;
-    CPUARMState *env = &cpu->env;
-
-    /*
-     * Completely clear out existing QEMU breakpoints and our array, to
-     * avoid possible stale entries following migration load.
-     */
-    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
-    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
-
-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
-        hw_breakpoint_update(cpu, i);
-    }
-}
-
 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ void define_debug_regs(ARMCPU *cpu)
         g_free(dbgwcr_el1_name);
     }
 }
-
-#if !defined(CONFIG_USER_ONLY)
-
-vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
-{
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-
-    /*
-     * In BE32 system mode, target memory is stored byteswapped (on a
-     * little-endian host system), and by the time we reach here (via an
-     * opcode helper) the addresses of subword accesses have been adjusted
-     * to account for that, which means that watchpoints will not match.
-     * Undo the adjustment here.
-     */
-    if (arm_sctlr_b(env)) {
-        if (len == 1) {
-            addr ^= 3;
-        } else if (len == 2) {
-            addr ^= 2;
-        }
-    }
-
-    return addr;
-}
-
-#endif
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Introduce the target/arm/tcg directory. Its purpose is to hold the TCG
code that is selected by CONFIG_TCG.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                             |  1 +
 target/arm/{ => tcg}/translate-a64.h    |  0
 target/arm/{ => tcg}/translate.h        |  0
 target/arm/{ => tcg}/a32-uncond.decode  |  0
 target/arm/{ => tcg}/a32.decode         |  0
 target/arm/{ => tcg}/m-nocp.decode      |  0
 target/arm/{ => tcg}/mve.decode         |  0
 target/arm/{ => tcg}/neon-dp.decode     |  0
 target/arm/{ => tcg}/neon-ls.decode     |  0
 target/arm/{ => tcg}/neon-shared.decode |  0
 target/arm/{ => tcg}/sme-fa64.decode    |  0
 target/arm/{ => tcg}/sme.decode         |  0
 target/arm/{ => tcg}/sve.decode         |  0
 target/arm/{ => tcg}/t16.decode         |  0
 target/arm/{ => tcg}/t32.decode         |  0
 target/arm/{ => tcg}/vfp-uncond.decode  |  0
 target/arm/{ => tcg}/vfp.decode         |  0
 target/arm/{ => tcg}/translate-a64.c    |  0
 target/arm/{ => tcg}/translate-m-nocp.c |  0
 target/arm/{ => tcg}/translate-mve.c    |  0
 target/arm/{ => tcg}/translate-neon.c   |  0
 target/arm/{ => tcg}/translate-sme.c    |  0
 target/arm/{ => tcg}/translate-sve.c    |  0
 target/arm/{ => tcg}/translate-vfp.c    |  0
 target/arm/{ => tcg}/translate.c        |  0
 target/arm/meson.build                  | 30 +++---------------
 target/arm/{ => tcg}/meson.build        | 41 +------------------------
 27 files changed, 6 insertions(+), 66 deletions(-)
 rename target/arm/{ => tcg}/translate-a64.h (100%)
 rename target/arm/{ => tcg}/translate.h (100%)
 rename target/arm/{ => tcg}/a32-uncond.decode (100%)
 rename target/arm/{ => tcg}/a32.decode (100%)
 rename target/arm/{ => tcg}/m-nocp.decode (100%)
 rename target/arm/{ => tcg}/mve.decode (100%)
 rename target/arm/{ => tcg}/neon-dp.decode (100%)
 rename target/arm/{ => tcg}/neon-ls.decode (100%)
 rename target/arm/{ => tcg}/neon-shared.decode (100%)
 rename target/arm/{ => tcg}/sme-fa64.decode (100%)
 rename target/arm/{ => tcg}/sme.decode (100%)
 rename target/arm/{ => tcg}/sve.decode (100%)
 rename target/arm/{ => tcg}/t16.decode (100%)
 rename target/arm/{ => tcg}/t32.decode (100%)
 rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
 rename target/arm/{ => tcg}/vfp.decode (100%)
 rename target/arm/{ => tcg}/translate-a64.c (100%)
 rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
 rename target/arm/{ => tcg}/translate-mve.c (100%)
 rename target/arm/{ => tcg}/translate-neon.c (100%)
 rename target/arm/{ => tcg}/translate-sme.c (100%)
 rename target/arm/{ => tcg}/translate-sve.c (100%)
 rename target/arm/{ => tcg}/translate-vfp.c (100%)
 rename target/arm/{ => tcg}/translate.c (100%)
 copy target/arm/{ => tcg}/meson.build (64%)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: target/arm/
+F: target/arm/tcg/
 F: tests/tcg/arm/
 F: tests/tcg/aarch64/
 F: tests/qtest/arm-cpu-features.c
diff --git a/target/arm/translate-a64.h b/target/arm/tcg/translate-a64.h
similarity index 100%
rename from target/arm/translate-a64.h
rename to target/arm/tcg/translate-a64.h
diff --git a/target/arm/translate.h b/target/arm/tcg/translate.h
similarity index 100%
rename from target/arm/translate.h
rename to target/arm/tcg/translate.h
diff --git a/target/arm/a32-uncond.decode b/target/arm/tcg/a32-uncond.decode
similarity index 100%
rename from target/arm/a32-uncond.decode
rename to target/arm/tcg/a32-uncond.decode
diff --git a/target/arm/a32.decode b/target/arm/tcg/a32.decode
similarity index 100%
rename from target/arm/a32.decode
rename to target/arm/tcg/a32.decode
diff --git a/target/arm/m-nocp.decode b/target/arm/tcg/m-nocp.decode
similarity index 100%
rename from target/arm/m-nocp.decode
rename to target/arm/tcg/m-nocp.decode
diff --git a/target/arm/mve.decode b/target/arm/tcg/mve.decode
similarity index 100%
rename from target/arm/mve.decode
rename to target/arm/tcg/mve.decode
diff --git a/target/arm/neon-dp.decode b/target/arm/tcg/neon-dp.decode
similarity index 100%
rename from target/arm/neon-dp.decode
rename to target/arm/tcg/neon-dp.decode
diff --git a/target/arm/neon-ls.decode b/target/arm/tcg/neon-ls.decode
similarity index 100%
rename from target/arm/neon-ls.decode
rename to target/arm/tcg/neon-ls.decode
diff --git a/target/arm/neon-shared.decode b/target/arm/tcg/neon-shared.decode
similarity index 100%
rename from target/arm/neon-shared.decode
rename to target/arm/tcg/neon-shared.decode
diff --git a/target/arm/sme-fa64.decode b/target/arm/tcg/sme-fa64.decode
similarity index 100%
rename from target/arm/sme-fa64.decode
rename to target/arm/tcg/sme-fa64.decode
diff --git a/target/arm/sme.decode b/target/arm/tcg/sme.decode
similarity index 100%
rename from target/arm/sme.decode
rename to target/arm/tcg/sme.decode
diff --git a/target/arm/sve.decode b/target/arm/tcg/sve.decode
similarity index 100%
rename from target/arm/sve.decode
rename to target/arm/tcg/sve.decode
diff --git a/target/arm/t16.decode b/target/arm/tcg/t16.decode
similarity index 100%
rename from target/arm/t16.decode
rename to target/arm/tcg/t16.decode
diff --git a/target/arm/t32.decode b/target/arm/tcg/t32.decode
similarity index 100%
rename from target/arm/t32.decode
rename to target/arm/tcg/t32.decode
diff --git a/target/arm/vfp-uncond.decode b/target/arm/tcg/vfp-uncond.decode
similarity index 100%
rename from target/arm/vfp-uncond.decode
rename to target/arm/tcg/vfp-uncond.decode
diff --git a/target/arm/vfp.decode b/target/arm/tcg/vfp.decode
similarity index 100%
rename from target/arm/vfp.decode
rename to target/arm/tcg/vfp.decode
diff --git a/target/arm/translate-a64.c b/target/arm/tcg/translate-a64.c
similarity index 100%
rename from target/arm/translate-a64.c
rename to target/arm/tcg/translate-a64.c
diff --git a/target/arm/translate-m-nocp.c b/target/arm/tcg/translate-m-nocp.c
similarity index 100%
rename from target/arm/translate-m-nocp.c
rename to target/arm/tcg/translate-m-nocp.c
diff --git a/target/arm/translate-mve.c b/target/arm/tcg/translate-mve.c
similarity index 100%
rename from target/arm/translate-mve.c
rename to target/arm/tcg/translate-mve.c
diff --git a/target/arm/translate-neon.c b/target/arm/tcg/translate-neon.c
similarity index 100%
rename from target/arm/translate-neon.c
rename to target/arm/tcg/translate-neon.c
diff --git a/target/arm/translate-sme.c b/target/arm/tcg/translate-sme.c
similarity index 100%
rename from target/arm/translate-sme.c
rename to target/arm/tcg/translate-sme.c
diff --git a/target/arm/translate-sve.c b/target/arm/tcg/translate-sve.c
similarity index 100%
rename from target/arm/translate-sve.c
rename to target/arm/tcg/translate-sve.c
diff --git a/target/arm/translate-vfp.c b/target/arm/tcg/translate-vfp.c
similarity index 100%
rename from target/arm/translate-vfp.c
rename to target/arm/tcg/translate-vfp.c
diff --git a/target/arm/translate.c b/target/arm/tcg/translate.c
similarity index 100%
rename from target/arm/translate.c
rename to target/arm/tcg/translate.c
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
-gen = [
-  decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
-  decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
-  decodetree.process('sme-fa64.decode', extra_args: '--static-decode=disas_sme_fa64'),
-  decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
-  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
-  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
-  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
-  decodetree.process('vfp-uncond.decode', extra_args: '--decode=disas_vfp_uncond'),
-  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
-  decodetree.process('mve.decode', extra_args: '--decode=disas_mve'),
-  decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
-  decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
-  decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
-  decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
-]
-
 arm_ss = ss.source_set()
-arm_ss.add(gen)
 arm_ss.add(files(
   'cpu.c',
   'crypto_helper.c',
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'neon_helper.c',
   'op_helper.c',
   'tlb_helper.c',
-  'translate.c',
-  'translate-m-nocp.c',
-  'translate-mve.c',
-  'translate-neon.c',
-  'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'pauth_helper.c',
   'sve_helper.c',
   'sme_helper.c',
-  'translate-a64.c',
-  'translate-sve.c',
-  'translate-sme.c',
 ))
 
 arm_softmmu_ss = ss.source_set()
@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
 
 subdir('hvf')
 
+if 'CONFIG_TCG' in config_all
+   subdir('tcg')
+endif
+
 target_arch += {'arm': arm_ss}
 target_softmmu_arch += {'arm': arm_softmmu_ss}
diff --git a/target/arm/meson.build b/target/arm/tcg/meson.build
similarity index 64%
copy from target/arm/meson.build
copy to target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ gen = [
   decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
 ]
 
-arm_ss = ss.source_set()
 arm_ss.add(gen)
+
 arm_ss.add(files(
-  'cpu.c',
-  'crypto_helper.c',
-  'debug_helper.c',
-  'gdbstub.c',
-  'helper.c',
-  'iwmmxt_helper.c',
-  'm_helper.c',
-  'mve_helper.c',
-  'neon_helper.c',
-  'op_helper.c',
-  'tlb_helper.c',
   'translate.c',
   'translate-m-nocp.c',
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
-  'vec_helper.c',
-  'vfp_helper.c',
-  'cpu_tcg.c',
 ))
-arm_ss.add(zlib)
-
-arm_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c', 'kvm64.c'), if_false: files('kvm-stub.c'))
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
-  'cpu64.c',
-  'gdbstub64.c',
-  'helper-a64.c',
-  'mte_helper.c',
-  'pauth_helper.c',
-  'sve_helper.c',
-  'sme_helper.c',
   'translate-a64.c',
   'translate-sve.c',
   'translate-sme.c',
 ))
-
-arm_softmmu_ss = ss.source_set()
-arm_softmmu_ss.add(files(
-  'arch_dump.c',
-  'arm-powerctl.c',
-  'machine.c',
-  'monitor.c',
-  'psci.c',
-  'ptw.c',
-))
-
-subdir('hvf')
-
-target_arch += {'arm': arm_ss}
-target_softmmu_arch += {'arm': arm_softmmu_ss}
-- 
2.34.1

From: Claudio Fontana <cfontana@suse.de>

diff --git a/target/arm/vec_internal.h b/target/arm/tcg/vec_internal.h
similarity index 100%
rename from target/arm/vec_internal.h
rename to target/arm/tcg/vec_internal.h
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg-stubs.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARM stubs for some TCG helper functions
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "internals.h"
+
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+{
+    g_assert_not_reached();
+}
+
+void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+                        uint32_t target_el, uintptr_t ra)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/crypto_helper.c b/target/arm/tcg/crypto_helper.c
similarity index 100%
rename from target/arm/crypto_helper.c
rename to target/arm/tcg/crypto_helper.c
diff --git a/target/arm/helper-a64.c b/target/arm/tcg/helper-a64.c
similarity index 100%
rename from target/arm/helper-a64.c
rename to target/arm/tcg/helper-a64.c
diff --git a/target/arm/iwmmxt_helper.c b/target/arm/tcg/iwmmxt_helper.c
similarity index 100%
rename from target/arm/iwmmxt_helper.c
rename to target/arm/tcg/iwmmxt_helper.c
diff --git a/target/arm/m_helper.c b/target/arm/tcg/m_helper.c
similarity index 100%
rename from target/arm/m_helper.c
rename to target/arm/tcg/m_helper.c
diff --git a/target/arm/mte_helper.c b/target/arm/tcg/mte_helper.c
similarity index 100%
rename from target/arm/mte_helper.c
rename to target/arm/tcg/mte_helper.c
diff --git a/target/arm/mve_helper.c b/target/arm/tcg/mve_helper.c
similarity index 100%
rename from target/arm/mve_helper.c
rename to target/arm/tcg/mve_helper.c
diff --git a/target/arm/neon_helper.c b/target/arm/tcg/neon_helper.c
similarity index 100%
rename from target/arm/neon_helper.c
rename to target/arm/tcg/neon_helper.c
diff --git a/target/arm/op_helper.c b/target/arm/tcg/op_helper.c
similarity index 100%
rename from target/arm/op_helper.c
rename to target/arm/tcg/op_helper.c
diff --git a/target/arm/pauth_helper.c b/target/arm/tcg/pauth_helper.c
similarity index 100%
rename from target/arm/pauth_helper.c
rename to target/arm/tcg/pauth_helper.c
diff --git a/target/arm/sme_helper.c b/target/arm/tcg/sme_helper.c
similarity index 100%
rename from target/arm/sme_helper.c
rename to target/arm/tcg/sme_helper.c
diff --git a/target/arm/sve_helper.c b/target/arm/tcg/sve_helper.c
similarity index 100%
rename from target/arm/sve_helper.c
rename to target/arm/tcg/sve_helper.c
diff --git a/target/arm/tlb_helper.c b/target/arm/tcg/tlb_helper.c
similarity index 100%
rename from target/arm/tlb_helper.c
rename to target/arm/tcg/tlb_helper.c
diff --git a/target/arm/vec_helper.c b/target/arm/tcg/vec_helper.c
similarity index 100%
rename from target/arm/vec_helper.c
rename to target/arm/tcg/vec_helper.c
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@
 arm_ss = ss.source_set()
 arm_ss.add(files(
   'cpu.c',
-  'crypto_helper.c',
   'debug_helper.c',
   'gdbstub.c',
   'helper.c',
-  'iwmmxt_helper.c',
-  'm_helper.c',
-  'mve_helper.c',
-  'neon_helper.c',
-  'op_helper.c',
-  'tlb_helper.c',
-  'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
 ))
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c', 'kvm64.c'), if_false: fil
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'cpu64.c',
   'gdbstub64.c',
-  'helper-a64.c',
-  'mte_helper.c',
-  'pauth_helper.c',
-  'sve_helper.c',
-  'sme_helper.c',
 ))
 
 arm_softmmu_ss = ss.source_set()
@@ -XXX,XX +XXX,XX @@ subdir('hvf')
 
 if 'CONFIG_TCG' in config_all
    subdir('tcg')
+else
+    arm_ss.add(files('tcg-stubs.c'))
 endif
 
 target_arch += {'arm': arm_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
+  'crypto_helper.c',
+  'iwmmxt_helper.c',
+  'm_helper.c',
+  'mve_helper.c',
+  'neon_helper.c',
+  'op_helper.c',
+  'tlb_helper.c',
+  'vec_helper.c',
 ))
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'translate-a64.c',
   'translate-sve.c',
   'translate-sme.c',
+  'helper-a64.c',
+  'mte_helper.c',
+  'pauth_helper.c',
+  'sme_helper.c',
+  'sve_helper.c',
 ))
-- 
2.34.1

From: Claudio Fontana <cfontana@suse.de>

diff --git a/target/arm/psci.c b/target/arm/tcg/psci.c
similarity index 100%
rename from target/arm/psci.c
rename to target/arm/tcg/psci.c
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
   'arm-powerctl.c',
   'machine.c',
   'monitor.c',
-  'psci.c',
   'ptw.c',
 ))
 
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'sme_helper.c',
   'sve_helper.c',
 ))
+
+arm_softmmu_ss.add(files(
+  'psci.c',
+))
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

This is in preparation to moving the hflags code into its own file
under the tcg/ directory.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c             |  6 +++++-
 hw/intc/armv7m_nvic.c     | 20 +++++++++++++-------
 target/arm/arm-powerctl.c |  7 +++++--
 target/arm/cpu.c          |  3 ++-
 target/arm/helper.c       | 18 +++++++++++++-----
 target/arm/machine.c      |  5 ++++-
 6 files changed, 42 insertions(+), 17 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/numa.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                 info->secondary_cpu_reset_hook(cpu, info);
             }
         }
-        arm_rebuild_hflags(env);
+
+        if (tcg_enabled()) {
+            arm_rebuild_hflags(env);
+        }
     }
 }
 
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/armv7m_nvic.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "sysemu/tcg.h"
 #include "sysemu/runstate.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
     /* This is UNPREDICTABLE; treat as RAZ/WI */
 
  exit_ok:
-    /* Ensure any changes made are reflected in the cached hflags.  */
-    arm_rebuild_hflags(&s->cpu->env);
+    if (tcg_enabled()) {
+        /* Ensure any changes made are reflected in the cached hflags. */
+        arm_rebuild_hflags(&s->cpu->env);
+    }
     return MEMTX_OK;
 }
 
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
         }
     }
 
-    /*
-     * We updated state that affects the CPU's MMUidx and thus its hflags;
-     * and we can't guarantee that we run before the CPU reset function.
-     */
-    arm_rebuild_hflags(&s->cpu->env);
+    if (tcg_enabled()) {
+        /*
+         * We updated state that affects the CPU's MMUidx and thus its
+         * hflags; and we can't guarantee that we run before the CPU
+         * reset function.
+         */
+        arm_rebuild_hflags(&s->cpu->env);
+    }
 }
 
 static void nvic_systick_trigger(void *opaque, int n, int level)
diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@
 #include "arm-powerctl.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
+#include "sysemu/tcg.h"
 
 #ifndef DEBUG_ARM_POWERCTL
 #define DEBUG_ARM_POWERCTL 0
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
         target_cpu->env.regs[0] = info->context_id;
     }
 
-    /* CP15 update requires rebuilding hflags */
-    arm_rebuild_hflags(&target_cpu->env);
+    if (tcg_enabled()) {
+        /* CP15 update requires rebuilding hflags */
+        arm_rebuild_hflags(&target_cpu->env);
+    }
 
     /* Start the new CPU at the requested address */
     cpu_set_pc(target_cpu_state, info->entry);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
     if (tcg_enabled()) {
         hw_breakpoint_update_all(cpu);
         hw_watchpoint_update_all(cpu);
+
+        arm_rebuild_hflags(env);
     }
-    arm_rebuild_hflags(env);
 }
 
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     /* This may enable/disable the MMU, so do a TLB flush.  */
     tlb_flush(CPU(cpu));
 
-    if (ri->type & ARM_CP_SUPPRESS_TB_END) {
+    if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) {
         /*
          * Normally we would always end the TB on an SCTLR write; see the
          * comment in ARMCPRegInfo sctlr initialization below for why Xscale
@@ -XXX,XX +XXX,XX @@ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
         memset(env->zarray, 0, sizeof(env->zarray));
     }
 
-    arm_rebuild_hflags(env);
+    if (tcg_enabled()) {
+        arm_rebuild_hflags(env);
+    }
 }
 
 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
     }
     mask &= ~CACHED_CPSR_BITS;
     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
-    if (rebuild_hflags) {
+    if (tcg_enabled() && rebuild_hflags) {
         arm_rebuild_hflags(env);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
         env->regs[14] = env->regs[15] + offset;
     }
     env->regs[15] = newpc;
-    arm_rebuild_hflags(env);
+
+    if (tcg_enabled()) {
+        arm_rebuild_hflags(env);
+    }
 }
 
 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     pstate_write(env, PSTATE_DAIF | new_mode);
     env->aarch64 = true;
     aarch64_restore_sp(env, new_el);
-    helper_rebuild_hflags_a64(env, new_el);
+
+    if (tcg_enabled()) {
+        helper_rebuild_hflags_a64(env, new_el);
+    }
 
     env->pc = addr;
 
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
     if (!kvm_enabled()) {
         pmu_op_finish(&cpu->env);
     }
-    arm_rebuild_hflags(&cpu->env);
+
+    if (tcg_enabled()) {
+        arm_rebuild_hflags(&cpu->env);
+    }
 
     return 0;
 }
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

The hflags are used only for TCG code, so introduce a new file
hflags.c to keep that code.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h     |   2 +
 target/arm/helper.c        | 393 +-----------------------------------
 target/arm/tcg-stubs.c     |   4 +
 target/arm/tcg/hflags.c    | 403 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/meson.build |   1 +
 5 files changed, 411 insertions(+), 392 deletions(-)
 create mode 100644 target/arm/tcg/hflags.c

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 
 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
+int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx);
 
 /* Determine if allocation tags are available.  */
 static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
@@ -XXX,XX +XXX,XX @@ static inline bool arm_fgt_active(CPUARMState *env, int el)
         (!arm_feature(env, ARM_FEATURE_EL3) || (env->cp15.scr_el3 & SCR_FGTEN));
 }
 
+void assert_hflags_rebuild_correctly(CPUARMState *env);
 #endif
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-/* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */
-static bool sme_fa64(CPUARMState *env, int el)
-{
-    if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) {
-        return false;
-    }
-
-    if (el <= 1 && !el_is_in_host(env, el)) {
-        if (!FIELD_EX64(env->vfp.smcr_el[1], SMCR, FA64)) {
-            return false;
-        }
-    }
-    if (el <= 2 && arm_is_el2_enabled(env)) {
-        if (!FIELD_EX64(env->vfp.smcr_el[2], SMCR, FA64)) {
-            return false;
-        }
-    }
-    if (arm_feature(env, ARM_FEATURE_EL3)) {
-        if (!FIELD_EX64(env->vfp.smcr_el[3], SMCR, FA64)) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
     }
 }
 
-static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
+int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 57, 2);
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
     return arm_mmu_idx_el(env, arm_current_el(env));
 }
 
-static inline bool fgt_svc(CPUARMState *env, int el)
-{
-    /*
-     * Assuming fine-grained-traps are active, return true if we
-     * should be trapping on SVC instructions. Only AArch64 can
-     * trap on an SVC at EL1, but we don't need to special-case this
-     * because if this is AArch32 EL1 then arm_fgt_active() is false.
-     * We also know el is 0 or 1.
-     */
-    return el == 0 ?
-        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL0) :
-        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL1);
-}
-
-static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
-                                           ARMMMUIdx mmu_idx,
-                                           CPUARMTBFlags flags)
-{
-    DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
-    DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
-
-    if (arm_singlestep_active(env)) {
-        DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
-    }
-
-    return flags;
-}
-
-static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
-                                              ARMMMUIdx mmu_idx,
-                                              CPUARMTBFlags flags)
-{
-    bool sctlr_b = arm_sctlr_b(env);
-
-    if (sctlr_b) {
-        DP_TBFLAG_A32(flags, SCTLR__B, 1);
-    }
-    if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
-        DP_TBFLAG_ANY(flags, BE_DATA, 1);
-    }
-    DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
-
-    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
-                                        ARMMMUIdx mmu_idx)
-{
-    CPUARMTBFlags flags = {};
-    uint32_t ccr = env->v7m.ccr[env->v7m.secure];
-
-    /* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
-    if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
-        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
-    }
-
-    if (arm_v7m_is_handler_mode(env)) {
-        DP_TBFLAG_M32(flags, HANDLER, 1);
-    }
-
-    /*
-     * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
-     * is suppressing them because the requested execution priority
-     * is less than 0.
-     */
-    if (arm_feature(env, ARM_FEATURE_V8) &&
-        !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
-          (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
-        DP_TBFLAG_M32(flags, STACKCHECK, 1);
-    }
-
-    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
-        DP_TBFLAG_M32(flags, SECURE, 1);
-    }
-
-    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
-                                        ARMMMUIdx mmu_idx)
-{
-    CPUARMTBFlags flags = {};
-    int el = arm_current_el(env);
-
-    if (arm_sctlr(env, el) & SCTLR_A) {
-        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
-    }
-
-    if (arm_el_is_aa64(env, 1)) {
-        DP_TBFLAG_A32(flags, VFPEN, 1);
-    }
-
-    if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) &&
-        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
-        DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
-    }
-
-    if (arm_fgt_active(env, el)) {
-        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
-        if (fgt_svc(env, el)) {
-            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
-        }
-    }
-
-    if (env->uncached_cpsr & CPSR_IL) {
-        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
-    }
-
-    /*
-     * The SME exception we are testing for is raised via
-     * AArch64.CheckFPAdvSIMDEnabled(), as called from
-     * AArch32.CheckAdvSIMDOrFPEnabled().
-     */
-    if (el == 0
-        && FIELD_EX64(env->svcr, SVCR, SM)
-        && (!arm_is_el2_enabled(env)
-            || (arm_el_is_aa64(env, 2) && !(env->cp15.hcr_el2 & HCR_TGE)))
-        && arm_el_is_aa64(env, 1)
-        && !sme_fa64(env, el)) {
-        DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1);
-    }
-
-    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
-                                        ARMMMUIdx mmu_idx)
-{
-    CPUARMTBFlags flags = {};
-    ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
-    uint64_t tcr = regime_tcr(env, mmu_idx);
-    uint64_t sctlr;
-    int tbii, tbid;
-
-    DP_TBFLAG_ANY(flags, AARCH64_STATE, 1);
-
-    /* Get control bits for tagged addresses.  */
-    tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
-    tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
-
-    DP_TBFLAG_A64(flags, TBII, tbii);
-    DP_TBFLAG_A64(flags, TBID, tbid);
-
-    if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
-        int sve_el = sve_exception_el(env, el);
-
-        /*
-         * If either FP or SVE are disabled, translator does not need len.
-         * If SVE EL > FP EL, FP exception has precedence, and translator
-         * does not need SVE EL.  Save potential re-translations by forcing
-         * the unneeded data to zero.
-         */
-        if (fp_el != 0) {
-            if (sve_el > fp_el) {
-                sve_el = 0;
-            }
-        } else if (sve_el == 0) {
-            DP_TBFLAG_A64(flags, VL, sve_vqm1_for_el(env, el));
-        }
-        DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
-    }
-    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
-        int sme_el = sme_exception_el(env, el);
-        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
-
-        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
-        if (sme_el == 0) {
-            /* Similarly, do not compute SVL if SME is disabled. */
-            int svl = sve_vqm1_for_el_sm(env, el, true);
-            DP_TBFLAG_A64(flags, SVL, svl);
-            if (sm) {
-                /* If SVE is disabled, we will not have set VL above. */
-                DP_TBFLAG_A64(flags, VL, svl);
-            }
-        }
-        if (sm) {
-            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
-            DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
-        }
-        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
-    }
-
-    sctlr = regime_sctlr(env, stage1);
-
-    if (sctlr & SCTLR_A) {
-        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
-    }
-
-    if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
-        DP_TBFLAG_ANY(flags, BE_DATA, 1);
-    }
-
-    if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
-        /*
-         * In order to save space in flags, we record only whether
-         * pauth is "inactive", meaning all insns are implemented as
-         * a nop, or "active" when some action must be performed.
-         * The decision of which action to take is left to a helper.
-         */
-        if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
-            DP_TBFLAG_A64(flags, PAUTH_ACTIVE, 1);
-        }
-    }
-
-    if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
-        /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
-        if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
-            DP_TBFLAG_A64(flags, BT, 1);
-        }
-    }
-
-    /* Compute the condition for using AccType_UNPRIV for LDTR et al. */
-    if (!(env->pstate & PSTATE_UAO)) {
-        switch (mmu_idx) {
-        case ARMMMUIdx_E10_1:
-        case ARMMMUIdx_E10_1_PAN:
-            /* TODO: ARMv8.3-NV */
-            DP_TBFLAG_A64(flags, UNPRIV, 1);
-            break;
-        case ARMMMUIdx_E20_2:
-        case ARMMMUIdx_E20_2_PAN:
-            /*
-             * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
-             * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
-             */
-            if (env->cp15.hcr_el2 & HCR_TGE) {
-                DP_TBFLAG_A64(flags, UNPRIV, 1);
-            }
-            break;
-        default:
-            break;
-        }
-    }
-
-    if (env->pstate & PSTATE_IL) {
-        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
-    }
-
-    if (arm_fgt_active(env, el)) {
-        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
-        if (FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, ERET)) {
-            DP_TBFLAG_A64(flags, FGT_ERET, 1);
-        }
-        if (fgt_svc(env, el)) {
-            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
-        }
-    }
-
-    if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
-        /*
-         * Set MTE_ACTIVE if any access may be Checked, and leave clear
-         * if all accesses must be Unchecked:
-         * 1) If no TBI, then there are no tags in the address to check,
-         * 2) If Tag Check Override, then all accesses are Unchecked,
-         * 3) If Tag Check Fail == 0, then Checked access have no effect,
-         * 4) If no Allocation Tag Access, then all accesses are Unchecked.
-         */
-        if (allocation_tag_access_enabled(env, el, sctlr)) {
-            DP_TBFLAG_A64(flags, ATA, 1);
-            if (tbid
-                && !(env->pstate & PSTATE_TCO)
-                && (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {
-                DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);
-            }
-        }
-        /* And again for unprivileged accesses, if required.  */
-        if (EX_TBFLAG_A64(flags, UNPRIV)
-            && tbid
-            && !(env->pstate & PSTATE_TCO)
-            && (sctlr & SCTLR_TCF0)
-            && allocation_tag_access_enabled(env, 0, sctlr)) {
-            DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);
-        }
-        /* Cache TCMA as well as TBI. */
-        DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
-    }
-
-    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_internal(CPUARMState *env)
-{
-    int el = arm_current_el(env);
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-
-    if (is_a64(env)) {
-        return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
-    } else if (arm_feature(env, ARM_FEATURE_M)) {
-        return rebuild_hflags_m32(env, fp_el, mmu_idx);
-    } else {
-        return rebuild_hflags_a32(env, fp_el, mmu_idx);
-    }
-}
-
-void arm_rebuild_hflags(CPUARMState *env)
-{
-    env->hflags = rebuild_hflags_internal(env);
-}
-
-/*
- * If we have triggered a EL state change we can't rely on the
- * translator having passed it to us, we need to recompute.
- */
-void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
-{
-    int el = arm_current_el(env);
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-
-    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
-}
-
-void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
-{
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-
-    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
-}
-
-/*
- * If we have triggered a EL state change we can't rely on the
- * translator having passed it to us, we need to recompute.
- */
-void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
-{
-    int el = arm_current_el(env);
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
-}
-
-void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
-{
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-
-    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
-}
-
-void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
-{
-    int fp_el = fp_exception_el(env, el);
-    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
-
-    env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
-}
-
-static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
-{
-#ifdef CONFIG_DEBUG_TCG
-    CPUARMTBFlags c = env->hflags;
-    CPUARMTBFlags r = rebuild_hflags_internal(env);
-
-    if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
-        fprintf(stderr, "TCG hflags mismatch "
-                        "(current:(0x%08x,0x" TARGET_FMT_lx ")"
-                        " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
-                c.flags, c.flags2, r.flags, r.flags2);
-        abort();
-    }
-#endif
-}
-
 static bool mve_no_pred(CPUARMState *env)
 {
     /*
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
 {
     g_assert_not_reached();
 }
+/* Temporarily while cpu_get_tb_cpu_state() is still in common code */
+void assert_hflags_rebuild_correctly(CPUARMState *env)
+{
+}
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM hflags
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "internals.h"
+#include "exec/helper-proto.h"
+#include "cpregs.h"
+
+static inline bool fgt_svc(CPUARMState *env, int el)
+{
+    /*
+     * Assuming fine-grained-traps are active, return true if we
+     * should be trapping on SVC instructions. Only AArch64 can
+     * trap on an SVC at EL1, but we don't need to special-case this
+     * because if this is AArch32 EL1 then arm_fgt_active() is false.
+     * We also know el is 0 or 1.
+     */
+    return el == 0 ?
+        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL0) :
+        FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, SVC_EL1);
+}
+
+static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
+                                           ARMMMUIdx mmu_idx,
+                                           CPUARMTBFlags flags)
+{
+    DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
+    DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
+
+    if (arm_singlestep_active(env)) {
+        DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
+    }
+
+    return flags;
+}
+
+static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
+                                              ARMMMUIdx mmu_idx,
+                                              CPUARMTBFlags flags)
+{
+    bool sctlr_b = arm_sctlr_b(env);
+
+    if (sctlr_b) {
+        DP_TBFLAG_A32(flags, SCTLR__B, 1);
+    }
+    if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
+        DP_TBFLAG_ANY(flags, BE_DATA, 1);
+    }
+    DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
+
+    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
+}
+
+static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
+                                        ARMMMUIdx mmu_idx)
+{
+    CPUARMTBFlags flags = {};
+    uint32_t ccr = env->v7m.ccr[env->v7m.secure];
+
+    /* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
+    if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
+        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+    }
+
+    if (arm_v7m_is_handler_mode(env)) {
+        DP_TBFLAG_M32(flags, HANDLER, 1);
+    }
+
+    /*
+     * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
+     * is suppressing them because the requested execution priority
+     * is less than 0.
+     */
+    if (arm_feature(env, ARM_FEATURE_V8) &&
+        !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
+          (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
+        DP_TBFLAG_M32(flags, STACKCHECK, 1);
+    }
+
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
+        DP_TBFLAG_M32(flags, SECURE, 1);
+    }
+
+    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+}
+
+/* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */
+static bool sme_fa64(CPUARMState *env, int el)
+{
+    if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) {
+        return false;
+    }
+
+    if (el <= 1 && !el_is_in_host(env, el)) {
+        if (!FIELD_EX64(env->vfp.smcr_el[1], SMCR, FA64)) {
+            return false;
+        }
+    }
+    if (el <= 2 && arm_is_el2_enabled(env)) {
+        if (!FIELD_EX64(env->vfp.smcr_el[2], SMCR, FA64)) {
+            return false;
+        }
+    }
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        if (!FIELD_EX64(env->vfp.smcr_el[3], SMCR, FA64)) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+                                        ARMMMUIdx mmu_idx)
+{
+    CPUARMTBFlags flags = {};
+    int el = arm_current_el(env);
+
+    if (arm_sctlr(env, el) & SCTLR_A) {
+        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+    }
+
+    if (arm_el_is_aa64(env, 1)) {
+        DP_TBFLAG_A32(flags, VFPEN, 1);
+    }
+
+    if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
+    }
+
+    if (arm_fgt_active(env, el)) {
+        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
+        if (fgt_svc(env, el)) {
+            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
+        }
+    }
+
+    if (env->uncached_cpsr & CPSR_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
+    /*
+     * The SME exception we are testing for is raised via
+     * AArch64.CheckFPAdvSIMDEnabled(), as called from
+     * AArch32.CheckAdvSIMDOrFPEnabled().
+     */
+    if (el == 0
+        && FIELD_EX64(env->svcr, SVCR, SM)
+        && (!arm_is_el2_enabled(env)
+            || (arm_el_is_aa64(env, 2) && !(env->cp15.hcr_el2 & HCR_TGE)))
+        && arm_el_is_aa64(env, 1)
+        && !sme_fa64(env, el)) {
+        DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1);
+    }
+
+    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+}
+
+static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+                                        ARMMMUIdx mmu_idx)
+{
+    CPUARMTBFlags flags = {};
+    ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
+    uint64_t sctlr;
+    int tbii, tbid;
+
+    DP_TBFLAG_ANY(flags, AARCH64_STATE, 1);
+
+    /* Get control bits for tagged addresses.  */
+    tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
+    tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
+
+    DP_TBFLAG_A64(flags, TBII, tbii);
+    DP_TBFLAG_A64(flags, TBID, tbid);
+
+    if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
+        int sve_el = sve_exception_el(env, el);
+
+        /*
+         * If either FP or SVE are disabled, translator does not need len.
+         * If SVE EL > FP EL, FP exception has precedence, and translator
+         * does not need SVE EL.  Save potential re-translations by forcing
+         * the unneeded data to zero.
+         */
+        if (fp_el != 0) {
+            if (sve_el > fp_el) {
+                sve_el = 0;
+            }
+        } else if (sve_el == 0) {
+            DP_TBFLAG_A64(flags, VL, sve_vqm1_for_el(env, el));
+        }
+        DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
+    }
+    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+        int sme_el = sme_exception_el(env, el);
+        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
+
+        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
+        if (sme_el == 0) {
+            /* Similarly, do not compute SVL if SME is disabled. */
+            int svl = sve_vqm1_for_el_sm(env, el, true);
+            DP_TBFLAG_A64(flags, SVL, svl);
+            if (sm) {
+                /* If SVE is disabled, we will not have set VL above. */
+                DP_TBFLAG_A64(flags, VL, svl);
+            }
+        }
+        if (sm) {
+            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
+            DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
+        }
+        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
+    }
+
+    sctlr = regime_sctlr(env, stage1);
+
+    if (sctlr & SCTLR_A) {
+        DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+    }
+
+    if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
+        DP_TBFLAG_ANY(flags, BE_DATA, 1);
+    }
+
+    if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
+        /*
+         * In order to save space in flags, we record only whether
+         * pauth is "inactive", meaning all insns are implemented as
+         * a nop, or "active" when some action must be performed.
+         * The decision of which action to take is left to a helper.
+         */
+        if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
+            DP_TBFLAG_A64(flags, PAUTH_ACTIVE, 1);
+        }
+    }
+
+    if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
+        /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
+        if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
+            DP_TBFLAG_A64(flags, BT, 1);
+        }
+    }
+
+    /* Compute the condition for using AccType_UNPRIV for LDTR et al. */
+    if (!(env->pstate & PSTATE_UAO)) {
+        switch (mmu_idx) {
+        case ARMMMUIdx_E10_1:
+        case ARMMMUIdx_E10_1_PAN:
+            /* TODO: ARMv8.3-NV */
+            DP_TBFLAG_A64(flags, UNPRIV, 1);
+            break;
+        case ARMMMUIdx_E20_2:
+        case ARMMMUIdx_E20_2_PAN:
+            /*
+             * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
+             * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
+             */
+            if (env->cp15.hcr_el2 & HCR_TGE) {
+                DP_TBFLAG_A64(flags, UNPRIV, 1);
+            }
+            break;
+        default:
+            break;
+        }
+    }
+
+    if (env->pstate & PSTATE_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
+    if (arm_fgt_active(env, el)) {
+        DP_TBFLAG_ANY(flags, FGT_ACTIVE, 1);
+        if (FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR], HFGITR_EL2, ERET)) {
+            DP_TBFLAG_A64(flags, FGT_ERET, 1);
+        }
+        if (fgt_svc(env, el)) {
+            DP_TBFLAG_ANY(flags, FGT_SVC, 1);
+        }
+    }
+
+    if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
+        /*
+         * Set MTE_ACTIVE if any access may be Checked, and leave clear
+         * if all accesses must be Unchecked:
+         * 1) If no TBI, then there are no tags in the address to check,
+         * 2) If Tag Check Override, then all accesses are Unchecked,
+         * 3) If Tag Check Fail == 0, then Checked access have no effect,
+         * 4) If no Allocation Tag Access, then all accesses are Unchecked.
+         */
+        if (allocation_tag_access_enabled(env, el, sctlr)) {
+            DP_TBFLAG_A64(flags, ATA, 1);
+            if (tbid
+                && !(env->pstate & PSTATE_TCO)
+                && (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {
+                DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);
+            }
+        }
+        /* And again for unprivileged accesses, if required.  */
+        if (EX_TBFLAG_A64(flags, UNPRIV)
+            && tbid
+            && !(env->pstate & PSTATE_TCO)
+            && (sctlr & SCTLR_TCF0)
+            && allocation_tag_access_enabled(env, 0, sctlr)) {
+            DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);
+        }
+        /* Cache TCMA as well as TBI. */
+        DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
+    }
+
+    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
+}
+
+static CPUARMTBFlags rebuild_hflags_internal(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    if (is_a64(env)) {
+        return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
+    } else if (arm_feature(env, ARM_FEATURE_M)) {
+        return rebuild_hflags_m32(env, fp_el, mmu_idx);
+    } else {
+        return rebuild_hflags_a32(env, fp_el, mmu_idx);
+    }
+}
+
+void arm_rebuild_hflags(CPUARMState *env)
+{
+    env->hflags = rebuild_hflags_internal(env);
+}
+
+/*
+ * If we have triggered a EL state change we can't rely on the
+ * translator having passed it to us, we need to recompute.
+ */
+void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+}
+
+void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+}
+
+/*
+ * If we have triggered a EL state change we can't rely on the
+ * translator having passed it to us, we need to recompute.
+ */
+void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
+}
+
+void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
+}
+
+void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
+}
+
+void assert_hflags_rebuild_correctly(CPUARMState *env)
+{
+#ifdef CONFIG_DEBUG_TCG
+    CPUARMTBFlags c = env->hflags;
+    CPUARMTBFlags r = rebuild_hflags_internal(env);
+
+    if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
+        fprintf(stderr, "TCG hflags mismatch "
+                        "(current:(0x%08x,0x" TARGET_FMT_lx ")"
+                        " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
+                c.flags, c.flags2, r.flags, r.flags2);
+        abort();
+    }
+#endif
+}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(files(
   'translate-neon.c',
   'translate-vfp.c',
   'crypto_helper.c',
+  'hflags.c',
   'iwmmxt_helper.c',
   'm_helper.c',
   'mve_helper.c',
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

This function is needed by common code (ptw.c), so move it along with
the other regime_* functions in internal.h. When we enable the build
without TCG, the tlb_helper.c file will not be present.

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
 /* Return the MMU index for a v7M CPU in the specified security state */
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
 
-/* Return true if the translation regime is using LPAE format page tables */
-bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
-
 /*
  * Return true if the stage 1 translation regime is using LPAE
  * format page tables
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
+/* Return true if the translation regime is using LPAE format page tables */
+static inline bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
+{
+    int el = regime_el(env, mmu_idx);
+    if (el == 2 || arm_el_is_aa64(env, el)) {
+        return true;
+    }
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
+        arm_feature(env, ARM_FEATURE_V8)) {
+        return true;
+    }
+    if (arm_feature(env, ARM_FEATURE_LPAE)
+        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
+        return true;
+    }
+    return false;
+}
+
 /**
  * arm_num_brps: Return number of implemented breakpoints.
  * Note that the ID register BRPS field is "number of bps - 1",
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 
-/* Return true if the translation regime is using LPAE format page tables */
-bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
-    int el = regime_el(env, mmu_idx);
-    if (el == 2 || arm_el_is_aa64(env, el)) {
-        return true;
-    }
-    if (arm_feature(env, ARM_FEATURE_PMSA) &&
-        arm_feature(env, ARM_FEATURE_V8)) {
-        return true;
-    }
-    if (arm_feature(env, ARM_FEATURE_LPAE)
-        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
-        return true;
-    }
-    return false;
-}
-
 /*
  * Returns true if the stage 1 translation regime is using LPAE format page
  * tables. Used when raising alignment exceptions, whose FSR changes depending
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

When TCG is disabled this part of the code should not be reachable, so
wrap it with an ifdef for now.

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_host = NULL;
         ptw->out_rw = false;
     } else {
+#ifdef CONFIG_TCG
         CPUTLBEntryFull *full;
         int flags;
 
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_rw = full->prot & PAGE_WRITE;
         pte_attrs = full->pte_attrs;
         pte_secure = full->attrs.secure;
+#else
+        g_assert_not_reached();
+#endif
     }
 
     if (regime_is_stage2(s2_mmu_idx)) {
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

This struct has no dependencies on TCG code and it is being used in
target/arm/ptw.c to simplify the passing around of page table walk
results. Those routines can be reached by KVM code via the gdbstub
breakpoint code, so take the structure out of CONFIG_TCG to make it
visible when building with --disable-tcg.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/cpu-defs.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
 
 QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
 
+
+#endif  /* !CONFIG_USER_ONLY && CONFIG_TCG */
+
+#if !defined(CONFIG_USER_ONLY)
 /*
  * The full TLB entry, which is not accessed by generated TCG code,
  * so the layout is not as critical as that of CPUTLBEntry. This is
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
     TARGET_PAGE_ENTRY_EXTRA
 #endif
 } CPUTLBEntryFull;
+#endif  /* !CONFIG_USER_ONLY */
 
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 /*
  * Data elements that are per MMU mode, minus the bits accessed by
  * the TCG fast path.
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Since &I2C_SLAVE(dev)->qdev == dev, no need to go back and
forth with QOM type casting. Directly use 'dev'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230220115114.25237-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/max7310.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/gpio/max7310.c b/hw/gpio/max7310.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/max7310.c
+++ b/hw/gpio/max7310.c
@@ -XXX,XX +XXX,XX @@ static void max7310_gpio_set(void *opaque, int line, int level)
  * but also accepts sequences that are not SMBus so return an I2C device.  */
 static void max7310_realize(DeviceState *dev, Error **errp)
 {
-    I2CSlave *i2c = I2C_SLAVE(dev);
     MAX7310State *s = MAX7310(dev);
 
-    qdev_init_gpio_in(&i2c->qdev, max7310_gpio_set, 8);
-    qdev_init_gpio_out(&i2c->qdev, s->handler, 8);
+    qdev_init_gpio_in(dev, max7310_gpio_set, ARRAY_SIZE(s->handler));
+    qdev_init_gpio_out(dev, s->handler, ARRAY_SIZE(s->handler));
 }
 
 static void max7310_class_init(ObjectClass *klass, void *data)
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

pl011_create() is only used in DeviceRealize handlers,
not a hot-path. Inlining is not justified.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230220115114.25237-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/pl011.h | 19 +------------------
 hw/char/pl011.c         | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/pl011.h
+++ b/include/hw/char/pl011.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_PL011_H
 #define HW_PL011_H
 
-#include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "chardev/char-fe.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #define TYPE_PL011 "pl011"
@@ -XXX,XX +XXX,XX @@ struct PL011State {
     const unsigned char *id;
 };
 
-static inline DeviceState *pl011_create(hwaddr addr,
-                                        qemu_irq irq,
-                                        Chardev *chr)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new("pl011");
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_chr(dev, "chardev", chr);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, irq);
-
-    return dev;
-}
+DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr);
 
 static inline DeviceState *pl011_luminary_create(hwaddr addr,
                                                  qemu_irq irq,
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "hw/char/pl011.h"
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "migration/vmstate.h"
 #include "chardev/char-fe.h"
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "trace.h"
 
+DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr)
+{
+    DeviceState *dev;
+    SysBusDevice *s;
+
+    dev = qdev_new("pl011");
+    s = SYS_BUS_DEVICE(dev);
+    qdev_prop_set_chr(dev, "chardev", chr);
+    sysbus_realize_and_unref(s, &error_fatal);
+    sysbus_mmio_map(s, 0, addr);
+    sysbus_connect_irq(s, 0, irq);
+
+    return dev;
+}
+
 #define PL011_INT_TX 0x20
 #define PL011_INT_RX 0x10
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

pl011_luminary_create() is only used for the Stellaris board,
open-code it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230220115114.25237-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/pl011.h | 17 -----------------
 hw/arm/stellaris.c      | 11 ++++++++---
 2 files changed, 8 insertions(+), 20 deletions(-)

diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/pl011.h
+++ b/include/hw/char/pl011.h
@@ -XXX,XX +XXX,XX @@ struct PL011State {
 
 DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr);
 
-static inline DeviceState *pl011_luminary_create(hwaddr addr,
-                                                 qemu_irq irq,
-                                                 Chardev *chr)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new("pl011_luminary");
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_chr(dev, "chardev", chr);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, irq);
-
-    return dev;
-}
-
 #endif
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 
     for (i = 0; i < 4; i++) {
         if (board->dc2 & (1 << i)) {
-            pl011_luminary_create(0x4000c000 + i * 0x1000,
-                                  qdev_get_gpio_in(nvic, uart_irq[i]),
-                                  serial_hd(i));
+            SysBusDevice *sbd;
+
+            dev = qdev_new("pl011_luminary");
+            sbd = SYS_BUS_DEVICE(dev);
+            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+            sysbus_realize_and_unref(sbd, &error_fatal);
+            sysbus_mmio_map(sbd, 0, 0x4000c000 + i * 0x1000);
+            sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
         }
     }
     if (board->dc2 & (1 << 4)) {
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230220115114.25237-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/xilinx_uartlite.h | 6 +++++-
 hw/char/xilinx_uartlite.c         | 4 +---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/hw/char/xilinx_uartlite.h b/include/hw/char/xilinx_uartlite.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/xilinx_uartlite.h
+++ b/include/hw/char/xilinx_uartlite.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "qapi/error.h"
+#include "qom/object.h"
+
+#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
+OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
 
 static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
                                         qemu_irq irq,
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_new("xlnx.xps-uartlite");
+    dev = qdev_new(TYPE_XILINX_UARTLITE);
     s = SYS_BUS_DEVICE(dev);
     qdev_prop_set_chr(dev, "chardev", chr);
     sysbus_realize_and_unref(s, &error_fatal);
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "hw/char/xilinx_uartlite.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
@@ -XXX,XX +XXX,XX @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
-#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
-OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
-
 struct XilinxUARTLite {
     SysBusDevice parent_obj;
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Open-code the single use of xilinx_uartlite_create().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230220115114.25237-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/xilinx_uartlite.h        | 20 --------------------
 hw/microblaze/petalogix_s3adsp1800_mmu.c |  7 +++++--
 2 files changed, 5 insertions(+), 22 deletions(-)

diff --git a/include/hw/char/xilinx_uartlite.h b/include/hw/char/xilinx_uartlite.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/xilinx_uartlite.h
+++ b/include/hw/char/xilinx_uartlite.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XILINX_UARTLITE_H
 #define XILINX_UARTLITE_H
 
-#include "hw/qdev-properties.h"
-#include "hw/sysbus.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
 OBJECT_DECLARE_SIMPLE_TYPE(XilinxUARTLite, XILINX_UARTLITE)
 
-static inline DeviceState *xilinx_uartlite_create(hwaddr addr,
-                                        qemu_irq irq,
-                                        Chardev *chr)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new(TYPE_XILINX_UARTLITE);
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_chr(dev, "chardev", chr);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, irq);
-
-    return dev;
-}
-
 #endif
diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -XXX,XX +XXX,XX @@ petalogix_s3adsp1800_init(MachineState *machine)
         irq[i] = qdev_get_gpio_in(dev, i);
     }
 
-    xilinx_uartlite_create(UARTLITE_BASEADDR, irq[UARTLITE_IRQ],
-                           serial_hd(0));
+    dev = qdev_new(TYPE_XILINX_UARTLITE);
+    qdev_prop_set_chr(dev, "chardev", serial_hd(0));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, UARTLITE_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[UARTLITE_IRQ]);
 
     /* 2 timers at irq 2 @ 62 Mhz.  */
     dev = qdev_new("xlnx.xps-timer");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

cmsdk_apb_uart_create() is only used twice in the same
file. Open-code it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230220115114.25237-7-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/cmsdk-apb-uart.h | 34 --------------------------
 hw/arm/mps2.c                    | 41 +++++++++++++++++++++-----------
 2 files changed, 27 insertions(+), 48 deletions(-)

diff --git a/include/hw/char/cmsdk-apb-uart.h b/include/hw/char/cmsdk-apb-uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/cmsdk-apb-uart.h
+++ b/include/hw/char/cmsdk-apb-uart.h
@@ -XXX,XX +XXX,XX @@
 #ifndef CMSDK_APB_UART_H
 #define CMSDK_APB_UART_H
 
-#include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "chardev/char-fe.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_UART "cmsdk-apb-uart"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBUART {
     uint8_t rxbuf;
 };
 
-/**
- * cmsdk_apb_uart_create - convenience function to create TYPE_CMSDK_APB_UART
- * @addr: location in system memory to map registers
- * @chr: Chardev backend to connect UART to, or NULL if no backend
- * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
- */
-static inline DeviceState *cmsdk_apb_uart_create(hwaddr addr,
-                                                 qemu_irq txint,
-                                                 qemu_irq rxint,
-                                                 qemu_irq txovrint,
-                                                 qemu_irq rxovrint,
-                                                 qemu_irq uartint,
-                                                 Chardev *chr,
-                                                 uint32_t pclk_frq)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new(TYPE_CMSDK_APB_UART);
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_chr(dev, "chardev", chr);
-    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, txint);
-    sysbus_connect_irq(s, 1, rxint);
-    sysbus_connect_irq(s, 2, txovrint);
-    sysbus_connect_irq(s, 3, rxovrint);
-    sysbus_connect_irq(s, 4, uartint);
-    return dev;
-}
-
 #endif
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
+#include "hw/qdev-properties.h"
 #include "hw/misc/unimp.h"
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/timer/cmsdk-apb-timer.h"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
 
         for (i = 0; i < 5; i++) {
+            DeviceState *dev;
+            SysBusDevice *s;
+
             static const hwaddr uartbase[] = {0x40004000, 0x40005000,
                                               0x40006000, 0x40007000,
                                               0x40009000};
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                 rxovrint = qdev_get_gpio_in(orgate_dev, i * 2 + 1);
             }
 
-            cmsdk_apb_uart_create(uartbase[i],
-                                  qdev_get_gpio_in(armv7m, uartirq[i] + 1),
-                                  qdev_get_gpio_in(armv7m, uartirq[i]),
-                                  txovrint, rxovrint,
-                                  NULL,
-                                  serial_hd(i), SYSCLK_FRQ);
+            dev = qdev_new(TYPE_CMSDK_APB_UART);
+            s = SYS_BUS_DEVICE(dev);
+            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+            qdev_prop_set_uint32(dev, "pclk-frq", SYSCLK_FRQ);
+            sysbus_realize_and_unref(s, &error_fatal);
+            sysbus_mmio_map(s, 0, uartbase[i]);
+            sysbus_connect_irq(s, 0, qdev_get_gpio_in(armv7m, uartirq[i] + 1));
+            sysbus_connect_irq(s, 1, qdev_get_gpio_in(armv7m, uartirq[i]));
+            sysbus_connect_irq(s, 2, txovrint);
+            sysbus_connect_irq(s, 3, rxovrint);
         }
         break;
     }
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                               0x4002c000, 0x4002d000,
                                               0x4002e000};
             Object *txrx_orgate;
-            DeviceState *txrx_orgate_dev;
+            DeviceState *txrx_orgate_dev, *dev;
+            SysBusDevice *s;
 
             txrx_orgate = object_new(TYPE_OR_IRQ);
             object_property_set_int(txrx_orgate, "num-lines", 2, &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
             txrx_orgate_dev = DEVICE(txrx_orgate);
             qdev_connect_gpio_out(txrx_orgate_dev, 0,
                                   qdev_get_gpio_in(armv7m, uart_txrx_irqno[i]));
-            cmsdk_apb_uart_create(uartbase[i],
-                                  qdev_get_gpio_in(txrx_orgate_dev, 0),
-                                  qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, i * 2),
-                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
-                                  NULL,
-                                  serial_hd(i), SYSCLK_FRQ);
+
+            dev = qdev_new(TYPE_CMSDK_APB_UART);
+            s = SYS_BUS_DEVICE(dev);
+            qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+            qdev_prop_set_uint32(dev, "pclk-frq", SYSCLK_FRQ);
+            sysbus_realize_and_unref(s, &error_fatal);
+            sysbus_mmio_map(s, 0, uartbase[i]);
+            sysbus_connect_irq(s, 0, qdev_get_gpio_in(txrx_orgate_dev, 0));
+            sysbus_connect_irq(s, 1, qdev_get_gpio_in(txrx_orgate_dev, 1));
+            sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
+            sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
         }
         break;
     }
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Avoid accessing 'parent_obj' directly.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230220115114.25237-9-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
              * which saves having to have an extra argument is_terminal
              * that we'd only use in one place.
              */
-            cpu_abort(&s->cpu->parent_obj,
+            cpu_abort(CPU(s->cpu),
                       "Lockup: can't take terminal derived exception "
                       "(original exception priority %d)\n",
                       s->vectpending_prio);
@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
                  * Lockup condition due to a guest bug. We don't model
                  * Lockup, so report via cpu_abort() instead.
                  */
-                cpu_abort(&s->cpu->parent_obj,
+                cpu_abort(CPU(s->cpu),
                           "Lockup: can't escalate %d to HardFault "
                           "(current priority %d)\n", irq, running);
             }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure)
              * We want to escalate to HardFault but the context the
              * FP state belongs to prevents the exception pre-empting.
              */
-            cpu_abort(&s->cpu->parent_obj,
+            cpu_abort(CPU(s->cpu),
                       "Lockup: can't escalate to HardFault during "
                       "lazy FP register stacking\n");
         }
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

QOM *DECLARE* macros expect a typedef as first argument,
not a structure. Replace 'struct IRQState' by 'IRQState'
to avoid when modifying the macros:

../hw/core/irq.c:29:1: error: declaration of anonymous struct must be a definition
  DECLARE_INSTANCE_CHECKER(struct IRQState, IRQ,
  ^

Use OBJECT_DECLARE_SIMPLE_TYPE instead of DECLARE_INSTANCE_CHECKER.

diff --git a/hw/core/irq.c b/hw/core/irq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "qom/object.h"
 
-DECLARE_INSTANCE_CHECKER(struct IRQState, IRQ,
-                         TYPE_IRQ)
+OBJECT_DECLARE_SIMPLE_TYPE(IRQState, IRQ)
 
 struct IRQState {
     Object parent_obj;
@@ -XXX,XX +XXX,XX @@ qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n)
 
 qemu_irq qemu_allocate_irq(qemu_irq_handler handler, void *opaque, int n)
 {
-    struct IRQState *irq;
+    IRQState *irq;
 
     irq = IRQ(object_new(TYPE_IRQ));
     irq->handler = handler;
@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq)
 
 static void qemu_notirq(void *opaque, int line, int level)
 {
-    struct IRQState *irq = opaque;
+    IRQState *irq = opaque;
 
     irq->handler(irq->opaque, irq->n, !level);
 }
@@ -XXX,XX +XXX,XX @@ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
 static const TypeInfo irq_type_info = {
    .name = TYPE_IRQ,
    .parent = TYPE_OBJECT,
-   .instance_size = sizeof(struct IRQState),
+   .instance_size = sizeof(IRQState),
 };
 
 static void irq_register_types(void)
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

OBJECT_DECLARE_SIMPLE_TYPE() macro provides the OrIRQState
declaration for free. Besides, the QOM code style is to use
the structure name as typedef, and QEMU style is to use Camel
Case, so rename qemu_or_irq as OrIRQState.

Mechanical change using:

$ sed -i -e 's/qemu_or_irq/OrIRQState/g' $(git grep -l qemu_or_irq)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20230113200138.52869-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/armsse.h              |  6 +++---
 include/hw/arm/bcm2835_peripherals.h |  2 +-
 include/hw/arm/exynos4210.h          |  4 ++--
 include/hw/arm/stm32f205_soc.h       |  2 +-
 include/hw/arm/stm32f405_soc.h       |  2 +-
 include/hw/arm/xlnx-versal.h         |  6 +++---
 include/hw/arm/xlnx-zynqmp.h         |  2 +-
 include/hw/or-irq.h                  |  2 --
 hw/arm/exynos4210.c                  |  4 ++--
 hw/arm/mps2-tz.c                     |  2 +-
 hw/core/or-irq.c                     | 18 +++++++++---------
 hw/pci-host/raven.c                  |  2 +-
 12 files changed, 25 insertions(+), 27 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
     TZPPC apb_ppc[NUM_INTERNAL_PPCS];
     TZMPC mpc[IOTS_NUM_MPC];
     CMSDKAPBTimer timer[3];
-    qemu_or_irq ppc_irq_orgate;
+    OrIRQState ppc_irq_orgate;
     SplitIRQ sec_resp_splitter;
     SplitIRQ ppc_irq_splitter[NUM_PPCS];
     SplitIRQ mpc_irq_splitter[IOTS_NUM_EXP_MPC + IOTS_NUM_MPC];
-    qemu_or_irq mpc_irq_orgate;
-    qemu_or_irq nmi_orgate;
+    OrIRQState mpc_irq_orgate;
+    OrIRQState nmi_orgate;
 
     SplitIRQ cpu_irq_splitter[NUM_SSE_IRQS];
 
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
     BCM2835AuxState aux;
     BCM2835FBState fb;
     BCM2835DMAState dma;
-    qemu_or_irq orgated_dma_irq;
+    OrIRQState orgated_dma_irq;
     BCM2835ICState ic;
     BCM2835PropertyState property;
     BCM2835RngState rng;
diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     MemoryRegion boot_secondary;
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
-    qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
-    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+    OrIRQState pl330_irq_orgate[EXYNOS4210_NUM_DMA];
+    OrIRQState cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
     Exynos4210GicState ext_gic;
     Exynos4210CombinerState int_combiner;
diff --git a/include/hw/arm/stm32f205_soc.h b/include/hw/arm/stm32f205_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32f205_soc.h
+++ b/include/hw/arm/stm32f205_soc.h
@@ -XXX,XX +XXX,XX @@ struct STM32F205State {
     STM32F2XXADCState adc[STM_NUM_ADCS];
     STM32F2XXSPIState spi[STM_NUM_SPIS];
 
-    qemu_or_irq *adc_irqs;
+    OrIRQState *adc_irqs;
 
     MemoryRegion sram;
     MemoryRegion flash;
diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32f405_soc.h
+++ b/include/hw/arm/stm32f405_soc.h
@@ -XXX,XX +XXX,XX @@ struct STM32F405State {
     STM32F4xxExtiState exti;
     STM32F2XXUsartState usart[STM_NUM_USARTS];
     STM32F2XXTimerState timer[STM_NUM_TIMERS];
-    qemu_or_irq adc_irqs;
+    OrIRQState adc_irqs;
     STM32F2XXADCState adc[STM_NUM_ADCS];
     STM32F2XXSPIState spi[STM_NUM_SPIS];
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ struct Versal {
         } rpu;
 
         struct {
-            qemu_or_irq irq_orgate;
+            OrIRQState irq_orgate;
             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
         } xram;
 
@@ -XXX,XX +XXX,XX @@ struct Versal {
                 XlnxCSUDMA dma_src;
                 XlnxCSUDMA dma_dst;
                 MemoryRegion linear_mr;
-                qemu_or_irq irq_orgate;
+                OrIRQState irq_orgate;
             } ospi;
         } iou;
 
@@ -XXX,XX +XXX,XX @@ struct Versal {
         XlnxVersalEFuseCtrl efuse_ctrl;
         XlnxVersalEFuseCache efuse_cache;
 
-        qemu_or_irq apb_irq_orgate;
+        OrIRQState apb_irq_orgate;
     } pmc;
 
     struct {
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     XlnxZDMA gdma[XLNX_ZYNQMP_NUM_GDMA_CH];
     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
     XlnxCSUDMA qspi_dma;
-    qemu_or_irq qspi_irq_orgate;
+    OrIRQState qspi_irq_orgate;
     XlnxZynqMPAPUCtrl apu_ctrl;
     XlnxZynqMPCRF crf;
     CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/or-irq.h
+++ b/include/hw/or-irq.h
@@ -XXX,XX +XXX,XX @@
  */
 #define MAX_OR_LINES      48
 
-typedef struct OrIRQState qemu_or_irq;
-
 OBJECT_DECLARE_SIMPLE_TYPE(OrIRQState, OR_IRQ)
 
 struct OrIRQState {
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
-static DeviceState *pl330_create(uint32_t base, qemu_or_irq *orgate,
+static DeviceState *pl330_create(uint32_t base, OrIRQState *orgate,
                                  qemu_irq irq, int nreq, int nevents, int width)
 {
     SysBusDevice *busdev;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
 
     for (i = 0; i < ARRAY_SIZE(s->pl330_irq_orgate); i++) {
         char *name = g_strdup_printf("pl330-irq-orgate%d", i);
-        qemu_or_irq *orgate = &s->pl330_irq_orgate[i];
+        OrIRQState *orgate = &s->pl330_irq_orgate[i];
 
         object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
         g_free(name);
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
     TZMSC msc[4];
     CMSDKAPBUART uart[6];
     SplitIRQ sec_resp_splitter;
-    qemu_or_irq uart_irq_orgate;
+    OrIRQState uart_irq_orgate;
     DeviceState *lan9118;
     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
     Clock *sysclk;
diff --git a/hw/core/or-irq.c b/hw/core/or-irq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/or-irq.c
+++ b/hw/core/or-irq.c
@@ -XXX,XX +XXX,XX @@
 
 static void or_irq_handler(void *opaque, int n, int level)
 {
-    qemu_or_irq *s = OR_IRQ(opaque);
+    OrIRQState *s = OR_IRQ(opaque);
     int or_level = 0;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void or_irq_handler(void *opaque, int n, int level)
 
 static void or_irq_reset(DeviceState *dev)
 {
-    qemu_or_irq *s = OR_IRQ(dev);
+    OrIRQState *s = OR_IRQ(dev);
     int i;
 
     for (i = 0; i < MAX_OR_LINES; i++) {
@@ -XXX,XX +XXX,XX @@ static void or_irq_reset(DeviceState *dev)
 
 static void or_irq_realize(DeviceState *dev, Error **errp)
 {
-    qemu_or_irq *s = OR_IRQ(dev);
+    OrIRQState *s = OR_IRQ(dev);
 
     assert(s->num_lines <= MAX_OR_LINES);
 
@@ -XXX,XX +XXX,XX @@ static void or_irq_realize(DeviceState *dev, Error **errp)
 
 static void or_irq_init(Object *obj)
 {
-    qemu_or_irq *s = OR_IRQ(obj);
+    OrIRQState *s = OR_IRQ(obj);
 
     qdev_init_gpio_out(DEVICE(obj), &s->out_irq, 1);
 }
@@ -XXX,XX +XXX,XX @@ static void or_irq_init(Object *obj)
 
 static bool vmstate_extras_needed(void *opaque)
 {
-    qemu_or_irq *s = OR_IRQ(opaque);
+    OrIRQState *s = OR_IRQ(opaque);
 
     return s->num_lines >= OLD_MAX_OR_LINES;
 }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq_extras = {
     .minimum_version_id = 1,
     .needed = vmstate_extras_needed,
     .fields = (VMStateField[]) {
-        VMSTATE_VARRAY_UINT16_UNSAFE(levels, qemu_or_irq, num_lines, 0,
+        VMSTATE_VARRAY_UINT16_UNSAFE(levels, OrIRQState, num_lines, 0,
                                      vmstate_info_bool, bool),
         VMSTATE_END_OF_LIST(),
     },
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_BOOL_SUB_ARRAY(levels, qemu_or_irq, 0, OLD_MAX_OR_LINES),
+        VMSTATE_BOOL_SUB_ARRAY(levels, OrIRQState, 0, OLD_MAX_OR_LINES),
         VMSTATE_END_OF_LIST(),
     },
     .subsections = (const VMStateDescription*[]) {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_or_irq = {
 };
 
 static Property or_irq_properties[] = {
-    DEFINE_PROP_UINT16("num-lines", qemu_or_irq, num_lines, 1),
+    DEFINE_PROP_UINT16("num-lines", OrIRQState, num_lines, 1),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static void or_irq_class_init(ObjectClass *klass, void *data)
 static const TypeInfo or_irq_type_info = {
    .name = TYPE_OR_IRQ,
    .parent = TYPE_DEVICE,
-   .instance_size = sizeof(qemu_or_irq),
+   .instance_size = sizeof(OrIRQState),
    .instance_init = or_irq_init,
    .class_init = or_irq_class_init,
 };
diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(PREPPCIState, RAVEN_PCI_HOST_BRIDGE,
 struct PRePPCIState {
     PCIHostState parent_obj;
 
-    qemu_or_irq *or_irq;
+    OrIRQState *or_irq;
     qemu_irq pci_irqs[PCI_NUM_PINS];
     PCIBus pci_bus;
     AddressSpace pci_io_as;
-- 
2.34.1