--- /dev/null
+From 707f294ca28977968fb85bf36f10c6b37b16f557 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Wed, 29 Aug 2012 23:54:25 +0400
+Subject: [PATCH] target-xtensa: convert host errno values to guest
+
+Guest errno values are taken from the newlib. Convert only those errno
+values that can be returned from used system calls.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-xtensa/xtensa-semi.c | 106 ++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 98 insertions(+), 8 deletions(-)
+
+diff --git a/target-xtensa/xtensa-semi.c b/target-xtensa/xtensa-semi.c
+index 6d001c2..e745bef 100644
+--- a/target-xtensa/xtensa-semi.c
++++ b/target-xtensa/xtensa-semi.c
+@@ -54,6 +54,96 @@ enum {
+ SELECT_ONE_EXCEPT = 3,
+ };
+
++enum {
++ TARGET_EPERM = 1,
++ TARGET_ENOENT = 2,
++ TARGET_ESRCH = 3,
++ TARGET_EINTR = 4,
++ TARGET_EIO = 5,
++ TARGET_ENXIO = 6,
++ TARGET_E2BIG = 7,
++ TARGET_ENOEXEC = 8,
++ TARGET_EBADF = 9,
++ TARGET_ECHILD = 10,
++ TARGET_EAGAIN = 11,
++ TARGET_ENOMEM = 12,
++ TARGET_EACCES = 13,
++ TARGET_EFAULT = 14,
++ TARGET_ENOTBLK = 15,
++ TARGET_EBUSY = 16,
++ TARGET_EEXIST = 17,
++ TARGET_EXDEV = 18,
++ TARGET_ENODEV = 19,
++ TARGET_ENOTDIR = 20,
++ TARGET_EISDIR = 21,
++ TARGET_EINVAL = 22,
++ TARGET_ENFILE = 23,
++ TARGET_EMFILE = 24,
++ TARGET_ENOTTY = 25,
++ TARGET_ETXTBSY = 26,
++ TARGET_EFBIG = 27,
++ TARGET_ENOSPC = 28,
++ TARGET_ESPIPE = 29,
++ TARGET_EROFS = 30,
++ TARGET_EMLINK = 31,
++ TARGET_EPIPE = 32,
++ TARGET_EDOM = 33,
++ TARGET_ERANGE = 34,
++ TARGET_ENOSYS = 88,
++ TARGET_ELOOP = 92,
++};
++
++static uint32_t errno_h2g(int host_errno)
++{
++ static const uint32_t guest_errno[] = {
++ [EPERM] = TARGET_EPERM,
++ [ENOENT] = TARGET_ENOENT,
++ [ESRCH] = TARGET_ESRCH,
++ [EINTR] = TARGET_EINTR,
++ [EIO] = TARGET_EIO,
++ [ENXIO] = TARGET_ENXIO,
++ [E2BIG] = TARGET_E2BIG,
++ [ENOEXEC] = TARGET_ENOEXEC,
++ [EBADF] = TARGET_EBADF,
++ [ECHILD] = TARGET_ECHILD,
++ [EAGAIN] = TARGET_EAGAIN,
++ [ENOMEM] = TARGET_ENOMEM,
++ [EACCES] = TARGET_EACCES,
++ [EFAULT] = TARGET_EFAULT,
++ [ENOTBLK] = TARGET_ENOTBLK,
++ [EBUSY] = TARGET_EBUSY,
++ [EEXIST] = TARGET_EEXIST,
++ [EXDEV] = TARGET_EXDEV,
++ [ENODEV] = TARGET_ENODEV,
++ [ENOTDIR] = TARGET_ENOTDIR,
++ [EISDIR] = TARGET_EISDIR,
++ [EINVAL] = TARGET_EINVAL,
++ [ENFILE] = TARGET_ENFILE,
++ [EMFILE] = TARGET_EMFILE,
++ [ENOTTY] = TARGET_ENOTTY,
++ [ETXTBSY] = TARGET_ETXTBSY,
++ [EFBIG] = TARGET_EFBIG,
++ [ENOSPC] = TARGET_ENOSPC,
++ [ESPIPE] = TARGET_ESPIPE,
++ [EROFS] = TARGET_EROFS,
++ [EMLINK] = TARGET_EMLINK,
++ [EPIPE] = TARGET_EPIPE,
++ [EDOM] = TARGET_EDOM,
++ [ERANGE] = TARGET_ERANGE,
++ [ENOSYS] = TARGET_ENOSYS,
++ [ELOOP] = TARGET_ELOOP,
++ };
++
++ if (host_errno == 0) {
++ return 0;
++ } else if (host_errno > 0 && host_errno < ARRAY_SIZE(guest_errno) &&
++ guest_errno[host_errno]) {
++ return guest_errno[host_errno];
++ } else {
++ return TARGET_EINVAL;
++ }
++}
++
+ void HELPER(simcall)(CPUXtensaState *env)
+ {
+ uint32_t *regs = env->regs;
+@@ -87,14 +177,14 @@ void HELPER(simcall)(CPUXtensaState *env)
+ regs[2] = is_write ?
+ write(fd, buf, io_sz) :
+ read(fd, buf, io_sz);
+- regs[3] = errno;
++ regs[3] = errno_h2g(errno);
+ cpu_physical_memory_unmap(buf, sz, is_write, sz);
+ if (regs[2] == -1) {
+ break;
+ }
+ } else {
+ regs[2] = -1;
+- regs[3] = EINVAL;
++ regs[3] = TARGET_EINVAL;
+ break;
+ }
+ }
+@@ -117,10 +207,10 @@ void HELPER(simcall)(CPUXtensaState *env)
+
+ if (rc == 0 && i < ARRAY_SIZE(name)) {
+ regs[2] = open(name, regs[4], regs[5]);
+- regs[3] = errno;
++ regs[3] = errno_h2g(errno);
+ } else {
+ regs[2] = -1;
+- regs[3] = EINVAL;
++ regs[3] = TARGET_EINVAL;
+ }
+ }
+ break;
+@@ -130,13 +220,13 @@ void HELPER(simcall)(CPUXtensaState *env)
+ regs[2] = regs[3] = 0;
+ } else {
+ regs[2] = close(regs[3]);
+- regs[3] = errno;
++ regs[3] = errno_h2g(errno);
+ }
+ break;
+
+ case TARGET_SYS_lseek:
+ regs[2] = lseek(regs[3], (off_t)(int32_t)regs[4], regs[5]);
+- regs[3] = errno;
++ regs[3] = errno_h2g(errno);
+ break;
+
+ case TARGET_SYS_select_one:
+@@ -163,7 +253,7 @@ void HELPER(simcall)(CPUXtensaState *env)
+ rq == SELECT_ONE_WRITE ? &fdset : NULL,
+ rq == SELECT_ONE_EXCEPT ? &fdset : NULL,
+ target_tv ? &tv : NULL);
+- regs[3] = errno;
++ regs[3] = errno_h2g(errno);
+ }
+ break;
+
+@@ -219,7 +309,7 @@ void HELPER(simcall)(CPUXtensaState *env)
+ default:
+ qemu_log("%s(%d): not implemented\n", __func__, regs[2]);
+ regs[2] = -1;
+- regs[3] = ENOSYS;
++ regs[3] = TARGET_ENOSYS;
+ break;
+ }
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 8057ac10e8cba3acb89c11c94f04967306e55a9f Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 7 Sep 2012 22:36:08 +0200
+Subject: [PATCH] target-cris: Fix buffer overflow
+
+Report from smatch:
+
+target-cris/translate.c:3464 cpu_dump_state(32) error:
+ buffer overflow 'env->sregs' 4 <= 255
+
+sregs is declared 'uint32_t sregs[4][16]', so the first index must be
+less than 4 or ARRAY_SIZE(env->sregs).
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-cris/translate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target-cris/translate.c b/target-cris/translate.c
+index 1ad9ec7..ad31877 100644
+--- a/target-cris/translate.c
++++ b/target-cris/translate.c
+@@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
+ }
+ srs = env->pregs[PR_SRS];
+ cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs);
+- if (srs < 256) {
++ if (srs < ARRAY_SIZE(env->sregs)) {
+ for (i = 0; i < 16; i++) {
+ cpu_fprintf(f, "s%2.2d=%8.8x ",
+ i, env->sregs[srs][i]);
+--
+1.7.12.1
+
--- /dev/null
+From 33e25a4a6c6dc7632b15ee50637d33b4c3cf729e Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Thu, 6 Sep 2012 04:36:46 +0400
+Subject: [PATCH] target-xtensa: fix missing errno codes for mingw32
+
+Put the following errno value mappings under #ifdef:
+
+xtensa-semi.c: In function 'errno_h2g':
+xtensa-semi.c:113: error: 'ENOTBLK' undeclared (first use in this function)
+xtensa-semi.c:113: error: (Each undeclared identifier is reported only once
+xtensa-semi.c:113: error: for each function it appears in.)
+xtensa-semi.c:113: error: array index in initializer not of integer type
+xtensa-semi.c:113: error: (near initialization for 'guest_errno')
+xtensa-semi.c:124: error: 'ETXTBSY' undeclared (first use in this function)
+xtensa-semi.c:124: error: array index in initializer not of integer type
+xtensa-semi.c:124: error: (near initialization for 'guest_errno')
+xtensa-semi.c:134: error: 'ELOOP' undeclared (first use in this function)
+xtensa-semi.c:134: error: array index in initializer not of integer type
+xtensa-semi.c:134: error: (near initialization for 'guest_errno')
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-xtensa/xtensa-semi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/target-xtensa/xtensa-semi.c b/target-xtensa/xtensa-semi.c
+index e745bef..52be07a 100644
+--- a/target-xtensa/xtensa-semi.c
++++ b/target-xtensa/xtensa-semi.c
+@@ -110,7 +110,9 @@ static uint32_t errno_h2g(int host_errno)
+ [ENOMEM] = TARGET_ENOMEM,
+ [EACCES] = TARGET_EACCES,
+ [EFAULT] = TARGET_EFAULT,
++#ifdef ENOTBLK
+ [ENOTBLK] = TARGET_ENOTBLK,
++#endif
+ [EBUSY] = TARGET_EBUSY,
+ [EEXIST] = TARGET_EEXIST,
+ [EXDEV] = TARGET_EXDEV,
+@@ -121,7 +123,9 @@ static uint32_t errno_h2g(int host_errno)
+ [ENFILE] = TARGET_ENFILE,
+ [EMFILE] = TARGET_EMFILE,
+ [ENOTTY] = TARGET_ENOTTY,
++#ifdef ETXTBSY
+ [ETXTBSY] = TARGET_ETXTBSY,
++#endif
+ [EFBIG] = TARGET_EFBIG,
+ [ENOSPC] = TARGET_ENOSPC,
+ [ESPIPE] = TARGET_ESPIPE,
+@@ -131,7 +135,9 @@ static uint32_t errno_h2g(int host_errno)
+ [EDOM] = TARGET_EDOM,
+ [ERANGE] = TARGET_ERANGE,
+ [ENOSYS] = TARGET_ENOSYS,
++#ifdef ELOOP
+ [ELOOP] = TARGET_ELOOP,
++#endif
+ };
+
+ if (host_errno == 0) {
+--
+1.7.12.1
+
--- /dev/null
+From 5e955b895d4a92cdc49c7b4e76284483d49aa4b8 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 7 Sep 2012 17:13:28 +0200
+Subject: [PATCH] target-sparc: fix fcmp{s,d,q} instructions wrt exception
+
+fcmp{s,d,q} instructions are supposed to ignore quiet NaN (contrary to
+the fcmpe{s,d,q} instructions), but the current code is wrongly setting
+the NV exception in that case. Moreover the current code is duplicated:
+first the arguments are checked for NaN to generate an exception, and
+later in case the comparison is unordered (which can only happens if one
+of the argument is a NaN), the same check is done to generate an
+exception.
+
+Fix that by calling clear_float_exceptions() followed by
+check_ieee_exceptions() as for the other floating point instructions.
+Use the _compare_quiet functions for fcmp{s,d,q} and the _compare ones
+for fcmpe{s,d,q}. Simplify the flag setting by not clearing a flag that
+is set the line just below.
+
+This fix allows the math glibc testsuite to pass.
+
+Cc: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-sparc/fop_helper.c | 67 +++++++++++++++++++----------------------------
+ 1 file changed, 27 insertions(+), 40 deletions(-)
+
+diff --git a/target-sparc/fop_helper.c b/target-sparc/fop_helper.c
+index 9c64ef8..f4b62a5 100644
+--- a/target-sparc/fop_helper.c
++++ b/target-sparc/fop_helper.c
+@@ -334,34 +334,28 @@ void helper_fsqrtq(CPUSPARCState *env)
+ }
+
+ #define GEN_FCMP(name, size, reg1, reg2, FS, E) \
+- void glue(helper_, name) (CPUSPARCState *env) \
++ void glue(helper_, name) (CPUSPARCState *env) \
+ { \
+- env->fsr &= FSR_FTT_NMASK; \
+- if (E && (glue(size, _is_any_nan)(reg1) || \
+- glue(size, _is_any_nan)(reg2)) && \
+- (env->fsr & FSR_NVM)) { \
+- env->fsr |= FSR_NVC; \
+- env->fsr |= FSR_FTT_IEEE_EXCP; \
+- helper_raise_exception(env, TT_FP_EXCP); \
++ int ret; \
++ clear_float_exceptions(env); \
++ if (E) { \
++ ret = glue(size, _compare)(reg1, reg2, &env->fp_status); \
++ } else { \
++ ret = glue(size, _compare_quiet)(reg1, reg2, \
++ &env->fp_status); \
+ } \
+- switch (glue(size, _compare) (reg1, reg2, &env->fp_status)) { \
++ check_ieee_exceptions(env); \
++ switch (ret) { \
+ case float_relation_unordered: \
+- if ((env->fsr & FSR_NVM)) { \
+- env->fsr |= FSR_NVC; \
+- env->fsr |= FSR_FTT_IEEE_EXCP; \
+- helper_raise_exception(env, TT_FP_EXCP); \
+- } else { \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
+- env->fsr |= (FSR_FCC1 | FSR_FCC0) << FS; \
+- env->fsr |= FSR_NVA; \
+- } \
++ env->fsr |= (FSR_FCC1 | FSR_FCC0) << FS; \
++ env->fsr |= FSR_NVA; \
+ break; \
+ case float_relation_less: \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
++ env->fsr &= ~(FSR_FCC1) << FS; \
+ env->fsr |= FSR_FCC0 << FS; \
+ break; \
+ case float_relation_greater: \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
++ env->fsr &= ~(FSR_FCC0) << FS; \
+ env->fsr |= FSR_FCC1 << FS; \
+ break; \
+ default: \
+@@ -370,34 +364,27 @@ void helper_fsqrtq(CPUSPARCState *env)
+ } \
+ }
+ #define GEN_FCMP_T(name, size, FS, E) \
+- void glue(helper_, name)(CPUSPARCState *env, size src1, size src2) \
++ void glue(helper_, name)(CPUSPARCState *env, size src1, size src2) \
+ { \
+- env->fsr &= FSR_FTT_NMASK; \
+- if (E && (glue(size, _is_any_nan)(src1) || \
+- glue(size, _is_any_nan)(src2)) && \
+- (env->fsr & FSR_NVM)) { \
+- env->fsr |= FSR_NVC; \
+- env->fsr |= FSR_FTT_IEEE_EXCP; \
+- helper_raise_exception(env, TT_FP_EXCP); \
++ int ret; \
++ clear_float_exceptions(env); \
++ if (E) { \
++ ret = glue(size, _compare)(src1, src2, &env->fp_status); \
++ } else { \
++ ret = glue(size, _compare_quiet)(src1, src2, \
++ &env->fp_status); \
+ } \
+- switch (glue(size, _compare) (src1, src2, &env->fp_status)) { \
++ check_ieee_exceptions(env); \
++ switch (ret) { \
+ case float_relation_unordered: \
+- if ((env->fsr & FSR_NVM)) { \
+- env->fsr |= FSR_NVC; \
+- env->fsr |= FSR_FTT_IEEE_EXCP; \
+- helper_raise_exception(env, TT_FP_EXCP); \
+- } else { \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
+- env->fsr |= (FSR_FCC1 | FSR_FCC0) << FS; \
+- env->fsr |= FSR_NVA; \
+- } \
++ env->fsr |= (FSR_FCC1 | FSR_FCC0) << FS; \
+ break; \
+ case float_relation_less: \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
++ env->fsr &= ~(FSR_FCC1 << FS); \
+ env->fsr |= FSR_FCC0 << FS; \
+ break; \
+ case float_relation_greater: \
+- env->fsr &= ~((FSR_FCC1 | FSR_FCC0) << FS); \
++ env->fsr &= ~(FSR_FCC0 << FS); \
+ env->fsr |= FSR_FCC1 << FS; \
+ break; \
+ default: \
+--
+1.7.12.1
+
--- /dev/null
+From 985b8342244b5f76ed1df75eb8757d6feff30316 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:30 +0000
+Subject: [PATCH] target-s390x: fix style
+
+Before splitting op_helper.c and helper.c in the next patches,
+fix style issues. No functional changes.
+
+Replace also GCC specific __FUNCTION__ with
+standard __func__.
+
+Don't init static variable (cpu_s390x_init:inited) with 0.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/helper.c | 96 ++++++-----
+ target-s390x/op_helper.c | 438 +++++++++++++++++++++++++++--------------------
+ 2 files changed, 297 insertions(+), 237 deletions(-)
+
+diff --git a/target-s390x/helper.c b/target-s390x/helper.c
+index d0a1180..d98e6d9 100644
+--- a/target-s390x/helper.c
++++ b/target-s390x/helper.c
+@@ -74,7 +74,7 @@ S390CPU *cpu_s390x_init(const char *cpu_model)
+ {
+ S390CPU *cpu;
+ CPUS390XState *env;
+- static int inited = 0;
++ static int inited;
+
+ cpu = S390_CPU(object_new(TYPE_S390_CPU));
+ env = &cpu->env;
+@@ -91,25 +91,27 @@ S390CPU *cpu_s390x_init(const char *cpu_model)
+
+ #if defined(CONFIG_USER_ONLY)
+
+-void do_interrupt (CPUS390XState *env)
++void do_interrupt(CPUS390XState *env)
+ {
+ env->exception_index = -1;
+ }
+
+-int cpu_s390x_handle_mmu_fault (CPUS390XState *env, target_ulong address, int rw,
+- int mmu_idx)
++int cpu_s390x_handle_mmu_fault(CPUS390XState *env, target_ulong address,
++ int rw, int mmu_idx)
+ {
+- /* fprintf(stderr,"%s: address 0x%lx rw %d mmu_idx %d\n",
+- __FUNCTION__, address, rw, mmu_idx); */
++ /* fprintf(stderr, "%s: address 0x%lx rw %d mmu_idx %d\n",
++ __func__, address, rw, mmu_idx); */
+ env->exception_index = EXCP_ADDR;
+- env->__excp_addr = address; /* FIXME: find out how this works on a real machine */
++ /* FIXME: find out how this works on a real machine */
++ env->__excp_addr = address;
+ return 1;
+ }
+
+ #else /* !CONFIG_USER_ONLY */
+
+ /* Ensure to exit the TB after this call! */
+-static void trigger_pgm_exception(CPUS390XState *env, uint32_t code, uint32_t ilc)
++static void trigger_pgm_exception(CPUS390XState *env, uint32_t code,
++ uint32_t ilc)
+ {
+ env->exception_index = EXCP_PGM;
+ env->int_pgm_code = code;
+@@ -138,19 +140,20 @@ static int trans_bits(CPUS390XState *env, uint64_t mode)
+ return bits;
+ }
+
+-static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr, uint64_t mode)
++static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr,
++ uint64_t mode)
+ {
+ int ilc = ILC_LATER_INC_2;
+ int bits = trans_bits(env, mode) | 4;
+
+- DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __FUNCTION__, vaddr, bits);
++ DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __func__, vaddr, bits);
+
+ stq_phys(env->psa + offsetof(LowCore, trans_exc_code), vaddr | bits);
+ trigger_pgm_exception(env, PGM_PROTECTION, ilc);
+ }
+
+-static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, uint32_t type,
+- uint64_t asc, int rw)
++static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
++ uint32_t type, uint64_t asc, int rw)
+ {
+ int ilc = ILC_LATER;
+ int bits = trans_bits(env, asc);
+@@ -160,26 +163,26 @@ static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, uint32_t
+ ilc = 2;
+ }
+
+- DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __FUNCTION__, vaddr, bits);
++ DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __func__, vaddr, bits);
+
+ stq_phys(env->psa + offsetof(LowCore, trans_exc_code), vaddr | bits);
+ trigger_pgm_exception(env, type, ilc);
+ }
+
+-static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr, uint64_t asc,
+- uint64_t asce, int level, target_ulong *raddr,
+- int *flags, int rw)
++static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr,
++ uint64_t asc, uint64_t asce, int level,
++ target_ulong *raddr, int *flags, int rw)
+ {
+ uint64_t offs = 0;
+ uint64_t origin;
+ uint64_t new_asce;
+
+- PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __FUNCTION__, asce);
++ PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __func__, asce);
+
+ if (((level != _ASCE_TYPE_SEGMENT) && (asce & _REGION_ENTRY_INV)) ||
+ ((level == _ASCE_TYPE_SEGMENT) && (asce & _SEGMENT_ENTRY_INV))) {
+ /* XXX different regions have different faults */
+- DPRINTF("%s: invalid region\n", __FUNCTION__);
++ DPRINTF("%s: invalid region\n", __func__);
+ trigger_page_fault(env, vaddr, PGM_SEGMENT_TRANS, asc, rw);
+ return -1;
+ }
+@@ -222,7 +225,7 @@ static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr, uint64_t a
+
+ new_asce = ldq_phys(origin + offs);
+ PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
+- __FUNCTION__, origin, offs, new_asce);
++ __func__, origin, offs, new_asce);
+
+ if (level != _ASCE_TYPE_SEGMENT) {
+ /* yet another region */
+@@ -232,7 +235,7 @@ static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr, uint64_t a
+
+ /* PTE */
+ if (new_asce & _PAGE_INVALID) {
+- DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __FUNCTION__, new_asce);
++ DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __func__, new_asce);
+ trigger_page_fault(env, vaddr, PGM_PAGE_TRANS, asc, rw);
+ return -1;
+ }
+@@ -243,13 +246,14 @@ static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr, uint64_t a
+
+ *raddr = new_asce & _ASCE_ORIGIN;
+
+- PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __FUNCTION__, new_asce);
++ PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __func__, new_asce);
+
+ return 0;
+ }
+
+-static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t asc,
+- target_ulong *raddr, int *flags, int rw)
++static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr,
++ uint64_t asc, target_ulong *raddr, int *flags,
++ int rw)
+ {
+ uint64_t asce = 0;
+ int level, new_level;
+@@ -257,15 +261,15 @@ static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t as
+
+ switch (asc) {
+ case PSW_ASC_PRIMARY:
+- PTE_DPRINTF("%s: asc=primary\n", __FUNCTION__);
++ PTE_DPRINTF("%s: asc=primary\n", __func__);
+ asce = env->cregs[1];
+ break;
+ case PSW_ASC_SECONDARY:
+- PTE_DPRINTF("%s: asc=secondary\n", __FUNCTION__);
++ PTE_DPRINTF("%s: asc=secondary\n", __func__);
+ asce = env->cregs[7];
+ break;
+ case PSW_ASC_HOME:
+- PTE_DPRINTF("%s: asc=home\n", __FUNCTION__);
++ PTE_DPRINTF("%s: asc=home\n", __func__);
+ asce = env->cregs[13];
+ break;
+ }
+@@ -276,8 +280,7 @@ static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t as
+ case _ASCE_TYPE_REGION2:
+ if (vaddr & 0xffe0000000000000ULL) {
+ DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
+- " 0xffe0000000000000ULL\n", __FUNCTION__,
+- vaddr);
++ " 0xffe0000000000000ULL\n", __func__, vaddr);
+ trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
+ return -1;
+ }
+@@ -285,8 +288,7 @@ static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t as
+ case _ASCE_TYPE_REGION3:
+ if (vaddr & 0xfffffc0000000000ULL) {
+ DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
+- " 0xfffffc0000000000ULL\n", __FUNCTION__,
+- vaddr);
++ " 0xfffffc0000000000ULL\n", __func__, vaddr);
+ trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
+ return -1;
+ }
+@@ -294,8 +296,7 @@ static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t as
+ case _ASCE_TYPE_SEGMENT:
+ if (vaddr & 0xffffffff80000000ULL) {
+ DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
+- " 0xffffffff80000000ULL\n", __FUNCTION__,
+- vaddr);
++ " 0xffffffff80000000ULL\n", __func__, vaddr);
+ trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
+ return -1;
+ }
+@@ -358,7 +359,7 @@ int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
+ break;
+ }
+
+-out:
++ out:
+ /* Convert real address -> absolute address */
+ if (*raddr < 0x2000) {
+ *raddr = *raddr + env->psa;
+@@ -378,18 +379,18 @@ out:
+ return r;
+ }
+
+-int cpu_s390x_handle_mmu_fault (CPUS390XState *env, target_ulong _vaddr, int rw,
+- int mmu_idx)
++int cpu_s390x_handle_mmu_fault(CPUS390XState *env, target_ulong orig_vaddr,
++ int rw, int mmu_idx)
+ {
+ uint64_t asc = env->psw.mask & PSW_MASK_ASC;
+ target_ulong vaddr, raddr;
+ int prot;
+
+ DPRINTF("%s: address 0x%" PRIx64 " rw %d mmu_idx %d\n",
+- __FUNCTION__, _vaddr, rw, mmu_idx);
++ __func__, _vaddr, rw, mmu_idx);
+
+- _vaddr &= TARGET_PAGE_MASK;
+- vaddr = _vaddr;
++ orig_vaddr &= TARGET_PAGE_MASK;
++ vaddr = orig_vaddr;
+
+ /* 31-Bit mode */
+ if (!(env->psw.mask & PSW_MASK_64)) {
+@@ -403,22 +404,23 @@ int cpu_s390x_handle_mmu_fault (CPUS390XState *env, target_ulong _vaddr, int rw,
+
+ /* check out of RAM access */
+ if (raddr > (ram_size + virtio_size)) {
+- DPRINTF("%s: aaddr %" PRIx64 " > ram_size %" PRIx64 "\n", __FUNCTION__,
++ DPRINTF("%s: aaddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,
+ (uint64_t)aaddr, (uint64_t)ram_size);
+ trigger_pgm_exception(env, PGM_ADDRESSING, ILC_LATER);
+ return 1;
+ }
+
+- DPRINTF("%s: set tlb %" PRIx64 " -> %" PRIx64 " (%x)\n", __FUNCTION__,
++ DPRINTF("%s: set tlb %" PRIx64 " -> %" PRIx64 " (%x)\n", __func__,
+ (uint64_t)vaddr, (uint64_t)raddr, prot);
+
+- tlb_set_page(env, _vaddr, raddr, prot,
++ tlb_set_page(env, orig_vaddr, raddr, prot,
+ mmu_idx, TARGET_PAGE_SIZE);
+
+ return 0;
+ }
+
+-target_phys_addr_t cpu_get_phys_page_debug(CPUS390XState *env, target_ulong vaddr)
++target_phys_addr_t cpu_get_phys_page_debug(CPUS390XState *env,
++ target_ulong vaddr)
+ {
+ target_ulong raddr;
+ int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+@@ -509,7 +511,7 @@ static void do_program_interrupt(CPUS390XState *env)
+ break;
+ }
+
+- qemu_log("%s: code=0x%x ilc=%d\n", __FUNCTION__, env->int_pgm_code, ilc);
++ qemu_log("%s: code=0x%x ilc=%d\n", __func__, env->int_pgm_code, ilc);
+
+ lowcore = cpu_physical_memory_map(env->psa, &len, 1);
+
+@@ -522,7 +524,7 @@ static void do_program_interrupt(CPUS390XState *env)
+
+ cpu_physical_memory_unmap(lowcore, len, 1, len);
+
+- DPRINTF("%s: %x %x %" PRIx64 " %" PRIx64 "\n", __FUNCTION__,
++ DPRINTF("%s: %x %x %" PRIx64 " %" PRIx64 "\n", __func__,
+ env->int_pgm_code, ilc, env->psw.mask,
+ env->psw.addr);
+
+@@ -565,15 +567,15 @@ static void do_ext_interrupt(CPUS390XState *env)
+ env->pending_int &= ~INTERRUPT_EXT;
+ }
+
+- DPRINTF("%s: %" PRIx64 " %" PRIx64 "\n", __FUNCTION__,
++ DPRINTF("%s: %" PRIx64 " %" PRIx64 "\n", __func__,
+ env->psw.mask, env->psw.addr);
+
+ load_psw(env, mask, addr);
+ }
+
+-void do_interrupt (CPUS390XState *env)
++void do_interrupt(CPUS390XState *env)
+ {
+- qemu_log("%s: %d at pc=%" PRIx64 "\n", __FUNCTION__, env->exception_index,
++ qemu_log("%s: %d at pc=%" PRIx64 "\n", __func__, env->exception_index,
+ env->psw.addr);
+
+ s390_add_running_cpu(env);
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+index abc35dd..195e93e 100644
+--- a/target-s390x/op_helper.c
++++ b/target-s390x/op_helper.c
+@@ -31,13 +31,13 @@
+ #include <linux/kvm.h>
+ #endif
+
+-#if !defined (CONFIG_USER_ONLY)
++#if !defined(CONFIG_USER_ONLY)
+ #include "sysemu.h"
+ #endif
+
+ /*****************************************************************************/
+ /* Softmmu support */
+-#if !defined (CONFIG_USER_ONLY)
++#if !defined(CONFIG_USER_ONLY)
+ #include "softmmu_exec.h"
+
+ #define MMUSUFFIX _mmu
+@@ -95,7 +95,7 @@ void tlb_fill(CPUS390XState *env1, target_ulong addr, int is_write, int mmu_idx,
+ /* raise an exception */
+ void HELPER(exception)(uint32_t excp)
+ {
+- HELPER_LOG("%s: exception %d\n", __FUNCTION__, excp);
++ HELPER_LOG("%s: exception %d\n", __func__, excp);
+ env->exception_index = excp;
+ cpu_loop_exit(env);
+ }
+@@ -164,7 +164,7 @@ uint32_t HELPER(nc)(uint32_t l, uint64_t dest, uint64_t src)
+ uint32_t cc = 0;
+
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __FUNCTION__, l, dest, src);
++ __func__, l, dest, src);
+ for (i = 0; i <= l; i++) {
+ x = ldub(dest + i) & ldub(src + i);
+ if (x) {
+@@ -183,7 +183,7 @@ uint32_t HELPER(xc)(uint32_t l, uint64_t dest, uint64_t src)
+ uint32_t cc = 0;
+
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __FUNCTION__, l, dest, src);
++ __func__, l, dest, src);
+
+ #ifndef CONFIG_USER_ONLY
+ /* xor with itself is the same as memset(0) */
+@@ -217,7 +217,7 @@ uint32_t HELPER(oc)(uint32_t l, uint64_t dest, uint64_t src)
+ uint32_t cc = 0;
+
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __FUNCTION__, l, dest, src);
++ __func__, l, dest, src);
+ for (i = 0; i <= l; i++) {
+ x = ldub(dest + i) | ldub(src + i);
+ if (x) {
+@@ -236,7 +236,7 @@ void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+ uint32_t l_64 = (l + 1) / 8;
+
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __FUNCTION__, l, dest, src);
++ __func__, l, dest, src);
+
+ #ifndef CONFIG_USER_ONLY
+ if ((l > 32) &&
+@@ -278,10 +278,11 @@ void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+ uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
+ {
+ int i;
+- unsigned char x,y;
++ unsigned char x, y;
+ uint32_t cc;
++
+ HELPER_LOG("%s l %d s1 %" PRIx64 " s2 %" PRIx64 "\n",
+- __FUNCTION__, l, s1, s2);
++ __func__, l, s1, s2);
+ for (i = 0; i <= l; i++) {
+ x = ldub(s1 + i);
+ y = ldub(s2 + i);
+@@ -295,7 +296,7 @@ uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
+ }
+ }
+ cc = 0;
+-done:
++ done:
+ HELPER_LOG("\n");
+ return cc;
+ }
+@@ -303,9 +304,10 @@ done:
+ /* compare logical under mask */
+ uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ {
+- uint8_t r,d;
++ uint8_t r, d;
+ uint32_t cc;
+- HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%" PRIx64 "\n", __FUNCTION__, r1,
++
++ HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%" PRIx64 "\n", __func__, r1,
+ mask, addr);
+ cc = 0;
+ while (mask) {
+@@ -313,7 +315,7 @@ uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ d = ldub(addr);
+ r = (r1 & 0xff000000UL) >> 24;
+ HELPER_LOG("mask 0x%x %02x/%02x (0x%" PRIx64 ") ", mask, r, d,
+- addr);
++ addr);
+ if (r < d) {
+ cc = 1;
+ break;
+@@ -334,7 +336,8 @@ uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ {
+ uint8_t r;
+- HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%lx\n", __FUNCTION__, r1, mask,
++
++ HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%lx\n", __func__, r1, mask,
+ addr);
+ while (mask) {
+ if (mask & 8) {
+@@ -355,6 +358,7 @@ void HELPER(mlg)(uint32_t r1, uint64_t v2)
+ #if HOST_LONG_BITS == 64 && defined(__GNUC__)
+ /* assuming 64-bit hosts have __uint128_t */
+ __uint128_t res = (__uint128_t)env->regs[r1 + 1];
++
+ res *= (__uint128_t)v2;
+ env->regs[r1] = (uint64_t)(res >> 64);
+ env->regs[r1 + 1] = (uint64_t)res;
+@@ -370,18 +374,18 @@ void HELPER(dlg)(uint32_t r1, uint64_t v2)
+
+ if (!env->regs[r1]) {
+ /* 64 -> 64/64 case */
+- env->regs[r1] = env->regs[r1+1] % divisor;
+- env->regs[r1+1] = env->regs[r1+1] / divisor;
++ env->regs[r1] = env->regs[r1 + 1] % divisor;
++ env->regs[r1 + 1] = env->regs[r1 + 1] / divisor;
+ return;
+ } else {
+-
+ #if HOST_LONG_BITS == 64 && defined(__GNUC__)
+ /* assuming 64-bit hosts have __uint128_t */
+ __uint128_t dividend = (((__uint128_t)env->regs[r1]) << 64) |
+- (env->regs[r1+1]);
++ (env->regs[r1 + 1]);
+ __uint128_t quotient = dividend / divisor;
+- env->regs[r1+1] = quotient;
+ __uint128_t remainder = dividend % divisor;
++
++ env->regs[r1 + 1] = quotient;
+ env->regs[r1] = remainder;
+ #else
+ /* 32-bit hosts would need special wrapper functionality - just abort if
+@@ -431,7 +435,7 @@ uint32_t HELPER(srst)(uint32_t c, uint32_t r1, uint32_t r2)
+ uint64_t str = get_address_31fix(r2);
+ uint64_t end = get_address_31fix(r1);
+
+- HELPER_LOG("%s: c %d *r1 0x%" PRIx64 " *r2 0x%" PRIx64 "\n", __FUNCTION__,
++ HELPER_LOG("%s: c %d *r1 0x%" PRIx64 " *r2 0x%" PRIx64 "\n", __func__,
+ c, env->regs[r1], env->regs[r2]);
+
+ for (i = str; i != end; i++) {
+@@ -452,11 +456,12 @@ uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
+ uint64_t s2 = get_address_31fix(r2);
+ uint8_t v1, v2;
+ uint32_t cc;
++
+ c = c & 0xff;
+ #ifdef CONFIG_USER_ONLY
+ if (!c) {
+ HELPER_LOG("%s: comparing '%s' and '%s'\n",
+- __FUNCTION__, (char*)g2h(s1), (char*)g2h(s2));
++ __func__, (char *)g2h(s1), (char *)g2h(s2));
+ }
+ #endif
+ for (;;) {
+@@ -501,10 +506,11 @@ void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
+ uint64_t dest = get_address_31fix(r1);
+ uint64_t src = get_address_31fix(r2);
+ uint8_t v;
++
+ c = c & 0xff;
+ #ifdef CONFIG_USER_ONLY
+ if (!c) {
+- HELPER_LOG("%s: copy '%s' to 0x%lx\n", __FUNCTION__, (char*)g2h(src),
++ HELPER_LOG("%s: copy '%s' to 0x%lx\n", __func__, (char *)g2h(src),
+ dest);
+ }
+ #endif
+@@ -526,6 +532,7 @@ uint32_t HELPER(csg)(uint32_t r1, uint64_t a2, uint32_t r3)
+ /* FIXME: locking? */
+ uint32_t cc;
+ uint64_t v2 = ldq(a2);
++
+ if (env->regs[r1] == v2) {
+ cc = 0;
+ stq(a2, env->regs[r3]);
+@@ -564,8 +571,9 @@ uint32_t HELPER(cs)(uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ /* FIXME: locking? */
+ uint32_t cc;
+- HELPER_LOG("%s: r1 %d a2 0x%lx r3 %d\n", __FUNCTION__, r1, a2, r3);
+ uint32_t v2 = ldl(a2);
++
++ HELPER_LOG("%s: r1 %d a2 0x%lx r3 %d\n", __func__, r1, a2, r3);
+ if (((uint32_t)env->regs[r1]) == v2) {
+ cc = 0;
+ stl(a2, (uint32_t)env->regs[r3]);
+@@ -612,14 +620,16 @@ static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
+ it does not change the program counter
+ in other words: tricky...
+ currently implemented by interpreting the cases it is most commonly used in
+- */
++*/
+ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ {
+ uint16_t insn = lduw_code(addr);
+- HELPER_LOG("%s: v1 0x%lx addr 0x%lx insn 0x%x\n", __FUNCTION__, v1, addr,
+- insn);
++
++ HELPER_LOG("%s: v1 0x%lx addr 0x%lx insn 0x%x\n", __func__, v1, addr,
++ insn);
+ if ((insn & 0xf0ff) == 0xd000) {
+ uint32_t l, insn2, b1, b2, d1, d2;
++
+ l = v1 & 0xff;
+ insn2 = ldl_code(addr + 2);
+ b1 = (insn2 >> 28) & 0xf;
+@@ -645,13 +655,14 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ }
+ } else if ((insn & 0xff00) == 0x0a00) {
+ /* supervisor call */
+- HELPER_LOG("%s: svc %ld via execute\n", __FUNCTION__, (insn|v1) & 0xff);
++ HELPER_LOG("%s: svc %ld via execute\n", __func__, (insn | v1) & 0xff);
+ env->psw.addr = ret - 4;
+- env->int_svc_code = (insn|v1) & 0xff;
++ env->int_svc_code = (insn | v1) & 0xff;
+ env->int_svc_ilc = 4;
+ helper_exception(EXCP_SVC);
+ } else if ((insn & 0xff00) == 0xbf00) {
+ uint32_t insn2, r1, r3, b2, d2;
++
+ insn2 = ldl_code(addr + 2);
+ r1 = (insn2 >> 20) & 0xf;
+ r3 = (insn2 >> 16) & 0xf;
+@@ -659,7 +670,7 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ d2 = insn2 & 0xfff;
+ cc = helper_icm(r1, get_address(0, b2, d2), r3);
+ } else {
+-abort:
++ abort:
+ cpu_abort(env, "EXECUTE on instruction prefix 0x%x not implemented\n",
+ insn);
+ }
+@@ -689,7 +700,7 @@ int32_t HELPER(nabs_i32)(int32_t val)
+ /* absolute value 64-bit */
+ uint64_t HELPER(abs_i64)(int64_t val)
+ {
+- HELPER_LOG("%s: val 0x%" PRIx64 "\n", __FUNCTION__, val);
++ HELPER_LOG("%s: val 0x%" PRIx64 "\n", __func__, val);
+
+ if (val < 0) {
+ return -val;
+@@ -774,9 +785,9 @@ void HELPER(ipm)(uint32_t cc, uint32_t r1)
+ uint64_t r = env->regs[r1];
+
+ r &= 0xffffffff00ffffffULL;
+- r |= (cc << 28) | ( (env->psw.mask >> 40) & 0xf );
++ r |= (cc << 28) | ((env->psw.mask >> 40) & 0xf);
+ env->regs[r1] = r;
+- HELPER_LOG("%s: cc %d psw.mask 0x%lx r1 0x%lx\n", __FUNCTION__,
++ HELPER_LOG("%s: cc %d psw.mask 0x%lx r1 0x%lx\n", __func__,
+ cc, env->psw.mask, r);
+ }
+
+@@ -908,7 +919,7 @@ uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ uint64_t srclen = env->regs[r3 + 1];
+ uint64_t src = get_address_31fix(r3);
+ uint8_t pad = a2 & 0xff;
+- uint8_t v1 = 0,v2 = 0;
++ uint8_t v1 = 0, v2 = 0;
+ uint32_t cc = 0;
+
+ if (!(destlen || srclen)) {
+@@ -1036,7 +1047,7 @@ static uint32_t set_cc_nz_f128(float128 v)
+ /* convert 32-bit int to 64-bit float */
+ void HELPER(cdfbr)(uint32_t f1, int32_t v2)
+ {
+- HELPER_LOG("%s: converting %d to f%d\n", __FUNCTION__, v2, f1);
++ HELPER_LOG("%s: converting %d to f%d\n", __func__, v2, f1);
+ env->fregs[f1].d = int32_to_float64(v2, &env->fpu_status);
+ }
+
+@@ -1044,6 +1055,7 @@ void HELPER(cdfbr)(uint32_t f1, int32_t v2)
+ void HELPER(cxfbr)(uint32_t f1, int32_t v2)
+ {
+ CPU_QuadU v1;
++
+ v1.q = int32_to_float128(v2, &env->fpu_status);
+ env->fregs[f1].ll = v1.ll.upper;
+ env->fregs[f1 + 2].ll = v1.ll.lower;
+@@ -1052,14 +1064,14 @@ void HELPER(cxfbr)(uint32_t f1, int32_t v2)
+ /* convert 64-bit int to 32-bit float */
+ void HELPER(cegbr)(uint32_t f1, int64_t v2)
+ {
+- HELPER_LOG("%s: converting %ld to f%d\n", __FUNCTION__, v2, f1);
++ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+ env->fregs[f1].l.upper = int64_to_float32(v2, &env->fpu_status);
+ }
+
+ /* convert 64-bit int to 64-bit float */
+ void HELPER(cdgbr)(uint32_t f1, int64_t v2)
+ {
+- HELPER_LOG("%s: converting %ld to f%d\n", __FUNCTION__, v2, f1);
++ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+ env->fregs[f1].d = int64_to_float64(v2, &env->fpu_status);
+ }
+
+@@ -1067,8 +1079,9 @@ void HELPER(cdgbr)(uint32_t f1, int64_t v2)
+ void HELPER(cxgbr)(uint32_t f1, int64_t v2)
+ {
+ CPU_QuadU x1;
++
+ x1.q = int64_to_float128(v2, &env->fpu_status);
+- HELPER_LOG("%s: converted %ld to 0x%lx and 0x%lx\n", __FUNCTION__, v2,
++ HELPER_LOG("%s: converted %ld to 0x%lx and 0x%lx\n", __func__, v2,
+ x1.ll.upper, x1.ll.lower);
+ env->fregs[f1].ll = x1.ll.upper;
+ env->fregs[f1 + 2].ll = x1.ll.lower;
+@@ -1078,7 +1091,7 @@ void HELPER(cxgbr)(uint32_t f1, int64_t v2)
+ void HELPER(cefbr)(uint32_t f1, int32_t v2)
+ {
+ env->fregs[f1].l.upper = int32_to_float32(v2, &env->fpu_status);
+- HELPER_LOG("%s: converting %d to 0x%d in f%d\n", __FUNCTION__, v2,
++ HELPER_LOG("%s: converting %d to 0x%d in f%d\n", __func__, v2,
+ env->fregs[f1].l.upper, f1);
+ }
+
+@@ -1088,7 +1101,7 @@ uint32_t HELPER(aebr)(uint32_t f1, uint32_t f2)
+ env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+ &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __FUNCTION__,
++ HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
+ env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
+
+ return set_cc_nz_f32(env->fregs[f1].l.upper);
+@@ -1099,7 +1112,7 @@ uint32_t HELPER(adbr)(uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_add(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%ld resulting in 0x%ld in f%d\n", __FUNCTION__,
++ HELPER_LOG("%s: adding 0x%ld resulting in 0x%ld in f%d\n", __func__,
+ env->fregs[f2].d, env->fregs[f1].d, f1);
+
+ return set_cc_nz_f64(env->fregs[f1].d);
+@@ -1111,7 +1124,7 @@ uint32_t HELPER(sebr)(uint32_t f1, uint32_t f2)
+ env->fregs[f1].l.upper = float32_sub(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+ &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __FUNCTION__,
++ HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
+ env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
+
+ return set_cc_nz_f32(env->fregs[f1].l.upper);
+@@ -1123,7 +1136,7 @@ uint32_t HELPER(sdbr)(uint32_t f1, uint32_t f2)
+ env->fregs[f1].d = float64_sub(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+ HELPER_LOG("%s: subtracting 0x%ld resulting in 0x%ld in f%d\n",
+- __FUNCTION__, env->fregs[f2].d, env->fregs[f1].d, f1);
++ __func__, env->fregs[f2].d, env->fregs[f1].d, f1);
+
+ return set_cc_nz_f64(env->fregs[f1].d);
+ }
+@@ -1140,12 +1153,13 @@ void HELPER(debr)(uint32_t f1, uint32_t f2)
+ void HELPER(dxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+- CPU_QuadU v2;
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+- CPU_QuadU res;
+ res.q = float128_div(v1.q, v2.q, &env->fpu_status);
+ env->fregs[f1].ll = res.ll.upper;
+ env->fregs[f1 + 2].ll = res.ll.lower;
+@@ -1162,12 +1176,13 @@ void HELPER(mdbr)(uint32_t f1, uint32_t f2)
+ void HELPER(mxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+- CPU_QuadU v2;
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+- CPU_QuadU res;
+ res.q = float128_mul(v1.q, v2.q, &env->fpu_status);
+ env->fregs[f1].ll = res.ll.upper;
+ env->fregs[f1 + 2].ll = res.ll.lower;
+@@ -1184,16 +1199,18 @@ void HELPER(ldebr)(uint32_t r1, uint32_t r2)
+ void HELPER(ldxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x2;
++
+ x2.ll.upper = env->fregs[f2].ll;
+ x2.ll.lower = env->fregs[f2 + 2].ll;
+ env->fregs[f1].d = float128_to_float64(x2.q, &env->fpu_status);
+- HELPER_LOG("%s: to 0x%ld\n", __FUNCTION__, env->fregs[f1].d);
++ HELPER_LOG("%s: to 0x%ld\n", __func__, env->fregs[f1].d);
+ }
+
+ /* convert 64-bit float to 128-bit float */
+ void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU res;
++
+ res.q = float64_to_float128(env->fregs[f2].d, &env->fpu_status);
+ env->fregs[f1].ll = res.ll.upper;
+ env->fregs[f1 + 2].ll = res.ll.lower;
+@@ -1203,6 +1220,7 @@ void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
+ void HELPER(ledbr)(uint32_t f1, uint32_t f2)
+ {
+ float64 d2 = env->fregs[f2].d;
++
+ env->fregs[f1].l.upper = float64_to_float32(d2, &env->fpu_status);
+ }
+
+@@ -1210,10 +1228,11 @@ void HELPER(ledbr)(uint32_t f1, uint32_t f2)
+ void HELPER(lexbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x2;
++
+ x2.ll.upper = env->fregs[f2].ll;
+ x2.ll.lower = env->fregs[f2 + 2].ll;
+ env->fregs[f1].l.upper = float128_to_float32(x2.q, &env->fpu_status);
+- HELPER_LOG("%s: to 0x%d\n", __FUNCTION__, env->fregs[f1].l.upper);
++ HELPER_LOG("%s: to 0x%d\n", __func__, env->fregs[f1].l.upper);
+ }
+
+ /* absolute value of 32-bit float */
+@@ -1221,6 +1240,7 @@ uint32_t HELPER(lpebr)(uint32_t f1, uint32_t f2)
+ {
+ float32 v1;
+ float32 v2 = env->fregs[f2].d;
++
+ v1 = float32_abs(v2);
+ env->fregs[f1].d = v1;
+ return set_cc_nz_f32(v1);
+@@ -1231,6 +1251,7 @@ uint32_t HELPER(lpdbr)(uint32_t f1, uint32_t f2)
+ {
+ float64 v1;
+ float64 v2 = env->fregs[f2].d;
++
+ v1 = float64_abs(v2);
+ env->fregs[f1].d = v1;
+ return set_cc_nz_f64(v1);
+@@ -1241,6 +1262,7 @@ uint32_t HELPER(lpxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
++
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+ v1.q = float128_abs(v2.q);
+@@ -1267,6 +1289,7 @@ uint32_t HELPER(ltebr)(uint32_t f1, uint32_t f2)
+ uint32_t HELPER(ltxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x;
++
+ x.ll.upper = env->fregs[f2].ll;
+ x.ll.lower = env->fregs[f2 + 2].ll;
+ env->fregs[f1].ll = x.ll.upper;
+@@ -1294,6 +1317,7 @@ uint32_t HELPER(lcdbr)(uint32_t f1, uint32_t f2)
+ uint32_t HELPER(lcxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x1, x2;
++
+ x2.ll.upper = env->fregs[f2].ll;
+ x2.ll.lower = env->fregs[f2 + 2].ll;
+ x1.q = float128_chs(x2.q);
+@@ -1307,8 +1331,9 @@ void HELPER(aeb)(uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
++
+ v2.l = val;
+- HELPER_LOG("%s: adding 0x%d from f%d and 0x%d\n", __FUNCTION__,
++ HELPER_LOG("%s: adding 0x%d from f%d and 0x%d\n", __func__,
+ v1, f1, v2.f);
+ env->fregs[f1].l.upper = float32_add(v1, v2.f, &env->fpu_status);
+ }
+@@ -1318,8 +1343,9 @@ void HELPER(deb)(uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
++
+ v2.l = val;
+- HELPER_LOG("%s: dividing 0x%d from f%d by 0x%d\n", __FUNCTION__,
++ HELPER_LOG("%s: dividing 0x%d from f%d by 0x%d\n", __func__,
+ v1, f1, v2.f);
+ env->fregs[f1].l.upper = float32_div(v1, v2.f, &env->fpu_status);
+ }
+@@ -1329,8 +1355,9 @@ void HELPER(meeb)(uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
++
+ v2.l = val;
+- HELPER_LOG("%s: multiplying 0x%d from f%d and 0x%d\n", __FUNCTION__,
++ HELPER_LOG("%s: multiplying 0x%d from f%d and 0x%d\n", __func__,
+ v1, f1, v2.f);
+ env->fregs[f1].l.upper = float32_mul(v1, v2.f, &env->fpu_status);
+ }
+@@ -1340,7 +1367,8 @@ uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ float32 v2 = env->fregs[f2].l.upper;
+- HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __FUNCTION__,
++
++ HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __func__,
+ v1, f1, v2);
+ return set_cc_f32(v1, v2);
+ }
+@@ -1350,7 +1378,8 @@ uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ float64 v2 = env->fregs[f2].d;
+- HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __FUNCTION__,
++
++ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __func__,
+ v1, f1, v2);
+ return set_cc_f64(v1, v2);
+ }
+@@ -1359,14 +1388,15 @@ uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
+ uint32_t HELPER(cxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
++ CPU_QuadU v2;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+- CPU_QuadU v2;
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+
+ return float_comp_to_cc(float128_compare_quiet(v1.q, v2.q,
+- &env->fpu_status));
++ &env->fpu_status));
+ }
+
+ /* 64-bit FP compare RM */
+@@ -1374,8 +1404,9 @@ uint32_t HELPER(cdb)(uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
++
+ v2.ll = ldq(a2);
+- HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%lx\n", __FUNCTION__, v1,
++ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%lx\n", __func__, v1,
+ f1, v2.d);
+ return set_cc_f64(v1, v2.d);
+ }
+@@ -1385,8 +1416,9 @@ uint32_t HELPER(adb)(uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
++
+ v2.ll = ldq(a2);
+- HELPER_LOG("%s: adding 0x%lx from f%d and 0x%lx\n", __FUNCTION__,
++ HELPER_LOG("%s: adding 0x%lx from f%d and 0x%lx\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = v1 = float64_add(v1, v2.d, &env->fpu_status);
+ return set_cc_nz_f64(v1);
+@@ -1397,6 +1429,7 @@ void HELPER(seb)(uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
++
+ v2.l = val;
+ env->fregs[f1].l.upper = float32_sub(v1, v2.f, &env->fpu_status);
+ }
+@@ -1406,6 +1439,7 @@ uint32_t HELPER(sdb)(uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
++
+ v2.ll = ldq(a2);
+ env->fregs[f1].d = v1 = float64_sub(v1, v2.d, &env->fpu_status);
+ return set_cc_nz_f64(v1);
+@@ -1416,8 +1450,9 @@ void HELPER(mdb)(uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
++
+ v2.ll = ldq(a2);
+- HELPER_LOG("%s: multiplying 0x%lx from f%d and 0x%ld\n", __FUNCTION__,
++ HELPER_LOG("%s: multiplying 0x%lx from f%d and 0x%ld\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = float64_mul(v1, v2.d, &env->fpu_status);
+ }
+@@ -1427,8 +1462,9 @@ void HELPER(ddb)(uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
++
+ v2.ll = ldq(a2);
+- HELPER_LOG("%s: dividing 0x%lx from f%d by 0x%ld\n", __FUNCTION__,
++ HELPER_LOG("%s: dividing 0x%lx from f%d by 0x%ld\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = float64_div(v1, v2.d, &env->fpu_status);
+ }
+@@ -1464,6 +1500,7 @@ static void set_round_mode(int m3)
+ uint32_t HELPER(cgebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ float32 v2 = env->fregs[f2].l.upper;
++
+ set_round_mode(m3);
+ env->regs[r1] = float32_to_int64(v2, &env->fpu_status);
+ return set_cc_nz_f32(v2);
+@@ -1473,6 +1510,7 @@ uint32_t HELPER(cgebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ uint32_t HELPER(cgdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ float64 v2 = env->fregs[f2].d;
++
+ set_round_mode(m3);
+ env->regs[r1] = float64_to_int64(v2, &env->fpu_status);
+ return set_cc_nz_f64(v2);
+@@ -1482,6 +1520,7 @@ uint32_t HELPER(cgdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ CPU_QuadU v2;
++
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+ set_round_mode(m3);
+@@ -1501,9 +1540,10 @@ uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ uint32_t HELPER(cfebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ float32 v2 = env->fregs[f2].l.upper;
++
+ set_round_mode(m3);
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float32_to_int32(v2, &env->fpu_status);
++ float32_to_int32(v2, &env->fpu_status);
+ return set_cc_nz_f32(v2);
+ }
+
+@@ -1511,9 +1551,10 @@ uint32_t HELPER(cfebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ uint32_t HELPER(cfdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ float64 v2 = env->fregs[f2].d;
++
+ set_round_mode(m3);
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float64_to_int32(v2, &env->fpu_status);
++ float64_to_int32(v2, &env->fpu_status);
+ return set_cc_nz_f64(v2);
+ }
+
+@@ -1521,10 +1562,11 @@ uint32_t HELPER(cfdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ uint32_t HELPER(cfxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ {
+ CPU_QuadU v2;
++
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float128_to_int32(v2.q, &env->fpu_status);
++ float128_to_int32(v2.q, &env->fpu_status);
+ return set_cc_nz_f128(v2.q);
+ }
+
+@@ -1544,6 +1586,7 @@ void HELPER(lzdr)(uint32_t f1)
+ void HELPER(lzxr)(uint32_t f1)
+ {
+ CPU_QuadU x;
++
+ x.q = float64_to_float128(float64_zero, &env->fpu_status);
+ env->fregs[f1].ll = x.ll.upper;
+ env->fregs[f1 + 1].ll = x.ll.lower;
+@@ -1553,12 +1596,13 @@ void HELPER(lzxr)(uint32_t f1)
+ uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+- CPU_QuadU v2;
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+- CPU_QuadU res;
+ res.q = float128_sub(v1.q, v2.q, &env->fpu_status);
+ env->fregs[f1].ll = res.ll.upper;
+ env->fregs[f1 + 2].ll = res.ll.lower;
+@@ -1569,12 +1613,13 @@ uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
+ uint32_t HELPER(axbr)(uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+- CPU_QuadU v2;
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+- CPU_QuadU res;
+ res.q = float128_add(v1.q, v2.q, &env->fpu_status);
+ env->fregs[f1].ll = res.ll.upper;
+ env->fregs[f1 + 2].ll = res.ll.lower;
+@@ -1599,8 +1644,9 @@ void HELPER(ddbr)(uint32_t f1, uint32_t f2)
+ /* 64-bit FP multiply and add RM */
+ void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
+ {
+- HELPER_LOG("%s: f1 %d a2 0x%lx f3 %d\n", __FUNCTION__, f1, a2, f3);
+ CPU_DoubleU v2;
++
++ HELPER_LOG("%s: f1 %d a2 0x%lx f3 %d\n", __func__, f1, a2, f3);
+ v2.ll = ldq(a2);
+ env->fregs[f1].d = float64_add(env->fregs[f1].d,
+ float64_mul(v2.d, env->fregs[f3].d,
+@@ -1611,7 +1657,7 @@ void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
+ /* 64-bit FP multiply and add RR */
+ void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ {
+- HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __FUNCTION__, f1, f2, f3);
++ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+ env->fregs[f1].d = float64_add(float64_mul(env->fregs[f2].d,
+ env->fregs[f3].d,
+ &env->fpu_status),
+@@ -1621,7 +1667,7 @@ void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ /* 64-bit FP multiply and subtract RR */
+ void HELPER(msdbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ {
+- HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __FUNCTION__, f1, f2, f3);
++ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+ env->fregs[f1].d = float64_sub(float64_mul(env->fregs[f2].d,
+ env->fregs[f3].d,
+ &env->fpu_status),
+@@ -1642,6 +1688,7 @@ void HELPER(maebr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ void HELPER(ldeb)(uint32_t f1, uint64_t a2)
+ {
+ uint32_t v2;
++
+ v2 = ldl(a2);
+ env->fregs[f1].d = float32_to_float64(v2,
+ &env->fpu_status);
+@@ -1651,8 +1698,9 @@ void HELPER(ldeb)(uint32_t f1, uint64_t a2)
+ void HELPER(lxdb)(uint32_t f1, uint64_t a2)
+ {
+ CPU_DoubleU v2;
+- v2.ll = ldq(a2);
+ CPU_QuadU v1;
++
++ v2.ll = ldq(a2);
+ v1.q = float64_to_float128(v2.d, &env->fpu_status);
+ env->fregs[f1].ll = v1.ll.upper;
+ env->fregs[f1 + 2].ll = v1.ll.lower;
+@@ -1665,7 +1713,7 @@ uint32_t HELPER(tceb)(uint32_t f1, uint64_t m2)
+ int neg = float32_is_neg(v1);
+ uint32_t cc = 0;
+
+- HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __FUNCTION__, (long)v1, m2, neg);
++ HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, (long)v1, m2, neg);
+ if ((float32_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
+ (float32_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
+ (float32_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
+@@ -1687,7 +1735,7 @@ uint32_t HELPER(tcdb)(uint32_t f1, uint64_t m2)
+ int neg = float64_is_neg(v1);
+ uint32_t cc = 0;
+
+- HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __FUNCTION__, v1, m2, neg);
++ HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, v1, m2, neg);
+ if ((float64_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
+ (float64_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
+ (float64_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
+@@ -1706,10 +1754,12 @@ uint32_t HELPER(tcxb)(uint32_t f1, uint64_t m2)
+ {
+ CPU_QuadU v1;
+ uint32_t cc = 0;
++ int neg;
++
+ v1.ll.upper = env->fregs[f1].ll;
+ v1.ll.lower = env->fregs[f1 + 2].ll;
+
+- int neg = float128_is_neg(v1.q);
++ neg = float128_is_neg(v1.q);
+ if ((float128_is_zero(v1.q) && (m2 & (1 << (11-neg)))) ||
+ (float128_is_infinity(v1.q) && (m2 & (1 << (5-neg)))) ||
+ (float128_is_any_nan(v1.q) && (m2 & (1 << (3-neg)))) ||
+@@ -1787,7 +1837,7 @@ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+
+ /* store result */
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- ((uint32_t)cksm + (cksm >> 32));
++ ((uint32_t)cksm + (cksm >> 32));
+ }
+
+ static inline uint32_t cc_calc_ltgt_32(CPUS390XState *env, int32_t src,
+@@ -1848,10 +1898,12 @@ static inline uint32_t cc_calc_ltugtu_64(CPUS390XState *env, uint64_t src,
+ }
+ }
+
+-static inline uint32_t cc_calc_tm_32(CPUS390XState *env, uint32_t val, uint32_t mask)
++static inline uint32_t cc_calc_tm_32(CPUS390XState *env, uint32_t val,
++ uint32_t mask)
+ {
+- HELPER_LOG("%s: val 0x%x mask 0x%x\n", __FUNCTION__, val, mask);
+ uint16_t r = val & mask;
++
++ HELPER_LOG("%s: val 0x%x mask 0x%x\n", __func__, val, mask);
+ if (r == 0 || mask == 0) {
+ return 0;
+ } else if (r == mask) {
+@@ -1862,10 +1914,12 @@ static inline uint32_t cc_calc_tm_32(CPUS390XState *env, uint32_t val, uint32_t
+ }
+
+ /* set condition code for test under mask */
+-static inline uint32_t cc_calc_tm_64(CPUS390XState *env, uint64_t val, uint32_t mask)
++static inline uint32_t cc_calc_tm_64(CPUS390XState *env, uint64_t val,
++ uint32_t mask)
+ {
+ uint16_t r = val & mask;
+- HELPER_LOG("%s: val 0x%lx mask 0x%x r 0x%x\n", __FUNCTION__, val, mask, r);
++
++ HELPER_LOG("%s: val 0x%lx mask 0x%x r 0x%x\n", __func__, val, mask, r);
+ if (r == 0 || mask == 0) {
+ return 0;
+ } else if (r == mask) {
+@@ -1888,8 +1942,8 @@ static inline uint32_t cc_calc_nz(CPUS390XState *env, uint64_t dst)
+ return !!dst;
+ }
+
+-static inline uint32_t cc_calc_add_64(CPUS390XState *env, int64_t a1, int64_t a2,
+- int64_t ar)
++static inline uint32_t cc_calc_add_64(CPUS390XState *env, int64_t a1,
++ int64_t a2, int64_t ar)
+ {
+ if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
+ return 3; /* overflow */
+@@ -1904,8 +1958,8 @@ static inline uint32_t cc_calc_add_64(CPUS390XState *env, int64_t a1, int64_t a2
+ }
+ }
+
+-static inline uint32_t cc_calc_addu_64(CPUS390XState *env, uint64_t a1, uint64_t a2,
+- uint64_t ar)
++static inline uint32_t cc_calc_addu_64(CPUS390XState *env, uint64_t a1,
++ uint64_t a2, uint64_t ar)
+ {
+ if (ar == 0) {
+ if (a1) {
+@@ -1915,15 +1969,15 @@ static inline uint32_t cc_calc_addu_64(CPUS390XState *env, uint64_t a1, uint64_t
+ }
+ } else {
+ if (ar < a1 || ar < a2) {
+- return 3;
++ return 3;
+ } else {
+- return 1;
++ return 1;
+ }
+ }
+ }
+
+-static inline uint32_t cc_calc_sub_64(CPUS390XState *env, int64_t a1, int64_t a2,
+- int64_t ar)
++static inline uint32_t cc_calc_sub_64(CPUS390XState *env, int64_t a1,
++ int64_t a2, int64_t ar)
+ {
+ if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
+ return 3; /* overflow */
+@@ -1938,8 +1992,8 @@ static inline uint32_t cc_calc_sub_64(CPUS390XState *env, int64_t a1, int64_t a2
+ }
+ }
+
+-static inline uint32_t cc_calc_subu_64(CPUS390XState *env, uint64_t a1, uint64_t a2,
+- uint64_t ar)
++static inline uint32_t cc_calc_subu_64(CPUS390XState *env, uint64_t a1,
++ uint64_t a2, uint64_t ar)
+ {
+ if (ar == 0) {
+ return 2;
+@@ -1982,8 +2036,8 @@ static inline uint32_t cc_calc_comp_64(CPUS390XState *env, int64_t dst)
+ }
+
+
+-static inline uint32_t cc_calc_add_32(CPUS390XState *env, int32_t a1, int32_t a2,
+- int32_t ar)
++static inline uint32_t cc_calc_add_32(CPUS390XState *env, int32_t a1,
++ int32_t a2, int32_t ar)
+ {
+ if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
+ return 3; /* overflow */
+@@ -1998,26 +2052,26 @@ static inline uint32_t cc_calc_add_32(CPUS390XState *env, int32_t a1, int32_t a2
+ }
+ }
+
+-static inline uint32_t cc_calc_addu_32(CPUS390XState *env, uint32_t a1, uint32_t a2,
+- uint32_t ar)
++static inline uint32_t cc_calc_addu_32(CPUS390XState *env, uint32_t a1,
++ uint32_t a2, uint32_t ar)
+ {
+ if (ar == 0) {
+ if (a1) {
+- return 2;
++ return 2;
+ } else {
+- return 0;
++ return 0;
+ }
+ } else {
+ if (ar < a1 || ar < a2) {
+- return 3;
++ return 3;
+ } else {
+- return 1;
++ return 1;
+ }
+ }
+ }
+
+-static inline uint32_t cc_calc_sub_32(CPUS390XState *env, int32_t a1, int32_t a2,
+- int32_t ar)
++static inline uint32_t cc_calc_sub_32(CPUS390XState *env, int32_t a1,
++ int32_t a2, int32_t ar)
+ {
+ if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
+ return 3; /* overflow */
+@@ -2032,8 +2086,8 @@ static inline uint32_t cc_calc_sub_32(CPUS390XState *env, int32_t a1, int32_t a2
+ }
+ }
+
+-static inline uint32_t cc_calc_subu_32(CPUS390XState *env, uint32_t a1, uint32_t a2,
+- uint32_t ar)
++static inline uint32_t cc_calc_subu_32(CPUS390XState *env, uint32_t a1,
++ uint32_t a2, uint32_t ar)
+ {
+ if (ar == 0) {
+ return 2;
+@@ -2076,11 +2130,12 @@ static inline uint32_t cc_calc_comp_32(CPUS390XState *env, int32_t dst)
+ }
+
+ /* calculate condition code for insert character under mask insn */
+-static inline uint32_t cc_calc_icm_32(CPUS390XState *env, uint32_t mask, uint32_t val)
++static inline uint32_t cc_calc_icm_32(CPUS390XState *env, uint32_t mask,
++ uint32_t val)
+ {
+- HELPER_LOG("%s: mask 0x%x val %d\n", __FUNCTION__, mask, val);
+ uint32_t cc;
+
++ HELPER_LOG("%s: mask 0x%x val %d\n", __func__, mask, val);
+ if (mask == 0xf) {
+ if (!val) {
+ return 0;
+@@ -2107,7 +2162,8 @@ static inline uint32_t cc_calc_icm_32(CPUS390XState *env, uint32_t mask, uint32_
+ return cc;
+ }
+
+-static inline uint32_t cc_calc_slag(CPUS390XState *env, uint64_t src, uint64_t shift)
++static inline uint32_t cc_calc_slag(CPUS390XState *env, uint64_t src,
++ uint64_t shift)
+ {
+ uint64_t mask = ((1ULL << shift) - 1ULL) << (64 - shift);
+ uint64_t match, r;
+@@ -2136,8 +2192,8 @@ static inline uint32_t cc_calc_slag(CPUS390XState *env, uint64_t src, uint64_t s
+ }
+
+
+-static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src,
+- uint64_t dst, uint64_t vr)
++static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op,
++ uint64_t src, uint64_t dst, uint64_t vr)
+ {
+ uint32_t r = 0;
+
+@@ -2244,7 +2300,7 @@ static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t s
+ cpu_abort(env, "Unknown CC operation: %s\n", cc_name(cc_op));
+ }
+
+- HELPER_LOG("%s: %15s 0x%016lx 0x%016lx 0x%016lx = %d\n", __FUNCTION__,
++ HELPER_LOG("%s: %15s 0x%016lx 0x%016lx 0x%016lx = %d\n", __func__,
+ cc_name(cc_op), src, dst, vr, r);
+ return r;
+ }
+@@ -2334,6 +2390,7 @@ void HELPER(tr)(uint32_t len, uint64_t array, uint64_t trans)
+ for (i = 0; i <= len; i++) {
+ uint8_t byte = ldub(array + i);
+ uint8_t new_byte = ldub(trans + byte);
++
+ stb(array + i, new_byte);
+ }
+ }
+@@ -2363,7 +2420,7 @@ static void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
+ }
+
+ /*
+- * ret < 0 indicates program check, ret = 0,1,2,3 -> cc
++ * ret < 0 indicates program check, ret = 0, 1, 2, 3 -> cc
+ */
+ int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)
+ {
+@@ -2382,24 +2439,24 @@ int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)
+ return -PGM_SPECIFICATION;
+ }
+
+- switch(code) {
+- case SCLP_CMDW_READ_SCP_INFO:
+- case SCLP_CMDW_READ_SCP_INFO_FORCED:
+- while ((ram_size >> (20 + shift)) > 65535) {
+- shift++;
+- }
+- stw_phys(sccb + SCP_MEM_CODE, ram_size >> (20 + shift));
+- stb_phys(sccb + SCP_INCREMENT, 1 << shift);
+- stw_phys(sccb + SCP_RESPONSE_CODE, 0x10);
++ switch (code) {
++ case SCLP_CMDW_READ_SCP_INFO:
++ case SCLP_CMDW_READ_SCP_INFO_FORCED:
++ while ((ram_size >> (20 + shift)) > 65535) {
++ shift++;
++ }
++ stw_phys(sccb + SCP_MEM_CODE, ram_size >> (20 + shift));
++ stb_phys(sccb + SCP_INCREMENT, 1 << shift);
++ stw_phys(sccb + SCP_RESPONSE_CODE, 0x10);
+
+- s390_sclp_extint(sccb & ~3);
+- break;
+- default:
++ s390_sclp_extint(sccb & ~3);
++ break;
++ default:
+ #ifdef DEBUG_HELPER
+- printf("KVM: invalid sclp call 0x%x / 0x%" PRIx64 "x\n", sccb, code);
++ printf("KVM: invalid sclp call 0x%x / 0x%" PRIx64 "x\n", sccb, code);
+ #endif
+- r = 3;
+- break;
++ r = 3;
++ break;
+ }
+
+ return r;
+@@ -2479,7 +2536,7 @@ static inline uint64_t clock_value(CPUS390XState *env)
+ uint64_t time;
+
+ time = env->tod_offset +
+- time2tod(qemu_get_clock_ns(vm_clock) - env->tod_basetime);
++ time2tod(qemu_get_clock_ns(vm_clock) - env->tod_basetime);
+
+ return time;
+ }
+@@ -2503,7 +2560,6 @@ uint32_t HELPER(stcke)(uint64_t a1)
+ /* XXX programmable fields */
+ stw(a1 + 17, 0);
+
+-
+ return 0;
+ }
+
+@@ -2584,7 +2640,7 @@ uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+ ebcdic_put(sysib.model, "QEMU ", 16);
+ ebcdic_put(sysib.sequence, "QEMU ", 16);
+ ebcdic_put(sysib.plant, "QEMU", 4);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+ } else if ((sel1 == 2) && (sel2 == 1)) {
+ /* Basic Machine CPU */
+ struct sysib_121 sysib;
+@@ -2594,7 +2650,7 @@ uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+ ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
+ ebcdic_put(sysib.plant, "QEMU", 4);
+ stw_p(&sysib.cpu_addr, env->cpu_num);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+ } else if ((sel1 == 2) && (sel2 == 2)) {
+ /* Basic Machine CPUs */
+ struct sysib_122 sysib;
+@@ -2606,68 +2662,68 @@ uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+ stw_p(&sysib.active_cpus, 1);
+ stw_p(&sysib.standby_cpus, 0);
+ stw_p(&sysib.reserved_cpus, 0);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+ } else {
+ cc = 3;
+ }
+ break;
+ case STSI_LEVEL_2:
+- {
+- if ((sel1 == 2) && (sel2 == 1)) {
+- /* LPAR CPU */
+- struct sysib_221 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- /* XXX make different for different CPUs? */
+- ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
+- ebcdic_put(sysib.plant, "QEMU", 4);
+- stw_p(&sysib.cpu_addr, env->cpu_num);
+- stw_p(&sysib.cpu_id, 0);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
+- } else if ((sel1 == 2) && (sel2 == 2)) {
+- /* LPAR CPUs */
+- struct sysib_222 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- stw_p(&sysib.lpar_num, 0);
+- sysib.lcpuc = 0;
+- /* XXX change when SMP comes */
+- stw_p(&sysib.total_cpus, 1);
+- stw_p(&sysib.conf_cpus, 1);
+- stw_p(&sysib.standby_cpus, 0);
+- stw_p(&sysib.reserved_cpus, 0);
+- ebcdic_put(sysib.name, "QEMU ", 8);
+- stl_p(&sysib.caf, 1000);
+- stw_p(&sysib.dedicated_cpus, 0);
+- stw_p(&sysib.shared_cpus, 0);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
+- } else {
+- cc = 3;
++ {
++ if ((sel1 == 2) && (sel2 == 1)) {
++ /* LPAR CPU */
++ struct sysib_221 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ /* XXX make different for different CPUs? */
++ ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
++ ebcdic_put(sysib.plant, "QEMU", 4);
++ stw_p(&sysib.cpu_addr, env->cpu_num);
++ stw_p(&sysib.cpu_id, 0);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else if ((sel1 == 2) && (sel2 == 2)) {
++ /* LPAR CPUs */
++ struct sysib_222 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ stw_p(&sysib.lpar_num, 0);
++ sysib.lcpuc = 0;
++ /* XXX change when SMP comes */
++ stw_p(&sysib.total_cpus, 1);
++ stw_p(&sysib.conf_cpus, 1);
++ stw_p(&sysib.standby_cpus, 0);
++ stw_p(&sysib.reserved_cpus, 0);
++ ebcdic_put(sysib.name, "QEMU ", 8);
++ stl_p(&sysib.caf, 1000);
++ stw_p(&sysib.dedicated_cpus, 0);
++ stw_p(&sysib.shared_cpus, 0);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else {
++ cc = 3;
++ }
++ break;
+ }
+- break;
+- }
+ case STSI_LEVEL_3:
+- {
+- if ((sel1 == 2) && (sel2 == 2)) {
+- /* VM CPUs */
+- struct sysib_322 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- sysib.count = 1;
+- /* XXX change when SMP comes */
+- stw_p(&sysib.vm[0].total_cpus, 1);
+- stw_p(&sysib.vm[0].conf_cpus, 1);
+- stw_p(&sysib.vm[0].standby_cpus, 0);
+- stw_p(&sysib.vm[0].reserved_cpus, 0);
+- ebcdic_put(sysib.vm[0].name, "KVMguest", 8);
+- stl_p(&sysib.vm[0].caf, 1000);
+- ebcdic_put(sysib.vm[0].cpi, "KVM/Linux ", 16);
+- cpu_physical_memory_rw(a0, (uint8_t*)&sysib, sizeof(sysib), 1);
+- } else {
+- cc = 3;
++ {
++ if ((sel1 == 2) && (sel2 == 2)) {
++ /* VM CPUs */
++ struct sysib_322 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ sysib.count = 1;
++ /* XXX change when SMP comes */
++ stw_p(&sysib.vm[0].total_cpus, 1);
++ stw_p(&sysib.vm[0].conf_cpus, 1);
++ stw_p(&sysib.vm[0].standby_cpus, 0);
++ stw_p(&sysib.vm[0].reserved_cpus, 0);
++ ebcdic_put(sysib.vm[0].name, "KVMguest", 8);
++ stl_p(&sysib.vm[0].caf, 1000);
++ ebcdic_put(sysib.vm[0].cpi, "KVM/Linux ", 16);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else {
++ cc = 3;
++ }
++ break;
+ }
+- break;
+- }
+ case STSI_LEVEL_CURRENT:
+ env->regs[0] = STSI_LEVEL_3;
+ break;
+@@ -2781,6 +2837,7 @@ uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)
+ {
+ uint8_t re;
+ uint8_t key;
++
+ if (r2 > ram_size) {
+ return 0;
+ }
+@@ -2865,7 +2922,7 @@ static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
+ uint32_t HELPER(mvcs)(uint64_t l, uint64_t a1, uint64_t a2)
+ {
+ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+- __FUNCTION__, l, a1, a2);
++ __func__, l, a1, a2);
+
+ return mvc_asc(l, a1, PSW_ASC_SECONDARY, a2, PSW_ASC_PRIMARY);
+ }
+@@ -2873,7 +2930,7 @@ uint32_t HELPER(mvcs)(uint64_t l, uint64_t a1, uint64_t a2)
+ uint32_t HELPER(mvcp)(uint64_t l, uint64_t a1, uint64_t a2)
+ {
+ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+- __FUNCTION__, l, a1, a2);
++ __func__, l, a1, a2);
+
+ return mvc_asc(l, a1, PSW_ASC_PRIMARY, a2, PSW_ASC_SECONDARY);
+ }
+@@ -2883,9 +2940,9 @@ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+ int cc = 0;
+
+ HELPER_LOG("%s: %016" PRIx64 " %08x %016" PRIx64 "\n",
+- __FUNCTION__, order_code, r1, cpu_addr);
++ __func__, order_code, r1, cpu_addr);
+
+- /* Remember: Use "R1 or R1+1, whichever is the odd-numbered register"
++ /* Remember: Use "R1 or R1 + 1, whichever is the odd-numbered register"
+ as parameter (input). Status (output) is always R1. */
+
+ switch (order_code) {
+@@ -2901,7 +2958,7 @@ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+ env->regs[r1] &= 0xffffffff00000000ULL;
+ cc = 1;
+ break;
+-#if !defined (CONFIG_USER_ONLY)
++#if !defined(CONFIG_USER_ONLY)
+ case SIGP_RESTART:
+ qemu_system_reset_request();
+ cpu_loop_exit(env);
+@@ -2922,7 +2979,7 @@ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+
+ void HELPER(sacf)(uint64_t a1)
+ {
+- HELPER_LOG("%s: %16" PRIx64 "\n", __FUNCTION__, a1);
++ HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1);
+
+ switch (a1 & 0xf00) {
+ case 0x000:
+@@ -2953,13 +3010,13 @@ void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
+ /* XXX broadcast to other CPUs */
+
+ /* XXX Linux is nice enough to give us the exact pte address.
+- According to spec we'd have to find it out ourselves */
++ According to spec we'd have to find it out ourselves */
+ /* XXX Linux is fine with overwriting the pte, the spec requires
+- us to only set the invalid bit */
++ us to only set the invalid bit */
+ stq_phys(pte_addr, pte | _PAGE_INVALID);
+
+ /* XXX we exploit the fact that Linux passes the exact virtual
+- address here - it's not obliged to! */
++ address here - it's not obliged to! */
+ tlb_flush_page(env, page);
+
+ /* XXX 31-bit hack */
+@@ -3008,7 +3065,8 @@ uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
+ env->exception_index = old_exc;
+
+ if (!(env->psw.mask & PSW_MASK_64)) {
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | (ret & 0xffffffffULL);
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ (ret & 0xffffffffULL);
+ } else {
+ env->regs[r1] = ret;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 3eb9b25ae5d2bcc024646c5a04f28899661ab14c Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:31 +0000
+Subject: [PATCH] target-s390x: split FPU ops
+
+Move floating point instructions to fpu_helper.c.
+
+While exporting some condition code helpers,
+avoid duplicate identifier conflict with translate.c.
+
+Remove unused set_cc_nz_f64() in translate.c.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 2 +
+ target-s390x/cpu.h | 6 +
+ target-s390x/fpu_helper.c | 836 +++++++++++++++++++++++++++++++++++++++++++++
+ target-s390x/op_helper.c | 802 -------------------------------------------
+ target-s390x/translate.c | 11 +-
+ 5 files changed, 847 insertions(+), 810 deletions(-)
+ create mode 100644 target-s390x/fpu_helper.c
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 80be3bb..23b3bd9 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -1,5 +1,7 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o interrupt.o
++obj-y += fpu_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+ $(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
++$(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
+index 18ac6e3..b4620c5 100644
+--- a/target-s390x/cpu.h
++++ b/target-s390x/cpu.h
+@@ -999,4 +999,10 @@ static inline void cpu_pc_from_tb(CPUS390XState *env, TranslationBlock* tb)
+ env->psw.addr = tb->pc;
+ }
+
++/* fpu_helper.c */
++uint32_t set_cc_f32(float32 v1, float32 v2);
++uint32_t set_cc_f64(float64 v1, float64 v2);
++uint32_t set_cc_nz_f32(float32 v);
++uint32_t set_cc_nz_f64(float64 v);
++
+ #endif
+diff --git a/target-s390x/fpu_helper.c b/target-s390x/fpu_helper.c
+new file mode 100644
+index 0000000..1389052
+--- /dev/null
++++ b/target-s390x/fpu_helper.c
+@@ -0,0 +1,836 @@
++/*
++ * S/390 FPU helper routines
++ *
++ * Copyright (c) 2009 Ulrich Hecht
++ * Copyright (c) 2009 Alexander Graf
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "cpu.h"
++#include "dyngen-exec.h"
++#include "helper.h"
++
++#if !defined(CONFIG_USER_ONLY)
++#include "softmmu_exec.h"
++#endif
++
++/* #define DEBUG_HELPER */
++#ifdef DEBUG_HELPER
++#define HELPER_LOG(x...) qemu_log(x)
++#else
++#define HELPER_LOG(x...)
++#endif
++
++static inline int float_comp_to_cc(int float_compare)
++{
++ switch (float_compare) {
++ case float_relation_equal:
++ return 0;
++ case float_relation_less:
++ return 1;
++ case float_relation_greater:
++ return 2;
++ case float_relation_unordered:
++ return 3;
++ default:
++ cpu_abort(env, "unknown return value for float compare\n");
++ }
++}
++
++/* condition codes for binary FP ops */
++uint32_t set_cc_f32(float32 v1, float32 v2)
++{
++ return float_comp_to_cc(float32_compare_quiet(v1, v2, &env->fpu_status));
++}
++
++uint32_t set_cc_f64(float64 v1, float64 v2)
++{
++ return float_comp_to_cc(float64_compare_quiet(v1, v2, &env->fpu_status));
++}
++
++/* condition codes for unary FP ops */
++uint32_t set_cc_nz_f32(float32 v)
++{
++ if (float32_is_any_nan(v)) {
++ return 3;
++ } else if (float32_is_zero(v)) {
++ return 0;
++ } else if (float32_is_neg(v)) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++uint32_t set_cc_nz_f64(float64 v)
++{
++ if (float64_is_any_nan(v)) {
++ return 3;
++ } else if (float64_is_zero(v)) {
++ return 0;
++ } else if (float64_is_neg(v)) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++static uint32_t set_cc_nz_f128(float128 v)
++{
++ if (float128_is_any_nan(v)) {
++ return 3;
++ } else if (float128_is_zero(v)) {
++ return 0;
++ } else if (float128_is_neg(v)) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++/* convert 32-bit int to 64-bit float */
++void HELPER(cdfbr)(uint32_t f1, int32_t v2)
++{
++ HELPER_LOG("%s: converting %d to f%d\n", __func__, v2, f1);
++ env->fregs[f1].d = int32_to_float64(v2, &env->fpu_status);
++}
++
++/* convert 32-bit int to 128-bit float */
++void HELPER(cxfbr)(uint32_t f1, int32_t v2)
++{
++ CPU_QuadU v1;
++
++ v1.q = int32_to_float128(v2, &env->fpu_status);
++ env->fregs[f1].ll = v1.ll.upper;
++ env->fregs[f1 + 2].ll = v1.ll.lower;
++}
++
++/* convert 64-bit int to 32-bit float */
++void HELPER(cegbr)(uint32_t f1, int64_t v2)
++{
++ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
++ env->fregs[f1].l.upper = int64_to_float32(v2, &env->fpu_status);
++}
++
++/* convert 64-bit int to 64-bit float */
++void HELPER(cdgbr)(uint32_t f1, int64_t v2)
++{
++ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
++ env->fregs[f1].d = int64_to_float64(v2, &env->fpu_status);
++}
++
++/* convert 64-bit int to 128-bit float */
++void HELPER(cxgbr)(uint32_t f1, int64_t v2)
++{
++ CPU_QuadU x1;
++
++ x1.q = int64_to_float128(v2, &env->fpu_status);
++ HELPER_LOG("%s: converted %ld to 0x%lx and 0x%lx\n", __func__, v2,
++ x1.ll.upper, x1.ll.lower);
++ env->fregs[f1].ll = x1.ll.upper;
++ env->fregs[f1 + 2].ll = x1.ll.lower;
++}
++
++/* convert 32-bit int to 32-bit float */
++void HELPER(cefbr)(uint32_t f1, int32_t v2)
++{
++ env->fregs[f1].l.upper = int32_to_float32(v2, &env->fpu_status);
++ HELPER_LOG("%s: converting %d to 0x%d in f%d\n", __func__, v2,
++ env->fregs[f1].l.upper, f1);
++}
++
++/* 32-bit FP addition RR */
++uint32_t HELPER(aebr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
++ env->fregs[f2].l.upper,
++ &env->fpu_status);
++ HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
++ env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
++
++ return set_cc_nz_f32(env->fregs[f1].l.upper);
++}
++
++/* 64-bit FP addition RR */
++uint32_t HELPER(adbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_add(env->fregs[f1].d, env->fregs[f2].d,
++ &env->fpu_status);
++ HELPER_LOG("%s: adding 0x%ld resulting in 0x%ld in f%d\n", __func__,
++ env->fregs[f2].d, env->fregs[f1].d, f1);
++
++ return set_cc_nz_f64(env->fregs[f1].d);
++}
++
++/* 32-bit FP subtraction RR */
++uint32_t HELPER(sebr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_sub(env->fregs[f1].l.upper,
++ env->fregs[f2].l.upper,
++ &env->fpu_status);
++ HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
++ env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
++
++ return set_cc_nz_f32(env->fregs[f1].l.upper);
++}
++
++/* 64-bit FP subtraction RR */
++uint32_t HELPER(sdbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_sub(env->fregs[f1].d, env->fregs[f2].d,
++ &env->fpu_status);
++ HELPER_LOG("%s: subtracting 0x%ld resulting in 0x%ld in f%d\n",
++ __func__, env->fregs[f2].d, env->fregs[f1].d, f1);
++
++ return set_cc_nz_f64(env->fregs[f1].d);
++}
++
++/* 32-bit FP division RR */
++void HELPER(debr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_div(env->fregs[f1].l.upper,
++ env->fregs[f2].l.upper,
++ &env->fpu_status);
++}
++
++/* 128-bit FP division RR */
++void HELPER(dxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ res.q = float128_div(v1.q, v2.q, &env->fpu_status);
++ env->fregs[f1].ll = res.ll.upper;
++ env->fregs[f1 + 2].ll = res.ll.lower;
++}
++
++/* 64-bit FP multiplication RR */
++void HELPER(mdbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_mul(env->fregs[f1].d, env->fregs[f2].d,
++ &env->fpu_status);
++}
++
++/* 128-bit FP multiplication RR */
++void HELPER(mxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ res.q = float128_mul(v1.q, v2.q, &env->fpu_status);
++ env->fregs[f1].ll = res.ll.upper;
++ env->fregs[f1 + 2].ll = res.ll.lower;
++}
++
++/* convert 32-bit float to 64-bit float */
++void HELPER(ldebr)(uint32_t r1, uint32_t r2)
++{
++ env->fregs[r1].d = float32_to_float64(env->fregs[r2].l.upper,
++ &env->fpu_status);
++}
++
++/* convert 128-bit float to 64-bit float */
++void HELPER(ldxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU x2;
++
++ x2.ll.upper = env->fregs[f2].ll;
++ x2.ll.lower = env->fregs[f2 + 2].ll;
++ env->fregs[f1].d = float128_to_float64(x2.q, &env->fpu_status);
++ HELPER_LOG("%s: to 0x%ld\n", __func__, env->fregs[f1].d);
++}
++
++/* convert 64-bit float to 128-bit float */
++void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU res;
++
++ res.q = float64_to_float128(env->fregs[f2].d, &env->fpu_status);
++ env->fregs[f1].ll = res.ll.upper;
++ env->fregs[f1 + 2].ll = res.ll.lower;
++}
++
++/* convert 64-bit float to 32-bit float */
++void HELPER(ledbr)(uint32_t f1, uint32_t f2)
++{
++ float64 d2 = env->fregs[f2].d;
++
++ env->fregs[f1].l.upper = float64_to_float32(d2, &env->fpu_status);
++}
++
++/* convert 128-bit float to 32-bit float */
++void HELPER(lexbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU x2;
++
++ x2.ll.upper = env->fregs[f2].ll;
++ x2.ll.lower = env->fregs[f2 + 2].ll;
++ env->fregs[f1].l.upper = float128_to_float32(x2.q, &env->fpu_status);
++ HELPER_LOG("%s: to 0x%d\n", __func__, env->fregs[f1].l.upper);
++}
++
++/* absolute value of 32-bit float */
++uint32_t HELPER(lpebr)(uint32_t f1, uint32_t f2)
++{
++ float32 v1;
++ float32 v2 = env->fregs[f2].d;
++
++ v1 = float32_abs(v2);
++ env->fregs[f1].d = v1;
++ return set_cc_nz_f32(v1);
++}
++
++/* absolute value of 64-bit float */
++uint32_t HELPER(lpdbr)(uint32_t f1, uint32_t f2)
++{
++ float64 v1;
++ float64 v2 = env->fregs[f2].d;
++
++ v1 = float64_abs(v2);
++ env->fregs[f1].d = v1;
++ return set_cc_nz_f64(v1);
++}
++
++/* absolute value of 128-bit float */
++uint32_t HELPER(lpxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ v1.q = float128_abs(v2.q);
++ env->fregs[f1].ll = v1.ll.upper;
++ env->fregs[f1 + 2].ll = v1.ll.lower;
++ return set_cc_nz_f128(v1.q);
++}
++
++/* load and test 64-bit float */
++uint32_t HELPER(ltdbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = env->fregs[f2].d;
++ return set_cc_nz_f64(env->fregs[f1].d);
++}
++
++/* load and test 32-bit float */
++uint32_t HELPER(ltebr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = env->fregs[f2].l.upper;
++ return set_cc_nz_f32(env->fregs[f1].l.upper);
++}
++
++/* load and test 128-bit float */
++uint32_t HELPER(ltxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU x;
++
++ x.ll.upper = env->fregs[f2].ll;
++ x.ll.lower = env->fregs[f2 + 2].ll;
++ env->fregs[f1].ll = x.ll.upper;
++ env->fregs[f1 + 2].ll = x.ll.lower;
++ return set_cc_nz_f128(x.q);
++}
++
++/* load complement of 32-bit float */
++uint32_t HELPER(lcebr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_chs(env->fregs[f2].l.upper);
++
++ return set_cc_nz_f32(env->fregs[f1].l.upper);
++}
++
++/* load complement of 64-bit float */
++uint32_t HELPER(lcdbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_chs(env->fregs[f2].d);
++
++ return set_cc_nz_f64(env->fregs[f1].d);
++}
++
++/* load complement of 128-bit float */
++uint32_t HELPER(lcxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU x1, x2;
++
++ x2.ll.upper = env->fregs[f2].ll;
++ x2.ll.lower = env->fregs[f2 + 2].ll;
++ x1.q = float128_chs(x2.q);
++ env->fregs[f1].ll = x1.ll.upper;
++ env->fregs[f1 + 2].ll = x1.ll.lower;
++ return set_cc_nz_f128(x1.q);
++}
++
++/* 32-bit FP addition RM */
++void HELPER(aeb)(uint32_t f1, uint32_t val)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ CPU_FloatU v2;
++
++ v2.l = val;
++ HELPER_LOG("%s: adding 0x%d from f%d and 0x%d\n", __func__,
++ v1, f1, v2.f);
++ env->fregs[f1].l.upper = float32_add(v1, v2.f, &env->fpu_status);
++}
++
++/* 32-bit FP division RM */
++void HELPER(deb)(uint32_t f1, uint32_t val)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ CPU_FloatU v2;
++
++ v2.l = val;
++ HELPER_LOG("%s: dividing 0x%d from f%d by 0x%d\n", __func__,
++ v1, f1, v2.f);
++ env->fregs[f1].l.upper = float32_div(v1, v2.f, &env->fpu_status);
++}
++
++/* 32-bit FP multiplication RM */
++void HELPER(meeb)(uint32_t f1, uint32_t val)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ CPU_FloatU v2;
++
++ v2.l = val;
++ HELPER_LOG("%s: multiplying 0x%d from f%d and 0x%d\n", __func__,
++ v1, f1, v2.f);
++ env->fregs[f1].l.upper = float32_mul(v1, v2.f, &env->fpu_status);
++}
++
++/* 32-bit FP compare RR */
++uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ float32 v2 = env->fregs[f2].l.upper;
++
++ HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __func__,
++ v1, f1, v2);
++ return set_cc_f32(v1, v2);
++}
++
++/* 64-bit FP compare RR */
++uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
++{
++ float64 v1 = env->fregs[f1].d;
++ float64 v2 = env->fregs[f2].d;
++
++ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __func__,
++ v1, f1, v2);
++ return set_cc_f64(v1, v2);
++}
++
++/* 128-bit FP compare RR */
++uint32_t HELPER(cxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++
++ return float_comp_to_cc(float128_compare_quiet(v1.q, v2.q,
++ &env->fpu_status));
++}
++
++/* 64-bit FP compare RM */
++uint32_t HELPER(cdb)(uint32_t f1, uint64_t a2)
++{
++ float64 v1 = env->fregs[f1].d;
++ CPU_DoubleU v2;
++
++ v2.ll = ldq(a2);
++ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%lx\n", __func__, v1,
++ f1, v2.d);
++ return set_cc_f64(v1, v2.d);
++}
++
++/* 64-bit FP addition RM */
++uint32_t HELPER(adb)(uint32_t f1, uint64_t a2)
++{
++ float64 v1 = env->fregs[f1].d;
++ CPU_DoubleU v2;
++
++ v2.ll = ldq(a2);
++ HELPER_LOG("%s: adding 0x%lx from f%d and 0x%lx\n", __func__,
++ v1, f1, v2.d);
++ env->fregs[f1].d = v1 = float64_add(v1, v2.d, &env->fpu_status);
++ return set_cc_nz_f64(v1);
++}
++
++/* 32-bit FP subtraction RM */
++void HELPER(seb)(uint32_t f1, uint32_t val)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ CPU_FloatU v2;
++
++ v2.l = val;
++ env->fregs[f1].l.upper = float32_sub(v1, v2.f, &env->fpu_status);
++}
++
++/* 64-bit FP subtraction RM */
++uint32_t HELPER(sdb)(uint32_t f1, uint64_t a2)
++{
++ float64 v1 = env->fregs[f1].d;
++ CPU_DoubleU v2;
++
++ v2.ll = ldq(a2);
++ env->fregs[f1].d = v1 = float64_sub(v1, v2.d, &env->fpu_status);
++ return set_cc_nz_f64(v1);
++}
++
++/* 64-bit FP multiplication RM */
++void HELPER(mdb)(uint32_t f1, uint64_t a2)
++{
++ float64 v1 = env->fregs[f1].d;
++ CPU_DoubleU v2;
++
++ v2.ll = ldq(a2);
++ HELPER_LOG("%s: multiplying 0x%lx from f%d and 0x%ld\n", __func__,
++ v1, f1, v2.d);
++ env->fregs[f1].d = float64_mul(v1, v2.d, &env->fpu_status);
++}
++
++/* 64-bit FP division RM */
++void HELPER(ddb)(uint32_t f1, uint64_t a2)
++{
++ float64 v1 = env->fregs[f1].d;
++ CPU_DoubleU v2;
++
++ v2.ll = ldq(a2);
++ HELPER_LOG("%s: dividing 0x%lx from f%d by 0x%ld\n", __func__,
++ v1, f1, v2.d);
++ env->fregs[f1].d = float64_div(v1, v2.d, &env->fpu_status);
++}
++
++static void set_round_mode(int m3)
++{
++ switch (m3) {
++ case 0:
++ /* current mode */
++ break;
++ case 1:
++ /* biased round no nearest */
++ case 4:
++ /* round to nearest */
++ set_float_rounding_mode(float_round_nearest_even, &env->fpu_status);
++ break;
++ case 5:
++ /* round to zero */
++ set_float_rounding_mode(float_round_to_zero, &env->fpu_status);
++ break;
++ case 6:
++ /* round to +inf */
++ set_float_rounding_mode(float_round_up, &env->fpu_status);
++ break;
++ case 7:
++ /* round to -inf */
++ set_float_rounding_mode(float_round_down, &env->fpu_status);
++ break;
++ }
++}
++
++/* convert 32-bit float to 64-bit int */
++uint32_t HELPER(cgebr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ float32 v2 = env->fregs[f2].l.upper;
++
++ set_round_mode(m3);
++ env->regs[r1] = float32_to_int64(v2, &env->fpu_status);
++ return set_cc_nz_f32(v2);
++}
++
++/* convert 64-bit float to 64-bit int */
++uint32_t HELPER(cgdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ float64 v2 = env->fregs[f2].d;
++
++ set_round_mode(m3);
++ env->regs[r1] = float64_to_int64(v2, &env->fpu_status);
++ return set_cc_nz_f64(v2);
++}
++
++/* convert 128-bit float to 64-bit int */
++uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ CPU_QuadU v2;
++
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ set_round_mode(m3);
++ env->regs[r1] = float128_to_int64(v2.q, &env->fpu_status);
++ if (float128_is_any_nan(v2.q)) {
++ return 3;
++ } else if (float128_is_zero(v2.q)) {
++ return 0;
++ } else if (float128_is_neg(v2.q)) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++/* convert 32-bit float to 32-bit int */
++uint32_t HELPER(cfebr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ float32 v2 = env->fregs[f2].l.upper;
++
++ set_round_mode(m3);
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ float32_to_int32(v2, &env->fpu_status);
++ return set_cc_nz_f32(v2);
++}
++
++/* convert 64-bit float to 32-bit int */
++uint32_t HELPER(cfdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ float64 v2 = env->fregs[f2].d;
++
++ set_round_mode(m3);
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ float64_to_int32(v2, &env->fpu_status);
++ return set_cc_nz_f64(v2);
++}
++
++/* convert 128-bit float to 32-bit int */
++uint32_t HELPER(cfxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++{
++ CPU_QuadU v2;
++
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ float128_to_int32(v2.q, &env->fpu_status);
++ return set_cc_nz_f128(v2.q);
++}
++
++/* load 32-bit FP zero */
++void HELPER(lzer)(uint32_t f1)
++{
++ env->fregs[f1].l.upper = float32_zero;
++}
++
++/* load 64-bit FP zero */
++void HELPER(lzdr)(uint32_t f1)
++{
++ env->fregs[f1].d = float64_zero;
++}
++
++/* load 128-bit FP zero */
++void HELPER(lzxr)(uint32_t f1)
++{
++ CPU_QuadU x;
++
++ x.q = float64_to_float128(float64_zero, &env->fpu_status);
++ env->fregs[f1].ll = x.ll.upper;
++ env->fregs[f1 + 1].ll = x.ll.lower;
++}
++
++/* 128-bit FP subtraction RR */
++uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ res.q = float128_sub(v1.q, v2.q, &env->fpu_status);
++ env->fregs[f1].ll = res.ll.upper;
++ env->fregs[f1 + 2].ll = res.ll.lower;
++ return set_cc_nz_f128(res.q);
++}
++
++/* 128-bit FP addition RR */
++uint32_t HELPER(axbr)(uint32_t f1, uint32_t f2)
++{
++ CPU_QuadU v1;
++ CPU_QuadU v2;
++ CPU_QuadU res;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++ v2.ll.upper = env->fregs[f2].ll;
++ v2.ll.lower = env->fregs[f2 + 2].ll;
++ res.q = float128_add(v1.q, v2.q, &env->fpu_status);
++ env->fregs[f1].ll = res.ll.upper;
++ env->fregs[f1 + 2].ll = res.ll.lower;
++ return set_cc_nz_f128(res.q);
++}
++
++/* 32-bit FP multiplication RR */
++void HELPER(meebr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_mul(env->fregs[f1].l.upper,
++ env->fregs[f2].l.upper,
++ &env->fpu_status);
++}
++
++/* 64-bit FP division RR */
++void HELPER(ddbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_div(env->fregs[f1].d, env->fregs[f2].d,
++ &env->fpu_status);
++}
++
++/* 64-bit FP multiply and add RM */
++void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
++{
++ CPU_DoubleU v2;
++
++ HELPER_LOG("%s: f1 %d a2 0x%lx f3 %d\n", __func__, f1, a2, f3);
++ v2.ll = ldq(a2);
++ env->fregs[f1].d = float64_add(env->fregs[f1].d,
++ float64_mul(v2.d, env->fregs[f3].d,
++ &env->fpu_status),
++ &env->fpu_status);
++}
++
++/* 64-bit FP multiply and add RR */
++void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
++{
++ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
++ env->fregs[f1].d = float64_add(float64_mul(env->fregs[f2].d,
++ env->fregs[f3].d,
++ &env->fpu_status),
++ env->fregs[f1].d, &env->fpu_status);
++}
++
++/* 64-bit FP multiply and subtract RR */
++void HELPER(msdbr)(uint32_t f1, uint32_t f3, uint32_t f2)
++{
++ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
++ env->fregs[f1].d = float64_sub(float64_mul(env->fregs[f2].d,
++ env->fregs[f3].d,
++ &env->fpu_status),
++ env->fregs[f1].d, &env->fpu_status);
++}
++
++/* 32-bit FP multiply and add RR */
++void HELPER(maebr)(uint32_t f1, uint32_t f3, uint32_t f2)
++{
++ env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
++ float32_mul(env->fregs[f2].l.upper,
++ env->fregs[f3].l.upper,
++ &env->fpu_status),
++ &env->fpu_status);
++}
++
++/* convert 32-bit float to 64-bit float */
++void HELPER(ldeb)(uint32_t f1, uint64_t a2)
++{
++ uint32_t v2;
++
++ v2 = ldl(a2);
++ env->fregs[f1].d = float32_to_float64(v2,
++ &env->fpu_status);
++}
++
++/* convert 64-bit float to 128-bit float */
++void HELPER(lxdb)(uint32_t f1, uint64_t a2)
++{
++ CPU_DoubleU v2;
++ CPU_QuadU v1;
++
++ v2.ll = ldq(a2);
++ v1.q = float64_to_float128(v2.d, &env->fpu_status);
++ env->fregs[f1].ll = v1.ll.upper;
++ env->fregs[f1 + 2].ll = v1.ll.lower;
++}
++
++/* test data class 32-bit */
++uint32_t HELPER(tceb)(uint32_t f1, uint64_t m2)
++{
++ float32 v1 = env->fregs[f1].l.upper;
++ int neg = float32_is_neg(v1);
++ uint32_t cc = 0;
++
++ HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, (long)v1, m2, neg);
++ if ((float32_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
++ (float32_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
++ (float32_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
++ (float32_is_signaling_nan(v1) && (m2 & (1 << (1-neg))))) {
++ cc = 1;
++ } else if (m2 & (1 << (9-neg))) {
++ /* assume normalized number */
++ cc = 1;
++ }
++
++ /* FIXME: denormalized? */
++ return cc;
++}
++
++/* test data class 64-bit */
++uint32_t HELPER(tcdb)(uint32_t f1, uint64_t m2)
++{
++ float64 v1 = env->fregs[f1].d;
++ int neg = float64_is_neg(v1);
++ uint32_t cc = 0;
++
++ HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, v1, m2, neg);
++ if ((float64_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
++ (float64_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
++ (float64_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
++ (float64_is_signaling_nan(v1) && (m2 & (1 << (1-neg))))) {
++ cc = 1;
++ } else if (m2 & (1 << (9-neg))) {
++ /* assume normalized number */
++ cc = 1;
++ }
++ /* FIXME: denormalized? */
++ return cc;
++}
++
++/* test data class 128-bit */
++uint32_t HELPER(tcxb)(uint32_t f1, uint64_t m2)
++{
++ CPU_QuadU v1;
++ uint32_t cc = 0;
++ int neg;
++
++ v1.ll.upper = env->fregs[f1].ll;
++ v1.ll.lower = env->fregs[f1 + 2].ll;
++
++ neg = float128_is_neg(v1.q);
++ if ((float128_is_zero(v1.q) && (m2 & (1 << (11-neg)))) ||
++ (float128_is_infinity(v1.q) && (m2 & (1 << (5-neg)))) ||
++ (float128_is_any_nan(v1.q) && (m2 & (1 << (3-neg)))) ||
++ (float128_is_signaling_nan(v1.q) && (m2 & (1 << (1-neg))))) {
++ cc = 1;
++ } else if (m2 & (1 << (9-neg))) {
++ /* assume normalized number */
++ cc = 1;
++ }
++ /* FIXME: denormalized? */
++ return cc;
++}
++
++/* square root 64-bit RR */
++void HELPER(sqdbr)(uint32_t f1, uint32_t f2)
++{
++ env->fregs[f1].d = float64_sqrt(env->fregs[f2].d, &env->fpu_status);
++}
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+index 195e93e..270bf14 100644
+--- a/target-s390x/op_helper.c
++++ b/target-s390x/op_helper.c
+@@ -977,802 +977,6 @@ uint32_t HELPER(slbg)(uint32_t cc, uint32_t r1, uint64_t v1, uint64_t v2)
+ }
+ }
+
+-static inline int float_comp_to_cc(int float_compare)
+-{
+- switch (float_compare) {
+- case float_relation_equal:
+- return 0;
+- case float_relation_less:
+- return 1;
+- case float_relation_greater:
+- return 2;
+- case float_relation_unordered:
+- return 3;
+- default:
+- cpu_abort(env, "unknown return value for float compare\n");
+- }
+-}
+-
+-/* condition codes for binary FP ops */
+-static uint32_t set_cc_f32(float32 v1, float32 v2)
+-{
+- return float_comp_to_cc(float32_compare_quiet(v1, v2, &env->fpu_status));
+-}
+-
+-static uint32_t set_cc_f64(float64 v1, float64 v2)
+-{
+- return float_comp_to_cc(float64_compare_quiet(v1, v2, &env->fpu_status));
+-}
+-
+-/* condition codes for unary FP ops */
+-static uint32_t set_cc_nz_f32(float32 v)
+-{
+- if (float32_is_any_nan(v)) {
+- return 3;
+- } else if (float32_is_zero(v)) {
+- return 0;
+- } else if (float32_is_neg(v)) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static uint32_t set_cc_nz_f64(float64 v)
+-{
+- if (float64_is_any_nan(v)) {
+- return 3;
+- } else if (float64_is_zero(v)) {
+- return 0;
+- } else if (float64_is_neg(v)) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static uint32_t set_cc_nz_f128(float128 v)
+-{
+- if (float128_is_any_nan(v)) {
+- return 3;
+- } else if (float128_is_zero(v)) {
+- return 0;
+- } else if (float128_is_neg(v)) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-/* convert 32-bit int to 64-bit float */
+-void HELPER(cdfbr)(uint32_t f1, int32_t v2)
+-{
+- HELPER_LOG("%s: converting %d to f%d\n", __func__, v2, f1);
+- env->fregs[f1].d = int32_to_float64(v2, &env->fpu_status);
+-}
+-
+-/* convert 32-bit int to 128-bit float */
+-void HELPER(cxfbr)(uint32_t f1, int32_t v2)
+-{
+- CPU_QuadU v1;
+-
+- v1.q = int32_to_float128(v2, &env->fpu_status);
+- env->fregs[f1].ll = v1.ll.upper;
+- env->fregs[f1 + 2].ll = v1.ll.lower;
+-}
+-
+-/* convert 64-bit int to 32-bit float */
+-void HELPER(cegbr)(uint32_t f1, int64_t v2)
+-{
+- HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+- env->fregs[f1].l.upper = int64_to_float32(v2, &env->fpu_status);
+-}
+-
+-/* convert 64-bit int to 64-bit float */
+-void HELPER(cdgbr)(uint32_t f1, int64_t v2)
+-{
+- HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+- env->fregs[f1].d = int64_to_float64(v2, &env->fpu_status);
+-}
+-
+-/* convert 64-bit int to 128-bit float */
+-void HELPER(cxgbr)(uint32_t f1, int64_t v2)
+-{
+- CPU_QuadU x1;
+-
+- x1.q = int64_to_float128(v2, &env->fpu_status);
+- HELPER_LOG("%s: converted %ld to 0x%lx and 0x%lx\n", __func__, v2,
+- x1.ll.upper, x1.ll.lower);
+- env->fregs[f1].ll = x1.ll.upper;
+- env->fregs[f1 + 2].ll = x1.ll.lower;
+-}
+-
+-/* convert 32-bit int to 32-bit float */
+-void HELPER(cefbr)(uint32_t f1, int32_t v2)
+-{
+- env->fregs[f1].l.upper = int32_to_float32(v2, &env->fpu_status);
+- HELPER_LOG("%s: converting %d to 0x%d in f%d\n", __func__, v2,
+- env->fregs[f1].l.upper, f1);
+-}
+-
+-/* 32-bit FP addition RR */
+-uint32_t HELPER(aebr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
+- env->fregs[f2].l.upper,
+- &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
+- env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
+-
+- return set_cc_nz_f32(env->fregs[f1].l.upper);
+-}
+-
+-/* 64-bit FP addition RR */
+-uint32_t HELPER(adbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_add(env->fregs[f1].d, env->fregs[f2].d,
+- &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%ld resulting in 0x%ld in f%d\n", __func__,
+- env->fregs[f2].d, env->fregs[f1].d, f1);
+-
+- return set_cc_nz_f64(env->fregs[f1].d);
+-}
+-
+-/* 32-bit FP subtraction RR */
+-uint32_t HELPER(sebr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_sub(env->fregs[f1].l.upper,
+- env->fregs[f2].l.upper,
+- &env->fpu_status);
+- HELPER_LOG("%s: adding 0x%d resulting in 0x%d in f%d\n", __func__,
+- env->fregs[f2].l.upper, env->fregs[f1].l.upper, f1);
+-
+- return set_cc_nz_f32(env->fregs[f1].l.upper);
+-}
+-
+-/* 64-bit FP subtraction RR */
+-uint32_t HELPER(sdbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_sub(env->fregs[f1].d, env->fregs[f2].d,
+- &env->fpu_status);
+- HELPER_LOG("%s: subtracting 0x%ld resulting in 0x%ld in f%d\n",
+- __func__, env->fregs[f2].d, env->fregs[f1].d, f1);
+-
+- return set_cc_nz_f64(env->fregs[f1].d);
+-}
+-
+-/* 32-bit FP division RR */
+-void HELPER(debr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_div(env->fregs[f1].l.upper,
+- env->fregs[f2].l.upper,
+- &env->fpu_status);
+-}
+-
+-/* 128-bit FP division RR */
+-void HELPER(dxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+- CPU_QuadU res;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- res.q = float128_div(v1.q, v2.q, &env->fpu_status);
+- env->fregs[f1].ll = res.ll.upper;
+- env->fregs[f1 + 2].ll = res.ll.lower;
+-}
+-
+-/* 64-bit FP multiplication RR */
+-void HELPER(mdbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_mul(env->fregs[f1].d, env->fregs[f2].d,
+- &env->fpu_status);
+-}
+-
+-/* 128-bit FP multiplication RR */
+-void HELPER(mxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+- CPU_QuadU res;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- res.q = float128_mul(v1.q, v2.q, &env->fpu_status);
+- env->fregs[f1].ll = res.ll.upper;
+- env->fregs[f1 + 2].ll = res.ll.lower;
+-}
+-
+-/* convert 32-bit float to 64-bit float */
+-void HELPER(ldebr)(uint32_t r1, uint32_t r2)
+-{
+- env->fregs[r1].d = float32_to_float64(env->fregs[r2].l.upper,
+- &env->fpu_status);
+-}
+-
+-/* convert 128-bit float to 64-bit float */
+-void HELPER(ldxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU x2;
+-
+- x2.ll.upper = env->fregs[f2].ll;
+- x2.ll.lower = env->fregs[f2 + 2].ll;
+- env->fregs[f1].d = float128_to_float64(x2.q, &env->fpu_status);
+- HELPER_LOG("%s: to 0x%ld\n", __func__, env->fregs[f1].d);
+-}
+-
+-/* convert 64-bit float to 128-bit float */
+-void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU res;
+-
+- res.q = float64_to_float128(env->fregs[f2].d, &env->fpu_status);
+- env->fregs[f1].ll = res.ll.upper;
+- env->fregs[f1 + 2].ll = res.ll.lower;
+-}
+-
+-/* convert 64-bit float to 32-bit float */
+-void HELPER(ledbr)(uint32_t f1, uint32_t f2)
+-{
+- float64 d2 = env->fregs[f2].d;
+-
+- env->fregs[f1].l.upper = float64_to_float32(d2, &env->fpu_status);
+-}
+-
+-/* convert 128-bit float to 32-bit float */
+-void HELPER(lexbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU x2;
+-
+- x2.ll.upper = env->fregs[f2].ll;
+- x2.ll.lower = env->fregs[f2 + 2].ll;
+- env->fregs[f1].l.upper = float128_to_float32(x2.q, &env->fpu_status);
+- HELPER_LOG("%s: to 0x%d\n", __func__, env->fregs[f1].l.upper);
+-}
+-
+-/* absolute value of 32-bit float */
+-uint32_t HELPER(lpebr)(uint32_t f1, uint32_t f2)
+-{
+- float32 v1;
+- float32 v2 = env->fregs[f2].d;
+-
+- v1 = float32_abs(v2);
+- env->fregs[f1].d = v1;
+- return set_cc_nz_f32(v1);
+-}
+-
+-/* absolute value of 64-bit float */
+-uint32_t HELPER(lpdbr)(uint32_t f1, uint32_t f2)
+-{
+- float64 v1;
+- float64 v2 = env->fregs[f2].d;
+-
+- v1 = float64_abs(v2);
+- env->fregs[f1].d = v1;
+- return set_cc_nz_f64(v1);
+-}
+-
+-/* absolute value of 128-bit float */
+-uint32_t HELPER(lpxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+-
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- v1.q = float128_abs(v2.q);
+- env->fregs[f1].ll = v1.ll.upper;
+- env->fregs[f1 + 2].ll = v1.ll.lower;
+- return set_cc_nz_f128(v1.q);
+-}
+-
+-/* load and test 64-bit float */
+-uint32_t HELPER(ltdbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = env->fregs[f2].d;
+- return set_cc_nz_f64(env->fregs[f1].d);
+-}
+-
+-/* load and test 32-bit float */
+-uint32_t HELPER(ltebr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = env->fregs[f2].l.upper;
+- return set_cc_nz_f32(env->fregs[f1].l.upper);
+-}
+-
+-/* load and test 128-bit float */
+-uint32_t HELPER(ltxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU x;
+-
+- x.ll.upper = env->fregs[f2].ll;
+- x.ll.lower = env->fregs[f2 + 2].ll;
+- env->fregs[f1].ll = x.ll.upper;
+- env->fregs[f1 + 2].ll = x.ll.lower;
+- return set_cc_nz_f128(x.q);
+-}
+-
+-/* load complement of 32-bit float */
+-uint32_t HELPER(lcebr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_chs(env->fregs[f2].l.upper);
+-
+- return set_cc_nz_f32(env->fregs[f1].l.upper);
+-}
+-
+-/* load complement of 64-bit float */
+-uint32_t HELPER(lcdbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_chs(env->fregs[f2].d);
+-
+- return set_cc_nz_f64(env->fregs[f1].d);
+-}
+-
+-/* load complement of 128-bit float */
+-uint32_t HELPER(lcxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU x1, x2;
+-
+- x2.ll.upper = env->fregs[f2].ll;
+- x2.ll.lower = env->fregs[f2 + 2].ll;
+- x1.q = float128_chs(x2.q);
+- env->fregs[f1].ll = x1.ll.upper;
+- env->fregs[f1 + 2].ll = x1.ll.lower;
+- return set_cc_nz_f128(x1.q);
+-}
+-
+-/* 32-bit FP addition RM */
+-void HELPER(aeb)(uint32_t f1, uint32_t val)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- CPU_FloatU v2;
+-
+- v2.l = val;
+- HELPER_LOG("%s: adding 0x%d from f%d and 0x%d\n", __func__,
+- v1, f1, v2.f);
+- env->fregs[f1].l.upper = float32_add(v1, v2.f, &env->fpu_status);
+-}
+-
+-/* 32-bit FP division RM */
+-void HELPER(deb)(uint32_t f1, uint32_t val)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- CPU_FloatU v2;
+-
+- v2.l = val;
+- HELPER_LOG("%s: dividing 0x%d from f%d by 0x%d\n", __func__,
+- v1, f1, v2.f);
+- env->fregs[f1].l.upper = float32_div(v1, v2.f, &env->fpu_status);
+-}
+-
+-/* 32-bit FP multiplication RM */
+-void HELPER(meeb)(uint32_t f1, uint32_t val)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- CPU_FloatU v2;
+-
+- v2.l = val;
+- HELPER_LOG("%s: multiplying 0x%d from f%d and 0x%d\n", __func__,
+- v1, f1, v2.f);
+- env->fregs[f1].l.upper = float32_mul(v1, v2.f, &env->fpu_status);
+-}
+-
+-/* 32-bit FP compare RR */
+-uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- float32 v2 = env->fregs[f2].l.upper;
+-
+- HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __func__,
+- v1, f1, v2);
+- return set_cc_f32(v1, v2);
+-}
+-
+-/* 64-bit FP compare RR */
+-uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- float64 v2 = env->fregs[f2].d;
+-
+- HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __func__,
+- v1, f1, v2);
+- return set_cc_f64(v1, v2);
+-}
+-
+-/* 128-bit FP compare RR */
+-uint32_t HELPER(cxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+-
+- return float_comp_to_cc(float128_compare_quiet(v1.q, v2.q,
+- &env->fpu_status));
+-}
+-
+-/* 64-bit FP compare RM */
+-uint32_t HELPER(cdb)(uint32_t f1, uint64_t a2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- CPU_DoubleU v2;
+-
+- v2.ll = ldq(a2);
+- HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%lx\n", __func__, v1,
+- f1, v2.d);
+- return set_cc_f64(v1, v2.d);
+-}
+-
+-/* 64-bit FP addition RM */
+-uint32_t HELPER(adb)(uint32_t f1, uint64_t a2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- CPU_DoubleU v2;
+-
+- v2.ll = ldq(a2);
+- HELPER_LOG("%s: adding 0x%lx from f%d and 0x%lx\n", __func__,
+- v1, f1, v2.d);
+- env->fregs[f1].d = v1 = float64_add(v1, v2.d, &env->fpu_status);
+- return set_cc_nz_f64(v1);
+-}
+-
+-/* 32-bit FP subtraction RM */
+-void HELPER(seb)(uint32_t f1, uint32_t val)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- CPU_FloatU v2;
+-
+- v2.l = val;
+- env->fregs[f1].l.upper = float32_sub(v1, v2.f, &env->fpu_status);
+-}
+-
+-/* 64-bit FP subtraction RM */
+-uint32_t HELPER(sdb)(uint32_t f1, uint64_t a2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- CPU_DoubleU v2;
+-
+- v2.ll = ldq(a2);
+- env->fregs[f1].d = v1 = float64_sub(v1, v2.d, &env->fpu_status);
+- return set_cc_nz_f64(v1);
+-}
+-
+-/* 64-bit FP multiplication RM */
+-void HELPER(mdb)(uint32_t f1, uint64_t a2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- CPU_DoubleU v2;
+-
+- v2.ll = ldq(a2);
+- HELPER_LOG("%s: multiplying 0x%lx from f%d and 0x%ld\n", __func__,
+- v1, f1, v2.d);
+- env->fregs[f1].d = float64_mul(v1, v2.d, &env->fpu_status);
+-}
+-
+-/* 64-bit FP division RM */
+-void HELPER(ddb)(uint32_t f1, uint64_t a2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- CPU_DoubleU v2;
+-
+- v2.ll = ldq(a2);
+- HELPER_LOG("%s: dividing 0x%lx from f%d by 0x%ld\n", __func__,
+- v1, f1, v2.d);
+- env->fregs[f1].d = float64_div(v1, v2.d, &env->fpu_status);
+-}
+-
+-static void set_round_mode(int m3)
+-{
+- switch (m3) {
+- case 0:
+- /* current mode */
+- break;
+- case 1:
+- /* biased round no nearest */
+- case 4:
+- /* round to nearest */
+- set_float_rounding_mode(float_round_nearest_even, &env->fpu_status);
+- break;
+- case 5:
+- /* round to zero */
+- set_float_rounding_mode(float_round_to_zero, &env->fpu_status);
+- break;
+- case 6:
+- /* round to +inf */
+- set_float_rounding_mode(float_round_up, &env->fpu_status);
+- break;
+- case 7:
+- /* round to -inf */
+- set_float_rounding_mode(float_round_down, &env->fpu_status);
+- break;
+- }
+-}
+-
+-/* convert 32-bit float to 64-bit int */
+-uint32_t HELPER(cgebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- float32 v2 = env->fregs[f2].l.upper;
+-
+- set_round_mode(m3);
+- env->regs[r1] = float32_to_int64(v2, &env->fpu_status);
+- return set_cc_nz_f32(v2);
+-}
+-
+-/* convert 64-bit float to 64-bit int */
+-uint32_t HELPER(cgdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- float64 v2 = env->fregs[f2].d;
+-
+- set_round_mode(m3);
+- env->regs[r1] = float64_to_int64(v2, &env->fpu_status);
+- return set_cc_nz_f64(v2);
+-}
+-
+-/* convert 128-bit float to 64-bit int */
+-uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- CPU_QuadU v2;
+-
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- set_round_mode(m3);
+- env->regs[r1] = float128_to_int64(v2.q, &env->fpu_status);
+- if (float128_is_any_nan(v2.q)) {
+- return 3;
+- } else if (float128_is_zero(v2.q)) {
+- return 0;
+- } else if (float128_is_neg(v2.q)) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-/* convert 32-bit float to 32-bit int */
+-uint32_t HELPER(cfebr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- float32 v2 = env->fregs[f2].l.upper;
+-
+- set_round_mode(m3);
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float32_to_int32(v2, &env->fpu_status);
+- return set_cc_nz_f32(v2);
+-}
+-
+-/* convert 64-bit float to 32-bit int */
+-uint32_t HELPER(cfdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- float64 v2 = env->fregs[f2].d;
+-
+- set_round_mode(m3);
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float64_to_int32(v2, &env->fpu_status);
+- return set_cc_nz_f64(v2);
+-}
+-
+-/* convert 128-bit float to 32-bit int */
+-uint32_t HELPER(cfxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+-{
+- CPU_QuadU v2;
+-
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- float128_to_int32(v2.q, &env->fpu_status);
+- return set_cc_nz_f128(v2.q);
+-}
+-
+-/* load 32-bit FP zero */
+-void HELPER(lzer)(uint32_t f1)
+-{
+- env->fregs[f1].l.upper = float32_zero;
+-}
+-
+-/* load 64-bit FP zero */
+-void HELPER(lzdr)(uint32_t f1)
+-{
+- env->fregs[f1].d = float64_zero;
+-}
+-
+-/* load 128-bit FP zero */
+-void HELPER(lzxr)(uint32_t f1)
+-{
+- CPU_QuadU x;
+-
+- x.q = float64_to_float128(float64_zero, &env->fpu_status);
+- env->fregs[f1].ll = x.ll.upper;
+- env->fregs[f1 + 1].ll = x.ll.lower;
+-}
+-
+-/* 128-bit FP subtraction RR */
+-uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+- CPU_QuadU res;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- res.q = float128_sub(v1.q, v2.q, &env->fpu_status);
+- env->fregs[f1].ll = res.ll.upper;
+- env->fregs[f1 + 2].ll = res.ll.lower;
+- return set_cc_nz_f128(res.q);
+-}
+-
+-/* 128-bit FP addition RR */
+-uint32_t HELPER(axbr)(uint32_t f1, uint32_t f2)
+-{
+- CPU_QuadU v1;
+- CPU_QuadU v2;
+- CPU_QuadU res;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+- v2.ll.upper = env->fregs[f2].ll;
+- v2.ll.lower = env->fregs[f2 + 2].ll;
+- res.q = float128_add(v1.q, v2.q, &env->fpu_status);
+- env->fregs[f1].ll = res.ll.upper;
+- env->fregs[f1 + 2].ll = res.ll.lower;
+- return set_cc_nz_f128(res.q);
+-}
+-
+-/* 32-bit FP multiplication RR */
+-void HELPER(meebr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_mul(env->fregs[f1].l.upper,
+- env->fregs[f2].l.upper,
+- &env->fpu_status);
+-}
+-
+-/* 64-bit FP division RR */
+-void HELPER(ddbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_div(env->fregs[f1].d, env->fregs[f2].d,
+- &env->fpu_status);
+-}
+-
+-/* 64-bit FP multiply and add RM */
+-void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
+-{
+- CPU_DoubleU v2;
+-
+- HELPER_LOG("%s: f1 %d a2 0x%lx f3 %d\n", __func__, f1, a2, f3);
+- v2.ll = ldq(a2);
+- env->fregs[f1].d = float64_add(env->fregs[f1].d,
+- float64_mul(v2.d, env->fregs[f3].d,
+- &env->fpu_status),
+- &env->fpu_status);
+-}
+-
+-/* 64-bit FP multiply and add RR */
+-void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+-{
+- HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+- env->fregs[f1].d = float64_add(float64_mul(env->fregs[f2].d,
+- env->fregs[f3].d,
+- &env->fpu_status),
+- env->fregs[f1].d, &env->fpu_status);
+-}
+-
+-/* 64-bit FP multiply and subtract RR */
+-void HELPER(msdbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+-{
+- HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+- env->fregs[f1].d = float64_sub(float64_mul(env->fregs[f2].d,
+- env->fregs[f3].d,
+- &env->fpu_status),
+- env->fregs[f1].d, &env->fpu_status);
+-}
+-
+-/* 32-bit FP multiply and add RR */
+-void HELPER(maebr)(uint32_t f1, uint32_t f3, uint32_t f2)
+-{
+- env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
+- float32_mul(env->fregs[f2].l.upper,
+- env->fregs[f3].l.upper,
+- &env->fpu_status),
+- &env->fpu_status);
+-}
+-
+-/* convert 32-bit float to 64-bit float */
+-void HELPER(ldeb)(uint32_t f1, uint64_t a2)
+-{
+- uint32_t v2;
+-
+- v2 = ldl(a2);
+- env->fregs[f1].d = float32_to_float64(v2,
+- &env->fpu_status);
+-}
+-
+-/* convert 64-bit float to 128-bit float */
+-void HELPER(lxdb)(uint32_t f1, uint64_t a2)
+-{
+- CPU_DoubleU v2;
+- CPU_QuadU v1;
+-
+- v2.ll = ldq(a2);
+- v1.q = float64_to_float128(v2.d, &env->fpu_status);
+- env->fregs[f1].ll = v1.ll.upper;
+- env->fregs[f1 + 2].ll = v1.ll.lower;
+-}
+-
+-/* test data class 32-bit */
+-uint32_t HELPER(tceb)(uint32_t f1, uint64_t m2)
+-{
+- float32 v1 = env->fregs[f1].l.upper;
+- int neg = float32_is_neg(v1);
+- uint32_t cc = 0;
+-
+- HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, (long)v1, m2, neg);
+- if ((float32_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
+- (float32_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
+- (float32_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
+- (float32_is_signaling_nan(v1) && (m2 & (1 << (1-neg))))) {
+- cc = 1;
+- } else if (m2 & (1 << (9-neg))) {
+- /* assume normalized number */
+- cc = 1;
+- }
+-
+- /* FIXME: denormalized? */
+- return cc;
+-}
+-
+-/* test data class 64-bit */
+-uint32_t HELPER(tcdb)(uint32_t f1, uint64_t m2)
+-{
+- float64 v1 = env->fregs[f1].d;
+- int neg = float64_is_neg(v1);
+- uint32_t cc = 0;
+-
+- HELPER_LOG("%s: v1 0x%lx m2 0x%lx neg %d\n", __func__, v1, m2, neg);
+- if ((float64_is_zero(v1) && (m2 & (1 << (11-neg)))) ||
+- (float64_is_infinity(v1) && (m2 & (1 << (5-neg)))) ||
+- (float64_is_any_nan(v1) && (m2 & (1 << (3-neg)))) ||
+- (float64_is_signaling_nan(v1) && (m2 & (1 << (1-neg))))) {
+- cc = 1;
+- } else if (m2 & (1 << (9-neg))) {
+- /* assume normalized number */
+- cc = 1;
+- }
+- /* FIXME: denormalized? */
+- return cc;
+-}
+-
+-/* test data class 128-bit */
+-uint32_t HELPER(tcxb)(uint32_t f1, uint64_t m2)
+-{
+- CPU_QuadU v1;
+- uint32_t cc = 0;
+- int neg;
+-
+- v1.ll.upper = env->fregs[f1].ll;
+- v1.ll.lower = env->fregs[f1 + 2].ll;
+-
+- neg = float128_is_neg(v1.q);
+- if ((float128_is_zero(v1.q) && (m2 & (1 << (11-neg)))) ||
+- (float128_is_infinity(v1.q) && (m2 & (1 << (5-neg)))) ||
+- (float128_is_any_nan(v1.q) && (m2 & (1 << (3-neg)))) ||
+- (float128_is_signaling_nan(v1.q) && (m2 & (1 << (1-neg))))) {
+- cc = 1;
+- } else if (m2 & (1 << (9-neg))) {
+- /* assume normalized number */
+- cc = 1;
+- }
+- /* FIXME: denormalized? */
+- return cc;
+-}
+-
+ /* find leftmost one */
+ uint32_t HELPER(flogr)(uint32_t r1, uint64_t v2)
+ {
+@@ -1795,12 +999,6 @@ uint32_t HELPER(flogr)(uint32_t r1, uint64_t v2)
+ }
+ }
+
+-/* square root 64-bit RR */
+-void HELPER(sqdbr)(uint32_t f1, uint32_t f2)
+-{
+- env->fregs[f1].d = float64_sqrt(env->fregs[f2].d, &env->fpu_status);
+-}
+-
+ /* checksum */
+ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ {
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index 1c1baf5..c370df3 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -667,16 +667,11 @@ static void set_cc_cmp_f32_i64(DisasContext *s, TCGv_i32 v1, TCGv_i64 v2)
+ s->cc_op = CC_OP_LTGT_F32;
+ }
+
+-static void set_cc_nz_f32(DisasContext *s, TCGv_i32 v1)
++static void gen_set_cc_nz_f32(DisasContext *s, TCGv_i32 v1)
+ {
+ gen_op_update1_cc_i32(s, CC_OP_NZ_F32, v1);
+ }
+
+-static inline void set_cc_nz_f64(DisasContext *s, TCGv_i64 v1)
+-{
+- gen_op_update1_cc_i64(s, CC_OP_NZ_F64, v1);
+-}
+-
+ /* CC value is in env->cc_op */
+ static inline void set_cc_static(DisasContext *s)
+ {
+@@ -2235,7 +2230,7 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tcg_temp_free_i32(tmp32);
+
+ tmp32 = load_freg32(r1);
+- set_cc_nz_f32(s, tmp32);
++ gen_set_cc_nz_f32(s, tmp32);
+ tcg_temp_free_i32(tmp32);
+ break;
+ case 0xb: /* SEB R1,D2(X2,B2) [RXE] */
+@@ -2248,7 +2243,7 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tcg_temp_free_i32(tmp32);
+
+ tmp32 = load_freg32(r1);
+- set_cc_nz_f32(s, tmp32);
++ gen_set_cc_nz_f32(s, tmp32);
+ tcg_temp_free_i32(tmp32);
+ break;
+ case 0xd: /* DEB R1,D2(X2,B2) [RXE] */
+--
+1.7.12.1
+
--- /dev/null
+From f642126aece222f6ff87d26c29f00e1b6c47e10a Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:32 +0000
+Subject: [PATCH] target-s390x: split condition code helpers
+
+Move condition code helpers to cc_helper.c.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 3 +-
+ target-s390x/cc_helper.c | 551 +++++++++++++++++++++++++++++++++++++++++++++
+ target-s390x/cpu.h | 3 +
+ target-s390x/op_helper.c | 522 +-----------------------------------------
+ 4 files changed, 557 insertions(+), 522 deletions(-)
+ create mode 100644 target-s390x/cc_helper.c
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 23b3bd9..f9437d6 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -1,7 +1,8 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o interrupt.o
+-obj-y += fpu_helper.o
++obj-y += fpu_helper.o cc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+ $(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
++$(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cc_helper.c b/target-s390x/cc_helper.c
+new file mode 100644
+index 0000000..2ac1659
+--- /dev/null
++++ b/target-s390x/cc_helper.c
+@@ -0,0 +1,551 @@
++/*
++ * S/390 condition code helper routines
++ *
++ * Copyright (c) 2009 Ulrich Hecht
++ * Copyright (c) 2009 Alexander Graf
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "cpu.h"
++#include "dyngen-exec.h"
++#include "helper.h"
++
++/* #define DEBUG_HELPER */
++#ifdef DEBUG_HELPER
++#define HELPER_LOG(x...) qemu_log(x)
++#else
++#define HELPER_LOG(x...)
++#endif
++
++static inline uint32_t cc_calc_ltgt_32(CPUS390XState *env, int32_t src,
++ int32_t dst)
++{
++ if (src == dst) {
++ return 0;
++ } else if (src < dst) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++static inline uint32_t cc_calc_ltgt0_32(CPUS390XState *env, int32_t dst)
++{
++ return cc_calc_ltgt_32(env, dst, 0);
++}
++
++static inline uint32_t cc_calc_ltgt_64(CPUS390XState *env, int64_t src,
++ int64_t dst)
++{
++ if (src == dst) {
++ return 0;
++ } else if (src < dst) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++static inline uint32_t cc_calc_ltgt0_64(CPUS390XState *env, int64_t dst)
++{
++ return cc_calc_ltgt_64(env, dst, 0);
++}
++
++static inline uint32_t cc_calc_ltugtu_32(CPUS390XState *env, uint32_t src,
++ uint32_t dst)
++{
++ if (src == dst) {
++ return 0;
++ } else if (src < dst) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++static inline uint32_t cc_calc_ltugtu_64(CPUS390XState *env, uint64_t src,
++ uint64_t dst)
++{
++ if (src == dst) {
++ return 0;
++ } else if (src < dst) {
++ return 1;
++ } else {
++ return 2;
++ }
++}
++
++static inline uint32_t cc_calc_tm_32(CPUS390XState *env, uint32_t val,
++ uint32_t mask)
++{
++ uint16_t r = val & mask;
++
++ HELPER_LOG("%s: val 0x%x mask 0x%x\n", __func__, val, mask);
++ if (r == 0 || mask == 0) {
++ return 0;
++ } else if (r == mask) {
++ return 3;
++ } else {
++ return 1;
++ }
++}
++
++/* set condition code for test under mask */
++static inline uint32_t cc_calc_tm_64(CPUS390XState *env, uint64_t val,
++ uint32_t mask)
++{
++ uint16_t r = val & mask;
++
++ HELPER_LOG("%s: val 0x%lx mask 0x%x r 0x%x\n", __func__, val, mask, r);
++ if (r == 0 || mask == 0) {
++ return 0;
++ } else if (r == mask) {
++ return 3;
++ } else {
++ while (!(mask & 0x8000)) {
++ mask <<= 1;
++ val <<= 1;
++ }
++ if (val & 0x8000) {
++ return 2;
++ } else {
++ return 1;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_nz(CPUS390XState *env, uint64_t dst)
++{
++ return !!dst;
++}
++
++static inline uint32_t cc_calc_add_64(CPUS390XState *env, int64_t a1,
++ int64_t a2, int64_t ar)
++{
++ if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
++ return 3; /* overflow */
++ } else {
++ if (ar < 0) {
++ return 1;
++ } else if (ar > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_addu_64(CPUS390XState *env, uint64_t a1,
++ uint64_t a2, uint64_t ar)
++{
++ if (ar == 0) {
++ if (a1) {
++ return 2;
++ } else {
++ return 0;
++ }
++ } else {
++ if (ar < a1 || ar < a2) {
++ return 3;
++ } else {
++ return 1;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_sub_64(CPUS390XState *env, int64_t a1,
++ int64_t a2, int64_t ar)
++{
++ if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
++ return 3; /* overflow */
++ } else {
++ if (ar < 0) {
++ return 1;
++ } else if (ar > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_subu_64(CPUS390XState *env, uint64_t a1,
++ uint64_t a2, uint64_t ar)
++{
++ if (ar == 0) {
++ return 2;
++ } else {
++ if (a2 > a1) {
++ return 1;
++ } else {
++ return 3;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_abs_64(CPUS390XState *env, int64_t dst)
++{
++ if ((uint64_t)dst == 0x8000000000000000ULL) {
++ return 3;
++ } else if (dst) {
++ return 1;
++ } else {
++ return 0;
++ }
++}
++
++static inline uint32_t cc_calc_nabs_64(CPUS390XState *env, int64_t dst)
++{
++ return !!dst;
++}
++
++static inline uint32_t cc_calc_comp_64(CPUS390XState *env, int64_t dst)
++{
++ if ((uint64_t)dst == 0x8000000000000000ULL) {
++ return 3;
++ } else if (dst < 0) {
++ return 1;
++ } else if (dst > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++}
++
++
++static inline uint32_t cc_calc_add_32(CPUS390XState *env, int32_t a1,
++ int32_t a2, int32_t ar)
++{
++ if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
++ return 3; /* overflow */
++ } else {
++ if (ar < 0) {
++ return 1;
++ } else if (ar > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_addu_32(CPUS390XState *env, uint32_t a1,
++ uint32_t a2, uint32_t ar)
++{
++ if (ar == 0) {
++ if (a1) {
++ return 2;
++ } else {
++ return 0;
++ }
++ } else {
++ if (ar < a1 || ar < a2) {
++ return 3;
++ } else {
++ return 1;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_sub_32(CPUS390XState *env, int32_t a1,
++ int32_t a2, int32_t ar)
++{
++ if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
++ return 3; /* overflow */
++ } else {
++ if (ar < 0) {
++ return 1;
++ } else if (ar > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_subu_32(CPUS390XState *env, uint32_t a1,
++ uint32_t a2, uint32_t ar)
++{
++ if (ar == 0) {
++ return 2;
++ } else {
++ if (a2 > a1) {
++ return 1;
++ } else {
++ return 3;
++ }
++ }
++}
++
++static inline uint32_t cc_calc_abs_32(CPUS390XState *env, int32_t dst)
++{
++ if ((uint32_t)dst == 0x80000000UL) {
++ return 3;
++ } else if (dst) {
++ return 1;
++ } else {
++ return 0;
++ }
++}
++
++static inline uint32_t cc_calc_nabs_32(CPUS390XState *env, int32_t dst)
++{
++ return !!dst;
++}
++
++static inline uint32_t cc_calc_comp_32(CPUS390XState *env, int32_t dst)
++{
++ if ((uint32_t)dst == 0x80000000UL) {
++ return 3;
++ } else if (dst < 0) {
++ return 1;
++ } else if (dst > 0) {
++ return 2;
++ } else {
++ return 0;
++ }
++}
++
++/* calculate condition code for insert character under mask insn */
++static inline uint32_t cc_calc_icm_32(CPUS390XState *env, uint32_t mask,
++ uint32_t val)
++{
++ uint32_t cc;
++
++ HELPER_LOG("%s: mask 0x%x val %d\n", __func__, mask, val);
++ if (mask == 0xf) {
++ if (!val) {
++ return 0;
++ } else if (val & 0x80000000) {
++ return 1;
++ } else {
++ return 2;
++ }
++ }
++
++ if (!val || !mask) {
++ cc = 0;
++ } else {
++ while (mask != 1) {
++ mask >>= 1;
++ val >>= 8;
++ }
++ if (val & 0x80) {
++ cc = 1;
++ } else {
++ cc = 2;
++ }
++ }
++ return cc;
++}
++
++static inline uint32_t cc_calc_slag(CPUS390XState *env, uint64_t src,
++ uint64_t shift)
++{
++ uint64_t mask = ((1ULL << shift) - 1ULL) << (64 - shift);
++ uint64_t match, r;
++
++ /* check if the sign bit stays the same */
++ if (src & (1ULL << 63)) {
++ match = mask;
++ } else {
++ match = 0;
++ }
++
++ if ((src & mask) != match) {
++ /* overflow */
++ return 3;
++ }
++
++ r = ((src << shift) & ((1ULL << 63) - 1)) | (src & (1ULL << 63));
++
++ if ((int64_t)r == 0) {
++ return 0;
++ } else if ((int64_t)r < 0) {
++ return 1;
++ }
++
++ return 2;
++}
++
++
++static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op,
++ uint64_t src, uint64_t dst, uint64_t vr)
++{
++ uint32_t r = 0;
++
++ switch (cc_op) {
++ case CC_OP_CONST0:
++ case CC_OP_CONST1:
++ case CC_OP_CONST2:
++ case CC_OP_CONST3:
++ /* cc_op value _is_ cc */
++ r = cc_op;
++ break;
++ case CC_OP_LTGT0_32:
++ r = cc_calc_ltgt0_32(env, dst);
++ break;
++ case CC_OP_LTGT0_64:
++ r = cc_calc_ltgt0_64(env, dst);
++ break;
++ case CC_OP_LTGT_32:
++ r = cc_calc_ltgt_32(env, src, dst);
++ break;
++ case CC_OP_LTGT_64:
++ r = cc_calc_ltgt_64(env, src, dst);
++ break;
++ case CC_OP_LTUGTU_32:
++ r = cc_calc_ltugtu_32(env, src, dst);
++ break;
++ case CC_OP_LTUGTU_64:
++ r = cc_calc_ltugtu_64(env, src, dst);
++ break;
++ case CC_OP_TM_32:
++ r = cc_calc_tm_32(env, src, dst);
++ break;
++ case CC_OP_TM_64:
++ r = cc_calc_tm_64(env, src, dst);
++ break;
++ case CC_OP_NZ:
++ r = cc_calc_nz(env, dst);
++ break;
++ case CC_OP_ADD_64:
++ r = cc_calc_add_64(env, src, dst, vr);
++ break;
++ case CC_OP_ADDU_64:
++ r = cc_calc_addu_64(env, src, dst, vr);
++ break;
++ case CC_OP_SUB_64:
++ r = cc_calc_sub_64(env, src, dst, vr);
++ break;
++ case CC_OP_SUBU_64:
++ r = cc_calc_subu_64(env, src, dst, vr);
++ break;
++ case CC_OP_ABS_64:
++ r = cc_calc_abs_64(env, dst);
++ break;
++ case CC_OP_NABS_64:
++ r = cc_calc_nabs_64(env, dst);
++ break;
++ case CC_OP_COMP_64:
++ r = cc_calc_comp_64(env, dst);
++ break;
++
++ case CC_OP_ADD_32:
++ r = cc_calc_add_32(env, src, dst, vr);
++ break;
++ case CC_OP_ADDU_32:
++ r = cc_calc_addu_32(env, src, dst, vr);
++ break;
++ case CC_OP_SUB_32:
++ r = cc_calc_sub_32(env, src, dst, vr);
++ break;
++ case CC_OP_SUBU_32:
++ r = cc_calc_subu_32(env, src, dst, vr);
++ break;
++ case CC_OP_ABS_32:
++ r = cc_calc_abs_64(env, dst);
++ break;
++ case CC_OP_NABS_32:
++ r = cc_calc_nabs_64(env, dst);
++ break;
++ case CC_OP_COMP_32:
++ r = cc_calc_comp_32(env, dst);
++ break;
++
++ case CC_OP_ICM:
++ r = cc_calc_icm_32(env, src, dst);
++ break;
++ case CC_OP_SLAG:
++ r = cc_calc_slag(env, src, dst);
++ break;
++
++ case CC_OP_LTGT_F32:
++ r = set_cc_f32(src, dst);
++ break;
++ case CC_OP_LTGT_F64:
++ r = set_cc_f64(src, dst);
++ break;
++ case CC_OP_NZ_F32:
++ r = set_cc_nz_f32(dst);
++ break;
++ case CC_OP_NZ_F64:
++ r = set_cc_nz_f64(dst);
++ break;
++
++ default:
++ cpu_abort(env, "Unknown CC operation: %s\n", cc_name(cc_op));
++ }
++
++ HELPER_LOG("%s: %15s 0x%016lx 0x%016lx 0x%016lx = %d\n", __func__,
++ cc_name(cc_op), src, dst, vr, r);
++ return r;
++}
++
++uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst,
++ uint64_t vr)
++{
++ return do_calc_cc(env, cc_op, src, dst, vr);
++}
++
++uint32_t HELPER(calc_cc)(uint32_t cc_op, uint64_t src, uint64_t dst,
++ uint64_t vr)
++{
++ return do_calc_cc(env, cc_op, src, dst, vr);
++}
++
++/* insert psw mask and condition code into r1 */
++void HELPER(ipm)(uint32_t cc, uint32_t r1)
++{
++ uint64_t r = env->regs[r1];
++
++ r &= 0xffffffff00ffffffULL;
++ r |= (cc << 28) | ((env->psw.mask >> 40) & 0xf);
++ env->regs[r1] = r;
++ HELPER_LOG("%s: cc %d psw.mask 0x%lx r1 0x%lx\n", __func__,
++ cc, env->psw.mask, r);
++}
++
++#ifndef CONFIG_USER_ONLY
++void HELPER(load_psw)(uint64_t mask, uint64_t addr)
++{
++ load_psw(env, mask, addr);
++ cpu_loop_exit(env);
++}
++
++void HELPER(sacf)(uint64_t a1)
++{
++ HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1);
++
++ switch (a1 & 0xf00) {
++ case 0x000:
++ env->psw.mask &= ~PSW_MASK_ASC;
++ env->psw.mask |= PSW_ASC_PRIMARY;
++ break;
++ case 0x100:
++ env->psw.mask &= ~PSW_MASK_ASC;
++ env->psw.mask |= PSW_ASC_SECONDARY;
++ break;
++ case 0x300:
++ env->psw.mask &= ~PSW_MASK_ASC;
++ env->psw.mask |= PSW_ASC_HOME;
++ break;
++ default:
++ qemu_log("unknown sacf mode: %" PRIx64 "\n", a1);
++ program_interrupt(env, PGM_SPECIFICATION, 2);
++ break;
++ }
++}
++#endif
+diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
+index b4620c5..97fde5e 100644
+--- a/target-s390x/cpu.h
++++ b/target-s390x/cpu.h
+@@ -1005,4 +1005,7 @@ uint32_t set_cc_f64(float64 v1, float64 v2);
+ uint32_t set_cc_nz_f32(float32 v);
+ uint32_t set_cc_nz_f64(float64 v);
+
++/* op_helper.c */
++void program_interrupt(CPUS390XState *env, uint32_t code, int ilc);
++
+ #endif
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+index 270bf14..eced890 100644
+--- a/target-s390x/op_helper.c
++++ b/target-s390x/op_helper.c
+@@ -779,18 +779,6 @@ uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
+ return cc;
+ }
+
+-/* insert psw mask and condition code into r1 */
+-void HELPER(ipm)(uint32_t cc, uint32_t r1)
+-{
+- uint64_t r = env->regs[r1];
+-
+- r &= 0xffffffff00ffffffULL;
+- r |= (cc << 28) | ((env->psw.mask >> 40) & 0xf);
+- env->regs[r1] = r;
+- HELPER_LOG("%s: cc %d psw.mask 0x%lx r1 0x%lx\n", __func__,
+- cc, env->psw.mask, r);
+-}
+-
+ /* load access registers r1 to r3 from memory at a2 */
+ void HELPER(lam)(uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+@@ -1038,483 +1026,6 @@ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ ((uint32_t)cksm + (cksm >> 32));
+ }
+
+-static inline uint32_t cc_calc_ltgt_32(CPUS390XState *env, int32_t src,
+- int32_t dst)
+-{
+- if (src == dst) {
+- return 0;
+- } else if (src < dst) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static inline uint32_t cc_calc_ltgt0_32(CPUS390XState *env, int32_t dst)
+-{
+- return cc_calc_ltgt_32(env, dst, 0);
+-}
+-
+-static inline uint32_t cc_calc_ltgt_64(CPUS390XState *env, int64_t src,
+- int64_t dst)
+-{
+- if (src == dst) {
+- return 0;
+- } else if (src < dst) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static inline uint32_t cc_calc_ltgt0_64(CPUS390XState *env, int64_t dst)
+-{
+- return cc_calc_ltgt_64(env, dst, 0);
+-}
+-
+-static inline uint32_t cc_calc_ltugtu_32(CPUS390XState *env, uint32_t src,
+- uint32_t dst)
+-{
+- if (src == dst) {
+- return 0;
+- } else if (src < dst) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static inline uint32_t cc_calc_ltugtu_64(CPUS390XState *env, uint64_t src,
+- uint64_t dst)
+-{
+- if (src == dst) {
+- return 0;
+- } else if (src < dst) {
+- return 1;
+- } else {
+- return 2;
+- }
+-}
+-
+-static inline uint32_t cc_calc_tm_32(CPUS390XState *env, uint32_t val,
+- uint32_t mask)
+-{
+- uint16_t r = val & mask;
+-
+- HELPER_LOG("%s: val 0x%x mask 0x%x\n", __func__, val, mask);
+- if (r == 0 || mask == 0) {
+- return 0;
+- } else if (r == mask) {
+- return 3;
+- } else {
+- return 1;
+- }
+-}
+-
+-/* set condition code for test under mask */
+-static inline uint32_t cc_calc_tm_64(CPUS390XState *env, uint64_t val,
+- uint32_t mask)
+-{
+- uint16_t r = val & mask;
+-
+- HELPER_LOG("%s: val 0x%lx mask 0x%x r 0x%x\n", __func__, val, mask, r);
+- if (r == 0 || mask == 0) {
+- return 0;
+- } else if (r == mask) {
+- return 3;
+- } else {
+- while (!(mask & 0x8000)) {
+- mask <<= 1;
+- val <<= 1;
+- }
+- if (val & 0x8000) {
+- return 2;
+- } else {
+- return 1;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_nz(CPUS390XState *env, uint64_t dst)
+-{
+- return !!dst;
+-}
+-
+-static inline uint32_t cc_calc_add_64(CPUS390XState *env, int64_t a1,
+- int64_t a2, int64_t ar)
+-{
+- if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
+- return 3; /* overflow */
+- } else {
+- if (ar < 0) {
+- return 1;
+- } else if (ar > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_addu_64(CPUS390XState *env, uint64_t a1,
+- uint64_t a2, uint64_t ar)
+-{
+- if (ar == 0) {
+- if (a1) {
+- return 2;
+- } else {
+- return 0;
+- }
+- } else {
+- if (ar < a1 || ar < a2) {
+- return 3;
+- } else {
+- return 1;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_sub_64(CPUS390XState *env, int64_t a1,
+- int64_t a2, int64_t ar)
+-{
+- if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
+- return 3; /* overflow */
+- } else {
+- if (ar < 0) {
+- return 1;
+- } else if (ar > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_subu_64(CPUS390XState *env, uint64_t a1,
+- uint64_t a2, uint64_t ar)
+-{
+- if (ar == 0) {
+- return 2;
+- } else {
+- if (a2 > a1) {
+- return 1;
+- } else {
+- return 3;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_abs_64(CPUS390XState *env, int64_t dst)
+-{
+- if ((uint64_t)dst == 0x8000000000000000ULL) {
+- return 3;
+- } else if (dst) {
+- return 1;
+- } else {
+- return 0;
+- }
+-}
+-
+-static inline uint32_t cc_calc_nabs_64(CPUS390XState *env, int64_t dst)
+-{
+- return !!dst;
+-}
+-
+-static inline uint32_t cc_calc_comp_64(CPUS390XState *env, int64_t dst)
+-{
+- if ((uint64_t)dst == 0x8000000000000000ULL) {
+- return 3;
+- } else if (dst < 0) {
+- return 1;
+- } else if (dst > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+-}
+-
+-
+-static inline uint32_t cc_calc_add_32(CPUS390XState *env, int32_t a1,
+- int32_t a2, int32_t ar)
+-{
+- if ((a1 > 0 && a2 > 0 && ar < 0) || (a1 < 0 && a2 < 0 && ar > 0)) {
+- return 3; /* overflow */
+- } else {
+- if (ar < 0) {
+- return 1;
+- } else if (ar > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_addu_32(CPUS390XState *env, uint32_t a1,
+- uint32_t a2, uint32_t ar)
+-{
+- if (ar == 0) {
+- if (a1) {
+- return 2;
+- } else {
+- return 0;
+- }
+- } else {
+- if (ar < a1 || ar < a2) {
+- return 3;
+- } else {
+- return 1;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_sub_32(CPUS390XState *env, int32_t a1,
+- int32_t a2, int32_t ar)
+-{
+- if ((a1 > 0 && a2 < 0 && ar < 0) || (a1 < 0 && a2 > 0 && ar > 0)) {
+- return 3; /* overflow */
+- } else {
+- if (ar < 0) {
+- return 1;
+- } else if (ar > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_subu_32(CPUS390XState *env, uint32_t a1,
+- uint32_t a2, uint32_t ar)
+-{
+- if (ar == 0) {
+- return 2;
+- } else {
+- if (a2 > a1) {
+- return 1;
+- } else {
+- return 3;
+- }
+- }
+-}
+-
+-static inline uint32_t cc_calc_abs_32(CPUS390XState *env, int32_t dst)
+-{
+- if ((uint32_t)dst == 0x80000000UL) {
+- return 3;
+- } else if (dst) {
+- return 1;
+- } else {
+- return 0;
+- }
+-}
+-
+-static inline uint32_t cc_calc_nabs_32(CPUS390XState *env, int32_t dst)
+-{
+- return !!dst;
+-}
+-
+-static inline uint32_t cc_calc_comp_32(CPUS390XState *env, int32_t dst)
+-{
+- if ((uint32_t)dst == 0x80000000UL) {
+- return 3;
+- } else if (dst < 0) {
+- return 1;
+- } else if (dst > 0) {
+- return 2;
+- } else {
+- return 0;
+- }
+-}
+-
+-/* calculate condition code for insert character under mask insn */
+-static inline uint32_t cc_calc_icm_32(CPUS390XState *env, uint32_t mask,
+- uint32_t val)
+-{
+- uint32_t cc;
+-
+- HELPER_LOG("%s: mask 0x%x val %d\n", __func__, mask, val);
+- if (mask == 0xf) {
+- if (!val) {
+- return 0;
+- } else if (val & 0x80000000) {
+- return 1;
+- } else {
+- return 2;
+- }
+- }
+-
+- if (!val || !mask) {
+- cc = 0;
+- } else {
+- while (mask != 1) {
+- mask >>= 1;
+- val >>= 8;
+- }
+- if (val & 0x80) {
+- cc = 1;
+- } else {
+- cc = 2;
+- }
+- }
+- return cc;
+-}
+-
+-static inline uint32_t cc_calc_slag(CPUS390XState *env, uint64_t src,
+- uint64_t shift)
+-{
+- uint64_t mask = ((1ULL << shift) - 1ULL) << (64 - shift);
+- uint64_t match, r;
+-
+- /* check if the sign bit stays the same */
+- if (src & (1ULL << 63)) {
+- match = mask;
+- } else {
+- match = 0;
+- }
+-
+- if ((src & mask) != match) {
+- /* overflow */
+- return 3;
+- }
+-
+- r = ((src << shift) & ((1ULL << 63) - 1)) | (src & (1ULL << 63));
+-
+- if ((int64_t)r == 0) {
+- return 0;
+- } else if ((int64_t)r < 0) {
+- return 1;
+- }
+-
+- return 2;
+-}
+-
+-
+-static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op,
+- uint64_t src, uint64_t dst, uint64_t vr)
+-{
+- uint32_t r = 0;
+-
+- switch (cc_op) {
+- case CC_OP_CONST0:
+- case CC_OP_CONST1:
+- case CC_OP_CONST2:
+- case CC_OP_CONST3:
+- /* cc_op value _is_ cc */
+- r = cc_op;
+- break;
+- case CC_OP_LTGT0_32:
+- r = cc_calc_ltgt0_32(env, dst);
+- break;
+- case CC_OP_LTGT0_64:
+- r = cc_calc_ltgt0_64(env, dst);
+- break;
+- case CC_OP_LTGT_32:
+- r = cc_calc_ltgt_32(env, src, dst);
+- break;
+- case CC_OP_LTGT_64:
+- r = cc_calc_ltgt_64(env, src, dst);
+- break;
+- case CC_OP_LTUGTU_32:
+- r = cc_calc_ltugtu_32(env, src, dst);
+- break;
+- case CC_OP_LTUGTU_64:
+- r = cc_calc_ltugtu_64(env, src, dst);
+- break;
+- case CC_OP_TM_32:
+- r = cc_calc_tm_32(env, src, dst);
+- break;
+- case CC_OP_TM_64:
+- r = cc_calc_tm_64(env, src, dst);
+- break;
+- case CC_OP_NZ:
+- r = cc_calc_nz(env, dst);
+- break;
+- case CC_OP_ADD_64:
+- r = cc_calc_add_64(env, src, dst, vr);
+- break;
+- case CC_OP_ADDU_64:
+- r = cc_calc_addu_64(env, src, dst, vr);
+- break;
+- case CC_OP_SUB_64:
+- r = cc_calc_sub_64(env, src, dst, vr);
+- break;
+- case CC_OP_SUBU_64:
+- r = cc_calc_subu_64(env, src, dst, vr);
+- break;
+- case CC_OP_ABS_64:
+- r = cc_calc_abs_64(env, dst);
+- break;
+- case CC_OP_NABS_64:
+- r = cc_calc_nabs_64(env, dst);
+- break;
+- case CC_OP_COMP_64:
+- r = cc_calc_comp_64(env, dst);
+- break;
+-
+- case CC_OP_ADD_32:
+- r = cc_calc_add_32(env, src, dst, vr);
+- break;
+- case CC_OP_ADDU_32:
+- r = cc_calc_addu_32(env, src, dst, vr);
+- break;
+- case CC_OP_SUB_32:
+- r = cc_calc_sub_32(env, src, dst, vr);
+- break;
+- case CC_OP_SUBU_32:
+- r = cc_calc_subu_32(env, src, dst, vr);
+- break;
+- case CC_OP_ABS_32:
+- r = cc_calc_abs_64(env, dst);
+- break;
+- case CC_OP_NABS_32:
+- r = cc_calc_nabs_64(env, dst);
+- break;
+- case CC_OP_COMP_32:
+- r = cc_calc_comp_32(env, dst);
+- break;
+-
+- case CC_OP_ICM:
+- r = cc_calc_icm_32(env, src, dst);
+- break;
+- case CC_OP_SLAG:
+- r = cc_calc_slag(env, src, dst);
+- break;
+-
+- case CC_OP_LTGT_F32:
+- r = set_cc_f32(src, dst);
+- break;
+- case CC_OP_LTGT_F64:
+- r = set_cc_f64(src, dst);
+- break;
+- case CC_OP_NZ_F32:
+- r = set_cc_nz_f32(dst);
+- break;
+- case CC_OP_NZ_F64:
+- r = set_cc_nz_f64(dst);
+- break;
+-
+- default:
+- cpu_abort(env, "Unknown CC operation: %s\n", cc_name(cc_op));
+- }
+-
+- HELPER_LOG("%s: %15s 0x%016lx 0x%016lx 0x%016lx = %d\n", __func__,
+- cc_name(cc_op), src, dst, vr, r);
+- return r;
+-}
+-
+-uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst,
+- uint64_t vr)
+-{
+- return do_calc_cc(env, cc_op, src, dst, vr);
+-}
+-
+-uint32_t HELPER(calc_cc)(uint32_t cc_op, uint64_t src, uint64_t dst,
+- uint64_t vr)
+-{
+- return do_calc_cc(env, cc_op, src, dst, vr);
+-}
+-
+ uint64_t HELPER(cvd)(int32_t bin)
+ {
+ /* positive 0 */
+@@ -1594,14 +1105,7 @@ void HELPER(tr)(uint32_t len, uint64_t array, uint64_t trans)
+ }
+
+ #ifndef CONFIG_USER_ONLY
+-
+-void HELPER(load_psw)(uint64_t mask, uint64_t addr)
+-{
+- load_psw(env, mask, addr);
+- cpu_loop_exit(env);
+-}
+-
+-static void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
++void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
+ {
+ qemu_log("program interrupt at %#" PRIx64 "\n", env->psw.addr);
+
+@@ -2175,30 +1679,6 @@ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+ return cc;
+ }
+
+-void HELPER(sacf)(uint64_t a1)
+-{
+- HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1);
+-
+- switch (a1 & 0xf00) {
+- case 0x000:
+- env->psw.mask &= ~PSW_MASK_ASC;
+- env->psw.mask |= PSW_ASC_PRIMARY;
+- break;
+- case 0x100:
+- env->psw.mask &= ~PSW_MASK_ASC;
+- env->psw.mask |= PSW_ASC_SECONDARY;
+- break;
+- case 0x300:
+- env->psw.mask &= ~PSW_MASK_ASC;
+- env->psw.mask |= PSW_ASC_HOME;
+- break;
+- default:
+- qemu_log("unknown sacf mode: %" PRIx64 "\n", a1);
+- program_interrupt(env, PGM_SPECIFICATION, 2);
+- break;
+- }
+-}
+-
+ /* invalidate pte */
+ void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
+ {
+--
+1.7.12.1
+
--- /dev/null
+From e9f67c1f326a995ff0000a08a223435386867d8f Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:33 +0000
+Subject: [PATCH] target-s390x: split integer helpers
+
+Move integer helpers to int_helper.c.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 3 +-
+ target-s390x/int_helper.c | 201 +++++++++++++++++++++++++++++++++++++++++++++
+ target-s390x/op_helper.c | 170 --------------------------------------
+ 3 files changed, 203 insertions(+), 171 deletions(-)
+ create mode 100644 target-s390x/int_helper.c
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index f9437d6..e8f66e9 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -1,8 +1,9 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o interrupt.o
+-obj-y += fpu_helper.o cc_helper.o
++obj-y += int_helper.o fpu_helper.o cc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+ $(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
++$(obj)/int_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/int_helper.c b/target-s390x/int_helper.c
+new file mode 100644
+index 0000000..e2eeb07
+--- /dev/null
++++ b/target-s390x/int_helper.c
+@@ -0,0 +1,201 @@
++/*
++ * S/390 integer helper routines
++ *
++ * Copyright (c) 2009 Ulrich Hecht
++ * Copyright (c) 2009 Alexander Graf
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "cpu.h"
++#include "dyngen-exec.h"
++#include "host-utils.h"
++#include "helper.h"
++
++/* #define DEBUG_HELPER */
++#ifdef DEBUG_HELPER
++#define HELPER_LOG(x...) qemu_log(x)
++#else
++#define HELPER_LOG(x...)
++#endif
++
++/* 64/64 -> 128 unsigned multiplication */
++void HELPER(mlg)(uint32_t r1, uint64_t v2)
++{
++#if HOST_LONG_BITS == 64 && defined(__GNUC__)
++ /* assuming 64-bit hosts have __uint128_t */
++ __uint128_t res = (__uint128_t)env->regs[r1 + 1];
++
++ res *= (__uint128_t)v2;
++ env->regs[r1] = (uint64_t)(res >> 64);
++ env->regs[r1 + 1] = (uint64_t)res;
++#else
++ mulu64(&env->regs[r1 + 1], &env->regs[r1], env->regs[r1 + 1], v2);
++#endif
++}
++
++/* 128 -> 64/64 unsigned division */
++void HELPER(dlg)(uint32_t r1, uint64_t v2)
++{
++ uint64_t divisor = v2;
++
++ if (!env->regs[r1]) {
++ /* 64 -> 64/64 case */
++ env->regs[r1] = env->regs[r1 + 1] % divisor;
++ env->regs[r1 + 1] = env->regs[r1 + 1] / divisor;
++ return;
++ } else {
++#if HOST_LONG_BITS == 64 && defined(__GNUC__)
++ /* assuming 64-bit hosts have __uint128_t */
++ __uint128_t dividend = (((__uint128_t)env->regs[r1]) << 64) |
++ (env->regs[r1 + 1]);
++ __uint128_t quotient = dividend / divisor;
++ __uint128_t remainder = dividend % divisor;
++
++ env->regs[r1 + 1] = quotient;
++ env->regs[r1] = remainder;
++#else
++ /* 32-bit hosts would need special wrapper functionality - just abort if
++ we encounter such a case; it's very unlikely anyways. */
++ cpu_abort(env, "128 -> 64/64 division not implemented\n");
++#endif
++ }
++}
++
++/* absolute value 32-bit */
++uint32_t HELPER(abs_i32)(int32_t val)
++{
++ if (val < 0) {
++ return -val;
++ } else {
++ return val;
++ }
++}
++
++/* negative absolute value 32-bit */
++int32_t HELPER(nabs_i32)(int32_t val)
++{
++ if (val < 0) {
++ return val;
++ } else {
++ return -val;
++ }
++}
++
++/* absolute value 64-bit */
++uint64_t HELPER(abs_i64)(int64_t val)
++{
++ HELPER_LOG("%s: val 0x%" PRIx64 "\n", __func__, val);
++
++ if (val < 0) {
++ return -val;
++ } else {
++ return val;
++ }
++}
++
++/* negative absolute value 64-bit */
++int64_t HELPER(nabs_i64)(int64_t val)
++{
++ if (val < 0) {
++ return val;
++ } else {
++ return -val;
++ }
++}
++
++/* add with carry 32-bit unsigned */
++uint32_t HELPER(addc_u32)(uint32_t cc, uint32_t v1, uint32_t v2)
++{
++ uint32_t res;
++
++ res = v1 + v2;
++ if (cc & 2) {
++ res++;
++ }
++
++ return res;
++}
++
++/* subtract unsigned v2 from v1 with borrow */
++uint32_t HELPER(slb)(uint32_t cc, uint32_t r1, uint32_t v2)
++{
++ uint32_t v1 = env->regs[r1];
++ uint32_t res = v1 + (~v2) + (cc >> 1);
++
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | res;
++ if (cc & 2) {
++ /* borrow */
++ return v1 ? 1 : 0;
++ } else {
++ return v1 ? 3 : 2;
++ }
++}
++
++/* subtract unsigned v2 from v1 with borrow */
++uint32_t HELPER(slbg)(uint32_t cc, uint32_t r1, uint64_t v1, uint64_t v2)
++{
++ uint64_t res = v1 + (~v2) + (cc >> 1);
++
++ env->regs[r1] = res;
++ if (cc & 2) {
++ /* borrow */
++ return v1 ? 1 : 0;
++ } else {
++ return v1 ? 3 : 2;
++ }
++}
++
++/* find leftmost one */
++uint32_t HELPER(flogr)(uint32_t r1, uint64_t v2)
++{
++ uint64_t res = 0;
++ uint64_t ov2 = v2;
++
++ while (!(v2 & 0x8000000000000000ULL) && v2) {
++ v2 <<= 1;
++ res++;
++ }
++
++ if (!v2) {
++ env->regs[r1] = 64;
++ env->regs[r1 + 1] = 0;
++ return 0;
++ } else {
++ env->regs[r1] = res;
++ env->regs[r1 + 1] = ov2 & ~(0x8000000000000000ULL >> res);
++ return 2;
++ }
++}
++
++uint64_t HELPER(cvd)(int32_t bin)
++{
++ /* positive 0 */
++ uint64_t dec = 0x0c;
++ int shift = 4;
++
++ if (bin < 0) {
++ bin = -bin;
++ dec = 0x0d;
++ }
++
++ for (shift = 4; (shift < 64) && bin; shift += 4) {
++ int current_number = bin % 10;
++
++ dec |= (current_number) << shift;
++ bin /= 10;
++ }
++
++ return dec;
++}
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+index eced890..3b8b997 100644
+--- a/target-s390x/op_helper.c
++++ b/target-s390x/op_helper.c
+@@ -352,49 +352,6 @@ void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ HELPER_LOG("\n");
+ }
+
+-/* 64/64 -> 128 unsigned multiplication */
+-void HELPER(mlg)(uint32_t r1, uint64_t v2)
+-{
+-#if HOST_LONG_BITS == 64 && defined(__GNUC__)
+- /* assuming 64-bit hosts have __uint128_t */
+- __uint128_t res = (__uint128_t)env->regs[r1 + 1];
+-
+- res *= (__uint128_t)v2;
+- env->regs[r1] = (uint64_t)(res >> 64);
+- env->regs[r1 + 1] = (uint64_t)res;
+-#else
+- mulu64(&env->regs[r1 + 1], &env->regs[r1], env->regs[r1 + 1], v2);
+-#endif
+-}
+-
+-/* 128 -> 64/64 unsigned division */
+-void HELPER(dlg)(uint32_t r1, uint64_t v2)
+-{
+- uint64_t divisor = v2;
+-
+- if (!env->regs[r1]) {
+- /* 64 -> 64/64 case */
+- env->regs[r1] = env->regs[r1 + 1] % divisor;
+- env->regs[r1 + 1] = env->regs[r1 + 1] / divisor;
+- return;
+- } else {
+-#if HOST_LONG_BITS == 64 && defined(__GNUC__)
+- /* assuming 64-bit hosts have __uint128_t */
+- __uint128_t dividend = (((__uint128_t)env->regs[r1]) << 64) |
+- (env->regs[r1 + 1]);
+- __uint128_t quotient = dividend / divisor;
+- __uint128_t remainder = dividend % divisor;
+-
+- env->regs[r1 + 1] = quotient;
+- env->regs[r1] = remainder;
+-#else
+- /* 32-bit hosts would need special wrapper functionality - just abort if
+- we encounter such a case; it's very unlikely anyways. */
+- cpu_abort(env, "128 -> 64/64 division not implemented\n");
+-#endif
+- }
+-}
+-
+ static inline uint64_t get_address(int x2, int b2, int d2)
+ {
+ uint64_t r = d2;
+@@ -677,61 +634,6 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ return cc;
+ }
+
+-/* absolute value 32-bit */
+-uint32_t HELPER(abs_i32)(int32_t val)
+-{
+- if (val < 0) {
+- return -val;
+- } else {
+- return val;
+- }
+-}
+-
+-/* negative absolute value 32-bit */
+-int32_t HELPER(nabs_i32)(int32_t val)
+-{
+- if (val < 0) {
+- return val;
+- } else {
+- return -val;
+- }
+-}
+-
+-/* absolute value 64-bit */
+-uint64_t HELPER(abs_i64)(int64_t val)
+-{
+- HELPER_LOG("%s: val 0x%" PRIx64 "\n", __func__, val);
+-
+- if (val < 0) {
+- return -val;
+- } else {
+- return val;
+- }
+-}
+-
+-/* negative absolute value 64-bit */
+-int64_t HELPER(nabs_i64)(int64_t val)
+-{
+- if (val < 0) {
+- return val;
+- } else {
+- return -val;
+- }
+-}
+-
+-/* add with carry 32-bit unsigned */
+-uint32_t HELPER(addc_u32)(uint32_t cc, uint32_t v1, uint32_t v2)
+-{
+- uint32_t res;
+-
+- res = v1 + v2;
+- if (cc & 2) {
+- res++;
+- }
+-
+- return res;
+-}
+-
+ /* store character under mask high operates on the upper half of r1 */
+ void HELPER(stcmh)(uint32_t r1, uint64_t address, uint32_t mask)
+ {
+@@ -936,57 +838,6 @@ uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ return cc;
+ }
+
+-/* subtract unsigned v2 from v1 with borrow */
+-uint32_t HELPER(slb)(uint32_t cc, uint32_t r1, uint32_t v2)
+-{
+- uint32_t v1 = env->regs[r1];
+- uint32_t res = v1 + (~v2) + (cc >> 1);
+-
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | res;
+- if (cc & 2) {
+- /* borrow */
+- return v1 ? 1 : 0;
+- } else {
+- return v1 ? 3 : 2;
+- }
+-}
+-
+-/* subtract unsigned v2 from v1 with borrow */
+-uint32_t HELPER(slbg)(uint32_t cc, uint32_t r1, uint64_t v1, uint64_t v2)
+-{
+- uint64_t res = v1 + (~v2) + (cc >> 1);
+-
+- env->regs[r1] = res;
+- if (cc & 2) {
+- /* borrow */
+- return v1 ? 1 : 0;
+- } else {
+- return v1 ? 3 : 2;
+- }
+-}
+-
+-/* find leftmost one */
+-uint32_t HELPER(flogr)(uint32_t r1, uint64_t v2)
+-{
+- uint64_t res = 0;
+- uint64_t ov2 = v2;
+-
+- while (!(v2 & 0x8000000000000000ULL) && v2) {
+- v2 <<= 1;
+- res++;
+- }
+-
+- if (!v2) {
+- env->regs[r1] = 64;
+- env->regs[r1 + 1] = 0;
+- return 0;
+- } else {
+- env->regs[r1] = res;
+- env->regs[r1 + 1] = ov2 & ~(0x8000000000000000ULL >> res);
+- return 2;
+- }
+-}
+-
+ /* checksum */
+ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ {
+@@ -1026,27 +877,6 @@ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ ((uint32_t)cksm + (cksm >> 32));
+ }
+
+-uint64_t HELPER(cvd)(int32_t bin)
+-{
+- /* positive 0 */
+- uint64_t dec = 0x0c;
+- int shift = 4;
+-
+- if (bin < 0) {
+- bin = -bin;
+- dec = 0x0d;
+- }
+-
+- for (shift = 4; (shift < 64) && bin; shift += 4) {
+- int current_number = bin % 10;
+-
+- dec |= (current_number) << shift;
+- bin /= 10;
+- }
+-
+- return dec;
+-}
+-
+ void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
+ {
+ int len_dest = len >> 4;
+--
+1.7.12.1
+
--- /dev/null
+From a44aee2570031bfcf99098d278c53ab39a582ba6 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:34 +0000
+Subject: [PATCH] target-s390x: split memory access helpers
+
+Move memory access helpers to mem_helper.c.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+[agraf: fold softmmu include ifdefs together]
+Signed-off-by: Alexander Graf <agraf@suse.de>
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 3 +-
+ target-s390x/mem_helper.c | 1190 ++++++++++++++++++++++++++++++++++++++++++++
+ target-s390x/op_helper.c | 1159 +-----------------------------------------
+ 3 files changed, 1193 insertions(+), 1159 deletions(-)
+ create mode 100644 target-s390x/mem_helper.c
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index e8f66e9..b9b3061 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -1,5 +1,5 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o interrupt.o
+-obj-y += int_helper.o fpu_helper.o cc_helper.o
++obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+@@ -7,3 +7,4 @@ $(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/int_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
++$(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
+new file mode 100644
+index 0000000..ba05e65
+--- /dev/null
++++ b/target-s390x/mem_helper.c
+@@ -0,0 +1,1190 @@
++/*
++ * S/390 memory access helper routines
++ *
++ * Copyright (c) 2009 Ulrich Hecht
++ * Copyright (c) 2009 Alexander Graf
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "cpu.h"
++#include "dyngen-exec.h"
++#include "helper.h"
++
++/*****************************************************************************/
++/* Softmmu support */
++#if !defined(CONFIG_USER_ONLY)
++#include "softmmu_exec.h"
++
++#define MMUSUFFIX _mmu
++
++#define SHIFT 0
++#include "softmmu_template.h"
++
++#define SHIFT 1
++#include "softmmu_template.h"
++
++#define SHIFT 2
++#include "softmmu_template.h"
++
++#define SHIFT 3
++#include "softmmu_template.h"
++
++/* try to fill the TLB and return an exception if error. If retaddr is
++ NULL, it means that the function was called in C code (i.e. not
++ from generated code or from helper.c) */
++/* XXX: fix it to restore all registers */
++void tlb_fill(CPUS390XState *env1, target_ulong addr, int is_write, int mmu_idx,
++ uintptr_t retaddr)
++{
++ TranslationBlock *tb;
++ CPUS390XState *saved_env;
++ int ret;
++
++ saved_env = env;
++ env = env1;
++ ret = cpu_s390x_handle_mmu_fault(env, addr, is_write, mmu_idx);
++ if (unlikely(ret != 0)) {
++ if (likely(retaddr)) {
++ /* now we have a real cpu fault */
++ tb = tb_find_pc(retaddr);
++ if (likely(tb)) {
++ /* the PC is inside the translated code. It means that we have
++ a virtual CPU fault */
++ cpu_restore_state(tb, env, retaddr);
++ }
++ }
++ cpu_loop_exit(env);
++ }
++ env = saved_env;
++}
++
++#endif
++
++/* #define DEBUG_HELPER */
++#ifdef DEBUG_HELPER
++#define HELPER_LOG(x...) qemu_log(x)
++#else
++#define HELPER_LOG(x...)
++#endif
++
++#ifndef CONFIG_USER_ONLY
++static void mvc_fast_memset(CPUS390XState *env, uint32_t l, uint64_t dest,
++ uint8_t byte)
++{
++ target_phys_addr_t dest_phys;
++ target_phys_addr_t len = l;
++ void *dest_p;
++ uint64_t asc = env->psw.mask & PSW_MASK_ASC;
++ int flags;
++
++ if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
++ stb(dest, byte);
++ cpu_abort(env, "should never reach here");
++ }
++ dest_phys |= dest & ~TARGET_PAGE_MASK;
++
++ dest_p = cpu_physical_memory_map(dest_phys, &len, 1);
++
++ memset(dest_p, byte, len);
++
++ cpu_physical_memory_unmap(dest_p, 1, len, len);
++}
++
++static void mvc_fast_memmove(CPUS390XState *env, uint32_t l, uint64_t dest,
++ uint64_t src)
++{
++ target_phys_addr_t dest_phys;
++ target_phys_addr_t src_phys;
++ target_phys_addr_t len = l;
++ void *dest_p;
++ void *src_p;
++ uint64_t asc = env->psw.mask & PSW_MASK_ASC;
++ int flags;
++
++ if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
++ stb(dest, 0);
++ cpu_abort(env, "should never reach here");
++ }
++ dest_phys |= dest & ~TARGET_PAGE_MASK;
++
++ if (mmu_translate(env, src, 0, asc, &src_phys, &flags)) {
++ ldub(src);
++ cpu_abort(env, "should never reach here");
++ }
++ src_phys |= src & ~TARGET_PAGE_MASK;
++
++ dest_p = cpu_physical_memory_map(dest_phys, &len, 1);
++ src_p = cpu_physical_memory_map(src_phys, &len, 0);
++
++ memmove(dest_p, src_p, len);
++
++ cpu_physical_memory_unmap(dest_p, 1, len, len);
++ cpu_physical_memory_unmap(src_p, 0, len, len);
++}
++#endif
++
++/* and on array */
++uint32_t HELPER(nc)(uint32_t l, uint64_t dest, uint64_t src)
++{
++ int i;
++ unsigned char x;
++ uint32_t cc = 0;
++
++ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
++ __func__, l, dest, src);
++ for (i = 0; i <= l; i++) {
++ x = ldub(dest + i) & ldub(src + i);
++ if (x) {
++ cc = 1;
++ }
++ stb(dest + i, x);
++ }
++ return cc;
++}
++
++/* xor on array */
++uint32_t HELPER(xc)(uint32_t l, uint64_t dest, uint64_t src)
++{
++ int i;
++ unsigned char x;
++ uint32_t cc = 0;
++
++ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
++ __func__, l, dest, src);
++
++#ifndef CONFIG_USER_ONLY
++ /* xor with itself is the same as memset(0) */
++ if ((l > 32) && (src == dest) &&
++ (src & TARGET_PAGE_MASK) == ((src + l) & TARGET_PAGE_MASK)) {
++ mvc_fast_memset(env, l + 1, dest, 0);
++ return 0;
++ }
++#else
++ if (src == dest) {
++ memset(g2h(dest), 0, l + 1);
++ return 0;
++ }
++#endif
++
++ for (i = 0; i <= l; i++) {
++ x = ldub(dest + i) ^ ldub(src + i);
++ if (x) {
++ cc = 1;
++ }
++ stb(dest + i, x);
++ }
++ return cc;
++}
++
++/* or on array */
++uint32_t HELPER(oc)(uint32_t l, uint64_t dest, uint64_t src)
++{
++ int i;
++ unsigned char x;
++ uint32_t cc = 0;
++
++ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
++ __func__, l, dest, src);
++ for (i = 0; i <= l; i++) {
++ x = ldub(dest + i) | ldub(src + i);
++ if (x) {
++ cc = 1;
++ }
++ stb(dest + i, x);
++ }
++ return cc;
++}
++
++/* memmove */
++void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
++{
++ int i = 0;
++ int x = 0;
++ uint32_t l_64 = (l + 1) / 8;
++
++ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
++ __func__, l, dest, src);
++
++#ifndef CONFIG_USER_ONLY
++ if ((l > 32) &&
++ (src & TARGET_PAGE_MASK) == ((src + l) & TARGET_PAGE_MASK) &&
++ (dest & TARGET_PAGE_MASK) == ((dest + l) & TARGET_PAGE_MASK)) {
++ if (dest == (src + 1)) {
++ mvc_fast_memset(env, l + 1, dest, ldub(src));
++ return;
++ } else if ((src & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) {
++ mvc_fast_memmove(env, l + 1, dest, src);
++ return;
++ }
++ }
++#else
++ if (dest == (src + 1)) {
++ memset(g2h(dest), ldub(src), l + 1);
++ return;
++ } else {
++ memmove(g2h(dest), g2h(src), l + 1);
++ return;
++ }
++#endif
++
++ /* handle the parts that fit into 8-byte loads/stores */
++ if (dest != (src + 1)) {
++ for (i = 0; i < l_64; i++) {
++ stq(dest + x, ldq(src + x));
++ x += 8;
++ }
++ }
++
++ /* slow version crossing pages with byte accesses */
++ for (i = x; i <= l; i++) {
++ stb(dest + i, ldub(src + i));
++ }
++}
++
++/* compare unsigned byte arrays */
++uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
++{
++ int i;
++ unsigned char x, y;
++ uint32_t cc;
++
++ HELPER_LOG("%s l %d s1 %" PRIx64 " s2 %" PRIx64 "\n",
++ __func__, l, s1, s2);
++ for (i = 0; i <= l; i++) {
++ x = ldub(s1 + i);
++ y = ldub(s2 + i);
++ HELPER_LOG("%02x (%c)/%02x (%c) ", x, x, y, y);
++ if (x < y) {
++ cc = 1;
++ goto done;
++ } else if (x > y) {
++ cc = 2;
++ goto done;
++ }
++ }
++ cc = 0;
++ done:
++ HELPER_LOG("\n");
++ return cc;
++}
++
++/* compare logical under mask */
++uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
++{
++ uint8_t r, d;
++ uint32_t cc;
++
++ HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%" PRIx64 "\n", __func__, r1,
++ mask, addr);
++ cc = 0;
++ while (mask) {
++ if (mask & 8) {
++ d = ldub(addr);
++ r = (r1 & 0xff000000UL) >> 24;
++ HELPER_LOG("mask 0x%x %02x/%02x (0x%" PRIx64 ") ", mask, r, d,
++ addr);
++ if (r < d) {
++ cc = 1;
++ break;
++ } else if (r > d) {
++ cc = 2;
++ break;
++ }
++ addr++;
++ }
++ mask = (mask << 1) & 0xf;
++ r1 <<= 8;
++ }
++ HELPER_LOG("\n");
++ return cc;
++}
++
++/* store character under mask */
++void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
++{
++ uint8_t r;
++
++ HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%lx\n", __func__, r1, mask,
++ addr);
++ while (mask) {
++ if (mask & 8) {
++ r = (r1 & 0xff000000UL) >> 24;
++ stb(addr, r);
++ HELPER_LOG("mask 0x%x %02x (0x%lx) ", mask, r, addr);
++ addr++;
++ }
++ mask = (mask << 1) & 0xf;
++ r1 <<= 8;
++ }
++ HELPER_LOG("\n");
++}
++
++static inline uint64_t get_address(int x2, int b2, int d2)
++{
++ uint64_t r = d2;
++
++ if (x2) {
++ r += env->regs[x2];
++ }
++
++ if (b2) {
++ r += env->regs[b2];
++ }
++
++ /* 31-Bit mode */
++ if (!(env->psw.mask & PSW_MASK_64)) {
++ r &= 0x7fffffff;
++ }
++
++ return r;
++}
++
++static inline uint64_t get_address_31fix(int reg)
++{
++ uint64_t r = env->regs[reg];
++
++ /* 31-Bit mode */
++ if (!(env->psw.mask & PSW_MASK_64)) {
++ r &= 0x7fffffff;
++ }
++
++ return r;
++}
++
++/* search string (c is byte to search, r2 is string, r1 end of string) */
++uint32_t HELPER(srst)(uint32_t c, uint32_t r1, uint32_t r2)
++{
++ uint64_t i;
++ uint32_t cc = 2;
++ uint64_t str = get_address_31fix(r2);
++ uint64_t end = get_address_31fix(r1);
++
++ HELPER_LOG("%s: c %d *r1 0x%" PRIx64 " *r2 0x%" PRIx64 "\n", __func__,
++ c, env->regs[r1], env->regs[r2]);
++
++ for (i = str; i != end; i++) {
++ if (ldub(i) == c) {
++ env->regs[r1] = i;
++ cc = 1;
++ break;
++ }
++ }
++
++ return cc;
++}
++
++/* unsigned string compare (c is string terminator) */
++uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
++{
++ uint64_t s1 = get_address_31fix(r1);
++ uint64_t s2 = get_address_31fix(r2);
++ uint8_t v1, v2;
++ uint32_t cc;
++
++ c = c & 0xff;
++#ifdef CONFIG_USER_ONLY
++ if (!c) {
++ HELPER_LOG("%s: comparing '%s' and '%s'\n",
++ __func__, (char *)g2h(s1), (char *)g2h(s2));
++ }
++#endif
++ for (;;) {
++ v1 = ldub(s1);
++ v2 = ldub(s2);
++ if ((v1 == c || v2 == c) || (v1 != v2)) {
++ break;
++ }
++ s1++;
++ s2++;
++ }
++
++ if (v1 == v2) {
++ cc = 0;
++ } else {
++ cc = (v1 < v2) ? 1 : 2;
++ /* FIXME: 31-bit mode! */
++ env->regs[r1] = s1;
++ env->regs[r2] = s2;
++ }
++ return cc;
++}
++
++/* move page */
++void HELPER(mvpg)(uint64_t r0, uint64_t r1, uint64_t r2)
++{
++ /* XXX missing r0 handling */
++#ifdef CONFIG_USER_ONLY
++ int i;
++
++ for (i = 0; i < TARGET_PAGE_SIZE; i++) {
++ stb(r1 + i, ldub(r2 + i));
++ }
++#else
++ mvc_fast_memmove(env, TARGET_PAGE_SIZE, r1, r2);
++#endif
++}
++
++/* string copy (c is string terminator) */
++void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
++{
++ uint64_t dest = get_address_31fix(r1);
++ uint64_t src = get_address_31fix(r2);
++ uint8_t v;
++
++ c = c & 0xff;
++#ifdef CONFIG_USER_ONLY
++ if (!c) {
++ HELPER_LOG("%s: copy '%s' to 0x%lx\n", __func__, (char *)g2h(src),
++ dest);
++ }
++#endif
++ for (;;) {
++ v = ldub(src);
++ stb(dest, v);
++ if (v == c) {
++ break;
++ }
++ src++;
++ dest++;
++ }
++ env->regs[r1] = dest; /* FIXME: 31-bit mode! */
++}
++
++/* compare and swap 64-bit */
++uint32_t HELPER(csg)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ /* FIXME: locking? */
++ uint32_t cc;
++ uint64_t v2 = ldq(a2);
++
++ if (env->regs[r1] == v2) {
++ cc = 0;
++ stq(a2, env->regs[r3]);
++ } else {
++ cc = 1;
++ env->regs[r1] = v2;
++ }
++ return cc;
++}
++
++/* compare double and swap 64-bit */
++uint32_t HELPER(cdsg)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ /* FIXME: locking? */
++ uint32_t cc;
++ uint64_t v2_hi = ldq(a2);
++ uint64_t v2_lo = ldq(a2 + 8);
++ uint64_t v1_hi = env->regs[r1];
++ uint64_t v1_lo = env->regs[r1 + 1];
++
++ if ((v1_hi == v2_hi) && (v1_lo == v2_lo)) {
++ cc = 0;
++ stq(a2, env->regs[r3]);
++ stq(a2 + 8, env->regs[r3 + 1]);
++ } else {
++ cc = 1;
++ env->regs[r1] = v2_hi;
++ env->regs[r1 + 1] = v2_lo;
++ }
++
++ return cc;
++}
++
++/* compare and swap 32-bit */
++uint32_t HELPER(cs)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ /* FIXME: locking? */
++ uint32_t cc;
++ uint32_t v2 = ldl(a2);
++
++ HELPER_LOG("%s: r1 %d a2 0x%lx r3 %d\n", __func__, r1, a2, r3);
++ if (((uint32_t)env->regs[r1]) == v2) {
++ cc = 0;
++ stl(a2, (uint32_t)env->regs[r3]);
++ } else {
++ cc = 1;
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | v2;
++ }
++ return cc;
++}
++
++static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
++{
++ int pos = 24; /* top of the lower half of r1 */
++ uint64_t rmask = 0xff000000ULL;
++ uint8_t val = 0;
++ int ccd = 0;
++ uint32_t cc = 0;
++
++ while (mask) {
++ if (mask & 8) {
++ env->regs[r1] &= ~rmask;
++ val = ldub(address);
++ if ((val & 0x80) && !ccd) {
++ cc = 1;
++ }
++ ccd = 1;
++ if (val && cc == 0) {
++ cc = 2;
++ }
++ env->regs[r1] |= (uint64_t)val << pos;
++ address++;
++ }
++ mask = (mask << 1) & 0xf;
++ pos -= 8;
++ rmask >>= 8;
++ }
++
++ return cc;
++}
++
++/* execute instruction
++ this instruction executes an insn modified with the contents of r1
++ it does not change the executed instruction in memory
++ it does not change the program counter
++ in other words: tricky...
++ currently implemented by interpreting the cases it is most commonly used in
++*/
++uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
++{
++ uint16_t insn = lduw_code(addr);
++
++ HELPER_LOG("%s: v1 0x%lx addr 0x%lx insn 0x%x\n", __func__, v1, addr,
++ insn);
++ if ((insn & 0xf0ff) == 0xd000) {
++ uint32_t l, insn2, b1, b2, d1, d2;
++
++ l = v1 & 0xff;
++ insn2 = ldl_code(addr + 2);
++ b1 = (insn2 >> 28) & 0xf;
++ b2 = (insn2 >> 12) & 0xf;
++ d1 = (insn2 >> 16) & 0xfff;
++ d2 = insn2 & 0xfff;
++ switch (insn & 0xf00) {
++ case 0x200:
++ helper_mvc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ break;
++ case 0x500:
++ cc = helper_clc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ break;
++ case 0x700:
++ cc = helper_xc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ break;
++ case 0xc00:
++ helper_tr(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ break;
++ default:
++ goto abort;
++ break;
++ }
++ } else if ((insn & 0xff00) == 0x0a00) {
++ /* supervisor call */
++ HELPER_LOG("%s: svc %ld via execute\n", __func__, (insn | v1) & 0xff);
++ env->psw.addr = ret - 4;
++ env->int_svc_code = (insn | v1) & 0xff;
++ env->int_svc_ilc = 4;
++ helper_exception(EXCP_SVC);
++ } else if ((insn & 0xff00) == 0xbf00) {
++ uint32_t insn2, r1, r3, b2, d2;
++
++ insn2 = ldl_code(addr + 2);
++ r1 = (insn2 >> 20) & 0xf;
++ r3 = (insn2 >> 16) & 0xf;
++ b2 = (insn2 >> 12) & 0xf;
++ d2 = insn2 & 0xfff;
++ cc = helper_icm(r1, get_address(0, b2, d2), r3);
++ } else {
++ abort:
++ cpu_abort(env, "EXECUTE on instruction prefix 0x%x not implemented\n",
++ insn);
++ }
++ return cc;
++}
++
++/* store character under mask high operates on the upper half of r1 */
++void HELPER(stcmh)(uint32_t r1, uint64_t address, uint32_t mask)
++{
++ int pos = 56; /* top of the upper half of r1 */
++
++ while (mask) {
++ if (mask & 8) {
++ stb(address, (env->regs[r1] >> pos) & 0xff);
++ address++;
++ }
++ mask = (mask << 1) & 0xf;
++ pos -= 8;
++ }
++}
++
++/* insert character under mask high; same as icm, but operates on the
++ upper half of r1 */
++uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
++{
++ int pos = 56; /* top of the upper half of r1 */
++ uint64_t rmask = 0xff00000000000000ULL;
++ uint8_t val = 0;
++ int ccd = 0;
++ uint32_t cc = 0;
++
++ while (mask) {
++ if (mask & 8) {
++ env->regs[r1] &= ~rmask;
++ val = ldub(address);
++ if ((val & 0x80) && !ccd) {
++ cc = 1;
++ }
++ ccd = 1;
++ if (val && cc == 0) {
++ cc = 2;
++ }
++ env->regs[r1] |= (uint64_t)val << pos;
++ address++;
++ }
++ mask = (mask << 1) & 0xf;
++ pos -= 8;
++ rmask >>= 8;
++ }
++
++ return cc;
++}
++
++/* load access registers r1 to r3 from memory at a2 */
++void HELPER(lam)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ env->aregs[i] = ldl(a2);
++ a2 += 4;
++
++ if (i == r3) {
++ break;
++ }
++ }
++}
++
++/* store access registers r1 to r3 in memory at a2 */
++void HELPER(stam)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ stl(a2, env->aregs[i]);
++ a2 += 4;
++
++ if (i == r3) {
++ break;
++ }
++ }
++}
++
++/* move long */
++uint32_t HELPER(mvcl)(uint32_t r1, uint32_t r2)
++{
++ uint64_t destlen = env->regs[r1 + 1] & 0xffffff;
++ uint64_t dest = get_address_31fix(r1);
++ uint64_t srclen = env->regs[r2 + 1] & 0xffffff;
++ uint64_t src = get_address_31fix(r2);
++ uint8_t pad = src >> 24;
++ uint8_t v;
++ uint32_t cc;
++
++ if (destlen == srclen) {
++ cc = 0;
++ } else if (destlen < srclen) {
++ cc = 1;
++ } else {
++ cc = 2;
++ }
++
++ if (srclen > destlen) {
++ srclen = destlen;
++ }
++
++ for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
++ v = ldub(src);
++ stb(dest, v);
++ }
++
++ for (; destlen; dest++, destlen--) {
++ stb(dest, pad);
++ }
++
++ env->regs[r1 + 1] = destlen;
++ /* can't use srclen here, we trunc'ed it */
++ env->regs[r2 + 1] -= src - env->regs[r2];
++ env->regs[r1] = dest;
++ env->regs[r2] = src;
++
++ return cc;
++}
++
++/* move long extended another memcopy insn with more bells and whistles */
++uint32_t HELPER(mvcle)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ uint64_t destlen = env->regs[r1 + 1];
++ uint64_t dest = env->regs[r1];
++ uint64_t srclen = env->regs[r3 + 1];
++ uint64_t src = env->regs[r3];
++ uint8_t pad = a2 & 0xff;
++ uint8_t v;
++ uint32_t cc;
++
++ if (!(env->psw.mask & PSW_MASK_64)) {
++ destlen = (uint32_t)destlen;
++ srclen = (uint32_t)srclen;
++ dest &= 0x7fffffff;
++ src &= 0x7fffffff;
++ }
++
++ if (destlen == srclen) {
++ cc = 0;
++ } else if (destlen < srclen) {
++ cc = 1;
++ } else {
++ cc = 2;
++ }
++
++ if (srclen > destlen) {
++ srclen = destlen;
++ }
++
++ for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
++ v = ldub(src);
++ stb(dest, v);
++ }
++
++ for (; destlen; dest++, destlen--) {
++ stb(dest, pad);
++ }
++
++ env->regs[r1 + 1] = destlen;
++ /* can't use srclen here, we trunc'ed it */
++ /* FIXME: 31-bit mode! */
++ env->regs[r3 + 1] -= src - env->regs[r3];
++ env->regs[r1] = dest;
++ env->regs[r3] = src;
++
++ return cc;
++}
++
++/* compare logical long extended memcompare insn with padding */
++uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ uint64_t destlen = env->regs[r1 + 1];
++ uint64_t dest = get_address_31fix(r1);
++ uint64_t srclen = env->regs[r3 + 1];
++ uint64_t src = get_address_31fix(r3);
++ uint8_t pad = a2 & 0xff;
++ uint8_t v1 = 0, v2 = 0;
++ uint32_t cc = 0;
++
++ if (!(destlen || srclen)) {
++ return cc;
++ }
++
++ if (srclen > destlen) {
++ srclen = destlen;
++ }
++
++ for (; destlen || srclen; src++, dest++, destlen--, srclen--) {
++ v1 = srclen ? ldub(src) : pad;
++ v2 = destlen ? ldub(dest) : pad;
++ if (v1 != v2) {
++ cc = (v1 < v2) ? 1 : 2;
++ break;
++ }
++ }
++
++ env->regs[r1 + 1] = destlen;
++ /* can't use srclen here, we trunc'ed it */
++ env->regs[r3 + 1] -= src - env->regs[r3];
++ env->regs[r1] = dest;
++ env->regs[r3] = src;
++
++ return cc;
++}
++
++/* checksum */
++void HELPER(cksm)(uint32_t r1, uint32_t r2)
++{
++ uint64_t src = get_address_31fix(r2);
++ uint64_t src_len = env->regs[(r2 + 1) & 15];
++ uint64_t cksm = (uint32_t)env->regs[r1];
++
++ while (src_len >= 4) {
++ cksm += ldl(src);
++
++ /* move to next word */
++ src_len -= 4;
++ src += 4;
++ }
++
++ switch (src_len) {
++ case 0:
++ break;
++ case 1:
++ cksm += ldub(src) << 24;
++ break;
++ case 2:
++ cksm += lduw(src) << 16;
++ break;
++ case 3:
++ cksm += lduw(src) << 16;
++ cksm += ldub(src + 2) << 8;
++ break;
++ }
++
++ /* indicate we've processed everything */
++ env->regs[r2] = src + src_len;
++ env->regs[(r2 + 1) & 15] = 0;
++
++ /* store result */
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ ((uint32_t)cksm + (cksm >> 32));
++}
++
++void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
++{
++ int len_dest = len >> 4;
++ int len_src = len & 0xf;
++ uint8_t b;
++ int second_nibble = 0;
++
++ dest += len_dest;
++ src += len_src;
++
++ /* last byte is special, it only flips the nibbles */
++ b = ldub(src);
++ stb(dest, (b << 4) | (b >> 4));
++ src--;
++ len_src--;
++
++ /* now pad every nibble with 0xf0 */
++
++ while (len_dest > 0) {
++ uint8_t cur_byte = 0;
++
++ if (len_src > 0) {
++ cur_byte = ldub(src);
++ }
++
++ len_dest--;
++ dest--;
++
++ /* only advance one nibble at a time */
++ if (second_nibble) {
++ cur_byte >>= 4;
++ len_src--;
++ src--;
++ }
++ second_nibble = !second_nibble;
++
++ /* digit */
++ cur_byte = (cur_byte & 0xf);
++ /* zone bits */
++ cur_byte |= 0xf0;
++
++ stb(dest, cur_byte);
++ }
++}
++
++void HELPER(tr)(uint32_t len, uint64_t array, uint64_t trans)
++{
++ int i;
++
++ for (i = 0; i <= len; i++) {
++ uint8_t byte = ldub(array + i);
++ uint8_t new_byte = ldub(trans + byte);
++
++ stb(array + i, new_byte);
++ }
++}
++
++#if !defined(CONFIG_USER_ONLY)
++void HELPER(lctlg)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++ uint64_t src = a2;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ env->cregs[i] = ldq(src);
++ HELPER_LOG("load ctl %d from 0x%" PRIx64 " == 0x%" PRIx64 "\n",
++ i, src, env->cregs[i]);
++ src += sizeof(uint64_t);
++
++ if (i == r3) {
++ break;
++ }
++ }
++
++ tlb_flush(env, 1);
++}
++
++void HELPER(lctl)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++ uint64_t src = a2;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ env->cregs[i] = (env->cregs[i] & 0xFFFFFFFF00000000ULL) | ldl(src);
++ src += sizeof(uint32_t);
++
++ if (i == r3) {
++ break;
++ }
++ }
++
++ tlb_flush(env, 1);
++}
++
++void HELPER(stctg)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++ uint64_t dest = a2;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ stq(dest, env->cregs[i]);
++ dest += sizeof(uint64_t);
++
++ if (i == r3) {
++ break;
++ }
++ }
++}
++
++void HELPER(stctl)(uint32_t r1, uint64_t a2, uint32_t r3)
++{
++ int i;
++ uint64_t dest = a2;
++
++ for (i = r1;; i = (i + 1) % 16) {
++ stl(dest, env->cregs[i]);
++ dest += sizeof(uint32_t);
++
++ if (i == r3) {
++ break;
++ }
++ }
++}
++
++uint32_t HELPER(tprot)(uint64_t a1, uint64_t a2)
++{
++ /* XXX implement */
++
++ return 0;
++}
++
++/* insert storage key extended */
++uint64_t HELPER(iske)(uint64_t r2)
++{
++ uint64_t addr = get_address(0, 0, r2);
++
++ if (addr > ram_size) {
++ return 0;
++ }
++
++ return env->storage_keys[addr / TARGET_PAGE_SIZE];
++}
++
++/* set storage key extended */
++void HELPER(sske)(uint32_t r1, uint64_t r2)
++{
++ uint64_t addr = get_address(0, 0, r2);
++
++ if (addr > ram_size) {
++ return;
++ }
++
++ env->storage_keys[addr / TARGET_PAGE_SIZE] = r1;
++}
++
++/* reset reference bit extended */
++uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)
++{
++ uint8_t re;
++ uint8_t key;
++
++ if (r2 > ram_size) {
++ return 0;
++ }
++
++ key = env->storage_keys[r2 / TARGET_PAGE_SIZE];
++ re = key & (SK_R | SK_C);
++ env->storage_keys[r2 / TARGET_PAGE_SIZE] = (key & ~SK_R);
++
++ /*
++ * cc
++ *
++ * 0 Reference bit zero; change bit zero
++ * 1 Reference bit zero; change bit one
++ * 2 Reference bit one; change bit zero
++ * 3 Reference bit one; change bit one
++ */
++
++ return re >> 1;
++}
++
++/* compare and swap and purge */
++uint32_t HELPER(csp)(uint32_t r1, uint32_t r2)
++{
++ uint32_t cc;
++ uint32_t o1 = env->regs[r1];
++ uint64_t a2 = get_address_31fix(r2) & ~3ULL;
++ uint32_t o2 = ldl(a2);
++
++ if (o1 == o2) {
++ stl(a2, env->regs[(r1 + 1) & 15]);
++ if (env->regs[r2] & 0x3) {
++ /* flush TLB / ALB */
++ tlb_flush(env, 1);
++ }
++ cc = 0;
++ } else {
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | o2;
++ cc = 1;
++ }
++
++ return cc;
++}
++
++static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
++ uint64_t mode2)
++{
++ target_ulong src, dest;
++ int flags, cc = 0, i;
++
++ if (!l) {
++ return 0;
++ } else if (l > 256) {
++ /* max 256 */
++ l = 256;
++ cc = 3;
++ }
++
++ if (mmu_translate(env, a1 & TARGET_PAGE_MASK, 1, mode1, &dest, &flags)) {
++ cpu_loop_exit(env);
++ }
++ dest |= a1 & ~TARGET_PAGE_MASK;
++
++ if (mmu_translate(env, a2 & TARGET_PAGE_MASK, 0, mode2, &src, &flags)) {
++ cpu_loop_exit(env);
++ }
++ src |= a2 & ~TARGET_PAGE_MASK;
++
++ /* XXX replace w/ memcpy */
++ for (i = 0; i < l; i++) {
++ /* XXX be more clever */
++ if ((((dest + i) & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) ||
++ (((src + i) & TARGET_PAGE_MASK) != (src & TARGET_PAGE_MASK))) {
++ mvc_asc(l - i, a1 + i, mode1, a2 + i, mode2);
++ break;
++ }
++ stb_phys(dest + i, ldub_phys(src + i));
++ }
++
++ return cc;
++}
++
++uint32_t HELPER(mvcs)(uint64_t l, uint64_t a1, uint64_t a2)
++{
++ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
++ __func__, l, a1, a2);
++
++ return mvc_asc(l, a1, PSW_ASC_SECONDARY, a2, PSW_ASC_PRIMARY);
++}
++
++uint32_t HELPER(mvcp)(uint64_t l, uint64_t a1, uint64_t a2)
++{
++ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
++ __func__, l, a1, a2);
++
++ return mvc_asc(l, a1, PSW_ASC_PRIMARY, a2, PSW_ASC_SECONDARY);
++}
++
++/* invalidate pte */
++void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
++{
++ uint64_t page = vaddr & TARGET_PAGE_MASK;
++ uint64_t pte = 0;
++
++ /* XXX broadcast to other CPUs */
++
++ /* XXX Linux is nice enough to give us the exact pte address.
++ According to spec we'd have to find it out ourselves */
++ /* XXX Linux is fine with overwriting the pte, the spec requires
++ us to only set the invalid bit */
++ stq_phys(pte_addr, pte | _PAGE_INVALID);
++
++ /* XXX we exploit the fact that Linux passes the exact virtual
++ address here - it's not obliged to! */
++ tlb_flush_page(env, page);
++
++ /* XXX 31-bit hack */
++ if (page & 0x80000000) {
++ tlb_flush_page(env, page & ~0x80000000);
++ } else {
++ tlb_flush_page(env, page | 0x80000000);
++ }
++}
++
++/* flush local tlb */
++void HELPER(ptlb)(void)
++{
++ tlb_flush(env, 1);
++}
++
++/* store using real address */
++void HELPER(stura)(uint64_t addr, uint32_t v1)
++{
++ stw_phys(get_address(0, 0, addr), v1);
++}
++
++/* load real address */
++uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
++{
++ uint32_t cc = 0;
++ int old_exc = env->exception_index;
++ uint64_t asc = env->psw.mask & PSW_MASK_ASC;
++ uint64_t ret;
++ int flags;
++
++ /* XXX incomplete - has more corner cases */
++ if (!(env->psw.mask & PSW_MASK_64) && (addr >> 32)) {
++ program_interrupt(env, PGM_SPECIAL_OP, 2);
++ }
++
++ env->exception_index = old_exc;
++ if (mmu_translate(env, addr, 0, asc, &ret, &flags)) {
++ cc = 3;
++ }
++ if (env->exception_index == EXCP_PGM) {
++ ret = env->int_pgm_code | 0x80000000;
++ } else {
++ ret |= addr & ~TARGET_PAGE_MASK;
++ }
++ env->exception_index = old_exc;
++
++ if (!(env->psw.mask & PSW_MASK_64)) {
++ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
++ (ret & 0xffffffffULL);
++ } else {
++ env->regs[r1] = ret;
++ }
++
++ return cc;
++}
++
++#endif
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+index 3b8b997..bb8dbf5 100644
+--- a/target-s390x/op_helper.c
++++ b/target-s390x/op_helper.c
+@@ -32,57 +32,8 @@
+ #endif
+
+ #if !defined(CONFIG_USER_ONLY)
+-#include "sysemu.h"
+-#endif
+-
+-/*****************************************************************************/
+-/* Softmmu support */
+-#if !defined(CONFIG_USER_ONLY)
+ #include "softmmu_exec.h"
+-
+-#define MMUSUFFIX _mmu
+-
+-#define SHIFT 0
+-#include "softmmu_template.h"
+-
+-#define SHIFT 1
+-#include "softmmu_template.h"
+-
+-#define SHIFT 2
+-#include "softmmu_template.h"
+-
+-#define SHIFT 3
+-#include "softmmu_template.h"
+-
+-/* try to fill the TLB and return an exception if error. If retaddr is
+- NULL, it means that the function was called in C code (i.e. not
+- from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPUS390XState *env1, target_ulong addr, int is_write, int mmu_idx,
+- uintptr_t retaddr)
+-{
+- TranslationBlock *tb;
+- CPUS390XState *saved_env;
+- int ret;
+-
+- saved_env = env;
+- env = env1;
+- ret = cpu_s390x_handle_mmu_fault(env, addr, is_write, mmu_idx);
+- if (unlikely(ret != 0)) {
+- if (likely(retaddr)) {
+- /* now we have a real cpu fault */
+- tb = tb_find_pc(retaddr);
+- if (likely(tb)) {
+- /* the PC is inside the translated code. It means that we have
+- a virtual CPU fault */
+- cpu_restore_state(tb, env, retaddr);
+- }
+- }
+- cpu_loop_exit(env);
+- }
+- env = saved_env;
+-}
+-
++#include "sysemu.h"
+ #endif
+
+ /* #define DEBUG_HELPER */
+@@ -101,840 +52,6 @@ void HELPER(exception)(uint32_t excp)
+ }
+
+ #ifndef CONFIG_USER_ONLY
+-static void mvc_fast_memset(CPUS390XState *env, uint32_t l, uint64_t dest,
+- uint8_t byte)
+-{
+- target_phys_addr_t dest_phys;
+- target_phys_addr_t len = l;
+- void *dest_p;
+- uint64_t asc = env->psw.mask & PSW_MASK_ASC;
+- int flags;
+-
+- if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
+- stb(dest, byte);
+- cpu_abort(env, "should never reach here");
+- }
+- dest_phys |= dest & ~TARGET_PAGE_MASK;
+-
+- dest_p = cpu_physical_memory_map(dest_phys, &len, 1);
+-
+- memset(dest_p, byte, len);
+-
+- cpu_physical_memory_unmap(dest_p, 1, len, len);
+-}
+-
+-static void mvc_fast_memmove(CPUS390XState *env, uint32_t l, uint64_t dest,
+- uint64_t src)
+-{
+- target_phys_addr_t dest_phys;
+- target_phys_addr_t src_phys;
+- target_phys_addr_t len = l;
+- void *dest_p;
+- void *src_p;
+- uint64_t asc = env->psw.mask & PSW_MASK_ASC;
+- int flags;
+-
+- if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
+- stb(dest, 0);
+- cpu_abort(env, "should never reach here");
+- }
+- dest_phys |= dest & ~TARGET_PAGE_MASK;
+-
+- if (mmu_translate(env, src, 0, asc, &src_phys, &flags)) {
+- ldub(src);
+- cpu_abort(env, "should never reach here");
+- }
+- src_phys |= src & ~TARGET_PAGE_MASK;
+-
+- dest_p = cpu_physical_memory_map(dest_phys, &len, 1);
+- src_p = cpu_physical_memory_map(src_phys, &len, 0);
+-
+- memmove(dest_p, src_p, len);
+-
+- cpu_physical_memory_unmap(dest_p, 1, len, len);
+- cpu_physical_memory_unmap(src_p, 0, len, len);
+-}
+-#endif
+-
+-/* and on array */
+-uint32_t HELPER(nc)(uint32_t l, uint64_t dest, uint64_t src)
+-{
+- int i;
+- unsigned char x;
+- uint32_t cc = 0;
+-
+- HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __func__, l, dest, src);
+- for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) & ldub(src + i);
+- if (x) {
+- cc = 1;
+- }
+- stb(dest + i, x);
+- }
+- return cc;
+-}
+-
+-/* xor on array */
+-uint32_t HELPER(xc)(uint32_t l, uint64_t dest, uint64_t src)
+-{
+- int i;
+- unsigned char x;
+- uint32_t cc = 0;
+-
+- HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __func__, l, dest, src);
+-
+-#ifndef CONFIG_USER_ONLY
+- /* xor with itself is the same as memset(0) */
+- if ((l > 32) && (src == dest) &&
+- (src & TARGET_PAGE_MASK) == ((src + l) & TARGET_PAGE_MASK)) {
+- mvc_fast_memset(env, l + 1, dest, 0);
+- return 0;
+- }
+-#else
+- if (src == dest) {
+- memset(g2h(dest), 0, l + 1);
+- return 0;
+- }
+-#endif
+-
+- for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) ^ ldub(src + i);
+- if (x) {
+- cc = 1;
+- }
+- stb(dest + i, x);
+- }
+- return cc;
+-}
+-
+-/* or on array */
+-uint32_t HELPER(oc)(uint32_t l, uint64_t dest, uint64_t src)
+-{
+- int i;
+- unsigned char x;
+- uint32_t cc = 0;
+-
+- HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __func__, l, dest, src);
+- for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) | ldub(src + i);
+- if (x) {
+- cc = 1;
+- }
+- stb(dest + i, x);
+- }
+- return cc;
+-}
+-
+-/* memmove */
+-void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+-{
+- int i = 0;
+- int x = 0;
+- uint32_t l_64 = (l + 1) / 8;
+-
+- HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+- __func__, l, dest, src);
+-
+-#ifndef CONFIG_USER_ONLY
+- if ((l > 32) &&
+- (src & TARGET_PAGE_MASK) == ((src + l) & TARGET_PAGE_MASK) &&
+- (dest & TARGET_PAGE_MASK) == ((dest + l) & TARGET_PAGE_MASK)) {
+- if (dest == (src + 1)) {
+- mvc_fast_memset(env, l + 1, dest, ldub(src));
+- return;
+- } else if ((src & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) {
+- mvc_fast_memmove(env, l + 1, dest, src);
+- return;
+- }
+- }
+-#else
+- if (dest == (src + 1)) {
+- memset(g2h(dest), ldub(src), l + 1);
+- return;
+- } else {
+- memmove(g2h(dest), g2h(src), l + 1);
+- return;
+- }
+-#endif
+-
+- /* handle the parts that fit into 8-byte loads/stores */
+- if (dest != (src + 1)) {
+- for (i = 0; i < l_64; i++) {
+- stq(dest + x, ldq(src + x));
+- x += 8;
+- }
+- }
+-
+- /* slow version crossing pages with byte accesses */
+- for (i = x; i <= l; i++) {
+- stb(dest + i, ldub(src + i));
+- }
+-}
+-
+-/* compare unsigned byte arrays */
+-uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
+-{
+- int i;
+- unsigned char x, y;
+- uint32_t cc;
+-
+- HELPER_LOG("%s l %d s1 %" PRIx64 " s2 %" PRIx64 "\n",
+- __func__, l, s1, s2);
+- for (i = 0; i <= l; i++) {
+- x = ldub(s1 + i);
+- y = ldub(s2 + i);
+- HELPER_LOG("%02x (%c)/%02x (%c) ", x, x, y, y);
+- if (x < y) {
+- cc = 1;
+- goto done;
+- } else if (x > y) {
+- cc = 2;
+- goto done;
+- }
+- }
+- cc = 0;
+- done:
+- HELPER_LOG("\n");
+- return cc;
+-}
+-
+-/* compare logical under mask */
+-uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+-{
+- uint8_t r, d;
+- uint32_t cc;
+-
+- HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%" PRIx64 "\n", __func__, r1,
+- mask, addr);
+- cc = 0;
+- while (mask) {
+- if (mask & 8) {
+- d = ldub(addr);
+- r = (r1 & 0xff000000UL) >> 24;
+- HELPER_LOG("mask 0x%x %02x/%02x (0x%" PRIx64 ") ", mask, r, d,
+- addr);
+- if (r < d) {
+- cc = 1;
+- break;
+- } else if (r > d) {
+- cc = 2;
+- break;
+- }
+- addr++;
+- }
+- mask = (mask << 1) & 0xf;
+- r1 <<= 8;
+- }
+- HELPER_LOG("\n");
+- return cc;
+-}
+-
+-/* store character under mask */
+-void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
+-{
+- uint8_t r;
+-
+- HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%lx\n", __func__, r1, mask,
+- addr);
+- while (mask) {
+- if (mask & 8) {
+- r = (r1 & 0xff000000UL) >> 24;
+- stb(addr, r);
+- HELPER_LOG("mask 0x%x %02x (0x%lx) ", mask, r, addr);
+- addr++;
+- }
+- mask = (mask << 1) & 0xf;
+- r1 <<= 8;
+- }
+- HELPER_LOG("\n");
+-}
+-
+-static inline uint64_t get_address(int x2, int b2, int d2)
+-{
+- uint64_t r = d2;
+-
+- if (x2) {
+- r += env->regs[x2];
+- }
+-
+- if (b2) {
+- r += env->regs[b2];
+- }
+-
+- /* 31-Bit mode */
+- if (!(env->psw.mask & PSW_MASK_64)) {
+- r &= 0x7fffffff;
+- }
+-
+- return r;
+-}
+-
+-static inline uint64_t get_address_31fix(int reg)
+-{
+- uint64_t r = env->regs[reg];
+-
+- /* 31-Bit mode */
+- if (!(env->psw.mask & PSW_MASK_64)) {
+- r &= 0x7fffffff;
+- }
+-
+- return r;
+-}
+-
+-/* search string (c is byte to search, r2 is string, r1 end of string) */
+-uint32_t HELPER(srst)(uint32_t c, uint32_t r1, uint32_t r2)
+-{
+- uint64_t i;
+- uint32_t cc = 2;
+- uint64_t str = get_address_31fix(r2);
+- uint64_t end = get_address_31fix(r1);
+-
+- HELPER_LOG("%s: c %d *r1 0x%" PRIx64 " *r2 0x%" PRIx64 "\n", __func__,
+- c, env->regs[r1], env->regs[r2]);
+-
+- for (i = str; i != end; i++) {
+- if (ldub(i) == c) {
+- env->regs[r1] = i;
+- cc = 1;
+- break;
+- }
+- }
+-
+- return cc;
+-}
+-
+-/* unsigned string compare (c is string terminator) */
+-uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
+-{
+- uint64_t s1 = get_address_31fix(r1);
+- uint64_t s2 = get_address_31fix(r2);
+- uint8_t v1, v2;
+- uint32_t cc;
+-
+- c = c & 0xff;
+-#ifdef CONFIG_USER_ONLY
+- if (!c) {
+- HELPER_LOG("%s: comparing '%s' and '%s'\n",
+- __func__, (char *)g2h(s1), (char *)g2h(s2));
+- }
+-#endif
+- for (;;) {
+- v1 = ldub(s1);
+- v2 = ldub(s2);
+- if ((v1 == c || v2 == c) || (v1 != v2)) {
+- break;
+- }
+- s1++;
+- s2++;
+- }
+-
+- if (v1 == v2) {
+- cc = 0;
+- } else {
+- cc = (v1 < v2) ? 1 : 2;
+- /* FIXME: 31-bit mode! */
+- env->regs[r1] = s1;
+- env->regs[r2] = s2;
+- }
+- return cc;
+-}
+-
+-/* move page */
+-void HELPER(mvpg)(uint64_t r0, uint64_t r1, uint64_t r2)
+-{
+- /* XXX missing r0 handling */
+-#ifdef CONFIG_USER_ONLY
+- int i;
+-
+- for (i = 0; i < TARGET_PAGE_SIZE; i++) {
+- stb(r1 + i, ldub(r2 + i));
+- }
+-#else
+- mvc_fast_memmove(env, TARGET_PAGE_SIZE, r1, r2);
+-#endif
+-}
+-
+-/* string copy (c is string terminator) */
+-void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
+-{
+- uint64_t dest = get_address_31fix(r1);
+- uint64_t src = get_address_31fix(r2);
+- uint8_t v;
+-
+- c = c & 0xff;
+-#ifdef CONFIG_USER_ONLY
+- if (!c) {
+- HELPER_LOG("%s: copy '%s' to 0x%lx\n", __func__, (char *)g2h(src),
+- dest);
+- }
+-#endif
+- for (;;) {
+- v = ldub(src);
+- stb(dest, v);
+- if (v == c) {
+- break;
+- }
+- src++;
+- dest++;
+- }
+- env->regs[r1] = dest; /* FIXME: 31-bit mode! */
+-}
+-
+-/* compare and swap 64-bit */
+-uint32_t HELPER(csg)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- /* FIXME: locking? */
+- uint32_t cc;
+- uint64_t v2 = ldq(a2);
+-
+- if (env->regs[r1] == v2) {
+- cc = 0;
+- stq(a2, env->regs[r3]);
+- } else {
+- cc = 1;
+- env->regs[r1] = v2;
+- }
+- return cc;
+-}
+-
+-/* compare double and swap 64-bit */
+-uint32_t HELPER(cdsg)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- /* FIXME: locking? */
+- uint32_t cc;
+- uint64_t v2_hi = ldq(a2);
+- uint64_t v2_lo = ldq(a2 + 8);
+- uint64_t v1_hi = env->regs[r1];
+- uint64_t v1_lo = env->regs[r1 + 1];
+-
+- if ((v1_hi == v2_hi) && (v1_lo == v2_lo)) {
+- cc = 0;
+- stq(a2, env->regs[r3]);
+- stq(a2 + 8, env->regs[r3 + 1]);
+- } else {
+- cc = 1;
+- env->regs[r1] = v2_hi;
+- env->regs[r1 + 1] = v2_lo;
+- }
+-
+- return cc;
+-}
+-
+-/* compare and swap 32-bit */
+-uint32_t HELPER(cs)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- /* FIXME: locking? */
+- uint32_t cc;
+- uint32_t v2 = ldl(a2);
+-
+- HELPER_LOG("%s: r1 %d a2 0x%lx r3 %d\n", __func__, r1, a2, r3);
+- if (((uint32_t)env->regs[r1]) == v2) {
+- cc = 0;
+- stl(a2, (uint32_t)env->regs[r3]);
+- } else {
+- cc = 1;
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | v2;
+- }
+- return cc;
+-}
+-
+-static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
+-{
+- int pos = 24; /* top of the lower half of r1 */
+- uint64_t rmask = 0xff000000ULL;
+- uint8_t val = 0;
+- int ccd = 0;
+- uint32_t cc = 0;
+-
+- while (mask) {
+- if (mask & 8) {
+- env->regs[r1] &= ~rmask;
+- val = ldub(address);
+- if ((val & 0x80) && !ccd) {
+- cc = 1;
+- }
+- ccd = 1;
+- if (val && cc == 0) {
+- cc = 2;
+- }
+- env->regs[r1] |= (uint64_t)val << pos;
+- address++;
+- }
+- mask = (mask << 1) & 0xf;
+- pos -= 8;
+- rmask >>= 8;
+- }
+-
+- return cc;
+-}
+-
+-/* execute instruction
+- this instruction executes an insn modified with the contents of r1
+- it does not change the executed instruction in memory
+- it does not change the program counter
+- in other words: tricky...
+- currently implemented by interpreting the cases it is most commonly used in
+-*/
+-uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+-{
+- uint16_t insn = lduw_code(addr);
+-
+- HELPER_LOG("%s: v1 0x%lx addr 0x%lx insn 0x%x\n", __func__, v1, addr,
+- insn);
+- if ((insn & 0xf0ff) == 0xd000) {
+- uint32_t l, insn2, b1, b2, d1, d2;
+-
+- l = v1 & 0xff;
+- insn2 = ldl_code(addr + 2);
+- b1 = (insn2 >> 28) & 0xf;
+- b2 = (insn2 >> 12) & 0xf;
+- d1 = (insn2 >> 16) & 0xfff;
+- d2 = insn2 & 0xfff;
+- switch (insn & 0xf00) {
+- case 0x200:
+- helper_mvc(l, get_address(0, b1, d1), get_address(0, b2, d2));
+- break;
+- case 0x500:
+- cc = helper_clc(l, get_address(0, b1, d1), get_address(0, b2, d2));
+- break;
+- case 0x700:
+- cc = helper_xc(l, get_address(0, b1, d1), get_address(0, b2, d2));
+- break;
+- case 0xc00:
+- helper_tr(l, get_address(0, b1, d1), get_address(0, b2, d2));
+- break;
+- default:
+- goto abort;
+- break;
+- }
+- } else if ((insn & 0xff00) == 0x0a00) {
+- /* supervisor call */
+- HELPER_LOG("%s: svc %ld via execute\n", __func__, (insn | v1) & 0xff);
+- env->psw.addr = ret - 4;
+- env->int_svc_code = (insn | v1) & 0xff;
+- env->int_svc_ilc = 4;
+- helper_exception(EXCP_SVC);
+- } else if ((insn & 0xff00) == 0xbf00) {
+- uint32_t insn2, r1, r3, b2, d2;
+-
+- insn2 = ldl_code(addr + 2);
+- r1 = (insn2 >> 20) & 0xf;
+- r3 = (insn2 >> 16) & 0xf;
+- b2 = (insn2 >> 12) & 0xf;
+- d2 = insn2 & 0xfff;
+- cc = helper_icm(r1, get_address(0, b2, d2), r3);
+- } else {
+- abort:
+- cpu_abort(env, "EXECUTE on instruction prefix 0x%x not implemented\n",
+- insn);
+- }
+- return cc;
+-}
+-
+-/* store character under mask high operates on the upper half of r1 */
+-void HELPER(stcmh)(uint32_t r1, uint64_t address, uint32_t mask)
+-{
+- int pos = 56; /* top of the upper half of r1 */
+-
+- while (mask) {
+- if (mask & 8) {
+- stb(address, (env->regs[r1] >> pos) & 0xff);
+- address++;
+- }
+- mask = (mask << 1) & 0xf;
+- pos -= 8;
+- }
+-}
+-
+-/* insert character under mask high; same as icm, but operates on the
+- upper half of r1 */
+-uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
+-{
+- int pos = 56; /* top of the upper half of r1 */
+- uint64_t rmask = 0xff00000000000000ULL;
+- uint8_t val = 0;
+- int ccd = 0;
+- uint32_t cc = 0;
+-
+- while (mask) {
+- if (mask & 8) {
+- env->regs[r1] &= ~rmask;
+- val = ldub(address);
+- if ((val & 0x80) && !ccd) {
+- cc = 1;
+- }
+- ccd = 1;
+- if (val && cc == 0) {
+- cc = 2;
+- }
+- env->regs[r1] |= (uint64_t)val << pos;
+- address++;
+- }
+- mask = (mask << 1) & 0xf;
+- pos -= 8;
+- rmask >>= 8;
+- }
+-
+- return cc;
+-}
+-
+-/* load access registers r1 to r3 from memory at a2 */
+-void HELPER(lam)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- env->aregs[i] = ldl(a2);
+- a2 += 4;
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-}
+-
+-/* store access registers r1 to r3 in memory at a2 */
+-void HELPER(stam)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- stl(a2, env->aregs[i]);
+- a2 += 4;
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-}
+-
+-/* move long */
+-uint32_t HELPER(mvcl)(uint32_t r1, uint32_t r2)
+-{
+- uint64_t destlen = env->regs[r1 + 1] & 0xffffff;
+- uint64_t dest = get_address_31fix(r1);
+- uint64_t srclen = env->regs[r2 + 1] & 0xffffff;
+- uint64_t src = get_address_31fix(r2);
+- uint8_t pad = src >> 24;
+- uint8_t v;
+- uint32_t cc;
+-
+- if (destlen == srclen) {
+- cc = 0;
+- } else if (destlen < srclen) {
+- cc = 1;
+- } else {
+- cc = 2;
+- }
+-
+- if (srclen > destlen) {
+- srclen = destlen;
+- }
+-
+- for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
+- v = ldub(src);
+- stb(dest, v);
+- }
+-
+- for (; destlen; dest++, destlen--) {
+- stb(dest, pad);
+- }
+-
+- env->regs[r1 + 1] = destlen;
+- /* can't use srclen here, we trunc'ed it */
+- env->regs[r2 + 1] -= src - env->regs[r2];
+- env->regs[r1] = dest;
+- env->regs[r2] = src;
+-
+- return cc;
+-}
+-
+-/* move long extended another memcopy insn with more bells and whistles */
+-uint32_t HELPER(mvcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- uint64_t destlen = env->regs[r1 + 1];
+- uint64_t dest = env->regs[r1];
+- uint64_t srclen = env->regs[r3 + 1];
+- uint64_t src = env->regs[r3];
+- uint8_t pad = a2 & 0xff;
+- uint8_t v;
+- uint32_t cc;
+-
+- if (!(env->psw.mask & PSW_MASK_64)) {
+- destlen = (uint32_t)destlen;
+- srclen = (uint32_t)srclen;
+- dest &= 0x7fffffff;
+- src &= 0x7fffffff;
+- }
+-
+- if (destlen == srclen) {
+- cc = 0;
+- } else if (destlen < srclen) {
+- cc = 1;
+- } else {
+- cc = 2;
+- }
+-
+- if (srclen > destlen) {
+- srclen = destlen;
+- }
+-
+- for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
+- v = ldub(src);
+- stb(dest, v);
+- }
+-
+- for (; destlen; dest++, destlen--) {
+- stb(dest, pad);
+- }
+-
+- env->regs[r1 + 1] = destlen;
+- /* can't use srclen here, we trunc'ed it */
+- /* FIXME: 31-bit mode! */
+- env->regs[r3 + 1] -= src - env->regs[r3];
+- env->regs[r1] = dest;
+- env->regs[r3] = src;
+-
+- return cc;
+-}
+-
+-/* compare logical long extended memcompare insn with padding */
+-uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- uint64_t destlen = env->regs[r1 + 1];
+- uint64_t dest = get_address_31fix(r1);
+- uint64_t srclen = env->regs[r3 + 1];
+- uint64_t src = get_address_31fix(r3);
+- uint8_t pad = a2 & 0xff;
+- uint8_t v1 = 0, v2 = 0;
+- uint32_t cc = 0;
+-
+- if (!(destlen || srclen)) {
+- return cc;
+- }
+-
+- if (srclen > destlen) {
+- srclen = destlen;
+- }
+-
+- for (; destlen || srclen; src++, dest++, destlen--, srclen--) {
+- v1 = srclen ? ldub(src) : pad;
+- v2 = destlen ? ldub(dest) : pad;
+- if (v1 != v2) {
+- cc = (v1 < v2) ? 1 : 2;
+- break;
+- }
+- }
+-
+- env->regs[r1 + 1] = destlen;
+- /* can't use srclen here, we trunc'ed it */
+- env->regs[r3 + 1] -= src - env->regs[r3];
+- env->regs[r1] = dest;
+- env->regs[r3] = src;
+-
+- return cc;
+-}
+-
+-/* checksum */
+-void HELPER(cksm)(uint32_t r1, uint32_t r2)
+-{
+- uint64_t src = get_address_31fix(r2);
+- uint64_t src_len = env->regs[(r2 + 1) & 15];
+- uint64_t cksm = (uint32_t)env->regs[r1];
+-
+- while (src_len >= 4) {
+- cksm += ldl(src);
+-
+- /* move to next word */
+- src_len -= 4;
+- src += 4;
+- }
+-
+- switch (src_len) {
+- case 0:
+- break;
+- case 1:
+- cksm += ldub(src) << 24;
+- break;
+- case 2:
+- cksm += lduw(src) << 16;
+- break;
+- case 3:
+- cksm += lduw(src) << 16;
+- cksm += ldub(src + 2) << 8;
+- break;
+- }
+-
+- /* indicate we've processed everything */
+- env->regs[r2] = src + src_len;
+- env->regs[(r2 + 1) & 15] = 0;
+-
+- /* store result */
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- ((uint32_t)cksm + (cksm >> 32));
+-}
+-
+-void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
+-{
+- int len_dest = len >> 4;
+- int len_src = len & 0xf;
+- uint8_t b;
+- int second_nibble = 0;
+-
+- dest += len_dest;
+- src += len_src;
+-
+- /* last byte is special, it only flips the nibbles */
+- b = ldub(src);
+- stb(dest, (b << 4) | (b >> 4));
+- src--;
+- len_src--;
+-
+- /* now pad every nibble with 0xf0 */
+-
+- while (len_dest > 0) {
+- uint8_t cur_byte = 0;
+-
+- if (len_src > 0) {
+- cur_byte = ldub(src);
+- }
+-
+- len_dest--;
+- dest--;
+-
+- /* only advance one nibble at a time */
+- if (second_nibble) {
+- cur_byte >>= 4;
+- len_src--;
+- src--;
+- }
+- second_nibble = !second_nibble;
+-
+- /* digit */
+- cur_byte = (cur_byte & 0xf);
+- /* zone bits */
+- cur_byte |= 0xf0;
+-
+- stb(dest, cur_byte);
+- }
+-}
+-
+-void HELPER(tr)(uint32_t len, uint64_t array, uint64_t trans)
+-{
+- int i;
+-
+- for (i = 0; i <= len; i++) {
+- uint8_t byte = ldub(array + i);
+- uint8_t new_byte = ldub(trans + byte);
+-
+- stb(array + i, new_byte);
+- }
+-}
+-
+-#ifndef CONFIG_USER_ONLY
+ void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
+ {
+ qemu_log("program interrupt at %#" PRIx64 "\n", env->psw.addr);
+@@ -1267,206 +384,6 @@ uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+ return cc;
+ }
+
+-void HELPER(lctlg)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+- uint64_t src = a2;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- env->cregs[i] = ldq(src);
+- HELPER_LOG("load ctl %d from 0x%" PRIx64 " == 0x%" PRIx64 "\n",
+- i, src, env->cregs[i]);
+- src += sizeof(uint64_t);
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-
+- tlb_flush(env, 1);
+-}
+-
+-void HELPER(lctl)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+- uint64_t src = a2;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- env->cregs[i] = (env->cregs[i] & 0xFFFFFFFF00000000ULL) | ldl(src);
+- src += sizeof(uint32_t);
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-
+- tlb_flush(env, 1);
+-}
+-
+-void HELPER(stctg)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+- uint64_t dest = a2;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- stq(dest, env->cregs[i]);
+- dest += sizeof(uint64_t);
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-}
+-
+-void HELPER(stctl)(uint32_t r1, uint64_t a2, uint32_t r3)
+-{
+- int i;
+- uint64_t dest = a2;
+-
+- for (i = r1;; i = (i + 1) % 16) {
+- stl(dest, env->cregs[i]);
+- dest += sizeof(uint32_t);
+-
+- if (i == r3) {
+- break;
+- }
+- }
+-}
+-
+-uint32_t HELPER(tprot)(uint64_t a1, uint64_t a2)
+-{
+- /* XXX implement */
+-
+- return 0;
+-}
+-
+-/* insert storage key extended */
+-uint64_t HELPER(iske)(uint64_t r2)
+-{
+- uint64_t addr = get_address(0, 0, r2);
+-
+- if (addr > ram_size) {
+- return 0;
+- }
+-
+- return env->storage_keys[addr / TARGET_PAGE_SIZE];
+-}
+-
+-/* set storage key extended */
+-void HELPER(sske)(uint32_t r1, uint64_t r2)
+-{
+- uint64_t addr = get_address(0, 0, r2);
+-
+- if (addr > ram_size) {
+- return;
+- }
+-
+- env->storage_keys[addr / TARGET_PAGE_SIZE] = r1;
+-}
+-
+-/* reset reference bit extended */
+-uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)
+-{
+- uint8_t re;
+- uint8_t key;
+-
+- if (r2 > ram_size) {
+- return 0;
+- }
+-
+- key = env->storage_keys[r2 / TARGET_PAGE_SIZE];
+- re = key & (SK_R | SK_C);
+- env->storage_keys[r2 / TARGET_PAGE_SIZE] = (key & ~SK_R);
+-
+- /*
+- * cc
+- *
+- * 0 Reference bit zero; change bit zero
+- * 1 Reference bit zero; change bit one
+- * 2 Reference bit one; change bit zero
+- * 3 Reference bit one; change bit one
+- */
+-
+- return re >> 1;
+-}
+-
+-/* compare and swap and purge */
+-uint32_t HELPER(csp)(uint32_t r1, uint32_t r2)
+-{
+- uint32_t cc;
+- uint32_t o1 = env->regs[r1];
+- uint64_t a2 = get_address_31fix(r2) & ~3ULL;
+- uint32_t o2 = ldl(a2);
+-
+- if (o1 == o2) {
+- stl(a2, env->regs[(r1 + 1) & 15]);
+- if (env->regs[r2] & 0x3) {
+- /* flush TLB / ALB */
+- tlb_flush(env, 1);
+- }
+- cc = 0;
+- } else {
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | o2;
+- cc = 1;
+- }
+-
+- return cc;
+-}
+-
+-static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
+- uint64_t mode2)
+-{
+- target_ulong src, dest;
+- int flags, cc = 0, i;
+-
+- if (!l) {
+- return 0;
+- } else if (l > 256) {
+- /* max 256 */
+- l = 256;
+- cc = 3;
+- }
+-
+- if (mmu_translate(env, a1 & TARGET_PAGE_MASK, 1, mode1, &dest, &flags)) {
+- cpu_loop_exit(env);
+- }
+- dest |= a1 & ~TARGET_PAGE_MASK;
+-
+- if (mmu_translate(env, a2 & TARGET_PAGE_MASK, 0, mode2, &src, &flags)) {
+- cpu_loop_exit(env);
+- }
+- src |= a2 & ~TARGET_PAGE_MASK;
+-
+- /* XXX replace w/ memcpy */
+- for (i = 0; i < l; i++) {
+- /* XXX be more clever */
+- if ((((dest + i) & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) ||
+- (((src + i) & TARGET_PAGE_MASK) != (src & TARGET_PAGE_MASK))) {
+- mvc_asc(l - i, a1 + i, mode1, a2 + i, mode2);
+- break;
+- }
+- stb_phys(dest + i, ldub_phys(src + i));
+- }
+-
+- return cc;
+-}
+-
+-uint32_t HELPER(mvcs)(uint64_t l, uint64_t a1, uint64_t a2)
+-{
+- HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+- __func__, l, a1, a2);
+-
+- return mvc_asc(l, a1, PSW_ASC_SECONDARY, a2, PSW_ASC_PRIMARY);
+-}
+-
+-uint32_t HELPER(mvcp)(uint64_t l, uint64_t a1, uint64_t a2)
+-{
+- HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+- __func__, l, a1, a2);
+-
+- return mvc_asc(l, a1, PSW_ASC_PRIMARY, a2, PSW_ASC_SECONDARY);
+-}
+-
+ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+ {
+ int cc = 0;
+@@ -1508,78 +425,4 @@ uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+
+ return cc;
+ }
+-
+-/* invalidate pte */
+-void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
+-{
+- uint64_t page = vaddr & TARGET_PAGE_MASK;
+- uint64_t pte = 0;
+-
+- /* XXX broadcast to other CPUs */
+-
+- /* XXX Linux is nice enough to give us the exact pte address.
+- According to spec we'd have to find it out ourselves */
+- /* XXX Linux is fine with overwriting the pte, the spec requires
+- us to only set the invalid bit */
+- stq_phys(pte_addr, pte | _PAGE_INVALID);
+-
+- /* XXX we exploit the fact that Linux passes the exact virtual
+- address here - it's not obliged to! */
+- tlb_flush_page(env, page);
+-
+- /* XXX 31-bit hack */
+- if (page & 0x80000000) {
+- tlb_flush_page(env, page & ~0x80000000);
+- } else {
+- tlb_flush_page(env, page | 0x80000000);
+- }
+-}
+-
+-/* flush local tlb */
+-void HELPER(ptlb)(void)
+-{
+- tlb_flush(env, 1);
+-}
+-
+-/* store using real address */
+-void HELPER(stura)(uint64_t addr, uint32_t v1)
+-{
+- stw_phys(get_address(0, 0, addr), v1);
+-}
+-
+-/* load real address */
+-uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
+-{
+- uint32_t cc = 0;
+- int old_exc = env->exception_index;
+- uint64_t asc = env->psw.mask & PSW_MASK_ASC;
+- uint64_t ret;
+- int flags;
+-
+- /* XXX incomplete - has more corner cases */
+- if (!(env->psw.mask & PSW_MASK_64) && (addr >> 32)) {
+- program_interrupt(env, PGM_SPECIAL_OP, 2);
+- }
+-
+- env->exception_index = old_exc;
+- if (mmu_translate(env, addr, 0, asc, &ret, &flags)) {
+- cc = 3;
+- }
+- if (env->exception_index == EXCP_PGM) {
+- ret = env->int_pgm_code | 0x80000000;
+- } else {
+- ret |= addr & ~TARGET_PAGE_MASK;
+- }
+- env->exception_index = old_exc;
+-
+- if (!(env->psw.mask & PSW_MASK_64)) {
+- env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+- (ret & 0xffffffffULL);
+- } else {
+- env->regs[r1] = ret;
+- }
+-
+- return cc;
+-}
+-
+ #endif
+--
+1.7.12.1
+
--- /dev/null
+From 56018228deac6e704a7ec8befd9e9dc69f2fe73f Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:35 +0000
+Subject: [PATCH] target-s390x: rename op_helper.c to misc_helper.c
+
+Now op_helper.c contains miscellaneous helpers, rename
+it to misc_helper.c.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+[agraf: fix conflict]
+Signed-off-by: Alexander Graf <agraf@suse.de>
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 6 +-
+ target-s390x/cpu.h | 2 +-
+ target-s390x/misc_helper.c | 428 +++++++++++++++++++++++++++++++++++++++++++++
+ target-s390x/op_helper.c | 428 ---------------------------------------------
+ 4 files changed, 432 insertions(+), 432 deletions(-)
+ create mode 100644 target-s390x/misc_helper.c
+ delete mode 100644 target-s390x/op_helper.c
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index b9b3061..a87d26f 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -1,10 +1,10 @@
+-obj-y += translate.o op_helper.o helper.o cpu.o interrupt.o
+-obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o
++obj-y += translate.o helper.o cpu.o interrupt.o
++obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/int_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
++$(obj)/misc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
+index 97fde5e..0ccb551 100644
+--- a/target-s390x/cpu.h
++++ b/target-s390x/cpu.h
+@@ -1005,7 +1005,7 @@ uint32_t set_cc_f64(float64 v1, float64 v2);
+ uint32_t set_cc_nz_f32(float32 v);
+ uint32_t set_cc_nz_f64(float64 v);
+
+-/* op_helper.c */
++/* misc_helper.c */
+ void program_interrupt(CPUS390XState *env, uint32_t code, int ilc);
+
+ #endif
+diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
+new file mode 100644
+index 0000000..1d5137f
+--- /dev/null
++++ b/target-s390x/misc_helper.c
+@@ -0,0 +1,428 @@
++/*
++ * S/390 misc helper routines
++ *
++ * Copyright (c) 2009 Ulrich Hecht
++ * Copyright (c) 2009 Alexander Graf
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "cpu.h"
++#include "memory.h"
++#include "cputlb.h"
++#include "dyngen-exec.h"
++#include "host-utils.h"
++#include "helper.h"
++#include <string.h>
++#include "kvm.h"
++#include "qemu-timer.h"
++#ifdef CONFIG_KVM
++#include <linux/kvm.h>
++#endif
++
++#if !defined(CONFIG_USER_ONLY)
++#include "softmmu_exec.h"
++#include "sysemu.h"
++#endif
++
++/* #define DEBUG_HELPER */
++#ifdef DEBUG_HELPER
++#define HELPER_LOG(x...) qemu_log(x)
++#else
++#define HELPER_LOG(x...)
++#endif
++
++/* raise an exception */
++void HELPER(exception)(uint32_t excp)
++{
++ HELPER_LOG("%s: exception %d\n", __func__, excp);
++ env->exception_index = excp;
++ cpu_loop_exit(env);
++}
++
++#ifndef CONFIG_USER_ONLY
++void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
++{
++ qemu_log("program interrupt at %#" PRIx64 "\n", env->psw.addr);
++
++ if (kvm_enabled()) {
++#ifdef CONFIG_KVM
++ kvm_s390_interrupt(env, KVM_S390_PROGRAM_INT, code);
++#endif
++ } else {
++ env->int_pgm_code = code;
++ env->int_pgm_ilc = ilc;
++ env->exception_index = EXCP_PGM;
++ cpu_loop_exit(env);
++ }
++}
++
++/*
++ * ret < 0 indicates program check, ret = 0, 1, 2, 3 -> cc
++ */
++int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)
++{
++ int r = 0;
++ int shift = 0;
++
++#ifdef DEBUG_HELPER
++ printf("sclp(0x%x, 0x%" PRIx64 ")\n", sccb, code);
++#endif
++
++ /* basic checks */
++ if (!memory_region_is_ram(phys_page_find(sccb >> TARGET_PAGE_BITS)->mr)) {
++ return -PGM_ADDRESSING;
++ }
++ if (sccb & ~0x7ffffff8ul) {
++ return -PGM_SPECIFICATION;
++ }
++
++ switch (code) {
++ case SCLP_CMDW_READ_SCP_INFO:
++ case SCLP_CMDW_READ_SCP_INFO_FORCED:
++ while ((ram_size >> (20 + shift)) > 65535) {
++ shift++;
++ }
++ stw_phys(sccb + SCP_MEM_CODE, ram_size >> (20 + shift));
++ stb_phys(sccb + SCP_INCREMENT, 1 << shift);
++ stw_phys(sccb + SCP_RESPONSE_CODE, 0x10);
++
++ s390_sclp_extint(sccb & ~3);
++ break;
++ default:
++#ifdef DEBUG_HELPER
++ printf("KVM: invalid sclp call 0x%x / 0x%" PRIx64 "x\n", sccb, code);
++#endif
++ r = 3;
++ break;
++ }
++
++ return r;
++}
++
++/* SCLP service call */
++uint32_t HELPER(servc)(uint32_t r1, uint64_t r2)
++{
++ int r;
++
++ r = sclp_service_call(env, r1, r2);
++ if (r < 0) {
++ program_interrupt(env, -r, 4);
++ return 0;
++ }
++ return r;
++}
++
++/* DIAG */
++uint64_t HELPER(diag)(uint32_t num, uint64_t mem, uint64_t code)
++{
++ uint64_t r;
++
++ switch (num) {
++ case 0x500:
++ /* KVM hypercall */
++ r = s390_virtio_hypercall(env, mem, code);
++ break;
++ case 0x44:
++ /* yield */
++ r = 0;
++ break;
++ case 0x308:
++ /* ipl */
++ r = 0;
++ break;
++ default:
++ r = -1;
++ break;
++ }
++
++ if (r) {
++ program_interrupt(env, PGM_OPERATION, ILC_LATER_INC);
++ }
++
++ return r;
++}
++
++/* Store CPU ID */
++void HELPER(stidp)(uint64_t a1)
++{
++ stq(a1, env->cpu_num);
++}
++
++/* Set Prefix */
++void HELPER(spx)(uint64_t a1)
++{
++ uint32_t prefix;
++
++ prefix = ldl(a1);
++ env->psa = prefix & 0xfffff000;
++ qemu_log("prefix: %#x\n", prefix);
++ tlb_flush_page(env, 0);
++ tlb_flush_page(env, TARGET_PAGE_SIZE);
++}
++
++/* Set Clock */
++uint32_t HELPER(sck)(uint64_t a1)
++{
++ /* XXX not implemented - is it necessary? */
++
++ return 0;
++}
++
++static inline uint64_t clock_value(CPUS390XState *env)
++{
++ uint64_t time;
++
++ time = env->tod_offset +
++ time2tod(qemu_get_clock_ns(vm_clock) - env->tod_basetime);
++
++ return time;
++}
++
++/* Store Clock */
++uint32_t HELPER(stck)(uint64_t a1)
++{
++ stq(a1, clock_value(env));
++
++ return 0;
++}
++
++/* Store Clock Extended */
++uint32_t HELPER(stcke)(uint64_t a1)
++{
++ stb(a1, 0);
++ /* basically the same value as stck */
++ stq(a1 + 1, clock_value(env) | env->cpu_num);
++ /* more fine grained than stck */
++ stq(a1 + 9, 0);
++ /* XXX programmable fields */
++ stw(a1 + 17, 0);
++
++ return 0;
++}
++
++/* Set Clock Comparator */
++void HELPER(sckc)(uint64_t a1)
++{
++ uint64_t time = ldq(a1);
++
++ if (time == -1ULL) {
++ return;
++ }
++
++ /* difference between now and then */
++ time -= clock_value(env);
++ /* nanoseconds */
++ time = (time * 125) >> 9;
++
++ qemu_mod_timer(env->tod_timer, qemu_get_clock_ns(vm_clock) + time);
++}
++
++/* Store Clock Comparator */
++void HELPER(stckc)(uint64_t a1)
++{
++ /* XXX implement */
++ stq(a1, 0);
++}
++
++/* Set CPU Timer */
++void HELPER(spt)(uint64_t a1)
++{
++ uint64_t time = ldq(a1);
++
++ if (time == -1ULL) {
++ return;
++ }
++
++ /* nanoseconds */
++ time = (time * 125) >> 9;
++
++ qemu_mod_timer(env->cpu_timer, qemu_get_clock_ns(vm_clock) + time);
++}
++
++/* Store CPU Timer */
++void HELPER(stpt)(uint64_t a1)
++{
++ /* XXX implement */
++ stq(a1, 0);
++}
++
++/* Store System Information */
++uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
++{
++ int cc = 0;
++ int sel1, sel2;
++
++ if ((r0 & STSI_LEVEL_MASK) <= STSI_LEVEL_3 &&
++ ((r0 & STSI_R0_RESERVED_MASK) || (r1 & STSI_R1_RESERVED_MASK))) {
++ /* valid function code, invalid reserved bits */
++ program_interrupt(env, PGM_SPECIFICATION, 2);
++ }
++
++ sel1 = r0 & STSI_R0_SEL1_MASK;
++ sel2 = r1 & STSI_R1_SEL2_MASK;
++
++ /* XXX: spec exception if sysib is not 4k-aligned */
++
++ switch (r0 & STSI_LEVEL_MASK) {
++ case STSI_LEVEL_1:
++ if ((sel1 == 1) && (sel2 == 1)) {
++ /* Basic Machine Configuration */
++ struct sysib_111 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ ebcdic_put(sysib.manuf, "QEMU ", 16);
++ /* same as machine type number in STORE CPU ID */
++ ebcdic_put(sysib.type, "QEMU", 4);
++ /* same as model number in STORE CPU ID */
++ ebcdic_put(sysib.model, "QEMU ", 16);
++ ebcdic_put(sysib.sequence, "QEMU ", 16);
++ ebcdic_put(sysib.plant, "QEMU", 4);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else if ((sel1 == 2) && (sel2 == 1)) {
++ /* Basic Machine CPU */
++ struct sysib_121 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ /* XXX make different for different CPUs? */
++ ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
++ ebcdic_put(sysib.plant, "QEMU", 4);
++ stw_p(&sysib.cpu_addr, env->cpu_num);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else if ((sel1 == 2) && (sel2 == 2)) {
++ /* Basic Machine CPUs */
++ struct sysib_122 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ stl_p(&sysib.capability, 0x443afc29);
++ /* XXX change when SMP comes */
++ stw_p(&sysib.total_cpus, 1);
++ stw_p(&sysib.active_cpus, 1);
++ stw_p(&sysib.standby_cpus, 0);
++ stw_p(&sysib.reserved_cpus, 0);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else {
++ cc = 3;
++ }
++ break;
++ case STSI_LEVEL_2:
++ {
++ if ((sel1 == 2) && (sel2 == 1)) {
++ /* LPAR CPU */
++ struct sysib_221 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ /* XXX make different for different CPUs? */
++ ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
++ ebcdic_put(sysib.plant, "QEMU", 4);
++ stw_p(&sysib.cpu_addr, env->cpu_num);
++ stw_p(&sysib.cpu_id, 0);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else if ((sel1 == 2) && (sel2 == 2)) {
++ /* LPAR CPUs */
++ struct sysib_222 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ stw_p(&sysib.lpar_num, 0);
++ sysib.lcpuc = 0;
++ /* XXX change when SMP comes */
++ stw_p(&sysib.total_cpus, 1);
++ stw_p(&sysib.conf_cpus, 1);
++ stw_p(&sysib.standby_cpus, 0);
++ stw_p(&sysib.reserved_cpus, 0);
++ ebcdic_put(sysib.name, "QEMU ", 8);
++ stl_p(&sysib.caf, 1000);
++ stw_p(&sysib.dedicated_cpus, 0);
++ stw_p(&sysib.shared_cpus, 0);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else {
++ cc = 3;
++ }
++ break;
++ }
++ case STSI_LEVEL_3:
++ {
++ if ((sel1 == 2) && (sel2 == 2)) {
++ /* VM CPUs */
++ struct sysib_322 sysib;
++
++ memset(&sysib, 0, sizeof(sysib));
++ sysib.count = 1;
++ /* XXX change when SMP comes */
++ stw_p(&sysib.vm[0].total_cpus, 1);
++ stw_p(&sysib.vm[0].conf_cpus, 1);
++ stw_p(&sysib.vm[0].standby_cpus, 0);
++ stw_p(&sysib.vm[0].reserved_cpus, 0);
++ ebcdic_put(sysib.vm[0].name, "KVMguest", 8);
++ stl_p(&sysib.vm[0].caf, 1000);
++ ebcdic_put(sysib.vm[0].cpi, "KVM/Linux ", 16);
++ cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
++ } else {
++ cc = 3;
++ }
++ break;
++ }
++ case STSI_LEVEL_CURRENT:
++ env->regs[0] = STSI_LEVEL_3;
++ break;
++ default:
++ cc = 3;
++ break;
++ }
++
++ return cc;
++}
++
++uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
++{
++ int cc = 0;
++
++ HELPER_LOG("%s: %016" PRIx64 " %08x %016" PRIx64 "\n",
++ __func__, order_code, r1, cpu_addr);
++
++ /* Remember: Use "R1 or R1 + 1, whichever is the odd-numbered register"
++ as parameter (input). Status (output) is always R1. */
++
++ switch (order_code) {
++ case SIGP_SET_ARCH:
++ /* switch arch */
++ break;
++ case SIGP_SENSE:
++ /* enumerate CPU status */
++ if (cpu_addr) {
++ /* XXX implement when SMP comes */
++ return 3;
++ }
++ env->regs[r1] &= 0xffffffff00000000ULL;
++ cc = 1;
++ break;
++#if !defined(CONFIG_USER_ONLY)
++ case SIGP_RESTART:
++ qemu_system_reset_request();
++ cpu_loop_exit(env);
++ break;
++ case SIGP_STOP:
++ qemu_system_shutdown_request();
++ cpu_loop_exit(env);
++ break;
++#endif
++ default:
++ /* unknown sigp */
++ fprintf(stderr, "XXX unknown sigp: 0x%" PRIx64 "\n", order_code);
++ cc = 3;
++ }
++
++ return cc;
++}
++#endif
+diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
+deleted file mode 100644
+index bb8dbf5..0000000
+--- a/target-s390x/op_helper.c
++++ /dev/null
+@@ -1,428 +0,0 @@
+-/*
+- * S/390 helper routines
+- *
+- * Copyright (c) 2009 Ulrich Hecht
+- * Copyright (c) 2009 Alexander Graf
+- *
+- * This library is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU Lesser General Public
+- * License as published by the Free Software Foundation; either
+- * version 2 of the License, or (at your option) any later version.
+- *
+- * This library is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * Lesser General Public License for more details.
+- *
+- * You should have received a copy of the GNU Lesser General Public
+- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+- */
+-
+-#include "cpu.h"
+-#include "memory.h"
+-#include "cputlb.h"
+-#include "dyngen-exec.h"
+-#include "host-utils.h"
+-#include "helper.h"
+-#include <string.h>
+-#include "kvm.h"
+-#include "qemu-timer.h"
+-#ifdef CONFIG_KVM
+-#include <linux/kvm.h>
+-#endif
+-
+-#if !defined(CONFIG_USER_ONLY)
+-#include "softmmu_exec.h"
+-#include "sysemu.h"
+-#endif
+-
+-/* #define DEBUG_HELPER */
+-#ifdef DEBUG_HELPER
+-#define HELPER_LOG(x...) qemu_log(x)
+-#else
+-#define HELPER_LOG(x...)
+-#endif
+-
+-/* raise an exception */
+-void HELPER(exception)(uint32_t excp)
+-{
+- HELPER_LOG("%s: exception %d\n", __func__, excp);
+- env->exception_index = excp;
+- cpu_loop_exit(env);
+-}
+-
+-#ifndef CONFIG_USER_ONLY
+-void program_interrupt(CPUS390XState *env, uint32_t code, int ilc)
+-{
+- qemu_log("program interrupt at %#" PRIx64 "\n", env->psw.addr);
+-
+- if (kvm_enabled()) {
+-#ifdef CONFIG_KVM
+- kvm_s390_interrupt(env, KVM_S390_PROGRAM_INT, code);
+-#endif
+- } else {
+- env->int_pgm_code = code;
+- env->int_pgm_ilc = ilc;
+- env->exception_index = EXCP_PGM;
+- cpu_loop_exit(env);
+- }
+-}
+-
+-/*
+- * ret < 0 indicates program check, ret = 0, 1, 2, 3 -> cc
+- */
+-int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)
+-{
+- int r = 0;
+- int shift = 0;
+-
+-#ifdef DEBUG_HELPER
+- printf("sclp(0x%x, 0x%" PRIx64 ")\n", sccb, code);
+-#endif
+-
+- /* basic checks */
+- if (!memory_region_is_ram(phys_page_find(sccb >> TARGET_PAGE_BITS)->mr)) {
+- return -PGM_ADDRESSING;
+- }
+- if (sccb & ~0x7ffffff8ul) {
+- return -PGM_SPECIFICATION;
+- }
+-
+- switch (code) {
+- case SCLP_CMDW_READ_SCP_INFO:
+- case SCLP_CMDW_READ_SCP_INFO_FORCED:
+- while ((ram_size >> (20 + shift)) > 65535) {
+- shift++;
+- }
+- stw_phys(sccb + SCP_MEM_CODE, ram_size >> (20 + shift));
+- stb_phys(sccb + SCP_INCREMENT, 1 << shift);
+- stw_phys(sccb + SCP_RESPONSE_CODE, 0x10);
+-
+- s390_sclp_extint(sccb & ~3);
+- break;
+- default:
+-#ifdef DEBUG_HELPER
+- printf("KVM: invalid sclp call 0x%x / 0x%" PRIx64 "x\n", sccb, code);
+-#endif
+- r = 3;
+- break;
+- }
+-
+- return r;
+-}
+-
+-/* SCLP service call */
+-uint32_t HELPER(servc)(uint32_t r1, uint64_t r2)
+-{
+- int r;
+-
+- r = sclp_service_call(env, r1, r2);
+- if (r < 0) {
+- program_interrupt(env, -r, 4);
+- return 0;
+- }
+- return r;
+-}
+-
+-/* DIAG */
+-uint64_t HELPER(diag)(uint32_t num, uint64_t mem, uint64_t code)
+-{
+- uint64_t r;
+-
+- switch (num) {
+- case 0x500:
+- /* KVM hypercall */
+- r = s390_virtio_hypercall(env, mem, code);
+- break;
+- case 0x44:
+- /* yield */
+- r = 0;
+- break;
+- case 0x308:
+- /* ipl */
+- r = 0;
+- break;
+- default:
+- r = -1;
+- break;
+- }
+-
+- if (r) {
+- program_interrupt(env, PGM_OPERATION, ILC_LATER_INC);
+- }
+-
+- return r;
+-}
+-
+-/* Store CPU ID */
+-void HELPER(stidp)(uint64_t a1)
+-{
+- stq(a1, env->cpu_num);
+-}
+-
+-/* Set Prefix */
+-void HELPER(spx)(uint64_t a1)
+-{
+- uint32_t prefix;
+-
+- prefix = ldl(a1);
+- env->psa = prefix & 0xfffff000;
+- qemu_log("prefix: %#x\n", prefix);
+- tlb_flush_page(env, 0);
+- tlb_flush_page(env, TARGET_PAGE_SIZE);
+-}
+-
+-/* Set Clock */
+-uint32_t HELPER(sck)(uint64_t a1)
+-{
+- /* XXX not implemented - is it necessary? */
+-
+- return 0;
+-}
+-
+-static inline uint64_t clock_value(CPUS390XState *env)
+-{
+- uint64_t time;
+-
+- time = env->tod_offset +
+- time2tod(qemu_get_clock_ns(vm_clock) - env->tod_basetime);
+-
+- return time;
+-}
+-
+-/* Store Clock */
+-uint32_t HELPER(stck)(uint64_t a1)
+-{
+- stq(a1, clock_value(env));
+-
+- return 0;
+-}
+-
+-/* Store Clock Extended */
+-uint32_t HELPER(stcke)(uint64_t a1)
+-{
+- stb(a1, 0);
+- /* basically the same value as stck */
+- stq(a1 + 1, clock_value(env) | env->cpu_num);
+- /* more fine grained than stck */
+- stq(a1 + 9, 0);
+- /* XXX programmable fields */
+- stw(a1 + 17, 0);
+-
+- return 0;
+-}
+-
+-/* Set Clock Comparator */
+-void HELPER(sckc)(uint64_t a1)
+-{
+- uint64_t time = ldq(a1);
+-
+- if (time == -1ULL) {
+- return;
+- }
+-
+- /* difference between now and then */
+- time -= clock_value(env);
+- /* nanoseconds */
+- time = (time * 125) >> 9;
+-
+- qemu_mod_timer(env->tod_timer, qemu_get_clock_ns(vm_clock) + time);
+-}
+-
+-/* Store Clock Comparator */
+-void HELPER(stckc)(uint64_t a1)
+-{
+- /* XXX implement */
+- stq(a1, 0);
+-}
+-
+-/* Set CPU Timer */
+-void HELPER(spt)(uint64_t a1)
+-{
+- uint64_t time = ldq(a1);
+-
+- if (time == -1ULL) {
+- return;
+- }
+-
+- /* nanoseconds */
+- time = (time * 125) >> 9;
+-
+- qemu_mod_timer(env->cpu_timer, qemu_get_clock_ns(vm_clock) + time);
+-}
+-
+-/* Store CPU Timer */
+-void HELPER(stpt)(uint64_t a1)
+-{
+- /* XXX implement */
+- stq(a1, 0);
+-}
+-
+-/* Store System Information */
+-uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+-{
+- int cc = 0;
+- int sel1, sel2;
+-
+- if ((r0 & STSI_LEVEL_MASK) <= STSI_LEVEL_3 &&
+- ((r0 & STSI_R0_RESERVED_MASK) || (r1 & STSI_R1_RESERVED_MASK))) {
+- /* valid function code, invalid reserved bits */
+- program_interrupt(env, PGM_SPECIFICATION, 2);
+- }
+-
+- sel1 = r0 & STSI_R0_SEL1_MASK;
+- sel2 = r1 & STSI_R1_SEL2_MASK;
+-
+- /* XXX: spec exception if sysib is not 4k-aligned */
+-
+- switch (r0 & STSI_LEVEL_MASK) {
+- case STSI_LEVEL_1:
+- if ((sel1 == 1) && (sel2 == 1)) {
+- /* Basic Machine Configuration */
+- struct sysib_111 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- ebcdic_put(sysib.manuf, "QEMU ", 16);
+- /* same as machine type number in STORE CPU ID */
+- ebcdic_put(sysib.type, "QEMU", 4);
+- /* same as model number in STORE CPU ID */
+- ebcdic_put(sysib.model, "QEMU ", 16);
+- ebcdic_put(sysib.sequence, "QEMU ", 16);
+- ebcdic_put(sysib.plant, "QEMU", 4);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else if ((sel1 == 2) && (sel2 == 1)) {
+- /* Basic Machine CPU */
+- struct sysib_121 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- /* XXX make different for different CPUs? */
+- ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
+- ebcdic_put(sysib.plant, "QEMU", 4);
+- stw_p(&sysib.cpu_addr, env->cpu_num);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else if ((sel1 == 2) && (sel2 == 2)) {
+- /* Basic Machine CPUs */
+- struct sysib_122 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- stl_p(&sysib.capability, 0x443afc29);
+- /* XXX change when SMP comes */
+- stw_p(&sysib.total_cpus, 1);
+- stw_p(&sysib.active_cpus, 1);
+- stw_p(&sysib.standby_cpus, 0);
+- stw_p(&sysib.reserved_cpus, 0);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else {
+- cc = 3;
+- }
+- break;
+- case STSI_LEVEL_2:
+- {
+- if ((sel1 == 2) && (sel2 == 1)) {
+- /* LPAR CPU */
+- struct sysib_221 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- /* XXX make different for different CPUs? */
+- ebcdic_put(sysib.sequence, "QEMUQEMUQEMUQEMU", 16);
+- ebcdic_put(sysib.plant, "QEMU", 4);
+- stw_p(&sysib.cpu_addr, env->cpu_num);
+- stw_p(&sysib.cpu_id, 0);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else if ((sel1 == 2) && (sel2 == 2)) {
+- /* LPAR CPUs */
+- struct sysib_222 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- stw_p(&sysib.lpar_num, 0);
+- sysib.lcpuc = 0;
+- /* XXX change when SMP comes */
+- stw_p(&sysib.total_cpus, 1);
+- stw_p(&sysib.conf_cpus, 1);
+- stw_p(&sysib.standby_cpus, 0);
+- stw_p(&sysib.reserved_cpus, 0);
+- ebcdic_put(sysib.name, "QEMU ", 8);
+- stl_p(&sysib.caf, 1000);
+- stw_p(&sysib.dedicated_cpus, 0);
+- stw_p(&sysib.shared_cpus, 0);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else {
+- cc = 3;
+- }
+- break;
+- }
+- case STSI_LEVEL_3:
+- {
+- if ((sel1 == 2) && (sel2 == 2)) {
+- /* VM CPUs */
+- struct sysib_322 sysib;
+-
+- memset(&sysib, 0, sizeof(sysib));
+- sysib.count = 1;
+- /* XXX change when SMP comes */
+- stw_p(&sysib.vm[0].total_cpus, 1);
+- stw_p(&sysib.vm[0].conf_cpus, 1);
+- stw_p(&sysib.vm[0].standby_cpus, 0);
+- stw_p(&sysib.vm[0].reserved_cpus, 0);
+- ebcdic_put(sysib.vm[0].name, "KVMguest", 8);
+- stl_p(&sysib.vm[0].caf, 1000);
+- ebcdic_put(sysib.vm[0].cpi, "KVM/Linux ", 16);
+- cpu_physical_memory_rw(a0, (uint8_t *)&sysib, sizeof(sysib), 1);
+- } else {
+- cc = 3;
+- }
+- break;
+- }
+- case STSI_LEVEL_CURRENT:
+- env->regs[0] = STSI_LEVEL_3;
+- break;
+- default:
+- cc = 3;
+- break;
+- }
+-
+- return cc;
+-}
+-
+-uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
+-{
+- int cc = 0;
+-
+- HELPER_LOG("%s: %016" PRIx64 " %08x %016" PRIx64 "\n",
+- __func__, order_code, r1, cpu_addr);
+-
+- /* Remember: Use "R1 or R1 + 1, whichever is the odd-numbered register"
+- as parameter (input). Status (output) is always R1. */
+-
+- switch (order_code) {
+- case SIGP_SET_ARCH:
+- /* switch arch */
+- break;
+- case SIGP_SENSE:
+- /* enumerate CPU status */
+- if (cpu_addr) {
+- /* XXX implement when SMP comes */
+- return 3;
+- }
+- env->regs[r1] &= 0xffffffff00000000ULL;
+- cc = 1;
+- break;
+-#if !defined(CONFIG_USER_ONLY)
+- case SIGP_RESTART:
+- qemu_system_reset_request();
+- cpu_loop_exit(env);
+- break;
+- case SIGP_STOP:
+- qemu_system_shutdown_request();
+- cpu_loop_exit(env);
+- break;
+-#endif
+- default:
+- /* unknown sigp */
+- fprintf(stderr, "XXX unknown sigp: 0x%" PRIx64 "\n", order_code);
+- cc = 3;
+- }
+-
+- return cc;
+-}
+-#endif
+--
+1.7.12.1
+
--- /dev/null
+From 5d38110b1e23c963302f13f5917001a9298445a7 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:36 +0000
+Subject: [PATCH] target-s390x: avoid AREG0 for FPU helpers
+
+Make FPU helpers take a parameter for CPUState instead
+of relying on global env.
+
+Introduce temporary wrappers for FPU load and store ops.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 1 -
+ target-s390x/cc_helper.c | 4 +-
+ target-s390x/cpu.h | 14 +++-
+ target-s390x/fpu_helper.c | 184 +++++++++++++++++++++++----------------------
+ target-s390x/helper.h | 126 +++++++++++++++----------------
+ target-s390x/mem_helper.c | 49 ++++++++++++
+ target-s390x/translate.c | 70 ++++++++---------
+ 7 files changed, 257 insertions(+), 191 deletions(-)
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index a87d26f..7d965e9 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -4,7 +4,6 @@ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+ $(obj)/int_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+-$(obj)/fpu_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/misc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cc_helper.c b/target-s390x/cc_helper.c
+index 2ac1659..9c3a2c4 100644
+--- a/target-s390x/cc_helper.c
++++ b/target-s390x/cc_helper.c
+@@ -473,10 +473,10 @@ static inline uint32_t do_calc_cc(CPUS390XState *env, uint32_t cc_op,
+ break;
+
+ case CC_OP_LTGT_F32:
+- r = set_cc_f32(src, dst);
++ r = set_cc_f32(env, src, dst);
+ break;
+ case CC_OP_LTGT_F64:
+- r = set_cc_f64(src, dst);
++ r = set_cc_f64(env, src, dst);
+ break;
+ case CC_OP_NZ_F32:
+ r = set_cc_nz_f32(dst);
+diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
+index 0ccb551..9b7a2e3 100644
+--- a/target-s390x/cpu.h
++++ b/target-s390x/cpu.h
+@@ -1000,12 +1000,22 @@ static inline void cpu_pc_from_tb(CPUS390XState *env, TranslationBlock* tb)
+ }
+
+ /* fpu_helper.c */
+-uint32_t set_cc_f32(float32 v1, float32 v2);
+-uint32_t set_cc_f64(float64 v1, float64 v2);
++uint32_t set_cc_f32(CPUS390XState *env, float32 v1, float32 v2);
++uint32_t set_cc_f64(CPUS390XState *env, float64 v1, float64 v2);
+ uint32_t set_cc_nz_f32(float32 v);
+ uint32_t set_cc_nz_f64(float64 v);
+
+ /* misc_helper.c */
+ void program_interrupt(CPUS390XState *env, uint32_t code, int ilc);
+
++/* temporary wrappers */
++uint32_t cpu_ldub_data(CPUS390XState *env, target_ulong ptr);
++uint32_t cpu_lduw_data(CPUS390XState *env, target_ulong ptr);
++uint32_t cpu_ldl_data(CPUS390XState *env, target_ulong ptr);
++uint64_t cpu_ldq_data(CPUS390XState *env, target_ulong ptr);
++
++void cpu_stb_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
++void cpu_stw_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
++void cpu_stl_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
++void cpu_stq_data(CPUS390XState *env, target_ulong ptr, uint64_t data);
+ #endif
+diff --git a/target-s390x/fpu_helper.c b/target-s390x/fpu_helper.c
+index 1389052..e235419 100644
+--- a/target-s390x/fpu_helper.c
++++ b/target-s390x/fpu_helper.c
+@@ -19,10 +19,10 @@
+ */
+
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+-#if !defined(CONFIG_USER_ONLY)
++/* temporarily disabled due to wrapper use */
++#if 0 && !defined(CONFIG_USER_ONLY)
+ #include "softmmu_exec.h"
+ #endif
+
+@@ -33,7 +33,7 @@
+ #define HELPER_LOG(x...)
+ #endif
+
+-static inline int float_comp_to_cc(int float_compare)
++static inline int float_comp_to_cc(CPUS390XState *env, int float_compare)
+ {
+ switch (float_compare) {
+ case float_relation_equal:
+@@ -50,14 +50,16 @@ static inline int float_comp_to_cc(int float_compare)
+ }
+
+ /* condition codes for binary FP ops */
+-uint32_t set_cc_f32(float32 v1, float32 v2)
++uint32_t set_cc_f32(CPUS390XState *env, float32 v1, float32 v2)
+ {
+- return float_comp_to_cc(float32_compare_quiet(v1, v2, &env->fpu_status));
++ return float_comp_to_cc(env, float32_compare_quiet(v1, v2,
++ &env->fpu_status));
+ }
+
+-uint32_t set_cc_f64(float64 v1, float64 v2)
++uint32_t set_cc_f64(CPUS390XState *env, float64 v1, float64 v2)
+ {
+- return float_comp_to_cc(float64_compare_quiet(v1, v2, &env->fpu_status));
++ return float_comp_to_cc(env, float64_compare_quiet(v1, v2,
++ &env->fpu_status));
+ }
+
+ /* condition codes for unary FP ops */
+@@ -101,14 +103,14 @@ static uint32_t set_cc_nz_f128(float128 v)
+ }
+
+ /* convert 32-bit int to 64-bit float */
+-void HELPER(cdfbr)(uint32_t f1, int32_t v2)
++void HELPER(cdfbr)(CPUS390XState *env, uint32_t f1, int32_t v2)
+ {
+ HELPER_LOG("%s: converting %d to f%d\n", __func__, v2, f1);
+ env->fregs[f1].d = int32_to_float64(v2, &env->fpu_status);
+ }
+
+ /* convert 32-bit int to 128-bit float */
+-void HELPER(cxfbr)(uint32_t f1, int32_t v2)
++void HELPER(cxfbr)(CPUS390XState *env, uint32_t f1, int32_t v2)
+ {
+ CPU_QuadU v1;
+
+@@ -118,21 +120,21 @@ void HELPER(cxfbr)(uint32_t f1, int32_t v2)
+ }
+
+ /* convert 64-bit int to 32-bit float */
+-void HELPER(cegbr)(uint32_t f1, int64_t v2)
++void HELPER(cegbr)(CPUS390XState *env, uint32_t f1, int64_t v2)
+ {
+ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+ env->fregs[f1].l.upper = int64_to_float32(v2, &env->fpu_status);
+ }
+
+ /* convert 64-bit int to 64-bit float */
+-void HELPER(cdgbr)(uint32_t f1, int64_t v2)
++void HELPER(cdgbr)(CPUS390XState *env, uint32_t f1, int64_t v2)
+ {
+ HELPER_LOG("%s: converting %ld to f%d\n", __func__, v2, f1);
+ env->fregs[f1].d = int64_to_float64(v2, &env->fpu_status);
+ }
+
+ /* convert 64-bit int to 128-bit float */
+-void HELPER(cxgbr)(uint32_t f1, int64_t v2)
++void HELPER(cxgbr)(CPUS390XState *env, uint32_t f1, int64_t v2)
+ {
+ CPU_QuadU x1;
+
+@@ -144,7 +146,7 @@ void HELPER(cxgbr)(uint32_t f1, int64_t v2)
+ }
+
+ /* convert 32-bit int to 32-bit float */
+-void HELPER(cefbr)(uint32_t f1, int32_t v2)
++void HELPER(cefbr)(CPUS390XState *env, uint32_t f1, int32_t v2)
+ {
+ env->fregs[f1].l.upper = int32_to_float32(v2, &env->fpu_status);
+ HELPER_LOG("%s: converting %d to 0x%d in f%d\n", __func__, v2,
+@@ -152,7 +154,7 @@ void HELPER(cefbr)(uint32_t f1, int32_t v2)
+ }
+
+ /* 32-bit FP addition RR */
+-uint32_t HELPER(aebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(aebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+@@ -164,7 +166,7 @@ uint32_t HELPER(aebr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 64-bit FP addition RR */
+-uint32_t HELPER(adbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(adbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_add(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+@@ -175,7 +177,7 @@ uint32_t HELPER(adbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 32-bit FP subtraction RR */
+-uint32_t HELPER(sebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(sebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_sub(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+@@ -187,7 +189,7 @@ uint32_t HELPER(sebr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 64-bit FP subtraction RR */
+-uint32_t HELPER(sdbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(sdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_sub(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+@@ -198,7 +200,7 @@ uint32_t HELPER(sdbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 32-bit FP division RR */
+-void HELPER(debr)(uint32_t f1, uint32_t f2)
++void HELPER(debr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_div(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+@@ -206,7 +208,7 @@ void HELPER(debr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 128-bit FP division RR */
+-void HELPER(dxbr)(uint32_t f1, uint32_t f2)
++void HELPER(dxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -222,14 +224,14 @@ void HELPER(dxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 64-bit FP multiplication RR */
+-void HELPER(mdbr)(uint32_t f1, uint32_t f2)
++void HELPER(mdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_mul(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+ }
+
+ /* 128-bit FP multiplication RR */
+-void HELPER(mxbr)(uint32_t f1, uint32_t f2)
++void HELPER(mxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -245,14 +247,14 @@ void HELPER(mxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* convert 32-bit float to 64-bit float */
+-void HELPER(ldebr)(uint32_t r1, uint32_t r2)
++void HELPER(ldebr)(CPUS390XState *env, uint32_t r1, uint32_t r2)
+ {
+ env->fregs[r1].d = float32_to_float64(env->fregs[r2].l.upper,
+ &env->fpu_status);
+ }
+
+ /* convert 128-bit float to 64-bit float */
+-void HELPER(ldxbr)(uint32_t f1, uint32_t f2)
++void HELPER(ldxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x2;
+
+@@ -263,7 +265,7 @@ void HELPER(ldxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* convert 64-bit float to 128-bit float */
+-void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
++void HELPER(lxdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU res;
+
+@@ -273,7 +275,7 @@ void HELPER(lxdbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* convert 64-bit float to 32-bit float */
+-void HELPER(ledbr)(uint32_t f1, uint32_t f2)
++void HELPER(ledbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ float64 d2 = env->fregs[f2].d;
+
+@@ -281,7 +283,7 @@ void HELPER(ledbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* convert 128-bit float to 32-bit float */
+-void HELPER(lexbr)(uint32_t f1, uint32_t f2)
++void HELPER(lexbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x2;
+
+@@ -292,7 +294,7 @@ void HELPER(lexbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* absolute value of 32-bit float */
+-uint32_t HELPER(lpebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lpebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ float32 v1;
+ float32 v2 = env->fregs[f2].d;
+@@ -303,7 +305,7 @@ uint32_t HELPER(lpebr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* absolute value of 64-bit float */
+-uint32_t HELPER(lpdbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lpdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ float64 v1;
+ float64 v2 = env->fregs[f2].d;
+@@ -314,7 +316,7 @@ uint32_t HELPER(lpdbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* absolute value of 128-bit float */
+-uint32_t HELPER(lpxbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lpxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -328,21 +330,21 @@ uint32_t HELPER(lpxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* load and test 64-bit float */
+-uint32_t HELPER(ltdbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(ltdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = env->fregs[f2].d;
+ return set_cc_nz_f64(env->fregs[f1].d);
+ }
+
+ /* load and test 32-bit float */
+-uint32_t HELPER(ltebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(ltebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = env->fregs[f2].l.upper;
+ return set_cc_nz_f32(env->fregs[f1].l.upper);
+ }
+
+ /* load and test 128-bit float */
+-uint32_t HELPER(ltxbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(ltxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x;
+
+@@ -354,7 +356,7 @@ uint32_t HELPER(ltxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* load complement of 32-bit float */
+-uint32_t HELPER(lcebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lcebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_chs(env->fregs[f2].l.upper);
+
+@@ -362,7 +364,7 @@ uint32_t HELPER(lcebr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* load complement of 64-bit float */
+-uint32_t HELPER(lcdbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lcdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_chs(env->fregs[f2].d);
+
+@@ -370,7 +372,7 @@ uint32_t HELPER(lcdbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* load complement of 128-bit float */
+-uint32_t HELPER(lcxbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(lcxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU x1, x2;
+
+@@ -383,7 +385,7 @@ uint32_t HELPER(lcxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 32-bit FP addition RM */
+-void HELPER(aeb)(uint32_t f1, uint32_t val)
++void HELPER(aeb)(CPUS390XState *env, uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
+@@ -395,7 +397,7 @@ void HELPER(aeb)(uint32_t f1, uint32_t val)
+ }
+
+ /* 32-bit FP division RM */
+-void HELPER(deb)(uint32_t f1, uint32_t val)
++void HELPER(deb)(CPUS390XState *env, uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
+@@ -407,7 +409,7 @@ void HELPER(deb)(uint32_t f1, uint32_t val)
+ }
+
+ /* 32-bit FP multiplication RM */
+-void HELPER(meeb)(uint32_t f1, uint32_t val)
++void HELPER(meeb)(CPUS390XState *env, uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
+@@ -419,29 +421,29 @@ void HELPER(meeb)(uint32_t f1, uint32_t val)
+ }
+
+ /* 32-bit FP compare RR */
+-uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(cebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ float32 v2 = env->fregs[f2].l.upper;
+
+ HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __func__,
+ v1, f1, v2);
+- return set_cc_f32(v1, v2);
++ return set_cc_f32(env, v1, v2);
+ }
+
+ /* 64-bit FP compare RR */
+-uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(cdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ float64 v2 = env->fregs[f2].d;
+
+ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __func__,
+ v1, f1, v2);
+- return set_cc_f64(v1, v2);
++ return set_cc_f64(env, v1, v2);
+ }
+
+ /* 128-bit FP compare RR */
+-uint32_t HELPER(cxbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(cxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -451,29 +453,29 @@ uint32_t HELPER(cxbr)(uint32_t f1, uint32_t f2)
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+
+- return float_comp_to_cc(float128_compare_quiet(v1.q, v2.q,
++ return float_comp_to_cc(env, float128_compare_quiet(v1.q, v2.q,
+ &env->fpu_status));
+ }
+
+ /* 64-bit FP compare RM */
+-uint32_t HELPER(cdb)(uint32_t f1, uint64_t a2)
++uint32_t HELPER(cdb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%lx\n", __func__, v1,
+ f1, v2.d);
+- return set_cc_f64(v1, v2.d);
++ return set_cc_f64(env, v1, v2.d);
+ }
+
+ /* 64-bit FP addition RM */
+-uint32_t HELPER(adb)(uint32_t f1, uint64_t a2)
++uint32_t HELPER(adb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ HELPER_LOG("%s: adding 0x%lx from f%d and 0x%lx\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = v1 = float64_add(v1, v2.d, &env->fpu_status);
+@@ -481,7 +483,7 @@ uint32_t HELPER(adb)(uint32_t f1, uint64_t a2)
+ }
+
+ /* 32-bit FP subtraction RM */
+-void HELPER(seb)(uint32_t f1, uint32_t val)
++void HELPER(seb)(CPUS390XState *env, uint32_t f1, uint32_t val)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ CPU_FloatU v2;
+@@ -491,41 +493,41 @@ void HELPER(seb)(uint32_t f1, uint32_t val)
+ }
+
+ /* 64-bit FP subtraction RM */
+-uint32_t HELPER(sdb)(uint32_t f1, uint64_t a2)
++uint32_t HELPER(sdb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ env->fregs[f1].d = v1 = float64_sub(v1, v2.d, &env->fpu_status);
+ return set_cc_nz_f64(v1);
+ }
+
+ /* 64-bit FP multiplication RM */
+-void HELPER(mdb)(uint32_t f1, uint64_t a2)
++void HELPER(mdb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ HELPER_LOG("%s: multiplying 0x%lx from f%d and 0x%ld\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = float64_mul(v1, v2.d, &env->fpu_status);
+ }
+
+ /* 64-bit FP division RM */
+-void HELPER(ddb)(uint32_t f1, uint64_t a2)
++void HELPER(ddb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ CPU_DoubleU v2;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ HELPER_LOG("%s: dividing 0x%lx from f%d by 0x%ld\n", __func__,
+ v1, f1, v2.d);
+ env->fregs[f1].d = float64_div(v1, v2.d, &env->fpu_status);
+ }
+
+-static void set_round_mode(int m3)
++static void set_round_mode(CPUS390XState *env, int m3)
+ {
+ switch (m3) {
+ case 0:
+@@ -553,33 +555,36 @@ static void set_round_mode(int m3)
+ }
+
+ /* convert 32-bit float to 64-bit int */
+-uint32_t HELPER(cgebr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cgebr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ float32 v2 = env->fregs[f2].l.upper;
+
+- set_round_mode(m3);
++ set_round_mode(env, m3);
+ env->regs[r1] = float32_to_int64(v2, &env->fpu_status);
+ return set_cc_nz_f32(v2);
+ }
+
+ /* convert 64-bit float to 64-bit int */
+-uint32_t HELPER(cgdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cgdbr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ float64 v2 = env->fregs[f2].d;
+
+- set_round_mode(m3);
++ set_round_mode(env, m3);
+ env->regs[r1] = float64_to_int64(v2, &env->fpu_status);
+ return set_cc_nz_f64(v2);
+ }
+
+ /* convert 128-bit float to 64-bit int */
+-uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cgxbr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ CPU_QuadU v2;
+
+ v2.ll.upper = env->fregs[f2].ll;
+ v2.ll.lower = env->fregs[f2 + 2].ll;
+- set_round_mode(m3);
++ set_round_mode(env, m3);
+ env->regs[r1] = float128_to_int64(v2.q, &env->fpu_status);
+ if (float128_is_any_nan(v2.q)) {
+ return 3;
+@@ -593,29 +598,32 @@ uint32_t HELPER(cgxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ }
+
+ /* convert 32-bit float to 32-bit int */
+-uint32_t HELPER(cfebr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cfebr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ float32 v2 = env->fregs[f2].l.upper;
+
+- set_round_mode(m3);
++ set_round_mode(env, m3);
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+ float32_to_int32(v2, &env->fpu_status);
+ return set_cc_nz_f32(v2);
+ }
+
+ /* convert 64-bit float to 32-bit int */
+-uint32_t HELPER(cfdbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cfdbr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ float64 v2 = env->fregs[f2].d;
+
+- set_round_mode(m3);
++ set_round_mode(env, m3);
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) |
+ float64_to_int32(v2, &env->fpu_status);
+ return set_cc_nz_f64(v2);
+ }
+
+ /* convert 128-bit float to 32-bit int */
+-uint32_t HELPER(cfxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
++uint32_t HELPER(cfxbr)(CPUS390XState *env, uint32_t r1, uint32_t f2,
++ uint32_t m3)
+ {
+ CPU_QuadU v2;
+
+@@ -627,19 +635,19 @@ uint32_t HELPER(cfxbr)(uint32_t r1, uint32_t f2, uint32_t m3)
+ }
+
+ /* load 32-bit FP zero */
+-void HELPER(lzer)(uint32_t f1)
++void HELPER(lzer)(CPUS390XState *env, uint32_t f1)
+ {
+ env->fregs[f1].l.upper = float32_zero;
+ }
+
+ /* load 64-bit FP zero */
+-void HELPER(lzdr)(uint32_t f1)
++void HELPER(lzdr)(CPUS390XState *env, uint32_t f1)
+ {
+ env->fregs[f1].d = float64_zero;
+ }
+
+ /* load 128-bit FP zero */
+-void HELPER(lzxr)(uint32_t f1)
++void HELPER(lzxr)(CPUS390XState *env, uint32_t f1)
+ {
+ CPU_QuadU x;
+
+@@ -649,7 +657,7 @@ void HELPER(lzxr)(uint32_t f1)
+ }
+
+ /* 128-bit FP subtraction RR */
+-uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(sxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -666,7 +674,7 @@ uint32_t HELPER(sxbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 128-bit FP addition RR */
+-uint32_t HELPER(axbr)(uint32_t f1, uint32_t f2)
++uint32_t HELPER(axbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ CPU_QuadU v1;
+ CPU_QuadU v2;
+@@ -683,7 +691,7 @@ uint32_t HELPER(axbr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 32-bit FP multiplication RR */
+-void HELPER(meebr)(uint32_t f1, uint32_t f2)
++void HELPER(meebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_mul(env->fregs[f1].l.upper,
+ env->fregs[f2].l.upper,
+@@ -691,19 +699,19 @@ void HELPER(meebr)(uint32_t f1, uint32_t f2)
+ }
+
+ /* 64-bit FP division RR */
+-void HELPER(ddbr)(uint32_t f1, uint32_t f2)
++void HELPER(ddbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_div(env->fregs[f1].d, env->fregs[f2].d,
+ &env->fpu_status);
+ }
+
+ /* 64-bit FP multiply and add RM */
+-void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
++void HELPER(madb)(CPUS390XState *env, uint32_t f1, uint64_t a2, uint32_t f3)
+ {
+ CPU_DoubleU v2;
+
+ HELPER_LOG("%s: f1 %d a2 0x%lx f3 %d\n", __func__, f1, a2, f3);
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ env->fregs[f1].d = float64_add(env->fregs[f1].d,
+ float64_mul(v2.d, env->fregs[f3].d,
+ &env->fpu_status),
+@@ -711,7 +719,7 @@ void HELPER(madb)(uint32_t f1, uint64_t a2, uint32_t f3)
+ }
+
+ /* 64-bit FP multiply and add RR */
+-void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
++void HELPER(madbr)(CPUS390XState *env, uint32_t f1, uint32_t f3, uint32_t f2)
+ {
+ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+ env->fregs[f1].d = float64_add(float64_mul(env->fregs[f2].d,
+@@ -721,7 +729,7 @@ void HELPER(madbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ }
+
+ /* 64-bit FP multiply and subtract RR */
+-void HELPER(msdbr)(uint32_t f1, uint32_t f3, uint32_t f2)
++void HELPER(msdbr)(CPUS390XState *env, uint32_t f1, uint32_t f3, uint32_t f2)
+ {
+ HELPER_LOG("%s: f1 %d f2 %d f3 %d\n", __func__, f1, f2, f3);
+ env->fregs[f1].d = float64_sub(float64_mul(env->fregs[f2].d,
+@@ -731,7 +739,7 @@ void HELPER(msdbr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ }
+
+ /* 32-bit FP multiply and add RR */
+-void HELPER(maebr)(uint32_t f1, uint32_t f3, uint32_t f2)
++void HELPER(maebr)(CPUS390XState *env, uint32_t f1, uint32_t f3, uint32_t f2)
+ {
+ env->fregs[f1].l.upper = float32_add(env->fregs[f1].l.upper,
+ float32_mul(env->fregs[f2].l.upper,
+@@ -741,29 +749,29 @@ void HELPER(maebr)(uint32_t f1, uint32_t f3, uint32_t f2)
+ }
+
+ /* convert 32-bit float to 64-bit float */
+-void HELPER(ldeb)(uint32_t f1, uint64_t a2)
++void HELPER(ldeb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ uint32_t v2;
+
+- v2 = ldl(a2);
++ v2 = cpu_ldl_data(env, a2);
+ env->fregs[f1].d = float32_to_float64(v2,
+ &env->fpu_status);
+ }
+
+ /* convert 64-bit float to 128-bit float */
+-void HELPER(lxdb)(uint32_t f1, uint64_t a2)
++void HELPER(lxdb)(CPUS390XState *env, uint32_t f1, uint64_t a2)
+ {
+ CPU_DoubleU v2;
+ CPU_QuadU v1;
+
+- v2.ll = ldq(a2);
++ v2.ll = cpu_ldq_data(env, a2);
+ v1.q = float64_to_float128(v2.d, &env->fpu_status);
+ env->fregs[f1].ll = v1.ll.upper;
+ env->fregs[f1 + 2].ll = v1.ll.lower;
+ }
+
+ /* test data class 32-bit */
+-uint32_t HELPER(tceb)(uint32_t f1, uint64_t m2)
++uint32_t HELPER(tceb)(CPUS390XState *env, uint32_t f1, uint64_t m2)
+ {
+ float32 v1 = env->fregs[f1].l.upper;
+ int neg = float32_is_neg(v1);
+@@ -785,7 +793,7 @@ uint32_t HELPER(tceb)(uint32_t f1, uint64_t m2)
+ }
+
+ /* test data class 64-bit */
+-uint32_t HELPER(tcdb)(uint32_t f1, uint64_t m2)
++uint32_t HELPER(tcdb)(CPUS390XState *env, uint32_t f1, uint64_t m2)
+ {
+ float64 v1 = env->fregs[f1].d;
+ int neg = float64_is_neg(v1);
+@@ -806,7 +814,7 @@ uint32_t HELPER(tcdb)(uint32_t f1, uint64_t m2)
+ }
+
+ /* test data class 128-bit */
+-uint32_t HELPER(tcxb)(uint32_t f1, uint64_t m2)
++uint32_t HELPER(tcxb)(CPUS390XState *env, uint32_t f1, uint64_t m2)
+ {
+ CPU_QuadU v1;
+ uint32_t cc = 0;
+@@ -830,7 +838,7 @@ uint32_t HELPER(tcxb)(uint32_t f1, uint64_t m2)
+ }
+
+ /* square root 64-bit RR */
+-void HELPER(sqdbr)(uint32_t f1, uint32_t f2)
++void HELPER(sqdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)
+ {
+ env->fregs[f1].d = float64_sqrt(env->fregs[f2].d, &env->fpu_status);
+ }
+diff --git a/target-s390x/helper.h b/target-s390x/helper.h
+index 01c8d0e..af98773 100644
+--- a/target-s390x/helper.h
++++ b/target-s390x/helper.h
+@@ -45,70 +45,70 @@ DEF_HELPER_3(mvcle, i32, i32, i64, i32)
+ DEF_HELPER_3(clcle, i32, i32, i64, i32)
+ DEF_HELPER_3(slb, i32, i32, i32, i32)
+ DEF_HELPER_4(slbg, i32, i32, i32, i64, i64)
+-DEF_HELPER_2(cefbr, void, i32, s32)
+-DEF_HELPER_2(cdfbr, void, i32, s32)
+-DEF_HELPER_2(cxfbr, void, i32, s32)
+-DEF_HELPER_2(cegbr, void, i32, s64)
+-DEF_HELPER_2(cdgbr, void, i32, s64)
+-DEF_HELPER_2(cxgbr, void, i32, s64)
+-DEF_HELPER_2(adbr, i32, i32, i32)
+-DEF_HELPER_2(aebr, i32, i32, i32)
+-DEF_HELPER_2(sebr, i32, i32, i32)
+-DEF_HELPER_2(sdbr, i32, i32, i32)
+-DEF_HELPER_2(debr, void, i32, i32)
+-DEF_HELPER_2(dxbr, void, i32, i32)
+-DEF_HELPER_2(mdbr, void, i32, i32)
+-DEF_HELPER_2(mxbr, void, i32, i32)
+-DEF_HELPER_2(ldebr, void, i32, i32)
+-DEF_HELPER_2(ldxbr, void, i32, i32)
+-DEF_HELPER_2(lxdbr, void, i32, i32)
+-DEF_HELPER_2(ledbr, void, i32, i32)
+-DEF_HELPER_2(lexbr, void, i32, i32)
+-DEF_HELPER_2(lpebr, i32, i32, i32)
+-DEF_HELPER_2(lpdbr, i32, i32, i32)
+-DEF_HELPER_2(lpxbr, i32, i32, i32)
+-DEF_HELPER_2(ltebr, i32, i32, i32)
+-DEF_HELPER_2(ltdbr, i32, i32, i32)
+-DEF_HELPER_2(ltxbr, i32, i32, i32)
+-DEF_HELPER_2(lcebr, i32, i32, i32)
+-DEF_HELPER_2(lcdbr, i32, i32, i32)
+-DEF_HELPER_2(lcxbr, i32, i32, i32)
+-DEF_HELPER_2(aeb, void, i32, i32)
+-DEF_HELPER_2(deb, void, i32, i32)
+-DEF_HELPER_2(meeb, void, i32, i32)
+-DEF_HELPER_2(cdb, i32, i32, i64)
+-DEF_HELPER_2(adb, i32, i32, i64)
+-DEF_HELPER_2(seb, void, i32, i32)
+-DEF_HELPER_2(sdb, i32, i32, i64)
+-DEF_HELPER_2(mdb, void, i32, i64)
+-DEF_HELPER_2(ddb, void, i32, i64)
+-DEF_HELPER_FLAGS_2(cebr, TCG_CALL_PURE, i32, i32, i32)
+-DEF_HELPER_FLAGS_2(cdbr, TCG_CALL_PURE, i32, i32, i32)
+-DEF_HELPER_FLAGS_2(cxbr, TCG_CALL_PURE, i32, i32, i32)
+-DEF_HELPER_3(cgebr, i32, i32, i32, i32)
+-DEF_HELPER_3(cgdbr, i32, i32, i32, i32)
+-DEF_HELPER_3(cgxbr, i32, i32, i32, i32)
+-DEF_HELPER_1(lzer, void, i32)
+-DEF_HELPER_1(lzdr, void, i32)
+-DEF_HELPER_1(lzxr, void, i32)
+-DEF_HELPER_3(cfebr, i32, i32, i32, i32)
+-DEF_HELPER_3(cfdbr, i32, i32, i32, i32)
+-DEF_HELPER_3(cfxbr, i32, i32, i32, i32)
+-DEF_HELPER_2(axbr, i32, i32, i32)
+-DEF_HELPER_2(sxbr, i32, i32, i32)
+-DEF_HELPER_2(meebr, void, i32, i32)
+-DEF_HELPER_2(ddbr, void, i32, i32)
+-DEF_HELPER_3(madb, void, i32, i64, i32)
+-DEF_HELPER_3(maebr, void, i32, i32, i32)
+-DEF_HELPER_3(madbr, void, i32, i32, i32)
+-DEF_HELPER_3(msdbr, void, i32, i32, i32)
+-DEF_HELPER_2(ldeb, void, i32, i64)
+-DEF_HELPER_2(lxdb, void, i32, i64)
+-DEF_HELPER_FLAGS_2(tceb, TCG_CALL_PURE, i32, i32, i64)
+-DEF_HELPER_FLAGS_2(tcdb, TCG_CALL_PURE, i32, i32, i64)
+-DEF_HELPER_FLAGS_2(tcxb, TCG_CALL_PURE, i32, i32, i64)
++DEF_HELPER_3(cefbr, void, env, i32, s32)
++DEF_HELPER_3(cdfbr, void, env, i32, s32)
++DEF_HELPER_3(cxfbr, void, env, i32, s32)
++DEF_HELPER_3(cegbr, void, env, i32, s64)
++DEF_HELPER_3(cdgbr, void, env, i32, s64)
++DEF_HELPER_3(cxgbr, void, env, i32, s64)
++DEF_HELPER_3(adbr, i32, env, i32, i32)
++DEF_HELPER_3(aebr, i32, env, i32, i32)
++DEF_HELPER_3(sebr, i32, env, i32, i32)
++DEF_HELPER_3(sdbr, i32, env, i32, i32)
++DEF_HELPER_3(debr, void, env, i32, i32)
++DEF_HELPER_3(dxbr, void, env, i32, i32)
++DEF_HELPER_3(mdbr, void, env, i32, i32)
++DEF_HELPER_3(mxbr, void, env, i32, i32)
++DEF_HELPER_3(ldebr, void, env, i32, i32)
++DEF_HELPER_3(ldxbr, void, env, i32, i32)
++DEF_HELPER_3(lxdbr, void, env, i32, i32)
++DEF_HELPER_3(ledbr, void, env, i32, i32)
++DEF_HELPER_3(lexbr, void, env, i32, i32)
++DEF_HELPER_3(lpebr, i32, env, i32, i32)
++DEF_HELPER_3(lpdbr, i32, env, i32, i32)
++DEF_HELPER_3(lpxbr, i32, env, i32, i32)
++DEF_HELPER_3(ltebr, i32, env, i32, i32)
++DEF_HELPER_3(ltdbr, i32, env, i32, i32)
++DEF_HELPER_3(ltxbr, i32, env, i32, i32)
++DEF_HELPER_3(lcebr, i32, env, i32, i32)
++DEF_HELPER_3(lcdbr, i32, env, i32, i32)
++DEF_HELPER_3(lcxbr, i32, env, i32, i32)
++DEF_HELPER_3(aeb, void, env, i32, i32)
++DEF_HELPER_3(deb, void, env, i32, i32)
++DEF_HELPER_3(meeb, void, env, i32, i32)
++DEF_HELPER_3(cdb, i32, env, i32, i64)
++DEF_HELPER_3(adb, i32, env, i32, i64)
++DEF_HELPER_3(seb, void, env, i32, i32)
++DEF_HELPER_3(sdb, i32, env, i32, i64)
++DEF_HELPER_3(mdb, void, env, i32, i64)
++DEF_HELPER_3(ddb, void, env, i32, i64)
++DEF_HELPER_FLAGS_3(cebr, TCG_CALL_PURE, i32, env, i32, i32)
++DEF_HELPER_FLAGS_3(cdbr, TCG_CALL_PURE, i32, env, i32, i32)
++DEF_HELPER_FLAGS_3(cxbr, TCG_CALL_PURE, i32, env, i32, i32)
++DEF_HELPER_4(cgebr, i32, env, i32, i32, i32)
++DEF_HELPER_4(cgdbr, i32, env, i32, i32, i32)
++DEF_HELPER_4(cgxbr, i32, env, i32, i32, i32)
++DEF_HELPER_2(lzer, void, env, i32)
++DEF_HELPER_2(lzdr, void, env, i32)
++DEF_HELPER_2(lzxr, void, env, i32)
++DEF_HELPER_4(cfebr, i32, env, i32, i32, i32)
++DEF_HELPER_4(cfdbr, i32, env, i32, i32, i32)
++DEF_HELPER_4(cfxbr, i32, env, i32, i32, i32)
++DEF_HELPER_3(axbr, i32, env, i32, i32)
++DEF_HELPER_3(sxbr, i32, env, i32, i32)
++DEF_HELPER_3(meebr, void, env, i32, i32)
++DEF_HELPER_3(ddbr, void, env, i32, i32)
++DEF_HELPER_4(madb, void, env, i32, i64, i32)
++DEF_HELPER_4(maebr, void, env, i32, i32, i32)
++DEF_HELPER_4(madbr, void, env, i32, i32, i32)
++DEF_HELPER_4(msdbr, void, env, i32, i32, i32)
++DEF_HELPER_3(ldeb, void, env, i32, i64)
++DEF_HELPER_3(lxdb, void, env, i32, i64)
++DEF_HELPER_FLAGS_3(tceb, TCG_CALL_PURE, i32, env, i32, i64)
++DEF_HELPER_FLAGS_3(tcdb, TCG_CALL_PURE, i32, env, i32, i64)
++DEF_HELPER_FLAGS_3(tcxb, TCG_CALL_PURE, i32, env, i32, i64)
+ DEF_HELPER_2(flogr, i32, i32, i64)
+-DEF_HELPER_2(sqdbr, void, i32, i32)
++DEF_HELPER_3(sqdbr, void, env, i32, i32)
+ DEF_HELPER_FLAGS_1(cvd, TCG_CALL_PURE|TCG_CALL_CONST, i64, s32)
+ DEF_HELPER_3(unpk, void, i32, i64, i64)
+ DEF_HELPER_3(tr, void, i32, i64, i64)
+diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
+index ba05e65..3f8b3ba 100644
+--- a/target-s390x/mem_helper.c
++++ b/target-s390x/mem_helper.c
+@@ -1188,3 +1188,52 @@ uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
+ }
+
+ #endif
++
++/* temporary wrappers */
++#if defined(CONFIG_USER_ONLY)
++#define ldub_data(addr) ldub_raw(addr)
++#define lduw_data(addr) lduw_raw(addr)
++#define ldl_data(addr) ldl_raw(addr)
++#define ldq_data(addr) ldq_raw(addr)
++
++#define stb_data(addr, data) stb_raw(addr, data)
++#define stw_data(addr, data) stw_raw(addr, data)
++#define stl_data(addr, data) stl_raw(addr, data)
++#define stq_data(addr, data) stq_raw(addr, data)
++#endif
++
++#define WRAP_LD(rettype, fn) \
++ rettype cpu_ ## fn(CPUS390XState *env1, target_ulong addr) \
++ { \
++ CPUS390XState *saved_env; \
++ rettype ret; \
++ \
++ saved_env = env; \
++ env = env1; \
++ ret = fn(addr); \
++ env = saved_env; \
++ return ret; \
++ }
++
++WRAP_LD(uint32_t, ldub_data)
++WRAP_LD(uint32_t, lduw_data)
++WRAP_LD(uint32_t, ldl_data)
++WRAP_LD(uint64_t, ldq_data)
++#undef WRAP_LD
++
++#define WRAP_ST(datatype, fn) \
++ void cpu_ ## fn(CPUS390XState *env1, target_ulong addr, datatype val) \
++ { \
++ CPUS390XState *saved_env; \
++ \
++ saved_env = env; \
++ env = env1; \
++ fn(addr, val); \
++ env = saved_env; \
++ }
++
++WRAP_ST(uint32_t, stb_data)
++WRAP_ST(uint32_t, stw_data)
++WRAP_ST(uint32_t, stl_data)
++WRAP_ST(uint64_t, stq_data)
++#undef WRAP_ST
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index c370df3..b1f2071 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -2206,11 +2206,11 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ switch (op) {
+ case 0x4: /* LDEB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_ldeb(tmp_r1, addr);
++ gen_helper_ldeb(cpu_env, tmp_r1, addr);
+ break;
+ case 0x5: /* LXDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_lxdb(tmp_r1, addr);
++ gen_helper_lxdb(cpu_env, tmp_r1, addr);
+ break;
+ case 0x9: /* CEB R1,D2(X2,B2) [RXE] */
+ tmp = tcg_temp_new_i64();
+@@ -2225,7 +2225,7 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tmp32 = tcg_temp_new_i32();
+ tcg_gen_qemu_ld32u(tmp, addr, get_mem_index(s));
+ tcg_gen_trunc_i64_i32(tmp32, tmp);
+- gen_helper_aeb(tmp_r1, tmp32);
++ gen_helper_aeb(cpu_env, tmp_r1, tmp32);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32);
+
+@@ -2238,7 +2238,7 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tmp32 = tcg_temp_new_i32();
+ tcg_gen_qemu_ld32u(tmp, addr, get_mem_index(s));
+ tcg_gen_trunc_i64_i32(tmp32, tmp);
+- gen_helper_seb(tmp_r1, tmp32);
++ gen_helper_seb(cpu_env, tmp_r1, tmp32);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32);
+
+@@ -2251,23 +2251,23 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tmp32 = tcg_temp_new_i32();
+ tcg_gen_qemu_ld32u(tmp, addr, get_mem_index(s));
+ tcg_gen_trunc_i64_i32(tmp32, tmp);
+- gen_helper_deb(tmp_r1, tmp32);
++ gen_helper_deb(cpu_env, tmp_r1, tmp32);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32);
+ break;
+ case 0x10: /* TCEB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_tceb(cc_op, tmp_r1, addr);
++ gen_helper_tceb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x11: /* TCDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_tcdb(cc_op, tmp_r1, addr);
++ gen_helper_tcdb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x12: /* TCXB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_tcxb(cc_op, tmp_r1, addr);
++ gen_helper_tcxb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x17: /* MEEB R1,D2(X2,B2) [RXE] */
+@@ -2275,38 +2275,38 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ tmp32 = tcg_temp_new_i32();
+ tcg_gen_qemu_ld32u(tmp, addr, get_mem_index(s));
+ tcg_gen_trunc_i64_i32(tmp32, tmp);
+- gen_helper_meeb(tmp_r1, tmp32);
++ gen_helper_meeb(cpu_env, tmp_r1, tmp32);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32);
+ break;
+ case 0x19: /* CDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_cdb(cc_op, tmp_r1, addr);
++ gen_helper_cdb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x1a: /* ADB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_adb(cc_op, tmp_r1, addr);
++ gen_helper_adb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x1b: /* SDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_sdb(cc_op, tmp_r1, addr);
++ gen_helper_sdb(cc_op, cpu_env, tmp_r1, addr);
+ set_cc_static(s);
+ break;
+ case 0x1c: /* MDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_mdb(tmp_r1, addr);
++ gen_helper_mdb(cpu_env, tmp_r1, addr);
+ break;
+ case 0x1d: /* DDB R1,D2(X2,B2) [RXE] */
+ potential_page_fault(s);
+- gen_helper_ddb(tmp_r1, addr);
++ gen_helper_ddb(cpu_env, tmp_r1, addr);
+ break;
+ case 0x1e: /* MADB R1,R3,D2(X2,B2) [RXF] */
+ /* for RXF insns, r1 is R3 and r1b is R1 */
+ tmp32 = tcg_const_i32(r1b);
+ potential_page_fault(s);
+- gen_helper_madb(tmp32, addr, tmp_r1);
++ gen_helper_madb(cpu_env, tmp32, addr, tmp_r1);
+ tcg_temp_free_i32(tmp32);
+ break;
+ default:
+@@ -3001,14 +3001,14 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ #define FP_HELPER(i) \
+ tmp32_1 = tcg_const_i32(r1); \
+ tmp32_2 = tcg_const_i32(r2); \
+- gen_helper_ ## i (tmp32_1, tmp32_2); \
++ gen_helper_ ## i(cpu_env, tmp32_1, tmp32_2); \
+ tcg_temp_free_i32(tmp32_1); \
+ tcg_temp_free_i32(tmp32_2);
+
+ #define FP_HELPER_CC(i) \
+ tmp32_1 = tcg_const_i32(r1); \
+ tmp32_2 = tcg_const_i32(r2); \
+- gen_helper_ ## i (cc_op, tmp32_1, tmp32_2); \
++ gen_helper_ ## i(cc_op, cpu_env, tmp32_1, tmp32_2); \
+ set_cc_static(s); \
+ tcg_temp_free_i32(tmp32_1); \
+ tcg_temp_free_i32(tmp32_2);
+@@ -3080,13 +3080,13 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_3 = tcg_const_i32(r1);
+ switch (op) {
+ case 0xe:
+- gen_helper_maebr(tmp32_1, tmp32_3, tmp32_2);
++ gen_helper_maebr(cpu_env, tmp32_1, tmp32_3, tmp32_2);
+ break;
+ case 0x1e:
+- gen_helper_madbr(tmp32_1, tmp32_3, tmp32_2);
++ gen_helper_madbr(cpu_env, tmp32_1, tmp32_3, tmp32_2);
+ break;
+ case 0x1f:
+- gen_helper_msdbr(tmp32_1, tmp32_3, tmp32_2);
++ gen_helper_msdbr(cpu_env, tmp32_1, tmp32_3, tmp32_2);
+ break;
+ default:
+ tcg_abort();
+@@ -3138,17 +3138,17 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ break;
+ case 0x74: /* LZER R1 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+- gen_helper_lzer(tmp32_1);
++ gen_helper_lzer(cpu_env, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x75: /* LZDR R1 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+- gen_helper_lzdr(tmp32_1);
++ gen_helper_lzdr(cpu_env, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x76: /* LZXR R1 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+- gen_helper_lzxr(tmp32_1);
++ gen_helper_lzxr(cpu_env, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x84: /* SFPC R1 [RRE] */
+@@ -3169,13 +3169,13 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_2 = load_reg32(r2);
+ switch (op) {
+ case 0x94:
+- gen_helper_cefbr(tmp32_1, tmp32_2);
++ gen_helper_cefbr(cpu_env, tmp32_1, tmp32_2);
+ break;
+ case 0x95:
+- gen_helper_cdfbr(tmp32_1, tmp32_2);
++ gen_helper_cdfbr(cpu_env, tmp32_1, tmp32_2);
+ break;
+ case 0x96:
+- gen_helper_cxfbr(tmp32_1, tmp32_2);
++ gen_helper_cxfbr(cpu_env, tmp32_1, tmp32_2);
+ break;
+ default:
+ tcg_abort();
+@@ -3191,13 +3191,13 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_3 = tcg_const_i32(m3);
+ switch (op) {
+ case 0x98:
+- gen_helper_cfebr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cfebr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ break;
+ case 0x99:
+- gen_helper_cfdbr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cfdbr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ break;
+ case 0x9a:
+- gen_helper_cfxbr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cfxbr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ break;
+ default:
+ tcg_abort();
+@@ -3213,10 +3213,10 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp = load_reg(r2);
+ switch (op) {
+ case 0xa4:
+- gen_helper_cegbr(tmp32_1, tmp);
++ gen_helper_cegbr(cpu_env, tmp32_1, tmp);
+ break;
+ case 0xa5:
+- gen_helper_cdgbr(tmp32_1, tmp);
++ gen_helper_cdgbr(cpu_env, tmp32_1, tmp);
+ break;
+ default:
+ tcg_abort();
+@@ -3227,7 +3227,7 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ case 0xa6: /* CXGBR R1,R2 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+ tmp = load_reg(r2);
+- gen_helper_cxgbr(tmp32_1, tmp);
++ gen_helper_cxgbr(cpu_env, tmp32_1, tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp);
+ break;
+@@ -3235,7 +3235,7 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+ tmp32_3 = tcg_const_i32(m3);
+- gen_helper_cgebr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cgebr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -3245,7 +3245,7 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+ tmp32_3 = tcg_const_i32(m3);
+- gen_helper_cgdbr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cgdbr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -3255,7 +3255,7 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+ tmp32_3 = tcg_const_i32(m3);
+- gen_helper_cgxbr(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_cgxbr(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+--
+1.7.12.1
+
--- /dev/null
+From d44b8c2cacaa50e7420f0dfaf42c344bcf134431 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:37 +0000
+Subject: [PATCH] target-s390x: avoid AREG0 for integer helpers
+
+Make integer helpers take a parameter for CPUState instead
+of relying on global env.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 1 -
+ target-s390x/helper.h | 10 +++++-----
+ target-s390x/int_helper.c | 12 ++++++------
+ target-s390x/translate.c | 16 ++++++++--------
+ 4 files changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 7d965e9..7b2c5c1 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -3,7 +3,6 @@ obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+-$(obj)/int_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/misc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/helper.h b/target-s390x/helper.h
+index af98773..c03cd59 100644
+--- a/target-s390x/helper.h
++++ b/target-s390x/helper.h
+@@ -12,8 +12,8 @@ DEF_HELPER_FLAGS_1(set_cc_comp_s64, TCG_CALL_PURE|TCG_CALL_CONST, i32, s64)
+ DEF_HELPER_FLAGS_2(set_cc_icm, TCG_CALL_PURE|TCG_CALL_CONST, i32, i32, i32)
+ DEF_HELPER_3(clm, i32, i32, i32, i64)
+ DEF_HELPER_3(stcm, void, i32, i32, i64)
+-DEF_HELPER_2(mlg, void, i32, i64)
+-DEF_HELPER_2(dlg, void, i32, i64)
++DEF_HELPER_3(mlg, void, env, i32, i64)
++DEF_HELPER_3(dlg, void, env, i32, i64)
+ DEF_HELPER_FLAGS_3(set_cc_add64, TCG_CALL_PURE|TCG_CALL_CONST, i32, s64, s64, s64)
+ DEF_HELPER_FLAGS_3(set_cc_addu64, TCG_CALL_PURE|TCG_CALL_CONST, i32, i64, i64, i64)
+ DEF_HELPER_FLAGS_3(set_cc_add32, TCG_CALL_PURE|TCG_CALL_CONST, i32, s32, s32, s32)
+@@ -43,8 +43,8 @@ DEF_HELPER_3(stam, void, i32, i64, i32)
+ DEF_HELPER_3(lam, void, i32, i64, i32)
+ DEF_HELPER_3(mvcle, i32, i32, i64, i32)
+ DEF_HELPER_3(clcle, i32, i32, i64, i32)
+-DEF_HELPER_3(slb, i32, i32, i32, i32)
+-DEF_HELPER_4(slbg, i32, i32, i32, i64, i64)
++DEF_HELPER_4(slb, i32, env, i32, i32, i32)
++DEF_HELPER_5(slbg, i32, env, i32, i32, i64, i64)
+ DEF_HELPER_3(cefbr, void, env, i32, s32)
+ DEF_HELPER_3(cdfbr, void, env, i32, s32)
+ DEF_HELPER_3(cxfbr, void, env, i32, s32)
+@@ -107,7 +107,7 @@ DEF_HELPER_3(lxdb, void, env, i32, i64)
+ DEF_HELPER_FLAGS_3(tceb, TCG_CALL_PURE, i32, env, i32, i64)
+ DEF_HELPER_FLAGS_3(tcdb, TCG_CALL_PURE, i32, env, i32, i64)
+ DEF_HELPER_FLAGS_3(tcxb, TCG_CALL_PURE, i32, env, i32, i64)
+-DEF_HELPER_2(flogr, i32, i32, i64)
++DEF_HELPER_3(flogr, i32, env, i32, i64)
+ DEF_HELPER_3(sqdbr, void, env, i32, i32)
+ DEF_HELPER_FLAGS_1(cvd, TCG_CALL_PURE|TCG_CALL_CONST, i64, s32)
+ DEF_HELPER_3(unpk, void, i32, i64, i64)
+diff --git a/target-s390x/int_helper.c b/target-s390x/int_helper.c
+index e2eeb07..f202a7e 100644
+--- a/target-s390x/int_helper.c
++++ b/target-s390x/int_helper.c
+@@ -19,7 +19,6 @@
+ */
+
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "host-utils.h"
+ #include "helper.h"
+
+@@ -31,7 +30,7 @@
+ #endif
+
+ /* 64/64 -> 128 unsigned multiplication */
+-void HELPER(mlg)(uint32_t r1, uint64_t v2)
++void HELPER(mlg)(CPUS390XState *env, uint32_t r1, uint64_t v2)
+ {
+ #if HOST_LONG_BITS == 64 && defined(__GNUC__)
+ /* assuming 64-bit hosts have __uint128_t */
+@@ -46,7 +45,7 @@ void HELPER(mlg)(uint32_t r1, uint64_t v2)
+ }
+
+ /* 128 -> 64/64 unsigned division */
+-void HELPER(dlg)(uint32_t r1, uint64_t v2)
++void HELPER(dlg)(CPUS390XState *env, uint32_t r1, uint64_t v2)
+ {
+ uint64_t divisor = v2;
+
+@@ -129,7 +128,7 @@ uint32_t HELPER(addc_u32)(uint32_t cc, uint32_t v1, uint32_t v2)
+ }
+
+ /* subtract unsigned v2 from v1 with borrow */
+-uint32_t HELPER(slb)(uint32_t cc, uint32_t r1, uint32_t v2)
++uint32_t HELPER(slb)(CPUS390XState *env, uint32_t cc, uint32_t r1, uint32_t v2)
+ {
+ uint32_t v1 = env->regs[r1];
+ uint32_t res = v1 + (~v2) + (cc >> 1);
+@@ -144,7 +143,8 @@ uint32_t HELPER(slb)(uint32_t cc, uint32_t r1, uint32_t v2)
+ }
+
+ /* subtract unsigned v2 from v1 with borrow */
+-uint32_t HELPER(slbg)(uint32_t cc, uint32_t r1, uint64_t v1, uint64_t v2)
++uint32_t HELPER(slbg)(CPUS390XState *env, uint32_t cc, uint32_t r1,
++ uint64_t v1, uint64_t v2)
+ {
+ uint64_t res = v1 + (~v2) + (cc >> 1);
+
+@@ -158,7 +158,7 @@ uint32_t HELPER(slbg)(uint32_t cc, uint32_t r1, uint64_t v1, uint64_t v2)
+ }
+
+ /* find leftmost one */
+-uint32_t HELPER(flogr)(uint32_t r1, uint64_t v2)
++uint32_t HELPER(flogr)(CPUS390XState *env, uint32_t r1, uint64_t v2)
+ {
+ uint64_t res = 0;
+ uint64_t ov2 = v2;
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index b1f2071..2a61e92 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -1803,7 +1803,7 @@ static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_const_i32(r1);
+ tcg_gen_qemu_ld64(tmp2, addr, get_mem_index(s));
+- gen_helper_mlg(tmp32_1, tmp2);
++ gen_helper_mlg(cpu_env, tmp32_1, tmp2);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+@@ -1811,7 +1811,7 @@ static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_const_i32(r1);
+ tcg_gen_qemu_ld64(tmp2, addr, get_mem_index(s));
+- gen_helper_dlg(tmp32_1, tmp2);
++ gen_helper_dlg(cpu_env, tmp32_1, tmp2);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+@@ -1837,7 +1837,7 @@ static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
+ tcg_gen_qemu_ld64(tmp2, addr, get_mem_index(s));
+ /* XXX possible optimization point */
+ gen_op_calc_cc(s);
+- gen_helper_slbg(cc_op, cc_op, tmp32_1, regs[r1], tmp2);
++ gen_helper_slbg(cc_op, cpu_env, cc_op, tmp32_1, regs[r1], tmp2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i32(tmp32_1);
+@@ -1917,7 +1917,7 @@ static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
+ tcg_gen_trunc_i64_i32(tmp32_2, tmp2);
+ /* XXX possible optimization point */
+ gen_op_calc_cc(s);
+- gen_helper_slb(cc_op, cc_op, tmp32_1, tmp32_2);
++ gen_helper_slb(cc_op, cpu_env, cc_op, tmp32_1, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i32(tmp32_1);
+@@ -3535,7 +3535,7 @@ static void disas_b9(DisasContext *s, int op, int r1, int r2)
+ case 0x83: /* FLOGR R1,R2 [RRE] */
+ tmp = load_reg(r2);
+ tmp32_1 = tcg_const_i32(r1);
+- gen_helper_flogr(cc_op, tmp32_1, tmp);
++ gen_helper_flogr(cc_op, cpu_env, tmp32_1, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -3555,7 +3555,7 @@ static void disas_b9(DisasContext *s, int op, int r1, int r2)
+ case 0x87: /* DLGR R1,R2 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+ tmp = load_reg(r2);
+- gen_helper_dlg(tmp32_1, tmp);
++ gen_helper_dlg(cpu_env, tmp32_1, tmp);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+@@ -3580,7 +3580,7 @@ static void disas_b9(DisasContext *s, int op, int r1, int r2)
+ tmp2 = load_reg(r2);
+ tmp32_1 = tcg_const_i32(r1);
+ gen_op_calc_cc(s);
+- gen_helper_slbg(cc_op, cc_op, tmp32_1, tmp, tmp2);
++ gen_helper_slbg(cc_op, cpu_env, cc_op, tmp32_1, tmp, tmp2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+@@ -3647,7 +3647,7 @@ static void disas_b9(DisasContext *s, int op, int r1, int r2)
+ tmp32_1 = load_reg32(r2);
+ tmp32_2 = tcg_const_i32(r1);
+ gen_op_calc_cc(s);
+- gen_helper_slb(cc_op, cc_op, tmp32_2, tmp32_1);
++ gen_helper_slb(cc_op, cpu_env, cc_op, tmp32_2, tmp32_1);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+--
+1.7.12.1
+
--- /dev/null
+From ead7a100e907eddd0ba9f3cebb5f84c1afb120b8 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:38 +0000
+Subject: [PATCH] target-s390x: avoid AREG0 for condition code helpers
+
+Make condition code helpers take a parameter for CPUState instead
+of relying on global env.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 1 -
+ target-s390x/cc_helper.c | 11 +++++------
+ target-s390x/helper.h | 10 +++++-----
+ target-s390x/translate.c | 16 ++++++++--------
+ 4 files changed, 18 insertions(+), 20 deletions(-)
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 7b2c5c1..736cf33 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -3,6 +3,5 @@ obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+-$(obj)/cc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+ $(obj)/misc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cc_helper.c b/target-s390x/cc_helper.c
+index 9c3a2c4..19ef145 100644
+--- a/target-s390x/cc_helper.c
++++ b/target-s390x/cc_helper.c
+@@ -19,7 +19,6 @@
+ */
+
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+ /* #define DEBUG_HELPER */
+@@ -500,14 +499,14 @@ uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst,
+ return do_calc_cc(env, cc_op, src, dst, vr);
+ }
+
+-uint32_t HELPER(calc_cc)(uint32_t cc_op, uint64_t src, uint64_t dst,
+- uint64_t vr)
++uint32_t HELPER(calc_cc)(CPUS390XState *env, uint32_t cc_op, uint64_t src,
++ uint64_t dst, uint64_t vr)
+ {
+ return do_calc_cc(env, cc_op, src, dst, vr);
+ }
+
+ /* insert psw mask and condition code into r1 */
+-void HELPER(ipm)(uint32_t cc, uint32_t r1)
++void HELPER(ipm)(CPUS390XState *env, uint32_t cc, uint32_t r1)
+ {
+ uint64_t r = env->regs[r1];
+
+@@ -519,13 +518,13 @@ void HELPER(ipm)(uint32_t cc, uint32_t r1)
+ }
+
+ #ifndef CONFIG_USER_ONLY
+-void HELPER(load_psw)(uint64_t mask, uint64_t addr)
++void HELPER(load_psw)(CPUS390XState *env, uint64_t mask, uint64_t addr)
+ {
+ load_psw(env, mask, addr);
+ cpu_loop_exit(env);
+ }
+
+-void HELPER(sacf)(uint64_t a1)
++void HELPER(sacf)(CPUS390XState *env, uint64_t a1)
+ {
+ HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1);
+
+diff --git a/target-s390x/helper.h b/target-s390x/helper.h
+index c03cd59..876b88e 100644
+--- a/target-s390x/helper.h
++++ b/target-s390x/helper.h
+@@ -36,7 +36,7 @@ DEF_HELPER_FLAGS_1(abs_i64, TCG_CALL_PURE|TCG_CALL_CONST, i64, s64)
+ DEF_HELPER_FLAGS_1(nabs_i64, TCG_CALL_PURE|TCG_CALL_CONST, s64, s64)
+ DEF_HELPER_3(stcmh, void, i32, i64, i32)
+ DEF_HELPER_3(icmh, i32, i32, i64, i32)
+-DEF_HELPER_2(ipm, void, i32, i32)
++DEF_HELPER_3(ipm, void, env, i32, i32)
+ DEF_HELPER_FLAGS_3(addc_u32, TCG_CALL_PURE|TCG_CALL_CONST, i32, i32, i32, i32)
+ DEF_HELPER_FLAGS_3(set_cc_addc_u64, TCG_CALL_PURE|TCG_CALL_CONST, i32, i64, i64, i64)
+ DEF_HELPER_3(stam, void, i32, i64, i32)
+@@ -115,7 +115,7 @@ DEF_HELPER_3(tr, void, i32, i64, i64)
+
+ DEF_HELPER_2(servc, i32, i32, i64)
+ DEF_HELPER_3(diag, i64, i32, i64, i64)
+-DEF_HELPER_2(load_psw, void, i64, i64)
++DEF_HELPER_3(load_psw, void, env, i64, i64)
+ DEF_HELPER_1(program_interrupt, void, i32)
+ DEF_HELPER_FLAGS_1(stidp, TCG_CALL_CONST, void, i64)
+ DEF_HELPER_FLAGS_1(spx, TCG_CALL_CONST, void, i64)
+@@ -139,14 +139,14 @@ DEF_HELPER_2(csp, i32, i32, i32)
+ DEF_HELPER_3(mvcs, i32, i64, i64, i64)
+ DEF_HELPER_3(mvcp, i32, i64, i64, i64)
+ DEF_HELPER_3(sigp, i32, i64, i32, i64)
+-DEF_HELPER_1(sacf, void, i64)
++DEF_HELPER_2(sacf, void, env, i64)
+ DEF_HELPER_FLAGS_2(ipte, TCG_CALL_CONST, void, i64, i64)
+ DEF_HELPER_FLAGS_0(ptlb, TCG_CALL_CONST, void)
+ DEF_HELPER_2(lra, i32, i64, i32)
+ DEF_HELPER_2(stura, void, i64, i32)
+ DEF_HELPER_2(cksm, void, i32, i32)
+
+-DEF_HELPER_FLAGS_4(calc_cc, TCG_CALL_PURE|TCG_CALL_CONST,
+- i32, i32, i64, i64, i64)
++DEF_HELPER_FLAGS_5(calc_cc, TCG_CALL_PURE|TCG_CALL_CONST,
++ i32, env, i32, i64, i64, i64)
+
+ #include "def-helper.h"
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index 2a61e92..1d87272 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -722,7 +722,7 @@ static void gen_op_calc_cc(DisasContext *s)
+ case CC_OP_NZ_F32:
+ case CC_OP_NZ_F64:
+ /* 1 argument */
+- gen_helper_calc_cc(cc_op, local_cc_op, dummy, cc_dst, dummy);
++ gen_helper_calc_cc(cc_op, cpu_env, local_cc_op, dummy, cc_dst, dummy);
+ break;
+ case CC_OP_ICM:
+ case CC_OP_LTGT_32:
+@@ -735,7 +735,7 @@ static void gen_op_calc_cc(DisasContext *s)
+ case CC_OP_LTGT_F64:
+ case CC_OP_SLAG:
+ /* 2 arguments */
+- gen_helper_calc_cc(cc_op, local_cc_op, cc_src, cc_dst, dummy);
++ gen_helper_calc_cc(cc_op, cpu_env, local_cc_op, cc_src, cc_dst, dummy);
+ break;
+ case CC_OP_ADD_64:
+ case CC_OP_ADDU_64:
+@@ -746,11 +746,11 @@ static void gen_op_calc_cc(DisasContext *s)
+ case CC_OP_SUB_32:
+ case CC_OP_SUBU_32:
+ /* 3 arguments */
+- gen_helper_calc_cc(cc_op, local_cc_op, cc_src, cc_dst, cc_vr);
++ gen_helper_calc_cc(cc_op, cpu_env, local_cc_op, cc_src, cc_dst, cc_vr);
+ break;
+ case CC_OP_DYNAMIC:
+ /* unknown operation - assume 3 arguments and cc_op in env */
+- gen_helper_calc_cc(cc_op, cc_op, cc_src, cc_dst, cc_vr);
++ gen_helper_calc_cc(cc_op, cpu_env, cc_op, cc_src, cc_dst, cc_vr);
+ break;
+ default:
+ tcg_abort();
+@@ -2628,7 +2628,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ case 0x22: /* IPM R1 [RRE] */
+ tmp32_1 = tcg_const_i32(r1);
+ gen_op_calc_cc(s);
+- gen_helper_ipm(cc_op, tmp32_1);
++ gen_helper_ipm(cpu_env, cc_op, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x41: /* CKSM R1,R2 [RRE] */
+@@ -2916,7 +2916,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_sacf(tmp);
++ gen_helper_sacf(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ /* addressing mode has changed, so end the block */
+ s->pc += ilc * 2;
+@@ -2967,7 +2967,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tcg_gen_qemu_ld64(tmp2, tmp, get_mem_index(s));
+ tcg_gen_addi_i64(tmp, tmp, 8);
+ tcg_gen_qemu_ld64(tmp3, tmp, get_mem_index(s));
+- gen_helper_load_psw(tmp2, tmp3);
++ gen_helper_load_psw(cpu_env, tmp2, tmp3);
+ /* we need to keep cc_op intact */
+ s->is_jmp = DISAS_JUMP;
+ tcg_temp_free_i64(tmp);
+@@ -4527,7 +4527,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_gen_qemu_ld32u(tmp2, tmp, get_mem_index(s));
+ tcg_gen_addi_i64(tmp, tmp, 4);
+ tcg_gen_qemu_ld32u(tmp3, tmp, get_mem_index(s));
+- gen_helper_load_psw(tmp2, tmp3);
++ gen_helper_load_psw(cpu_env, tmp2, tmp3);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i64(tmp3);
+--
+1.7.12.1
+
--- /dev/null
+From 208547c7afbe6ee8a9a1f81095e67a6cbe4a37ec Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:39 +0000
+Subject: [PATCH] target-s390x: avoid AREG0 for misc helpers
+
+Make misc helpers take a parameter for CPUState instead
+of relying on global env.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+[agraf: fix conflict]
+Signed-off-by: Alexander Graf <agraf@suse.de>
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/Makefile.objs | 1 -
+ target-s390x/helper.h | 26 +++++++++++-----------
+ target-s390x/mem_helper.c | 2 +-
+ target-s390x/misc_helper.c | 55 +++++++++++++++++++++++++---------------------
+ target-s390x/translate.c | 32 +++++++++++++--------------
+ 5 files changed, 60 insertions(+), 56 deletions(-)
+
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 736cf33..156d946 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -4,4 +4,3 @@ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+
+ $(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+-$(obj)/misc_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/helper.h b/target-s390x/helper.h
+index 876b88e..f4e0b37 100644
+--- a/target-s390x/helper.h
++++ b/target-s390x/helper.h
+@@ -1,6 +1,6 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_1(exception, void, i32)
++DEF_HELPER_2(exception, void, env, i32)
+ DEF_HELPER_3(nc, i32, i32, i64, i64)
+ DEF_HELPER_3(oc, i32, i32, i64, i64)
+ DEF_HELPER_3(xc, i32, i32, i64, i64)
+@@ -113,20 +113,20 @@ DEF_HELPER_FLAGS_1(cvd, TCG_CALL_PURE|TCG_CALL_CONST, i64, s32)
+ DEF_HELPER_3(unpk, void, i32, i64, i64)
+ DEF_HELPER_3(tr, void, i32, i64, i64)
+
+-DEF_HELPER_2(servc, i32, i32, i64)
+-DEF_HELPER_3(diag, i64, i32, i64, i64)
++DEF_HELPER_3(servc, i32, env, i32, i64)
++DEF_HELPER_4(diag, i64, env, i32, i64, i64)
+ DEF_HELPER_3(load_psw, void, env, i64, i64)
+ DEF_HELPER_1(program_interrupt, void, i32)
+-DEF_HELPER_FLAGS_1(stidp, TCG_CALL_CONST, void, i64)
+-DEF_HELPER_FLAGS_1(spx, TCG_CALL_CONST, void, i64)
++DEF_HELPER_FLAGS_2(stidp, TCG_CALL_CONST, void, env, i64)
++DEF_HELPER_FLAGS_2(spx, TCG_CALL_CONST, void, env, i64)
+ DEF_HELPER_FLAGS_1(sck, TCG_CALL_CONST, i32, i64)
+-DEF_HELPER_1(stck, i32, i64)
+-DEF_HELPER_1(stcke, i32, i64)
+-DEF_HELPER_FLAGS_1(sckc, TCG_CALL_CONST, void, i64)
+-DEF_HELPER_FLAGS_1(stckc, TCG_CALL_CONST, void, i64)
+-DEF_HELPER_FLAGS_1(spt, TCG_CALL_CONST, void, i64)
+-DEF_HELPER_FLAGS_1(stpt, TCG_CALL_CONST, void, i64)
+-DEF_HELPER_3(stsi, i32, i64, i32, i32)
++DEF_HELPER_2(stck, i32, env, i64)
++DEF_HELPER_2(stcke, i32, env, i64)
++DEF_HELPER_FLAGS_2(sckc, TCG_CALL_CONST, void, env, i64)
++DEF_HELPER_FLAGS_2(stckc, TCG_CALL_CONST, void, env, i64)
++DEF_HELPER_FLAGS_2(spt, TCG_CALL_CONST, void, env, i64)
++DEF_HELPER_FLAGS_2(stpt, TCG_CALL_CONST, void, env, i64)
++DEF_HELPER_4(stsi, i32, env, i64, i32, i32)
+ DEF_HELPER_3(lctl, void, i32, i64, i32)
+ DEF_HELPER_3(lctlg, void, i32, i64, i32)
+ DEF_HELPER_3(stctl, void, i32, i64, i32)
+@@ -138,7 +138,7 @@ DEF_HELPER_FLAGS_2(rrbe, TCG_CALL_CONST, i32, i32, i64)
+ DEF_HELPER_2(csp, i32, i32, i32)
+ DEF_HELPER_3(mvcs, i32, i64, i64, i64)
+ DEF_HELPER_3(mvcp, i32, i64, i64, i64)
+-DEF_HELPER_3(sigp, i32, i64, i32, i64)
++DEF_HELPER_4(sigp, i32, env, i64, i32, i64)
+ DEF_HELPER_2(sacf, void, env, i64)
+ DEF_HELPER_FLAGS_2(ipte, TCG_CALL_CONST, void, i64, i64)
+ DEF_HELPER_FLAGS_0(ptlb, TCG_CALL_CONST, void)
+diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
+index 3f8b3ba..52f2602 100644
+--- a/target-s390x/mem_helper.c
++++ b/target-s390x/mem_helper.c
+@@ -595,7 +595,7 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ env->psw.addr = ret - 4;
+ env->int_svc_code = (insn | v1) & 0xff;
+ env->int_svc_ilc = 4;
+- helper_exception(EXCP_SVC);
++ helper_exception(env, EXCP_SVC);
+ } else if ((insn & 0xff00) == 0xbf00) {
+ uint32_t insn2, r1, r3, b2, d2;
+
+diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
+index 1d5137f..ced26c6 100644
+--- a/target-s390x/misc_helper.c
++++ b/target-s390x/misc_helper.c
+@@ -21,7 +21,6 @@
+ #include "cpu.h"
+ #include "memory.h"
+ #include "cputlb.h"
+-#include "dyngen-exec.h"
+ #include "host-utils.h"
+ #include "helper.h"
+ #include <string.h>
+@@ -32,7 +31,10 @@
+ #endif
+
+ #if !defined(CONFIG_USER_ONLY)
++/* temporarily disabled due to wrapper use */
++#if 0
+ #include "softmmu_exec.h"
++#endif
+ #include "sysemu.h"
+ #endif
+
+@@ -44,7 +46,7 @@
+ #endif
+
+ /* raise an exception */
+-void HELPER(exception)(uint32_t excp)
++void HELPER(exception)(CPUS390XState *env, uint32_t excp)
+ {
+ HELPER_LOG("%s: exception %d\n", __func__, excp);
+ env->exception_index = excp;
+@@ -112,7 +114,7 @@ int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)
+ }
+
+ /* SCLP service call */
+-uint32_t HELPER(servc)(uint32_t r1, uint64_t r2)
++uint32_t HELPER(servc)(CPUS390XState *env, uint32_t r1, uint64_t r2)
+ {
+ int r;
+
+@@ -125,7 +127,8 @@ uint32_t HELPER(servc)(uint32_t r1, uint64_t r2)
+ }
+
+ /* DIAG */
+-uint64_t HELPER(diag)(uint32_t num, uint64_t mem, uint64_t code)
++uint64_t HELPER(diag)(CPUS390XState *env, uint32_t num, uint64_t mem,
++ uint64_t code)
+ {
+ uint64_t r;
+
+@@ -155,17 +158,17 @@ uint64_t HELPER(diag)(uint32_t num, uint64_t mem, uint64_t code)
+ }
+
+ /* Store CPU ID */
+-void HELPER(stidp)(uint64_t a1)
++void HELPER(stidp)(CPUS390XState *env, uint64_t a1)
+ {
+- stq(a1, env->cpu_num);
++ cpu_stq_data(env, a1, env->cpu_num);
+ }
+
+ /* Set Prefix */
+-void HELPER(spx)(uint64_t a1)
++void HELPER(spx)(CPUS390XState *env, uint64_t a1)
+ {
+ uint32_t prefix;
+
+- prefix = ldl(a1);
++ prefix = cpu_ldl_data(env, a1);
+ env->psa = prefix & 0xfffff000;
+ qemu_log("prefix: %#x\n", prefix);
+ tlb_flush_page(env, 0);
+@@ -191,31 +194,31 @@ static inline uint64_t clock_value(CPUS390XState *env)
+ }
+
+ /* Store Clock */
+-uint32_t HELPER(stck)(uint64_t a1)
++uint32_t HELPER(stck)(CPUS390XState *env, uint64_t a1)
+ {
+- stq(a1, clock_value(env));
++ cpu_stq_data(env, a1, clock_value(env));
+
+ return 0;
+ }
+
+ /* Store Clock Extended */
+-uint32_t HELPER(stcke)(uint64_t a1)
++uint32_t HELPER(stcke)(CPUS390XState *env, uint64_t a1)
+ {
+- stb(a1, 0);
++ cpu_stb_data(env, a1, 0);
+ /* basically the same value as stck */
+- stq(a1 + 1, clock_value(env) | env->cpu_num);
++ cpu_stq_data(env, a1 + 1, clock_value(env) | env->cpu_num);
+ /* more fine grained than stck */
+- stq(a1 + 9, 0);
++ cpu_stq_data(env, a1 + 9, 0);
+ /* XXX programmable fields */
+- stw(a1 + 17, 0);
++ cpu_stw_data(env, a1 + 17, 0);
+
+ return 0;
+ }
+
+ /* Set Clock Comparator */
+-void HELPER(sckc)(uint64_t a1)
++void HELPER(sckc)(CPUS390XState *env, uint64_t a1)
+ {
+- uint64_t time = ldq(a1);
++ uint64_t time = cpu_ldq_data(env, a1);
+
+ if (time == -1ULL) {
+ return;
+@@ -230,16 +233,16 @@ void HELPER(sckc)(uint64_t a1)
+ }
+
+ /* Store Clock Comparator */
+-void HELPER(stckc)(uint64_t a1)
++void HELPER(stckc)(CPUS390XState *env, uint64_t a1)
+ {
+ /* XXX implement */
+- stq(a1, 0);
++ cpu_stq_data(env, a1, 0);
+ }
+
+ /* Set CPU Timer */
+-void HELPER(spt)(uint64_t a1)
++void HELPER(spt)(CPUS390XState *env, uint64_t a1)
+ {
+- uint64_t time = ldq(a1);
++ uint64_t time = cpu_ldq_data(env, a1);
+
+ if (time == -1ULL) {
+ return;
+@@ -252,14 +255,15 @@ void HELPER(spt)(uint64_t a1)
+ }
+
+ /* Store CPU Timer */
+-void HELPER(stpt)(uint64_t a1)
++void HELPER(stpt)(CPUS390XState *env, uint64_t a1)
+ {
+ /* XXX implement */
+- stq(a1, 0);
++ cpu_stq_data(env, a1, 0);
+ }
+
+ /* Store System Information */
+-uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
++uint32_t HELPER(stsi)(CPUS390XState *env, uint64_t a0, uint32_t r0,
++ uint32_t r1)
+ {
+ int cc = 0;
+ int sel1, sel2;
+@@ -384,7 +388,8 @@ uint32_t HELPER(stsi)(uint64_t a0, uint32_t r0, uint32_t r1)
+ return cc;
+ }
+
+-uint32_t HELPER(sigp)(uint64_t order_code, uint32_t r1, uint64_t cpu_addr)
++uint32_t HELPER(sigp)(CPUS390XState *env, uint64_t order_code, uint32_t r1,
++ uint64_t cpu_addr)
+ {
+ int cc = 0;
+
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index 1d87272..0c61e63 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -312,7 +312,7 @@ static inline void gen_debug(DisasContext *s)
+ TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
+ update_psw_addr(s);
+ gen_op_calc_cc(s);
+- gen_helper_exception(tmp);
++ gen_helper_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ s->is_jmp = DISAS_EXCP;
+ }
+@@ -324,7 +324,7 @@ static void gen_illegal_opcode(DisasContext *s, int ilc)
+ TCGv_i32 tmp = tcg_const_i32(EXCP_SPEC);
+ update_psw_addr(s);
+ gen_op_calc_cc(s);
+- gen_helper_exception(tmp);
++ gen_helper_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ s->is_jmp = DISAS_EXCP;
+ }
+@@ -377,7 +377,7 @@ static void gen_program_exception(DisasContext *s, int ilc, int code)
+
+ /* trigger exception */
+ tmp = tcg_const_i32(EXCP_PGM);
+- gen_helper_exception(tmp);
++ gen_helper_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+
+ /* end TB here */
+@@ -2712,7 +2712,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_stidp(tmp);
++ gen_helper_stidp(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x04: /* SCK D2(B2) [S] */
+@@ -2730,7 +2730,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_stck(cc_op, tmp);
++ gen_helper_stck(cc_op, cpu_env, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ break;
+@@ -2740,7 +2740,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_sckc(tmp);
++ gen_helper_sckc(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x07: /* STCKC D2(B2) [S] */
+@@ -2749,7 +2749,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_stckc(tmp);
++ gen_helper_stckc(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x08: /* SPT D2(B2) [S] */
+@@ -2758,7 +2758,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_spt(tmp);
++ gen_helper_spt(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x09: /* STPT D2(B2) [S] */
+@@ -2767,7 +2767,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_stpt(tmp);
++ gen_helper_stpt(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x0a: /* SPKA D2(B2) [S] */
+@@ -2793,7 +2793,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_spx(tmp);
++ gen_helper_spx(cpu_env, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x11: /* STPX D2(B2) [S] */
+@@ -2906,7 +2906,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+- gen_helper_stcke(cc_op, tmp);
++ gen_helper_stcke(cc_op, cpu_env, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ break;
+@@ -2930,7 +2930,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_1 = load_reg32(0);
+ tmp32_2 = load_reg32(1);
+ potential_page_fault(s);
+- gen_helper_stsi(cc_op, tmp, tmp32_1, tmp32_2);
++ gen_helper_stsi(cc_op, cpu_env, tmp, tmp32_1, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -2980,7 +2980,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ potential_page_fault(s);
+ tmp32_1 = load_reg32(r2);
+ tmp = load_reg(r1);
+- gen_helper_servc(cc_op, tmp32_1, tmp);
++ gen_helper_servc(cc_op, cpu_env, tmp32_1, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp);
+@@ -3926,7 +3926,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_3 = tcg_const_i32(EXCP_SVC);
+ tcg_gen_st_i32(tmp32_1, cpu_env, offsetof(CPUS390XState, int_svc_code));
+ tcg_gen_st_i32(tmp32_2, cpu_env, offsetof(CPUS390XState, int_svc_ilc));
+- gen_helper_exception(tmp32_3);
++ gen_helper_exception(cpu_env, tmp32_3);
+ s->is_jmp = DISAS_EXCP;
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4543,7 +4543,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(insn & 0xfff);
+ tmp2 = load_reg(2);
+ tmp3 = load_reg(1);
+- gen_helper_diag(tmp2, tmp32_1, tmp2, tmp3);
++ gen_helper_diag(tmp2, cpu_env, tmp32_1, tmp2, tmp3);
+ store_reg(2, tmp2);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp2);
+@@ -4777,7 +4777,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp2 = load_reg(r3);
+ tmp32_1 = tcg_const_i32(r1);
+ potential_page_fault(s);
+- gen_helper_sigp(cc_op, tmp, tmp32_1, tmp2);
++ gen_helper_sigp(cc_op, cpu_env, tmp, tmp32_1, tmp2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+--
+1.7.12.1
+
--- /dev/null
+From 77fb132a1dc3780a57d8a1e889b366f0492963a5 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:33:40 +0000
+Subject: [PATCH] target-s390x: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0.
+
+Remove temporary wrappers and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+[agraf: fix conflicts]
+Signed-off-by: Alexander Graf <agraf@suse.de>
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-s390x/Makefile.objs | 2 -
+ target-s390x/cpu.h | 10 --
+ target-s390x/fpu_helper.c | 3 +-
+ target-s390x/helper.c | 6 +-
+ target-s390x/helper.h | 78 +++++------
+ target-s390x/mem_helper.c | 338 ++++++++++++++++++++-------------------------
+ target-s390x/misc_helper.c | 3 -
+ target-s390x/translate.c | 88 ++++++------
+ 9 files changed, 239 insertions(+), 291 deletions(-)
+
+diff --git a/configure b/configure
+index bf3acc8..3ad6f74 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | i386 | or32 | sparc* | x86_64 | xtensa* | ppc*)
++ alpha | i386 | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
+index 156d946..e728abf 100644
+--- a/target-s390x/Makefile.objs
++++ b/target-s390x/Makefile.objs
+@@ -2,5 +2,3 @@ obj-y += translate.o helper.o cpu.o interrupt.o
+ obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-$(CONFIG_KVM) += kvm.o
+-
+-$(obj)/mem_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
+index 9b7a2e3..ed81af3 100644
+--- a/target-s390x/cpu.h
++++ b/target-s390x/cpu.h
+@@ -1008,14 +1008,4 @@ uint32_t set_cc_nz_f64(float64 v);
+ /* misc_helper.c */
+ void program_interrupt(CPUS390XState *env, uint32_t code, int ilc);
+
+-/* temporary wrappers */
+-uint32_t cpu_ldub_data(CPUS390XState *env, target_ulong ptr);
+-uint32_t cpu_lduw_data(CPUS390XState *env, target_ulong ptr);
+-uint32_t cpu_ldl_data(CPUS390XState *env, target_ulong ptr);
+-uint64_t cpu_ldq_data(CPUS390XState *env, target_ulong ptr);
+-
+-void cpu_stb_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
+-void cpu_stw_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
+-void cpu_stl_data(CPUS390XState *env, target_ulong ptr, uint32_t data);
+-void cpu_stq_data(CPUS390XState *env, target_ulong ptr, uint64_t data);
+ #endif
+diff --git a/target-s390x/fpu_helper.c b/target-s390x/fpu_helper.c
+index e235419..ee9420d 100644
+--- a/target-s390x/fpu_helper.c
++++ b/target-s390x/fpu_helper.c
+@@ -21,8 +21,7 @@
+ #include "cpu.h"
+ #include "helper.h"
+
+-/* temporarily disabled due to wrapper use */
+-#if 0 && !defined(CONFIG_USER_ONLY)
++#if !defined(CONFIG_USER_ONLY)
+ #include "softmmu_exec.h"
+ #endif
+
+diff --git a/target-s390x/helper.c b/target-s390x/helper.c
+index d98e6d9..a5741ec 100644
+--- a/target-s390x/helper.c
++++ b/target-s390x/helper.c
+@@ -499,14 +499,14 @@ static void do_program_interrupt(CPUS390XState *env)
+
+ switch (ilc) {
+ case ILC_LATER:
+- ilc = get_ilc(ldub_code(env->psw.addr));
++ ilc = get_ilc(cpu_ldub_code(env, env->psw.addr));
+ break;
+ case ILC_LATER_INC:
+- ilc = get_ilc(ldub_code(env->psw.addr));
++ ilc = get_ilc(cpu_ldub_code(env, env->psw.addr));
+ env->psw.addr += ilc * 2;
+ break;
+ case ILC_LATER_INC_2:
+- ilc = get_ilc(ldub_code(env->psw.addr)) * 2;
++ ilc = get_ilc(cpu_ldub_code(env, env->psw.addr)) * 2;
+ env->psw.addr += ilc;
+ break;
+ }
+diff --git a/target-s390x/helper.h b/target-s390x/helper.h
+index f4e0b37..5419f37 100644
+--- a/target-s390x/helper.h
++++ b/target-s390x/helper.h
+@@ -1,17 +1,17 @@
+ #include "def-helper.h"
+
+ DEF_HELPER_2(exception, void, env, i32)
+-DEF_HELPER_3(nc, i32, i32, i64, i64)
+-DEF_HELPER_3(oc, i32, i32, i64, i64)
+-DEF_HELPER_3(xc, i32, i32, i64, i64)
+-DEF_HELPER_3(mvc, void, i32, i64, i64)
+-DEF_HELPER_3(clc, i32, i32, i64, i64)
+-DEF_HELPER_2(mvcl, i32, i32, i32)
++DEF_HELPER_4(nc, i32, env, i32, i64, i64)
++DEF_HELPER_4(oc, i32, env, i32, i64, i64)
++DEF_HELPER_4(xc, i32, env, i32, i64, i64)
++DEF_HELPER_4(mvc, void, env, i32, i64, i64)
++DEF_HELPER_4(clc, i32, env, i32, i64, i64)
++DEF_HELPER_3(mvcl, i32, env, i32, i32)
+ DEF_HELPER_FLAGS_1(set_cc_comp_s32, TCG_CALL_PURE|TCG_CALL_CONST, i32, s32)
+ DEF_HELPER_FLAGS_1(set_cc_comp_s64, TCG_CALL_PURE|TCG_CALL_CONST, i32, s64)
+ DEF_HELPER_FLAGS_2(set_cc_icm, TCG_CALL_PURE|TCG_CALL_CONST, i32, i32, i32)
+-DEF_HELPER_3(clm, i32, i32, i32, i64)
+-DEF_HELPER_3(stcm, void, i32, i32, i64)
++DEF_HELPER_4(clm, i32, env, i32, i32, i64)
++DEF_HELPER_4(stcm, void, env, i32, i32, i64)
+ DEF_HELPER_3(mlg, void, env, i32, i64)
+ DEF_HELPER_3(dlg, void, env, i32, i64)
+ DEF_HELPER_FLAGS_3(set_cc_add64, TCG_CALL_PURE|TCG_CALL_CONST, i32, s64, s64, s64)
+@@ -22,27 +22,27 @@ DEF_HELPER_FLAGS_3(set_cc_sub64, TCG_CALL_PURE|TCG_CALL_CONST, i32, s64, s64, s6
+ DEF_HELPER_FLAGS_3(set_cc_subu64, TCG_CALL_PURE|TCG_CALL_CONST, i32, i64, i64, i64)
+ DEF_HELPER_FLAGS_3(set_cc_sub32, TCG_CALL_PURE|TCG_CALL_CONST, i32, s32, s32, s32)
+ DEF_HELPER_FLAGS_3(set_cc_subu32, TCG_CALL_PURE|TCG_CALL_CONST, i32, i32, i32, i32)
+-DEF_HELPER_3(srst, i32, i32, i32, i32)
+-DEF_HELPER_3(clst, i32, i32, i32, i32)
+-DEF_HELPER_3(mvpg, void, i64, i64, i64)
+-DEF_HELPER_3(mvst, void, i32, i32, i32)
+-DEF_HELPER_3(csg, i32, i32, i64, i32)
+-DEF_HELPER_3(cdsg, i32, i32, i64, i32)
+-DEF_HELPER_3(cs, i32, i32, i64, i32)
+-DEF_HELPER_4(ex, i32, i32, i64, i64, i64)
++DEF_HELPER_4(srst, i32, env, i32, i32, i32)
++DEF_HELPER_4(clst, i32, env, i32, i32, i32)
++DEF_HELPER_4(mvpg, void, env, i64, i64, i64)
++DEF_HELPER_4(mvst, void, env, i32, i32, i32)
++DEF_HELPER_4(csg, i32, env, i32, i64, i32)
++DEF_HELPER_4(cdsg, i32, env, i32, i64, i32)
++DEF_HELPER_4(cs, i32, env, i32, i64, i32)
++DEF_HELPER_5(ex, i32, env, i32, i64, i64, i64)
+ DEF_HELPER_FLAGS_1(abs_i32, TCG_CALL_PURE|TCG_CALL_CONST, i32, s32)
+ DEF_HELPER_FLAGS_1(nabs_i32, TCG_CALL_PURE|TCG_CALL_CONST, s32, s32)
+ DEF_HELPER_FLAGS_1(abs_i64, TCG_CALL_PURE|TCG_CALL_CONST, i64, s64)
+ DEF_HELPER_FLAGS_1(nabs_i64, TCG_CALL_PURE|TCG_CALL_CONST, s64, s64)
+-DEF_HELPER_3(stcmh, void, i32, i64, i32)
+-DEF_HELPER_3(icmh, i32, i32, i64, i32)
++DEF_HELPER_4(stcmh, void, env, i32, i64, i32)
++DEF_HELPER_4(icmh, i32, env, i32, i64, i32)
+ DEF_HELPER_3(ipm, void, env, i32, i32)
+ DEF_HELPER_FLAGS_3(addc_u32, TCG_CALL_PURE|TCG_CALL_CONST, i32, i32, i32, i32)
+ DEF_HELPER_FLAGS_3(set_cc_addc_u64, TCG_CALL_PURE|TCG_CALL_CONST, i32, i64, i64, i64)
+-DEF_HELPER_3(stam, void, i32, i64, i32)
+-DEF_HELPER_3(lam, void, i32, i64, i32)
+-DEF_HELPER_3(mvcle, i32, i32, i64, i32)
+-DEF_HELPER_3(clcle, i32, i32, i64, i32)
++DEF_HELPER_4(stam, void, env, i32, i64, i32)
++DEF_HELPER_4(lam, void, env, i32, i64, i32)
++DEF_HELPER_4(mvcle, i32, env, i32, i64, i32)
++DEF_HELPER_4(clcle, i32, env, i32, i64, i32)
+ DEF_HELPER_4(slb, i32, env, i32, i32, i32)
+ DEF_HELPER_5(slbg, i32, env, i32, i32, i64, i64)
+ DEF_HELPER_3(cefbr, void, env, i32, s32)
+@@ -110,8 +110,8 @@ DEF_HELPER_FLAGS_3(tcxb, TCG_CALL_PURE, i32, env, i32, i64)
+ DEF_HELPER_3(flogr, i32, env, i32, i64)
+ DEF_HELPER_3(sqdbr, void, env, i32, i32)
+ DEF_HELPER_FLAGS_1(cvd, TCG_CALL_PURE|TCG_CALL_CONST, i64, s32)
+-DEF_HELPER_3(unpk, void, i32, i64, i64)
+-DEF_HELPER_3(tr, void, i32, i64, i64)
++DEF_HELPER_4(unpk, void, env, i32, i64, i64)
++DEF_HELPER_4(tr, void, env, i32, i64, i64)
+
+ DEF_HELPER_3(servc, i32, env, i32, i64)
+ DEF_HELPER_4(diag, i64, env, i32, i64, i64)
+@@ -127,24 +127,24 @@ DEF_HELPER_FLAGS_2(stckc, TCG_CALL_CONST, void, env, i64)
+ DEF_HELPER_FLAGS_2(spt, TCG_CALL_CONST, void, env, i64)
+ DEF_HELPER_FLAGS_2(stpt, TCG_CALL_CONST, void, env, i64)
+ DEF_HELPER_4(stsi, i32, env, i64, i32, i32)
+-DEF_HELPER_3(lctl, void, i32, i64, i32)
+-DEF_HELPER_3(lctlg, void, i32, i64, i32)
+-DEF_HELPER_3(stctl, void, i32, i64, i32)
+-DEF_HELPER_3(stctg, void, i32, i64, i32)
++DEF_HELPER_4(lctl, void, env, i32, i64, i32)
++DEF_HELPER_4(lctlg, void, env, i32, i64, i32)
++DEF_HELPER_4(stctl, void, env, i32, i64, i32)
++DEF_HELPER_4(stctg, void, env, i32, i64, i32)
+ DEF_HELPER_FLAGS_2(tprot, TCG_CALL_CONST, i32, i64, i64)
+-DEF_HELPER_FLAGS_1(iske, TCG_CALL_PURE|TCG_CALL_CONST, i64, i64)
+-DEF_HELPER_FLAGS_2(sske, TCG_CALL_CONST, void, i32, i64)
+-DEF_HELPER_FLAGS_2(rrbe, TCG_CALL_CONST, i32, i32, i64)
+-DEF_HELPER_2(csp, i32, i32, i32)
+-DEF_HELPER_3(mvcs, i32, i64, i64, i64)
+-DEF_HELPER_3(mvcp, i32, i64, i64, i64)
++DEF_HELPER_FLAGS_2(iske, TCG_CALL_PURE|TCG_CALL_CONST, i64, env, i64)
++DEF_HELPER_FLAGS_3(sske, TCG_CALL_CONST, void, env, i32, i64)
++DEF_HELPER_FLAGS_3(rrbe, TCG_CALL_CONST, i32, env, i32, i64)
++DEF_HELPER_3(csp, i32, env, i32, i32)
++DEF_HELPER_4(mvcs, i32, env, i64, i64, i64)
++DEF_HELPER_4(mvcp, i32, env, i64, i64, i64)
+ DEF_HELPER_4(sigp, i32, env, i64, i32, i64)
+ DEF_HELPER_2(sacf, void, env, i64)
+-DEF_HELPER_FLAGS_2(ipte, TCG_CALL_CONST, void, i64, i64)
+-DEF_HELPER_FLAGS_0(ptlb, TCG_CALL_CONST, void)
+-DEF_HELPER_2(lra, i32, i64, i32)
+-DEF_HELPER_2(stura, void, i64, i32)
+-DEF_HELPER_2(cksm, void, i32, i32)
++DEF_HELPER_FLAGS_3(ipte, TCG_CALL_CONST, void, env, i64, i64)
++DEF_HELPER_FLAGS_1(ptlb, TCG_CALL_CONST, void, env)
++DEF_HELPER_3(lra, i32, env, i64, i32)
++DEF_HELPER_3(stura, void, env, i64, i32)
++DEF_HELPER_3(cksm, void, env, i32, i32)
+
+ DEF_HELPER_FLAGS_5(calc_cc, TCG_CALL_PURE|TCG_CALL_CONST,
+ i32, env, i32, i64, i64, i64)
+diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
+index 52f2602..b21b37c 100644
+--- a/target-s390x/mem_helper.c
++++ b/target-s390x/mem_helper.c
+@@ -19,7 +19,6 @@
+ */
+
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+ /*****************************************************************************/
+@@ -45,15 +44,12 @@
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+ /* XXX: fix it to restore all registers */
+-void tlb_fill(CPUS390XState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUS390XState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUS390XState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = cpu_s390x_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret != 0)) {
+ if (likely(retaddr)) {
+@@ -67,7 +63,6 @@ void tlb_fill(CPUS390XState *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+
+ #endif
+@@ -90,7 +85,7 @@ static void mvc_fast_memset(CPUS390XState *env, uint32_t l, uint64_t dest,
+ int flags;
+
+ if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
+- stb(dest, byte);
++ cpu_stb_data(env, dest, byte);
+ cpu_abort(env, "should never reach here");
+ }
+ dest_phys |= dest & ~TARGET_PAGE_MASK;
+@@ -114,13 +109,13 @@ static void mvc_fast_memmove(CPUS390XState *env, uint32_t l, uint64_t dest,
+ int flags;
+
+ if (mmu_translate(env, dest, 1, asc, &dest_phys, &flags)) {
+- stb(dest, 0);
++ cpu_stb_data(env, dest, 0);
+ cpu_abort(env, "should never reach here");
+ }
+ dest_phys |= dest & ~TARGET_PAGE_MASK;
+
+ if (mmu_translate(env, src, 0, asc, &src_phys, &flags)) {
+- ldub(src);
++ cpu_ldub_data(env, src);
+ cpu_abort(env, "should never reach here");
+ }
+ src_phys |= src & ~TARGET_PAGE_MASK;
+@@ -136,7 +131,8 @@ static void mvc_fast_memmove(CPUS390XState *env, uint32_t l, uint64_t dest,
+ #endif
+
+ /* and on array */
+-uint32_t HELPER(nc)(uint32_t l, uint64_t dest, uint64_t src)
++uint32_t HELPER(nc)(CPUS390XState *env, uint32_t l, uint64_t dest,
++ uint64_t src)
+ {
+ int i;
+ unsigned char x;
+@@ -145,17 +141,18 @@ uint32_t HELPER(nc)(uint32_t l, uint64_t dest, uint64_t src)
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+ __func__, l, dest, src);
+ for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) & ldub(src + i);
++ x = cpu_ldub_data(env, dest + i) & cpu_ldub_data(env, src + i);
+ if (x) {
+ cc = 1;
+ }
+- stb(dest + i, x);
++ cpu_stb_data(env, dest + i, x);
+ }
+ return cc;
+ }
+
+ /* xor on array */
+-uint32_t HELPER(xc)(uint32_t l, uint64_t dest, uint64_t src)
++uint32_t HELPER(xc)(CPUS390XState *env, uint32_t l, uint64_t dest,
++ uint64_t src)
+ {
+ int i;
+ unsigned char x;
+@@ -179,17 +176,18 @@ uint32_t HELPER(xc)(uint32_t l, uint64_t dest, uint64_t src)
+ #endif
+
+ for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) ^ ldub(src + i);
++ x = cpu_ldub_data(env, dest + i) ^ cpu_ldub_data(env, src + i);
+ if (x) {
+ cc = 1;
+ }
+- stb(dest + i, x);
++ cpu_stb_data(env, dest + i, x);
+ }
+ return cc;
+ }
+
+ /* or on array */
+-uint32_t HELPER(oc)(uint32_t l, uint64_t dest, uint64_t src)
++uint32_t HELPER(oc)(CPUS390XState *env, uint32_t l, uint64_t dest,
++ uint64_t src)
+ {
+ int i;
+ unsigned char x;
+@@ -198,17 +196,17 @@ uint32_t HELPER(oc)(uint32_t l, uint64_t dest, uint64_t src)
+ HELPER_LOG("%s l %d dest %" PRIx64 " src %" PRIx64 "\n",
+ __func__, l, dest, src);
+ for (i = 0; i <= l; i++) {
+- x = ldub(dest + i) | ldub(src + i);
++ x = cpu_ldub_data(env, dest + i) | cpu_ldub_data(env, src + i);
+ if (x) {
+ cc = 1;
+ }
+- stb(dest + i, x);
++ cpu_stb_data(env, dest + i, x);
+ }
+ return cc;
+ }
+
+ /* memmove */
+-void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
++void HELPER(mvc)(CPUS390XState *env, uint32_t l, uint64_t dest, uint64_t src)
+ {
+ int i = 0;
+ int x = 0;
+@@ -222,7 +220,7 @@ void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+ (src & TARGET_PAGE_MASK) == ((src + l) & TARGET_PAGE_MASK) &&
+ (dest & TARGET_PAGE_MASK) == ((dest + l) & TARGET_PAGE_MASK)) {
+ if (dest == (src + 1)) {
+- mvc_fast_memset(env, l + 1, dest, ldub(src));
++ mvc_fast_memset(env, l + 1, dest, cpu_ldub_data(env, src));
+ return;
+ } else if ((src & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) {
+ mvc_fast_memmove(env, l + 1, dest, src);
+@@ -231,7 +229,7 @@ void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+ }
+ #else
+ if (dest == (src + 1)) {
+- memset(g2h(dest), ldub(src), l + 1);
++ memset(g2h(dest), cpu_ldub_data(env, src), l + 1);
+ return;
+ } else {
+ memmove(g2h(dest), g2h(src), l + 1);
+@@ -242,19 +240,19 @@ void HELPER(mvc)(uint32_t l, uint64_t dest, uint64_t src)
+ /* handle the parts that fit into 8-byte loads/stores */
+ if (dest != (src + 1)) {
+ for (i = 0; i < l_64; i++) {
+- stq(dest + x, ldq(src + x));
++ cpu_stq_data(env, dest + x, cpu_ldq_data(env, src + x));
+ x += 8;
+ }
+ }
+
+ /* slow version crossing pages with byte accesses */
+ for (i = x; i <= l; i++) {
+- stb(dest + i, ldub(src + i));
++ cpu_stb_data(env, dest + i, cpu_ldub_data(env, src + i));
+ }
+ }
+
+ /* compare unsigned byte arrays */
+-uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
++uint32_t HELPER(clc)(CPUS390XState *env, uint32_t l, uint64_t s1, uint64_t s2)
+ {
+ int i;
+ unsigned char x, y;
+@@ -263,8 +261,8 @@ uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
+ HELPER_LOG("%s l %d s1 %" PRIx64 " s2 %" PRIx64 "\n",
+ __func__, l, s1, s2);
+ for (i = 0; i <= l; i++) {
+- x = ldub(s1 + i);
+- y = ldub(s2 + i);
++ x = cpu_ldub_data(env, s1 + i);
++ y = cpu_ldub_data(env, s2 + i);
+ HELPER_LOG("%02x (%c)/%02x (%c) ", x, x, y, y);
+ if (x < y) {
+ cc = 1;
+@@ -281,7 +279,8 @@ uint32_t HELPER(clc)(uint32_t l, uint64_t s1, uint64_t s2)
+ }
+
+ /* compare logical under mask */
+-uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
++uint32_t HELPER(clm)(CPUS390XState *env, uint32_t r1, uint32_t mask,
++ uint64_t addr)
+ {
+ uint8_t r, d;
+ uint32_t cc;
+@@ -291,7 +290,7 @@ uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ cc = 0;
+ while (mask) {
+ if (mask & 8) {
+- d = ldub(addr);
++ d = cpu_ldub_data(env, addr);
+ r = (r1 & 0xff000000UL) >> 24;
+ HELPER_LOG("mask 0x%x %02x/%02x (0x%" PRIx64 ") ", mask, r, d,
+ addr);
+@@ -312,7 +311,8 @@ uint32_t HELPER(clm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ }
+
+ /* store character under mask */
+-void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
++void HELPER(stcm)(CPUS390XState *env, uint32_t r1, uint32_t mask,
++ uint64_t addr)
+ {
+ uint8_t r;
+
+@@ -321,7 +321,7 @@ void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ while (mask) {
+ if (mask & 8) {
+ r = (r1 & 0xff000000UL) >> 24;
+- stb(addr, r);
++ cpu_stb_data(env, addr, r);
+ HELPER_LOG("mask 0x%x %02x (0x%lx) ", mask, r, addr);
+ addr++;
+ }
+@@ -331,7 +331,7 @@ void HELPER(stcm)(uint32_t r1, uint32_t mask, uint64_t addr)
+ HELPER_LOG("\n");
+ }
+
+-static inline uint64_t get_address(int x2, int b2, int d2)
++static inline uint64_t get_address(CPUS390XState *env, int x2, int b2, int d2)
+ {
+ uint64_t r = d2;
+
+@@ -351,7 +351,7 @@ static inline uint64_t get_address(int x2, int b2, int d2)
+ return r;
+ }
+
+-static inline uint64_t get_address_31fix(int reg)
++static inline uint64_t get_address_31fix(CPUS390XState *env, int reg)
+ {
+ uint64_t r = env->regs[reg];
+
+@@ -364,18 +364,18 @@ static inline uint64_t get_address_31fix(int reg)
+ }
+
+ /* search string (c is byte to search, r2 is string, r1 end of string) */
+-uint32_t HELPER(srst)(uint32_t c, uint32_t r1, uint32_t r2)
++uint32_t HELPER(srst)(CPUS390XState *env, uint32_t c, uint32_t r1, uint32_t r2)
+ {
+ uint64_t i;
+ uint32_t cc = 2;
+- uint64_t str = get_address_31fix(r2);
+- uint64_t end = get_address_31fix(r1);
++ uint64_t str = get_address_31fix(env, r2);
++ uint64_t end = get_address_31fix(env, r1);
+
+ HELPER_LOG("%s: c %d *r1 0x%" PRIx64 " *r2 0x%" PRIx64 "\n", __func__,
+ c, env->regs[r1], env->regs[r2]);
+
+ for (i = str; i != end; i++) {
+- if (ldub(i) == c) {
++ if (cpu_ldub_data(env, i) == c) {
+ env->regs[r1] = i;
+ cc = 1;
+ break;
+@@ -386,10 +386,10 @@ uint32_t HELPER(srst)(uint32_t c, uint32_t r1, uint32_t r2)
+ }
+
+ /* unsigned string compare (c is string terminator) */
+-uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
++uint32_t HELPER(clst)(CPUS390XState *env, uint32_t c, uint32_t r1, uint32_t r2)
+ {
+- uint64_t s1 = get_address_31fix(r1);
+- uint64_t s2 = get_address_31fix(r2);
++ uint64_t s1 = get_address_31fix(env, r1);
++ uint64_t s2 = get_address_31fix(env, r2);
+ uint8_t v1, v2;
+ uint32_t cc;
+
+@@ -401,8 +401,8 @@ uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
+ }
+ #endif
+ for (;;) {
+- v1 = ldub(s1);
+- v2 = ldub(s2);
++ v1 = cpu_ldub_data(env, s1);
++ v2 = cpu_ldub_data(env, s2);
+ if ((v1 == c || v2 == c) || (v1 != v2)) {
+ break;
+ }
+@@ -422,14 +422,14 @@ uint32_t HELPER(clst)(uint32_t c, uint32_t r1, uint32_t r2)
+ }
+
+ /* move page */
+-void HELPER(mvpg)(uint64_t r0, uint64_t r1, uint64_t r2)
++void HELPER(mvpg)(CPUS390XState *env, uint64_t r0, uint64_t r1, uint64_t r2)
+ {
+ /* XXX missing r0 handling */
+ #ifdef CONFIG_USER_ONLY
+ int i;
+
+ for (i = 0; i < TARGET_PAGE_SIZE; i++) {
+- stb(r1 + i, ldub(r2 + i));
++ cpu_stb_data(env, r1 + i, cpu_ldub_data(env, r2 + i));
+ }
+ #else
+ mvc_fast_memmove(env, TARGET_PAGE_SIZE, r1, r2);
+@@ -437,10 +437,10 @@ void HELPER(mvpg)(uint64_t r0, uint64_t r1, uint64_t r2)
+ }
+
+ /* string copy (c is string terminator) */
+-void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
++void HELPER(mvst)(CPUS390XState *env, uint32_t c, uint32_t r1, uint32_t r2)
+ {
+- uint64_t dest = get_address_31fix(r1);
+- uint64_t src = get_address_31fix(r2);
++ uint64_t dest = get_address_31fix(env, r1);
++ uint64_t src = get_address_31fix(env, r2);
+ uint8_t v;
+
+ c = c & 0xff;
+@@ -451,8 +451,8 @@ void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
+ }
+ #endif
+ for (;;) {
+- v = ldub(src);
+- stb(dest, v);
++ v = cpu_ldub_data(env, src);
++ cpu_stb_data(env, dest, v);
+ if (v == c) {
+ break;
+ }
+@@ -463,15 +463,15 @@ void HELPER(mvst)(uint32_t c, uint32_t r1, uint32_t r2)
+ }
+
+ /* compare and swap 64-bit */
+-uint32_t HELPER(csg)(uint32_t r1, uint64_t a2, uint32_t r3)
++uint32_t HELPER(csg)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ /* FIXME: locking? */
+ uint32_t cc;
+- uint64_t v2 = ldq(a2);
++ uint64_t v2 = cpu_ldq_data(env, a2);
+
+ if (env->regs[r1] == v2) {
+ cc = 0;
+- stq(a2, env->regs[r3]);
++ cpu_stq_data(env, a2, env->regs[r3]);
+ } else {
+ cc = 1;
+ env->regs[r1] = v2;
+@@ -480,19 +480,19 @@ uint32_t HELPER(csg)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* compare double and swap 64-bit */
+-uint32_t HELPER(cdsg)(uint32_t r1, uint64_t a2, uint32_t r3)
++uint32_t HELPER(cdsg)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ /* FIXME: locking? */
+ uint32_t cc;
+- uint64_t v2_hi = ldq(a2);
+- uint64_t v2_lo = ldq(a2 + 8);
++ uint64_t v2_hi = cpu_ldq_data(env, a2);
++ uint64_t v2_lo = cpu_ldq_data(env, a2 + 8);
+ uint64_t v1_hi = env->regs[r1];
+ uint64_t v1_lo = env->regs[r1 + 1];
+
+ if ((v1_hi == v2_hi) && (v1_lo == v2_lo)) {
+ cc = 0;
+- stq(a2, env->regs[r3]);
+- stq(a2 + 8, env->regs[r3 + 1]);
++ cpu_stq_data(env, a2, env->regs[r3]);
++ cpu_stq_data(env, a2 + 8, env->regs[r3 + 1]);
+ } else {
+ cc = 1;
+ env->regs[r1] = v2_hi;
+@@ -503,16 +503,16 @@ uint32_t HELPER(cdsg)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* compare and swap 32-bit */
+-uint32_t HELPER(cs)(uint32_t r1, uint64_t a2, uint32_t r3)
++uint32_t HELPER(cs)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ /* FIXME: locking? */
+ uint32_t cc;
+- uint32_t v2 = ldl(a2);
++ uint32_t v2 = cpu_ldl_data(env, a2);
+
+ HELPER_LOG("%s: r1 %d a2 0x%lx r3 %d\n", __func__, r1, a2, r3);
+ if (((uint32_t)env->regs[r1]) == v2) {
+ cc = 0;
+- stl(a2, (uint32_t)env->regs[r3]);
++ cpu_stl_data(env, a2, (uint32_t)env->regs[r3]);
+ } else {
+ cc = 1;
+ env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | v2;
+@@ -520,7 +520,8 @@ uint32_t HELPER(cs)(uint32_t r1, uint64_t a2, uint32_t r3)
+ return cc;
+ }
+
+-static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
++static uint32_t helper_icm(CPUS390XState *env, uint32_t r1, uint64_t address,
++ uint32_t mask)
+ {
+ int pos = 24; /* top of the lower half of r1 */
+ uint64_t rmask = 0xff000000ULL;
+@@ -531,7 +532,7 @@ static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
+ while (mask) {
+ if (mask & 8) {
+ env->regs[r1] &= ~rmask;
+- val = ldub(address);
++ val = cpu_ldub_data(env, address);
+ if ((val & 0x80) && !ccd) {
+ cc = 1;
+ }
+@@ -557,9 +558,10 @@ static uint32_t helper_icm(uint32_t r1, uint64_t address, uint32_t mask)
+ in other words: tricky...
+ currently implemented by interpreting the cases it is most commonly used in
+ */
+-uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
++uint32_t HELPER(ex)(CPUS390XState *env, uint32_t cc, uint64_t v1,
++ uint64_t addr, uint64_t ret)
+ {
+- uint16_t insn = lduw_code(addr);
++ uint16_t insn = cpu_lduw_code(env, addr);
+
+ HELPER_LOG("%s: v1 0x%lx addr 0x%lx insn 0x%x\n", __func__, v1, addr,
+ insn);
+@@ -567,23 +569,27 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ uint32_t l, insn2, b1, b2, d1, d2;
+
+ l = v1 & 0xff;
+- insn2 = ldl_code(addr + 2);
++ insn2 = cpu_ldl_code(env, addr + 2);
+ b1 = (insn2 >> 28) & 0xf;
+ b2 = (insn2 >> 12) & 0xf;
+ d1 = (insn2 >> 16) & 0xfff;
+ d2 = insn2 & 0xfff;
+ switch (insn & 0xf00) {
+ case 0x200:
+- helper_mvc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ helper_mvc(env, l, get_address(env, 0, b1, d1),
++ get_address(env, 0, b2, d2));
+ break;
+ case 0x500:
+- cc = helper_clc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ cc = helper_clc(env, l, get_address(env, 0, b1, d1),
++ get_address(env, 0, b2, d2));
+ break;
+ case 0x700:
+- cc = helper_xc(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ cc = helper_xc(env, l, get_address(env, 0, b1, d1),
++ get_address(env, 0, b2, d2));
+ break;
+ case 0xc00:
+- helper_tr(l, get_address(0, b1, d1), get_address(0, b2, d2));
++ helper_tr(env, l, get_address(env, 0, b1, d1),
++ get_address(env, 0, b2, d2));
+ break;
+ default:
+ goto abort;
+@@ -599,12 +605,12 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ } else if ((insn & 0xff00) == 0xbf00) {
+ uint32_t insn2, r1, r3, b2, d2;
+
+- insn2 = ldl_code(addr + 2);
++ insn2 = cpu_ldl_code(env, addr + 2);
+ r1 = (insn2 >> 20) & 0xf;
+ r3 = (insn2 >> 16) & 0xf;
+ b2 = (insn2 >> 12) & 0xf;
+ d2 = insn2 & 0xfff;
+- cc = helper_icm(r1, get_address(0, b2, d2), r3);
++ cc = helper_icm(env, r1, get_address(env, 0, b2, d2), r3);
+ } else {
+ abort:
+ cpu_abort(env, "EXECUTE on instruction prefix 0x%x not implemented\n",
+@@ -614,13 +620,14 @@ uint32_t HELPER(ex)(uint32_t cc, uint64_t v1, uint64_t addr, uint64_t ret)
+ }
+
+ /* store character under mask high operates on the upper half of r1 */
+-void HELPER(stcmh)(uint32_t r1, uint64_t address, uint32_t mask)
++void HELPER(stcmh)(CPUS390XState *env, uint32_t r1, uint64_t address,
++ uint32_t mask)
+ {
+ int pos = 56; /* top of the upper half of r1 */
+
+ while (mask) {
+ if (mask & 8) {
+- stb(address, (env->regs[r1] >> pos) & 0xff);
++ cpu_stb_data(env, address, (env->regs[r1] >> pos) & 0xff);
+ address++;
+ }
+ mask = (mask << 1) & 0xf;
+@@ -630,7 +637,8 @@ void HELPER(stcmh)(uint32_t r1, uint64_t address, uint32_t mask)
+
+ /* insert character under mask high; same as icm, but operates on the
+ upper half of r1 */
+-uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
++uint32_t HELPER(icmh)(CPUS390XState *env, uint32_t r1, uint64_t address,
++ uint32_t mask)
+ {
+ int pos = 56; /* top of the upper half of r1 */
+ uint64_t rmask = 0xff00000000000000ULL;
+@@ -641,7 +649,7 @@ uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
+ while (mask) {
+ if (mask & 8) {
+ env->regs[r1] &= ~rmask;
+- val = ldub(address);
++ val = cpu_ldub_data(env, address);
+ if ((val & 0x80) && !ccd) {
+ cc = 1;
+ }
+@@ -661,12 +669,12 @@ uint32_t HELPER(icmh)(uint32_t r1, uint64_t address, uint32_t mask)
+ }
+
+ /* load access registers r1 to r3 from memory at a2 */
+-void HELPER(lam)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(lam)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- env->aregs[i] = ldl(a2);
++ env->aregs[i] = cpu_ldl_data(env, a2);
+ a2 += 4;
+
+ if (i == r3) {
+@@ -676,12 +684,12 @@ void HELPER(lam)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* store access registers r1 to r3 in memory at a2 */
+-void HELPER(stam)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(stam)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- stl(a2, env->aregs[i]);
++ cpu_stl_data(env, a2, env->aregs[i]);
+ a2 += 4;
+
+ if (i == r3) {
+@@ -691,12 +699,12 @@ void HELPER(stam)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* move long */
+-uint32_t HELPER(mvcl)(uint32_t r1, uint32_t r2)
++uint32_t HELPER(mvcl)(CPUS390XState *env, uint32_t r1, uint32_t r2)
+ {
+ uint64_t destlen = env->regs[r1 + 1] & 0xffffff;
+- uint64_t dest = get_address_31fix(r1);
++ uint64_t dest = get_address_31fix(env, r1);
+ uint64_t srclen = env->regs[r2 + 1] & 0xffffff;
+- uint64_t src = get_address_31fix(r2);
++ uint64_t src = get_address_31fix(env, r2);
+ uint8_t pad = src >> 24;
+ uint8_t v;
+ uint32_t cc;
+@@ -714,12 +722,12 @@ uint32_t HELPER(mvcl)(uint32_t r1, uint32_t r2)
+ }
+
+ for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
+- v = ldub(src);
+- stb(dest, v);
++ v = cpu_ldub_data(env, src);
++ cpu_stb_data(env, dest, v);
+ }
+
+ for (; destlen; dest++, destlen--) {
+- stb(dest, pad);
++ cpu_stb_data(env, dest, pad);
+ }
+
+ env->regs[r1 + 1] = destlen;
+@@ -732,7 +740,8 @@ uint32_t HELPER(mvcl)(uint32_t r1, uint32_t r2)
+ }
+
+ /* move long extended another memcopy insn with more bells and whistles */
+-uint32_t HELPER(mvcle)(uint32_t r1, uint64_t a2, uint32_t r3)
++uint32_t HELPER(mvcle)(CPUS390XState *env, uint32_t r1, uint64_t a2,
++ uint32_t r3)
+ {
+ uint64_t destlen = env->regs[r1 + 1];
+ uint64_t dest = env->regs[r1];
+@@ -762,12 +771,12 @@ uint32_t HELPER(mvcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ for (; destlen && srclen; src++, dest++, destlen--, srclen--) {
+- v = ldub(src);
+- stb(dest, v);
++ v = cpu_ldub_data(env, src);
++ cpu_stb_data(env, dest, v);
+ }
+
+ for (; destlen; dest++, destlen--) {
+- stb(dest, pad);
++ cpu_stb_data(env, dest, pad);
+ }
+
+ env->regs[r1 + 1] = destlen;
+@@ -781,12 +790,13 @@ uint32_t HELPER(mvcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* compare logical long extended memcompare insn with padding */
+-uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
++uint32_t HELPER(clcle)(CPUS390XState *env, uint32_t r1, uint64_t a2,
++ uint32_t r3)
+ {
+ uint64_t destlen = env->regs[r1 + 1];
+- uint64_t dest = get_address_31fix(r1);
++ uint64_t dest = get_address_31fix(env, r1);
+ uint64_t srclen = env->regs[r3 + 1];
+- uint64_t src = get_address_31fix(r3);
++ uint64_t src = get_address_31fix(env, r3);
+ uint8_t pad = a2 & 0xff;
+ uint8_t v1 = 0, v2 = 0;
+ uint32_t cc = 0;
+@@ -800,8 +810,8 @@ uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ for (; destlen || srclen; src++, dest++, destlen--, srclen--) {
+- v1 = srclen ? ldub(src) : pad;
+- v2 = destlen ? ldub(dest) : pad;
++ v1 = srclen ? cpu_ldub_data(env, src) : pad;
++ v2 = destlen ? cpu_ldub_data(env, dest) : pad;
+ if (v1 != v2) {
+ cc = (v1 < v2) ? 1 : 2;
+ break;
+@@ -818,14 +828,14 @@ uint32_t HELPER(clcle)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+
+ /* checksum */
+-void HELPER(cksm)(uint32_t r1, uint32_t r2)
++void HELPER(cksm)(CPUS390XState *env, uint32_t r1, uint32_t r2)
+ {
+- uint64_t src = get_address_31fix(r2);
++ uint64_t src = get_address_31fix(env, r2);
+ uint64_t src_len = env->regs[(r2 + 1) & 15];
+ uint64_t cksm = (uint32_t)env->regs[r1];
+
+ while (src_len >= 4) {
+- cksm += ldl(src);
++ cksm += cpu_ldl_data(env, src);
+
+ /* move to next word */
+ src_len -= 4;
+@@ -836,14 +846,14 @@ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ case 0:
+ break;
+ case 1:
+- cksm += ldub(src) << 24;
++ cksm += cpu_ldub_data(env, src) << 24;
+ break;
+ case 2:
+- cksm += lduw(src) << 16;
++ cksm += cpu_lduw_data(env, src) << 16;
+ break;
+ case 3:
+- cksm += lduw(src) << 16;
+- cksm += ldub(src + 2) << 8;
++ cksm += cpu_lduw_data(env, src) << 16;
++ cksm += cpu_ldub_data(env, src + 2) << 8;
+ break;
+ }
+
+@@ -856,7 +866,8 @@ void HELPER(cksm)(uint32_t r1, uint32_t r2)
+ ((uint32_t)cksm + (cksm >> 32));
+ }
+
+-void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
++void HELPER(unpk)(CPUS390XState *env, uint32_t len, uint64_t dest,
++ uint64_t src)
+ {
+ int len_dest = len >> 4;
+ int len_src = len & 0xf;
+@@ -867,8 +878,8 @@ void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
+ src += len_src;
+
+ /* last byte is special, it only flips the nibbles */
+- b = ldub(src);
+- stb(dest, (b << 4) | (b >> 4));
++ b = cpu_ldub_data(env, src);
++ cpu_stb_data(env, dest, (b << 4) | (b >> 4));
+ src--;
+ len_src--;
+
+@@ -878,7 +889,7 @@ void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
+ uint8_t cur_byte = 0;
+
+ if (len_src > 0) {
+- cur_byte = ldub(src);
++ cur_byte = cpu_ldub_data(env, src);
+ }
+
+ len_dest--;
+@@ -897,30 +908,31 @@ void HELPER(unpk)(uint32_t len, uint64_t dest, uint64_t src)
+ /* zone bits */
+ cur_byte |= 0xf0;
+
+- stb(dest, cur_byte);
++ cpu_stb_data(env, dest, cur_byte);
+ }
+ }
+
+-void HELPER(tr)(uint32_t len, uint64_t array, uint64_t trans)
++void HELPER(tr)(CPUS390XState *env, uint32_t len, uint64_t array,
++ uint64_t trans)
+ {
+ int i;
+
+ for (i = 0; i <= len; i++) {
+- uint8_t byte = ldub(array + i);
+- uint8_t new_byte = ldub(trans + byte);
++ uint8_t byte = cpu_ldub_data(env, array + i);
++ uint8_t new_byte = cpu_ldub_data(env, trans + byte);
+
+- stb(array + i, new_byte);
++ cpu_stb_data(env, array + i, new_byte);
+ }
+ }
+
+ #if !defined(CONFIG_USER_ONLY)
+-void HELPER(lctlg)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(lctlg)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+ uint64_t src = a2;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- env->cregs[i] = ldq(src);
++ env->cregs[i] = cpu_ldq_data(env, src);
+ HELPER_LOG("load ctl %d from 0x%" PRIx64 " == 0x%" PRIx64 "\n",
+ i, src, env->cregs[i]);
+ src += sizeof(uint64_t);
+@@ -933,13 +945,14 @@ void HELPER(lctlg)(uint32_t r1, uint64_t a2, uint32_t r3)
+ tlb_flush(env, 1);
+ }
+
+-void HELPER(lctl)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(lctl)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+ uint64_t src = a2;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- env->cregs[i] = (env->cregs[i] & 0xFFFFFFFF00000000ULL) | ldl(src);
++ env->cregs[i] = (env->cregs[i] & 0xFFFFFFFF00000000ULL) |
++ cpu_ldl_data(env, src);
+ src += sizeof(uint32_t);
+
+ if (i == r3) {
+@@ -950,13 +963,13 @@ void HELPER(lctl)(uint32_t r1, uint64_t a2, uint32_t r3)
+ tlb_flush(env, 1);
+ }
+
+-void HELPER(stctg)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(stctg)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+ uint64_t dest = a2;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- stq(dest, env->cregs[i]);
++ cpu_stq_data(env, dest, env->cregs[i]);
+ dest += sizeof(uint64_t);
+
+ if (i == r3) {
+@@ -965,13 +978,13 @@ void HELPER(stctg)(uint32_t r1, uint64_t a2, uint32_t r3)
+ }
+ }
+
+-void HELPER(stctl)(uint32_t r1, uint64_t a2, uint32_t r3)
++void HELPER(stctl)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
+ {
+ int i;
+ uint64_t dest = a2;
+
+ for (i = r1;; i = (i + 1) % 16) {
+- stl(dest, env->cregs[i]);
++ cpu_stl_data(env, dest, env->cregs[i]);
+ dest += sizeof(uint32_t);
+
+ if (i == r3) {
+@@ -988,9 +1001,9 @@ uint32_t HELPER(tprot)(uint64_t a1, uint64_t a2)
+ }
+
+ /* insert storage key extended */
+-uint64_t HELPER(iske)(uint64_t r2)
++uint64_t HELPER(iske)(CPUS390XState *env, uint64_t r2)
+ {
+- uint64_t addr = get_address(0, 0, r2);
++ uint64_t addr = get_address(env, 0, 0, r2);
+
+ if (addr > ram_size) {
+ return 0;
+@@ -1000,9 +1013,9 @@ uint64_t HELPER(iske)(uint64_t r2)
+ }
+
+ /* set storage key extended */
+-void HELPER(sske)(uint32_t r1, uint64_t r2)
++void HELPER(sske)(CPUS390XState *env, uint32_t r1, uint64_t r2)
+ {
+- uint64_t addr = get_address(0, 0, r2);
++ uint64_t addr = get_address(env, 0, 0, r2);
+
+ if (addr > ram_size) {
+ return;
+@@ -1012,7 +1025,7 @@ void HELPER(sske)(uint32_t r1, uint64_t r2)
+ }
+
+ /* reset reference bit extended */
+-uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)
++uint32_t HELPER(rrbe)(CPUS390XState *env, uint32_t r1, uint64_t r2)
+ {
+ uint8_t re;
+ uint8_t key;
+@@ -1038,15 +1051,15 @@ uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)
+ }
+
+ /* compare and swap and purge */
+-uint32_t HELPER(csp)(uint32_t r1, uint32_t r2)
++uint32_t HELPER(csp)(CPUS390XState *env, uint32_t r1, uint32_t r2)
+ {
+ uint32_t cc;
+ uint32_t o1 = env->regs[r1];
+- uint64_t a2 = get_address_31fix(r2) & ~3ULL;
+- uint32_t o2 = ldl(a2);
++ uint64_t a2 = get_address_31fix(env, r2) & ~3ULL;
++ uint32_t o2 = cpu_ldl_data(env, a2);
+
+ if (o1 == o2) {
+- stl(a2, env->regs[(r1 + 1) & 15]);
++ cpu_stl_data(env, a2, env->regs[(r1 + 1) & 15]);
+ if (env->regs[r2] & 0x3) {
+ /* flush TLB / ALB */
+ tlb_flush(env, 1);
+@@ -1060,8 +1073,8 @@ uint32_t HELPER(csp)(uint32_t r1, uint32_t r2)
+ return cc;
+ }
+
+-static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
+- uint64_t mode2)
++static uint32_t mvc_asc(CPUS390XState *env, int64_t l, uint64_t a1,
++ uint64_t mode1, uint64_t a2, uint64_t mode2)
+ {
+ target_ulong src, dest;
+ int flags, cc = 0, i;
+@@ -1089,7 +1102,7 @@ static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
+ /* XXX be more clever */
+ if ((((dest + i) & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) ||
+ (((src + i) & TARGET_PAGE_MASK) != (src & TARGET_PAGE_MASK))) {
+- mvc_asc(l - i, a1 + i, mode1, a2 + i, mode2);
++ mvc_asc(env, l - i, a1 + i, mode1, a2 + i, mode2);
+ break;
+ }
+ stb_phys(dest + i, ldub_phys(src + i));
+@@ -1098,24 +1111,24 @@ static uint32_t mvc_asc(int64_t l, uint64_t a1, uint64_t mode1, uint64_t a2,
+ return cc;
+ }
+
+-uint32_t HELPER(mvcs)(uint64_t l, uint64_t a1, uint64_t a2)
++uint32_t HELPER(mvcs)(CPUS390XState *env, uint64_t l, uint64_t a1, uint64_t a2)
+ {
+ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+ __func__, l, a1, a2);
+
+- return mvc_asc(l, a1, PSW_ASC_SECONDARY, a2, PSW_ASC_PRIMARY);
++ return mvc_asc(env, l, a1, PSW_ASC_SECONDARY, a2, PSW_ASC_PRIMARY);
+ }
+
+-uint32_t HELPER(mvcp)(uint64_t l, uint64_t a1, uint64_t a2)
++uint32_t HELPER(mvcp)(CPUS390XState *env, uint64_t l, uint64_t a1, uint64_t a2)
+ {
+ HELPER_LOG("%s: %16" PRIx64 " %16" PRIx64 " %16" PRIx64 "\n",
+ __func__, l, a1, a2);
+
+- return mvc_asc(l, a1, PSW_ASC_PRIMARY, a2, PSW_ASC_SECONDARY);
++ return mvc_asc(env, l, a1, PSW_ASC_PRIMARY, a2, PSW_ASC_SECONDARY);
+ }
+
+ /* invalidate pte */
+-void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
++void HELPER(ipte)(CPUS390XState *env, uint64_t pte_addr, uint64_t vaddr)
+ {
+ uint64_t page = vaddr & TARGET_PAGE_MASK;
+ uint64_t pte = 0;
+@@ -1141,19 +1154,19 @@ void HELPER(ipte)(uint64_t pte_addr, uint64_t vaddr)
+ }
+
+ /* flush local tlb */
+-void HELPER(ptlb)(void)
++void HELPER(ptlb)(CPUS390XState *env)
+ {
+ tlb_flush(env, 1);
+ }
+
+ /* store using real address */
+-void HELPER(stura)(uint64_t addr, uint32_t v1)
++void HELPER(stura)(CPUS390XState *env, uint64_t addr, uint32_t v1)
+ {
+- stw_phys(get_address(0, 0, addr), v1);
++ stw_phys(get_address(env, 0, 0, addr), v1);
+ }
+
+ /* load real address */
+-uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
++uint32_t HELPER(lra)(CPUS390XState *env, uint64_t addr, uint32_t r1)
+ {
+ uint32_t cc = 0;
+ int old_exc = env->exception_index;
+@@ -1188,52 +1201,3 @@ uint32_t HELPER(lra)(uint64_t addr, uint32_t r1)
+ }
+
+ #endif
+-
+-/* temporary wrappers */
+-#if defined(CONFIG_USER_ONLY)
+-#define ldub_data(addr) ldub_raw(addr)
+-#define lduw_data(addr) lduw_raw(addr)
+-#define ldl_data(addr) ldl_raw(addr)
+-#define ldq_data(addr) ldq_raw(addr)
+-
+-#define stb_data(addr, data) stb_raw(addr, data)
+-#define stw_data(addr, data) stw_raw(addr, data)
+-#define stl_data(addr, data) stl_raw(addr, data)
+-#define stq_data(addr, data) stq_raw(addr, data)
+-#endif
+-
+-#define WRAP_LD(rettype, fn) \
+- rettype cpu_ ## fn(CPUS390XState *env1, target_ulong addr) \
+- { \
+- CPUS390XState *saved_env; \
+- rettype ret; \
+- \
+- saved_env = env; \
+- env = env1; \
+- ret = fn(addr); \
+- env = saved_env; \
+- return ret; \
+- }
+-
+-WRAP_LD(uint32_t, ldub_data)
+-WRAP_LD(uint32_t, lduw_data)
+-WRAP_LD(uint32_t, ldl_data)
+-WRAP_LD(uint64_t, ldq_data)
+-#undef WRAP_LD
+-
+-#define WRAP_ST(datatype, fn) \
+- void cpu_ ## fn(CPUS390XState *env1, target_ulong addr, datatype val) \
+- { \
+- CPUS390XState *saved_env; \
+- \
+- saved_env = env; \
+- env = env1; \
+- fn(addr, val); \
+- env = saved_env; \
+- }
+-
+-WRAP_ST(uint32_t, stb_data)
+-WRAP_ST(uint32_t, stw_data)
+-WRAP_ST(uint32_t, stl_data)
+-WRAP_ST(uint64_t, stq_data)
+-#undef WRAP_ST
+diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
+index ced26c6..2938ac9 100644
+--- a/target-s390x/misc_helper.c
++++ b/target-s390x/misc_helper.c
+@@ -31,10 +31,7 @@
+ #endif
+
+ #if !defined(CONFIG_USER_ONLY)
+-/* temporarily disabled due to wrapper use */
+-#if 0
+ #include "softmmu_exec.h"
+-#endif
+ #include "sysemu.h"
+ #endif
+
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index 0c61e63..66119cd 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -276,19 +276,19 @@ static inline void potential_page_fault(DisasContext *s)
+
+ static inline uint64_t ld_code2(uint64_t pc)
+ {
+- return (uint64_t)lduw_code(pc);
++ return (uint64_t)cpu_lduw_code(cpu_single_env, pc);
+ }
+
+ static inline uint64_t ld_code4(uint64_t pc)
+ {
+- return (uint64_t)ldl_code(pc);
++ return (uint64_t)cpu_ldl_code(cpu_single_env, pc);
+ }
+
+ static inline uint64_t ld_code6(uint64_t pc)
+ {
+ uint64_t opc;
+- opc = (uint64_t)lduw_code(pc) << 32;
+- opc |= (uint64_t)(uint32_t)ldl_code(pc+2);
++ opc = (uint64_t)cpu_lduw_code(cpu_single_env, pc) << 32;
++ opc |= (uint64_t)(uint32_t)cpu_ldl_code(cpu_single_env, pc + 2);
+ return opc;
+ }
+
+@@ -1263,7 +1263,7 @@ static void gen_op_mvc(DisasContext *s, int l, TCGv_i64 s1, TCGv_i64 s2)
+ /* Fall back to helper */
+ vl = tcg_const_i32(l);
+ potential_page_fault(s);
+- gen_helper_mvc(vl, s1, s2);
++ gen_helper_mvc(cpu_env, vl, s1, s2);
+ tcg_temp_free_i32(vl);
+ return;
+ }
+@@ -1455,7 +1455,7 @@ static void gen_op_clc(DisasContext *s, int l, TCGv_i64 s1, TCGv_i64 s2)
+
+ potential_page_fault(s);
+ vl = tcg_const_i32(l);
+- gen_helper_clc(cc_op, vl, s1, s2);
++ gen_helper_clc(cc_op, cpu_env, vl, s1, s2);
+ tcg_temp_free_i32(vl);
+ set_cc_static(s);
+ }
+@@ -2094,7 +2094,7 @@ do_mh:
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_stcmh(tmp32_1, tmp, tmp32_2);
++ gen_helper_stcmh(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -2107,7 +2107,7 @@ do_mh:
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_lctlg(tmp32_1, tmp, tmp32_2);
++ gen_helper_lctlg(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -2119,7 +2119,7 @@ do_mh:
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_stctg(tmp32_1, tmp, tmp32_2);
++ gen_helper_stctg(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -2131,7 +2131,7 @@ do_mh:
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+ /* XXX rewrite in tcg */
+- gen_helper_csg(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_csg(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -2143,7 +2143,7 @@ do_mh:
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+ /* XXX rewrite in tcg */
+- gen_helper_cdsg(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_cdsg(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -2183,7 +2183,7 @@ do_mh:
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+ /* XXX split CC calculation out */
+- gen_helper_icmh(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_icmh(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -2635,7 +2635,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+ potential_page_fault(s);
+- gen_helper_cksm(tmp32_1, tmp32_2);
++ gen_helper_cksm(cpu_env, tmp32_1, tmp32_2);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+ gen_op_movi_cc(s, 0);
+@@ -2664,7 +2664,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp2 = load_reg(r1);
+ tmp3 = load_reg(r2);
+ potential_page_fault(s);
+- gen_helper_mvpg(tmp, tmp2, tmp3);
++ gen_helper_mvpg(cpu_env, tmp, tmp2, tmp3);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+ tcg_temp_free_i64(tmp3);
+@@ -2676,7 +2676,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_2 = tcg_const_i32(r1);
+ tmp32_3 = tcg_const_i32(r2);
+ potential_page_fault(s);
+- gen_helper_mvst(tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_mvst(cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+ tcg_temp_free_i32(tmp32_3);
+@@ -2687,7 +2687,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_2 = tcg_const_i32(r1);
+ tmp32_3 = tcg_const_i32(r2);
+ potential_page_fault(s);
+- gen_helper_clst(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_clst(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -2698,7 +2698,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_2 = tcg_const_i32(r1);
+ tmp32_3 = tcg_const_i32(r2);
+ potential_page_fault(s);
+- gen_helper_srst(cc_op, tmp32_1, tmp32_2, tmp32_3);
++ gen_helper_srst(cc_op, cpu_env, tmp32_1, tmp32_2, tmp32_3);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -2785,7 +2785,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ case 0x0d: /* PTLB [S] */
+ /* Purge TLB */
+ check_privileged(s, ilc);
+- gen_helper_ptlb();
++ gen_helper_ptlb(cpu_env);
+ break;
+ case 0x10: /* SPX D2(B2) [S] */
+ /* Set Prefix Register */
+@@ -2828,7 +2828,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ r2 = insn & 0xf;
+ tmp = load_reg(r1);
+ tmp2 = load_reg(r2);
+- gen_helper_ipte(tmp, tmp2);
++ gen_helper_ipte(cpu_env, tmp, tmp2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+ break;
+@@ -2839,7 +2839,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ r2 = insn & 0xf;
+ tmp = load_reg(r2);
+ tmp2 = tcg_temp_new_i64();
+- gen_helper_iske(tmp2, tmp);
++ gen_helper_iske(tmp2, cpu_env, tmp);
+ store_reg(r1, tmp2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+@@ -2851,7 +2851,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ r2 = insn & 0xf;
+ tmp32_1 = load_reg32(r1);
+ tmp = load_reg(r2);
+- gen_helper_rrbe(cc_op, tmp32_1, tmp);
++ gen_helper_rrbe(cc_op, cpu_env, tmp32_1, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp);
+@@ -2863,7 +2863,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ r2 = insn & 0xf;
+ tmp32_1 = load_reg32(r1);
+ tmp = load_reg(r2);
+- gen_helper_sske(tmp32_1, tmp);
++ gen_helper_sske(cpu_env, tmp32_1, tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp);
+ break;
+@@ -2880,7 +2880,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ tmp32_1 = load_reg32(r1);
+ tmp = load_reg(r2);
+ potential_page_fault(s);
+- gen_helper_stura(tmp, tmp32_1);
++ gen_helper_stura(cpu_env, tmp, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i64(tmp);
+ break;
+@@ -2891,7 +2891,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ r2 = insn & 0xf;
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+- gen_helper_csp(cc_op, tmp32_1, tmp32_2);
++ gen_helper_csp(cc_op, cpu_env, tmp32_1, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -3865,7 +3865,7 @@ static void disas_s390_insn(DisasContext *s)
+ int ilc;
+ int l1;
+
+- opc = ldub_code(s->pc);
++ opc = cpu_ldub_code(cpu_single_env, s->pc);
+ LOG_DISAS("opc 0x%x\n", opc);
+
+ ilc = get_ilc(opc);
+@@ -3951,7 +3951,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+ potential_page_fault(s);
+- gen_helper_mvcl(cc_op, tmp32_1, tmp32_2);
++ gen_helper_mvcl(cc_op, cpu_env, tmp32_1, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4165,7 +4165,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp3 = tcg_const_i64(s->pc + 4);
+ update_psw_addr(s);
+ gen_op_calc_cc(s);
+- gen_helper_ex(cc_op, cc_op, tmp2, tmp, tmp3);
++ gen_helper_ex(cc_op, cpu_env, cc_op, tmp2, tmp, tmp3);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i64(tmp2);
+@@ -4694,7 +4694,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_lam(tmp32_1, tmp, tmp32_2);
++ gen_helper_lam(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4706,7 +4706,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_stam(tmp32_1, tmp, tmp32_2);
++ gen_helper_stam(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4732,7 +4732,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_mvcle(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_mvcle(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -4745,7 +4745,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_clcle(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_clcle(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -4789,7 +4789,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp32_1 = tcg_const_i32(r1);
+ potential_page_fault(s);
+- gen_helper_lra(cc_op, tmp, tmp32_1);
++ gen_helper_lra(cc_op, cpu_env, tmp, tmp32_1);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -4835,7 +4835,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_stctl(tmp32_1, tmp, tmp32_2);
++ gen_helper_stctl(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4849,7 +4849,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_lctl(tmp32_1, tmp, tmp32_2);
++ gen_helper_lctl(cpu_env, tmp32_1, tmp, tmp32_2);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4869,7 +4869,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_cs(cc_op, tmp32_1, tmp, tmp32_2);
++ gen_helper_cs(cc_op, cpu_env, tmp32_1, tmp, tmp32_2);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -4882,7 +4882,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_clm(cc_op, tmp32_1, tmp32_2, tmp);
++ gen_helper_clm(cc_op, cpu_env, tmp32_1, tmp32_2, tmp);
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+@@ -4895,7 +4895,7 @@ static void disas_s390_insn(DisasContext *s)
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+ potential_page_fault(s);
+- gen_helper_stcm(tmp32_1, tmp32_2, tmp);
++ gen_helper_stcm(cpu_env, tmp32_1, tmp32_2, tmp);
+ tcg_temp_free_i64(tmp);
+ tcg_temp_free_i32(tmp32_1);
+ tcg_temp_free_i32(tmp32_2);
+@@ -4992,7 +4992,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0xd4:
+ potential_page_fault(s);
+- gen_helper_nc(cc_op, vl, tmp, tmp2);
++ gen_helper_nc(cc_op, cpu_env, vl, tmp, tmp2);
+ set_cc_static(s);
+ break;
+ case 0xd5:
+@@ -5000,22 +5000,22 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0xd6:
+ potential_page_fault(s);
+- gen_helper_oc(cc_op, vl, tmp, tmp2);
++ gen_helper_oc(cc_op, cpu_env, vl, tmp, tmp2);
+ set_cc_static(s);
+ break;
+ case 0xd7:
+ potential_page_fault(s);
+- gen_helper_xc(cc_op, vl, tmp, tmp2);
++ gen_helper_xc(cc_op, cpu_env, vl, tmp, tmp2);
+ set_cc_static(s);
+ break;
+ case 0xdc:
+ potential_page_fault(s);
+- gen_helper_tr(vl, tmp, tmp2);
++ gen_helper_tr(cpu_env, vl, tmp, tmp2);
+ set_cc_static(s);
+ break;
+ case 0xf3:
+ potential_page_fault(s);
+- gen_helper_unpk(vl, tmp, tmp2);
++ gen_helper_unpk(cpu_env, vl, tmp, tmp2);
+ break;
+ default:
+ tcg_abort();
+@@ -5040,9 +5040,9 @@ static void disas_s390_insn(DisasContext *s)
+ tmp2 = get_address(s, 0, b1, d1);
+ tmp3 = get_address(s, 0, b2, d2);
+ if (opc == 0xda) {
+- gen_helper_mvcp(cc_op, tmp, tmp2, tmp3);
++ gen_helper_mvcp(cc_op, cpu_env, tmp, tmp2, tmp3);
+ } else {
+- gen_helper_mvcs(cc_op, tmp, tmp2, tmp3);
++ gen_helper_mvcs(cc_op, cpu_env, tmp, tmp2, tmp3);
+ }
+ set_cc_static(s);
+ tcg_temp_free_i64(tmp);
+--
+1.7.12.1
+
--- /dev/null
+From 0b95df52ecad351c916108e9f3a9d1bc3327b495 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Sat, 8 Sep 2012 03:45:43 +0000
+Subject: [PATCH] tcg/s390: fix ld/st with CONFIG_TCG_PASS_AREG0
+
+The load/store slow path has been broken in e141ab52d:
+- We need to move 4 registers for store functions and 3 registers for
+ load functions and not the reverse.
+- According to the s390x calling convention the arguments of a function
+ should be zero extended. This means that the register shift should be
+ done with TCG_TYPE_I64 to ensure the higher word is correctly zero
+ extended when needed.
+
+I am aware that CONFIG_TCG_PASS_AREG0 is being removed and thus that
+this patch can be improved, but doing so means it can also be applied to
+the 1.1 and 1.2 stable branches.
+
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/s390/tcg-target.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tcg/s390/tcg-target.c b/tcg/s390/tcg-target.c
+index 04662c1..99b5339 100644
+--- a/tcg/s390/tcg-target.c
++++ b/tcg/s390/tcg-target.c
+@@ -1509,11 +1509,13 @@ static void tcg_prepare_qemu_ldst(TCGContext* s, TCGReg data_reg,
+ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R4, mem_index);
+ #ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[2],
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[3],
++ tcg_target_call_iarg_regs[2]);
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+ tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[1],
+ tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+ #endif
+ tgen_calli(s, (tcg_target_ulong)qemu_st_helpers[s_bits]);
+@@ -1521,13 +1523,11 @@ static void tcg_prepare_qemu_ldst(TCGContext* s, TCGReg data_reg,
+ tcg_out_movi(s, TCG_TYPE_I32, arg1, mem_index);
+ #ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+- tcg_target_call_iarg_regs[2]);
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+ tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[1],
+ tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
++ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+ #endif
+ tgen_calli(s, (tcg_target_ulong)qemu_ld_helpers[s_bits]);
+--
+1.7.12.1
+
--- /dev/null
+From e7c3f6b4365f3162f8e25d58f76410aca28719a2 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 4 Sep 2012 07:35:57 +0200
+Subject: [PATCH] target-arm: Fix potential buffer overflow
+
+Report from smatch:
+
+target-arm/helper.c:651 arm946_prbs_read(6) error:
+ buffer overflow 'env->cp15.c6_region' 8 <= 8
+target-arm/helper.c:661 arm946_prbs_write(6) error:
+ buffer overflow 'env->cp15.c6_region' 8 <= 8
+
+c7_region is an array with 8 elements, so the index must be less than 8.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-arm/helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/target-arm/helper.c b/target-arm/helper.c
+index dceaa95..e27df96 100644
+--- a/target-arm/helper.c
++++ b/target-arm/helper.c
+@@ -645,7 +645,7 @@ static int pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri,
+ static int arm946_prbs_read(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t *value)
+ {
+- if (ri->crm > 8) {
++ if (ri->crm >= 8) {
+ return EXCP_UDEF;
+ }
+ *value = env->cp15.c6_region[ri->crm];
+@@ -655,7 +655,7 @@ static int arm946_prbs_read(CPUARMState *env, const ARMCPRegInfo *ri,
+ static int arm946_prbs_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+ {
+- if (ri->crm > 8) {
++ if (ri->crm >= 8) {
+ return EXCP_UDEF;
+ }
+ env->cp15.c6_region[ri->crm] = value;
+--
+1.7.12.1
+
--- /dev/null
+From 16f29b266435c7eaffc5081c6bba4651d56a8ce8 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:13 +0200
+Subject: [PATCH] tcg/optimize: split expression simplification
+
+Split expression simplification in multiple parts so that a given op
+can appear multiple times. This patch should not change anything.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 9c65474..63f970d 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -322,7 +322,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ break;
+ }
+
+- /* Simplify expression if possible. */
++ /* Simplify expression for "op r, a, 0 => mov r, a" cases */
+ switch (op) {
+ CASE_OP_32_64(add):
+ CASE_OP_32_64(sub):
+@@ -352,6 +352,12 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ continue;
+ }
+ break;
++ default:
++ break;
++ }
++
++ /* Simplify expression for "op r, a, 0 => movi r, 0" cases */
++ switch (op) {
+ CASE_OP_32_64(mul):
+ if ((temps[args[2]].state == TCG_TEMP_CONST
+ && temps[args[2]].val == 0)) {
+@@ -362,6 +368,12 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ continue;
+ }
+ break;
++ default:
++ break;
++ }
++
++ /* Simplify expression for "op r, a, a => mov r, a" cases */
++ switch (op) {
+ CASE_OP_32_64(or):
+ CASE_OP_32_64(and):
+ if (args[1] == args[2]) {
+--
+1.7.12.1
+
--- /dev/null
+From f69f9bd1a7a095ee153eea5422651780aef178b0 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: simplify or/xor r, a, 0 cases
+
+or/xor r, a, 0 is equivalent to a mov r, a.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 63f970d..0db849e 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -331,6 +331,8 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ CASE_OP_32_64(sar):
+ CASE_OP_32_64(rotl):
+ CASE_OP_32_64(rotr):
++ CASE_OP_32_64(or):
++ CASE_OP_32_64(xor):
+ if (temps[args[1]].state == TCG_TEMP_CONST) {
+ /* Proceed with possible constant folding. */
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From f08c59ce7dee67a95cf06d9588b4312e7d071788 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: simplify and r, a, 0 cases
+
+and r, a, 0 is equivalent to a movi r, 0.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 0db849e..c12cb2b 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -360,6 +360,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+
+ /* Simplify expression for "op r, a, 0 => movi r, 0" cases */
+ switch (op) {
++ CASE_OP_32_64(and):
+ CASE_OP_32_64(mul):
+ if ((temps[args[2]].state == TCG_TEMP_CONST
+ && temps[args[2]].val == 0)) {
+--
+1.7.12.1
+
--- /dev/null
+From bbed332c7ad12e9885d3f457f366fa0b29445dcd Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases
+
+shift/rot r, 0, a is equivalent to movi r, 0.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index c12cb2b..1698ba3 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -322,6 +322,26 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ break;
+ }
+
++ /* Simplify expressions for "shift/rot r, 0, a => movi r, 0" */
++ switch (op) {
++ CASE_OP_32_64(shl):
++ CASE_OP_32_64(shr):
++ CASE_OP_32_64(sar):
++ CASE_OP_32_64(rotl):
++ CASE_OP_32_64(rotr):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[1]].val == 0) {
++ gen_opc_buf[op_index] = op_to_movi(op);
++ tcg_opt_gen_movi(gen_args, args[0], 0, nb_temps, nb_globals);
++ args += 3;
++ gen_args += 2;
++ continue;
++ }
++ break;
++ default:
++ break;
++ }
++
+ /* Simplify expression for "op r, a, 0 => mov r, a" cases */
+ switch (op) {
+ CASE_OP_32_64(add):
+--
+1.7.12.1
+
--- /dev/null
+From 1127ad0d084f0cef11b5658b3dbbf8505d8d3af0 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: swap brcond/setcond arguments when possible
+
+brcond and setcond ops are not commutative, but it's easy to compute the
+new condition after swapping the arguments. Try to always put the constant
+argument in second position like for commutative ops, to help backends to
+generate better code.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 1698ba3..7debc8a 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -318,6 +318,24 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args[2] = tmp;
+ }
+ break;
++ CASE_OP_32_64(brcond):
++ if (temps[args[0]].state == TCG_TEMP_CONST
++ && temps[args[1]].state != TCG_TEMP_CONST) {
++ tmp = args[0];
++ args[0] = args[1];
++ args[1] = tmp;
++ args[2] = tcg_swap_cond(args[2]);
++ }
++ break;
++ CASE_OP_32_64(setcond):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[2]].state != TCG_TEMP_CONST) {
++ tmp = args[1];
++ args[1] = args[2];
++ args[2] = tmp;
++ args[3] = tcg_swap_cond(args[3]);
++ }
++ break;
+ default:
+ break;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 1bbb9ac3e775b55d0d5c57c209f47e742a9be810 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: add constant folding for setcond
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 7debc8a..1cb1f36 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -267,6 +267,67 @@ static TCGArg do_constant_folding(TCGOpcode op, TCGArg x, TCGArg y)
+ return res;
+ }
+
++static TCGArg do_constant_folding_cond(TCGOpcode op, TCGArg x,
++ TCGArg y, TCGCond c)
++{
++ switch (op_bits(op)) {
++ case 32:
++ switch (c) {
++ case TCG_COND_EQ:
++ return (uint32_t)x == (uint32_t)y;
++ case TCG_COND_NE:
++ return (uint32_t)x != (uint32_t)y;
++ case TCG_COND_LT:
++ return (int32_t)x < (int32_t)y;
++ case TCG_COND_GE:
++ return (int32_t)x >= (int32_t)y;
++ case TCG_COND_LE:
++ return (int32_t)x <= (int32_t)y;
++ case TCG_COND_GT:
++ return (int32_t)x > (int32_t)y;
++ case TCG_COND_LTU:
++ return (uint32_t)x < (uint32_t)y;
++ case TCG_COND_GEU:
++ return (uint32_t)x >= (uint32_t)y;
++ case TCG_COND_LEU:
++ return (uint32_t)x <= (uint32_t)y;
++ case TCG_COND_GTU:
++ return (uint32_t)x > (uint32_t)y;
++ }
++ break;
++ case 64:
++ switch (c) {
++ case TCG_COND_EQ:
++ return (uint64_t)x == (uint64_t)y;
++ case TCG_COND_NE:
++ return (uint64_t)x != (uint64_t)y;
++ case TCG_COND_LT:
++ return (int64_t)x < (int64_t)y;
++ case TCG_COND_GE:
++ return (int64_t)x >= (int64_t)y;
++ case TCG_COND_LE:
++ return (int64_t)x <= (int64_t)y;
++ case TCG_COND_GT:
++ return (int64_t)x > (int64_t)y;
++ case TCG_COND_LTU:
++ return (uint64_t)x < (uint64_t)y;
++ case TCG_COND_GEU:
++ return (uint64_t)x >= (uint64_t)y;
++ case TCG_COND_LEU:
++ return (uint64_t)x <= (uint64_t)y;
++ case TCG_COND_GTU:
++ return (uint64_t)x > (uint64_t)y;
++ }
++ break;
++ }
++
++ fprintf(stderr,
++ "Unrecognized bitness %d or condition %d in "
++ "do_constant_folding_cond.\n", op_bits(op), c);
++ tcg_abort();
++}
++
++
+ /* Propagate constants and copies, fold constant expressions. */
+ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ TCGArg *args, TCGOpDef *tcg_op_defs)
+@@ -522,6 +583,26 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args += 3;
+ break;
+ }
++ CASE_OP_32_64(setcond):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[2]].state == TCG_TEMP_CONST) {
++ gen_opc_buf[op_index] = op_to_movi(op);
++ tmp = do_constant_folding_cond(op, temps[args[1]].val,
++ temps[args[2]].val, args[3]);
++ tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
++ gen_args += 2;
++ args += 4;
++ break;
++ } else {
++ reset_temp(args[0], nb_temps, nb_globals);
++ gen_args[0] = args[0];
++ gen_args[1] = args[1];
++ gen_args[2] = args[2];
++ gen_args[3] = args[3];
++ gen_args += 4;
++ args += 4;
++ break;
++ }
+ case INDEX_op_call:
+ nb_call_args = (args[0] >> 16) + (args[0] & 0xffff);
+ if (!(args[nb_call_args + 1] & (TCG_CALL_CONST | TCG_CALL_PURE))) {
+--
+1.7.12.1
+
--- /dev/null
+From 98dc31743b94d5719c02c589e7cd652e95570b25 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 6 Sep 2012 16:47:14 +0200
+Subject: [PATCH] tcg/optimize: add constant folding for brcond
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 1cb1f36..156e8d9 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -603,6 +603,32 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args += 4;
+ break;
+ }
++ CASE_OP_32_64(brcond):
++ if (temps[args[0]].state == TCG_TEMP_CONST
++ && temps[args[1]].state == TCG_TEMP_CONST) {
++ if (do_constant_folding_cond(op, temps[args[0]].val,
++ temps[args[1]].val, args[2])) {
++ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
++ gen_opc_buf[op_index] = INDEX_op_br;
++ gen_args[0] = args[3];
++ gen_args += 1;
++ args += 4;
++ } else {
++ gen_opc_buf[op_index] = INDEX_op_nop;
++ args += 4;
++ }
++ break;
++ } else {
++ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
++ reset_temp(args[0], nb_temps, nb_globals);
++ gen_args[0] = args[0];
++ gen_args[1] = args[1];
++ gen_args[2] = args[2];
++ gen_args[3] = args[3];
++ gen_args += 4;
++ args += 4;
++ break;
++ }
+ case INDEX_op_call:
+ nb_call_args = (args[0] >> 16) + (args[0] & 0xffff);
+ if (!(args[nb_call_args + 1] & (TCG_CALL_CONST | TCG_CALL_PURE))) {
+@@ -624,7 +650,6 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ case INDEX_op_set_label:
+ case INDEX_op_jmp:
+ case INDEX_op_br:
+- CASE_OP_32_64(brcond):
+ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+ for (i = 0; i < def->nb_args; i++) {
+ *gen_args = *args;
+--
+1.7.12.1
+
--- /dev/null
+From b7dc881b44c3698a0a81d226d6012d3c5833fd29 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 7 Sep 2012 12:24:32 +0200
+Subject: [PATCH] tcg/optimize: fix if/else/break coding style
+
+optimizer.c contains some cases were the break is appearing in both the
+if and the else parts. Fix that by moving it to the outer part. Also
+move some common code there.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 34 +++++++++++-----------------------
+ 1 file changed, 11 insertions(+), 23 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 156e8d9..fba0ed9 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -441,15 +441,14 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ if ((temps[args[0]].state == TCG_TEMP_COPY
+ && temps[args[0]].val == args[1])
+ || args[0] == args[1]) {
+- args += 3;
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+ tcg_opt_gen_mov(s, gen_args, args[0], args[1],
+ nb_temps, nb_globals);
+ gen_args += 2;
+- args += 3;
+ }
++ args += 3;
+ continue;
+ }
+ break;
+@@ -480,15 +479,14 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ CASE_OP_32_64(and):
+ if (args[1] == args[2]) {
+ if (args[1] == args[0]) {
+- args += 3;
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+ tcg_opt_gen_mov(s, gen_args, args[0], args[1], nb_temps,
+ nb_globals);
+ gen_args += 2;
+- args += 3;
+ }
++ args += 3;
+ continue;
+ }
+ break;
+@@ -538,17 +536,14 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = op_to_movi(op);
+ tmp = do_constant_folding(op, temps[args[1]].val, 0);
+ tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
+- gen_args += 2;
+- args += 2;
+- break;
+ } else {
+ reset_temp(args[0], nb_temps, nb_globals);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+- gen_args += 2;
+- args += 2;
+- break;
+ }
++ gen_args += 2;
++ args += 2;
++ break;
+ CASE_OP_32_64(add):
+ CASE_OP_32_64(sub):
+ CASE_OP_32_64(mul):
+@@ -572,17 +567,15 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ temps[args[2]].val);
+ tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
+ gen_args += 2;
+- args += 3;
+- break;
+ } else {
+ reset_temp(args[0], nb_temps, nb_globals);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ gen_args[2] = args[2];
+ gen_args += 3;
+- args += 3;
+- break;
+ }
++ args += 3;
++ break;
+ CASE_OP_32_64(setcond):
+ if (temps[args[1]].state == TCG_TEMP_CONST
+ && temps[args[2]].state == TCG_TEMP_CONST) {
+@@ -591,8 +584,6 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ temps[args[2]].val, args[3]);
+ tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
+ gen_args += 2;
+- args += 4;
+- break;
+ } else {
+ reset_temp(args[0], nb_temps, nb_globals);
+ gen_args[0] = args[0];
+@@ -600,9 +591,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_args[2] = args[2];
+ gen_args[3] = args[3];
+ gen_args += 4;
+- args += 4;
+- break;
+ }
++ args += 4;
++ break;
+ CASE_OP_32_64(brcond):
+ if (temps[args[0]].state == TCG_TEMP_CONST
+ && temps[args[1]].state == TCG_TEMP_CONST) {
+@@ -612,12 +603,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = INDEX_op_br;
+ gen_args[0] = args[3];
+ gen_args += 1;
+- args += 4;
+ } else {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+- args += 4;
+ }
+- break;
+ } else {
+ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+ reset_temp(args[0], nb_temps, nb_globals);
+@@ -626,9 +614,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_args[2] = args[2];
+ gen_args[3] = args[3];
+ gen_args += 4;
+- args += 4;
+- break;
+ }
++ args += 4;
++ break;
+ case INDEX_op_call:
+ nb_call_args = (args[0] >> 16) + (args[0] & 0xffff);
+ if (!(args[nb_call_args + 1] & (TCG_CALL_CONST | TCG_CALL_PURE))) {
+--
+1.7.12.1
+
--- /dev/null
+From d8503917ec9ba86829387f05db7da2eb6fa8123f Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sat, 8 Sep 2012 11:15:37 +0000
+Subject: [PATCH] target-s390x: avoid cpu_single_env
+
+Pass around CPUState instead of using global cpu_single_env.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-s390x/translate.c | 356 ++++++++++++++++++++++++-----------------------
+ 1 file changed, 183 insertions(+), 173 deletions(-)
+
+diff --git a/target-s390x/translate.c b/target-s390x/translate.c
+index 66119cd..3214783 100644
+--- a/target-s390x/translate.c
++++ b/target-s390x/translate.c
+@@ -274,21 +274,21 @@ static inline void potential_page_fault(DisasContext *s)
+ #endif
+ }
+
+-static inline uint64_t ld_code2(uint64_t pc)
++static inline uint64_t ld_code2(CPUS390XState *env, uint64_t pc)
+ {
+- return (uint64_t)cpu_lduw_code(cpu_single_env, pc);
++ return (uint64_t)cpu_lduw_code(env, pc);
+ }
+
+-static inline uint64_t ld_code4(uint64_t pc)
++static inline uint64_t ld_code4(CPUS390XState *env, uint64_t pc)
+ {
+- return (uint64_t)cpu_ldl_code(cpu_single_env, pc);
++ return (uint64_t)cpu_ldl_code(env, pc);
+ }
+
+-static inline uint64_t ld_code6(uint64_t pc)
++static inline uint64_t ld_code6(CPUS390XState *env, uint64_t pc)
+ {
+ uint64_t opc;
+- opc = (uint64_t)cpu_lduw_code(cpu_single_env, pc) << 32;
+- opc |= (uint64_t)(uint32_t)cpu_ldl_code(cpu_single_env, pc + 2);
++ opc = (uint64_t)cpu_lduw_code(env, pc) << 32;
++ opc |= (uint64_t)(uint32_t)cpu_ldl_code(env, pc + 2);
+ return opc;
+ }
+
+@@ -319,7 +319,7 @@ static inline void gen_debug(DisasContext *s)
+
+ #ifdef CONFIG_USER_ONLY
+
+-static void gen_illegal_opcode(DisasContext *s, int ilc)
++static void gen_illegal_opcode(CPUS390XState *env, DisasContext *s, int ilc)
+ {
+ TCGv_i32 tmp = tcg_const_i32(EXCP_SPEC);
+ update_psw_addr(s);
+@@ -331,20 +331,20 @@ static void gen_illegal_opcode(DisasContext *s, int ilc)
+
+ #else /* CONFIG_USER_ONLY */
+
+-static void debug_print_inst(DisasContext *s, int ilc)
++static void debug_print_inst(CPUS390XState *env, DisasContext *s, int ilc)
+ {
+ #ifdef DEBUG_ILLEGAL_INSTRUCTIONS
+ uint64_t inst = 0;
+
+ switch (ilc & 3) {
+ case 1:
+- inst = ld_code2(s->pc);
++ inst = ld_code2(env, s->pc);
+ break;
+ case 2:
+- inst = ld_code4(s->pc);
++ inst = ld_code4(env, s->pc);
+ break;
+ case 3:
+- inst = ld_code6(s->pc);
++ inst = ld_code6(env, s->pc);
+ break;
+ }
+
+@@ -353,11 +353,12 @@ static void debug_print_inst(DisasContext *s, int ilc)
+ #endif
+ }
+
+-static void gen_program_exception(DisasContext *s, int ilc, int code)
++static void gen_program_exception(CPUS390XState *env, DisasContext *s, int ilc,
++ int code)
+ {
+ TCGv_i32 tmp;
+
+- debug_print_inst(s, ilc);
++ debug_print_inst(env, s, ilc);
+
+ /* remember what pgm exeption this was */
+ tmp = tcg_const_i32(code);
+@@ -385,20 +386,21 @@ static void gen_program_exception(DisasContext *s, int ilc, int code)
+ }
+
+
+-static void gen_illegal_opcode(DisasContext *s, int ilc)
++static void gen_illegal_opcode(CPUS390XState *env, DisasContext *s, int ilc)
+ {
+- gen_program_exception(s, ilc, PGM_SPECIFICATION);
++ gen_program_exception(env, s, ilc, PGM_SPECIFICATION);
+ }
+
+-static void gen_privileged_exception(DisasContext *s, int ilc)
++static void gen_privileged_exception(CPUS390XState *env, DisasContext *s,
++ int ilc)
+ {
+- gen_program_exception(s, ilc, PGM_PRIVILEGED);
++ gen_program_exception(env, s, ilc, PGM_PRIVILEGED);
+ }
+
+-static void check_privileged(DisasContext *s, int ilc)
++static void check_privileged(CPUS390XState *env, DisasContext *s, int ilc)
+ {
+ if (s->tb->flags & (PSW_MASK_PSTATE >> 32)) {
+- gen_privileged_exception(s, ilc);
++ gen_privileged_exception(env, s, ilc);
+ }
+ }
+
+@@ -1460,7 +1462,8 @@ static void gen_op_clc(DisasContext *s, int l, TCGv_i64 s1, TCGv_i64 s2)
+ set_cc_static(s);
+ }
+
+-static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
++static void disas_e3(CPUS390XState *env, DisasContext* s, int op, int r1,
++ int x2, int b2, int d2)
+ {
+ TCGv_i64 addr, tmp, tmp2, tmp3, tmp4;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -1925,14 +1928,14 @@ static void disas_e3(DisasContext* s, int op, int r1, int x2, int b2, int d2)
+ break;
+ default:
+ LOG_DISAS("illegal e3 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 3);
++ gen_illegal_opcode(env, s, 3);
+ break;
+ }
+ tcg_temp_free_i64(addr);
+ }
+
+ #ifndef CONFIG_USER_ONLY
+-static void disas_e5(DisasContext* s, uint64_t insn)
++static void disas_e5(CPUS390XState *env, DisasContext* s, uint64_t insn)
+ {
+ TCGv_i64 tmp, tmp2;
+ int op = (insn >> 32) & 0xff;
+@@ -1950,7 +1953,7 @@ static void disas_e5(DisasContext* s, uint64_t insn)
+ break;
+ default:
+ LOG_DISAS("illegal e5 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 3);
++ gen_illegal_opcode(env, s, 3);
+ break;
+ }
+
+@@ -1959,7 +1962,8 @@ static void disas_e5(DisasContext* s, uint64_t insn)
+ }
+ #endif
+
+-static void disas_eb(DisasContext *s, int op, int r1, int r3, int b2, int d2)
++static void disas_eb(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int r3, int b2, int d2)
+ {
+ TCGv_i64 tmp, tmp2, tmp3, tmp4;
+ TCGv_i32 tmp32_1, tmp32_2;
+@@ -2102,7 +2106,7 @@ do_mh:
+ #ifndef CONFIG_USER_ONLY
+ case 0x2f: /* LCTLG R1,R3,D2(B2) [RSE] */
+ /* Load Control */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+@@ -2114,7 +2118,7 @@ do_mh:
+ break;
+ case 0x25: /* STCTG R1,R3,D2(B2) [RSE] */
+ /* Store Control */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r3);
+@@ -2191,13 +2195,13 @@ do_mh:
+ break;
+ default:
+ LOG_DISAS("illegal eb operation 0x%x\n", op);
+- gen_illegal_opcode(s, ilc);
++ gen_illegal_opcode(env, s, ilc);
+ break;
+ }
+ }
+
+-static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+- int r1b)
++static void disas_ed(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int x2, int b2, int d2, int r1b)
+ {
+ TCGv_i32 tmp_r1, tmp32;
+ TCGv_i64 addr, tmp;
+@@ -2311,14 +2315,15 @@ static void disas_ed(DisasContext *s, int op, int r1, int x2, int b2, int d2,
+ break;
+ default:
+ LOG_DISAS("illegal ed operation 0x%x\n", op);
+- gen_illegal_opcode(s, 3);
++ gen_illegal_opcode(env, s, 3);
+ return;
+ }
+ tcg_temp_free_i32(tmp_r1);
+ tcg_temp_free_i64(addr);
+ }
+
+-static void disas_a5(DisasContext *s, int op, int r1, int i2)
++static void disas_a5(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int i2)
+ {
+ TCGv_i64 tmp, tmp2;
+ TCGv_i32 tmp32;
+@@ -2467,12 +2472,13 @@ static void disas_a5(DisasContext *s, int op, int r1, int i2)
+ break;
+ default:
+ LOG_DISAS("illegal a5 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 2);
++ gen_illegal_opcode(env, s, 2);
+ return;
+ }
+ }
+
+-static void disas_a7(DisasContext *s, int op, int r1, int i2)
++static void disas_a7(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int i2)
+ {
+ TCGv_i64 tmp, tmp2;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -2604,12 +2610,13 @@ static void disas_a7(DisasContext *s, int op, int r1, int i2)
+ break;
+ default:
+ LOG_DISAS("illegal a7 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 2);
++ gen_illegal_opcode(env, s, 2);
+ return;
+ }
+ }
+
+-static void disas_b2(DisasContext *s, int op, uint32_t insn)
++static void disas_b2(CPUS390XState *env, DisasContext *s, int op,
++ uint32_t insn)
+ {
+ TCGv_i64 tmp, tmp2, tmp3;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -2708,7 +2715,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ #ifndef CONFIG_USER_ONLY
+ case 0x02: /* STIDP D2(B2) [S] */
+ /* Store CPU ID */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2717,7 +2724,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x04: /* SCK D2(B2) [S] */
+ /* Set Clock */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2736,7 +2743,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x06: /* SCKC D2(B2) [S] */
+ /* Set Clock Comparator */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2745,7 +2752,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x07: /* STCKC D2(B2) [S] */
+ /* Store Clock Comparator */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2754,7 +2761,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x08: /* SPT D2(B2) [S] */
+ /* Set CPU Timer */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2763,7 +2770,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x09: /* STPT D2(B2) [S] */
+ /* Store CPU Timer */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2772,7 +2779,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x0a: /* SPKA D2(B2) [S] */
+ /* Set PSW Key from Address */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -2784,12 +2791,12 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x0d: /* PTLB [S] */
+ /* Purge TLB */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ gen_helper_ptlb(cpu_env);
+ break;
+ case 0x10: /* SPX D2(B2) [S] */
+ /* Set Prefix Register */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2798,7 +2805,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x11: /* STPX D2(B2) [S] */
+ /* Store Prefix */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -2809,7 +2816,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x12: /* STAP D2(B2) [S] */
+ /* Store CPU Address */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -2823,7 +2830,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x21: /* IPTE R1,R2 [RRE] */
+ /* Invalidate PTE */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp = load_reg(r1);
+@@ -2834,7 +2841,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x29: /* ISKE R1,R2 [RRE] */
+ /* Insert Storage Key Extended */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp = load_reg(r2);
+@@ -2846,7 +2853,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x2a: /* RRBE R1,R2 [RRE] */
+ /* Set Storage Key Extended */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp32_1 = load_reg32(r1);
+@@ -2858,7 +2865,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x2b: /* SSKE R1,R2 [RRE] */
+ /* Set Storage Key Extended */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp32_1 = load_reg32(r1);
+@@ -2869,12 +2876,12 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x34: /* STCH ? */
+ /* Store Subchannel */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ gen_op_movi_cc(s, 3);
+ break;
+ case 0x46: /* STURA R1,R2 [RRE] */
+ /* Store Using Real Address */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp32_1 = load_reg32(r1);
+@@ -2886,7 +2893,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x50: /* CSP R1,R2 [RRE] */
+ /* Compare And Swap And Purge */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ tmp32_1 = tcg_const_i32(r1);
+@@ -2898,7 +2905,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x5f: /* CHSC ? */
+ /* Channel Subsystem Call */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ gen_op_movi_cc(s, 3);
+ break;
+ case 0x78: /* STCKE D2(B2) [S] */
+@@ -2912,7 +2919,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x79: /* SACF D2(B2) [S] */
+ /* Store Clock Extended */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ potential_page_fault(s);
+@@ -2924,7 +2931,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ s->is_jmp = DISAS_EXCP;
+ break;
+ case 0x7d: /* STSI D2,(B2) [S] */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = load_reg32(0);
+@@ -2950,7 +2957,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0xb1: /* STFL D2(B2) [S] */
+ /* Store Facility List (CPU features) at 200 */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ tmp2 = tcg_const_i64(0xc0000000);
+ tmp = tcg_const_i64(200);
+ tcg_gen_qemu_st32(tmp2, tmp, get_mem_index(s));
+@@ -2959,7 +2966,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0xb2: /* LPSWE D2(B2) [S] */
+ /* Load PSW Extended */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -2976,7 +2983,7 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ break;
+ case 0x20: /* SERVC R1,R2 [RRE] */
+ /* SCLP Service call (PV hypercall) */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ potential_page_fault(s);
+ tmp32_1 = load_reg32(r2);
+ tmp = load_reg(r1);
+@@ -2988,12 +2995,13 @@ static void disas_b2(DisasContext *s, int op, uint32_t insn)
+ #endif
+ default:
+ LOG_DISAS("illegal b2 operation 0x%x\n", op);
+- gen_illegal_opcode(s, ilc);
++ gen_illegal_opcode(env, s, ilc);
+ break;
+ }
+ }
+
+-static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
++static void disas_b3(CPUS390XState *env, DisasContext *s, int op, int m3,
++ int r1, int r2)
+ {
+ TCGv_i64 tmp;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -3263,7 +3271,7 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ break;
+ default:
+ LOG_DISAS("illegal b3 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 2);
++ gen_illegal_opcode(env, s, 2);
+ break;
+ }
+
+@@ -3271,7 +3279,8 @@ static void disas_b3(DisasContext *s, int op, int m3, int r1, int r2)
+ #undef FP_HELPER
+ }
+
+-static void disas_b9(DisasContext *s, int op, int r1, int r2)
++static void disas_b9(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int r2)
+ {
+ TCGv_i64 tmp, tmp2, tmp3;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -3654,12 +3663,12 @@ static void disas_b9(DisasContext *s, int op, int r1, int r2)
+ break;
+ default:
+ LOG_DISAS("illegal b9 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 2);
++ gen_illegal_opcode(env, s, 2);
+ break;
+ }
+ }
+
+-static void disas_c0(DisasContext *s, int op, int r1, int i2)
++static void disas_c0(CPUS390XState *env, DisasContext *s, int op, int r1, int i2)
+ {
+ TCGv_i64 tmp;
+ TCGv_i32 tmp32_1, tmp32_2;
+@@ -3755,12 +3764,13 @@ static void disas_c0(DisasContext *s, int op, int r1, int i2)
+ break;
+ default:
+ LOG_DISAS("illegal c0 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 3);
++ gen_illegal_opcode(env, s, 3);
+ break;
+ }
+ }
+
+-static void disas_c2(DisasContext *s, int op, int r1, int i2)
++static void disas_c2(CPUS390XState *env, DisasContext *s, int op, int r1,
++ int i2)
+ {
+ TCGv_i64 tmp, tmp2, tmp3;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3;
+@@ -3832,7 +3842,7 @@ static void disas_c2(DisasContext *s, int op, int r1, int i2)
+ break;
+ default:
+ LOG_DISAS("illegal c2 operation 0x%x\n", op);
+- gen_illegal_opcode(s, 3);
++ gen_illegal_opcode(env, s, 3);
+ break;
+ }
+ }
+@@ -3854,7 +3864,7 @@ static void gen_and_or_xor_i32(int opc, TCGv_i32 tmp, TCGv_i32 tmp2)
+ }
+ }
+
+-static void disas_s390_insn(DisasContext *s)
++static void disas_s390_insn(CPUS390XState *env, DisasContext *s)
+ {
+ TCGv_i64 tmp, tmp2, tmp3, tmp4;
+ TCGv_i32 tmp32_1, tmp32_2, tmp32_3, tmp32_4;
+@@ -3865,7 +3875,7 @@ static void disas_s390_insn(DisasContext *s)
+ int ilc;
+ int l1;
+
+- opc = cpu_ldub_code(cpu_single_env, s->pc);
++ opc = cpu_ldub_code(env, s->pc);
+ LOG_DISAS("opc 0x%x\n", opc);
+
+ ilc = get_ilc(opc);
+@@ -3873,12 +3883,12 @@ static void disas_s390_insn(DisasContext *s)
+ switch (opc) {
+ #ifndef CONFIG_USER_ONLY
+ case 0x01: /* SAM */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ /* set addressing mode, but we only do 64bit anyways */
+ break;
+ #endif
+ case 0x6: /* BCTR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r1);
+ tcg_gen_subi_i32(tmp32_1, tmp32_1, 1);
+@@ -3904,7 +3914,7 @@ static void disas_s390_insn(DisasContext *s)
+ }
+ break;
+ case 0x7: /* BCR M1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ if (r2) {
+ tmp = load_reg(r2);
+@@ -3916,7 +3926,7 @@ static void disas_s390_insn(DisasContext *s)
+ }
+ break;
+ case 0xa: /* SVC I [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ debug_insn(insn);
+ i = insn & 0xff;
+ update_psw_addr(s);
+@@ -3933,7 +3943,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_3);
+ break;
+ case 0xd: /* BASR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp = tcg_const_i64(pc_to_link_info(s, s->pc + 2));
+ store_reg(r1, tmp);
+@@ -3946,7 +3956,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0xe: /* MVCL R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = tcg_const_i32(r1);
+ tmp32_2 = tcg_const_i32(r2);
+@@ -3957,7 +3967,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0x10: /* LPR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r2);
+ set_cc_abs32(s, tmp32_1);
+@@ -3966,7 +3976,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x11: /* LNR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r2);
+ set_cc_nabs32(s, tmp32_1);
+@@ -3975,7 +3985,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x12: /* LTR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r2);
+ if (r1 != r2) {
+@@ -3985,7 +3995,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x13: /* LCR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r2);
+ tcg_gen_neg_i32(tmp32_1, tmp32_1);
+@@ -3996,7 +4006,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x14: /* NR R1,R2 [RR] */
+ case 0x16: /* OR R1,R2 [RR] */
+ case 0x17: /* XR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_2 = load_reg32(r2);
+ tmp32_1 = load_reg32(r1);
+@@ -4007,7 +4017,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0x18: /* LR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r2);
+ store_reg32(r1, tmp32_1);
+@@ -4015,7 +4025,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x15: /* CLR R1,R2 [RR] */
+ case 0x19: /* CR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = load_reg32(r2);
+@@ -4029,7 +4039,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x1a: /* AR R1,R2 [RR] */
+ case 0x1e: /* ALR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = load_reg32(r2);
+@@ -4047,7 +4057,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x1b: /* SR R1,R2 [RR] */
+ case 0x1f: /* SLR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = load_reg32(r2);
+@@ -4065,7 +4075,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x1c: /* MR R1,R2 [RR] */
+ /* reg(r1, r1+1) = reg(r1+1) * reg(r2) */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp2 = load_reg(r2);
+ tmp3 = load_reg((r1 + 1) & 15);
+@@ -4079,7 +4089,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp3);
+ break;
+ case 0x1d: /* DR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = load_reg32(r1 + 1);
+@@ -4114,21 +4124,21 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp3);
+ break;
+ case 0x28: /* LDR R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp = load_freg(r2);
+ store_freg(r1, tmp);
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x38: /* LER R1,R2 [RR] */
+- insn = ld_code2(s->pc);
++ insn = ld_code2(env, s->pc);
+ decode_rr(s, insn, &r1, &r2);
+ tmp32_1 = load_freg32(r2);
+ store_freg32(r1, tmp32_1);
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x40: /* STH R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = load_reg(r1);
+ tcg_gen_qemu_st16(tmp2, tmp, get_mem_index(s));
+@@ -4136,13 +4146,13 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x41: /* la */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ store_reg(r1, tmp); /* FIXME: 31/24-bit addressing */
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x42: /* STC R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = load_reg(r1);
+ tcg_gen_qemu_st8(tmp2, tmp, get_mem_index(s));
+@@ -4150,7 +4160,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x43: /* IC R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld8u(tmp2, tmp, get_mem_index(s));
+@@ -4159,7 +4169,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x44: /* EX R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = load_reg(r1);
+ tmp3 = tcg_const_i64(s->pc + 4);
+@@ -4172,7 +4182,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp3);
+ break;
+ case 0x46: /* BCT R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tcg_temp_free_i64(tmp);
+
+@@ -4196,14 +4206,14 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp);
+ break;
+ case 0x47: /* BC M1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ gen_bcr(s, r1, tmp, s->pc + 4);
+ tcg_temp_free_i64(tmp);
+ s->is_jmp = DISAS_TB_JUMP;
+ break;
+ case 0x48: /* LH R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld16s(tmp2, tmp, get_mem_index(s));
+@@ -4212,7 +4222,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x49: /* CH R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = tcg_temp_new_i32();
+@@ -4228,7 +4238,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x4a: /* AH R1,D2(X2,B2) [RX] */
+ case 0x4b: /* SH R1,D2(X2,B2) [RX] */
+ case 0x4c: /* MH R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = load_reg32(r1);
+@@ -4261,7 +4271,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x4d: /* BAS R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_const_i64(pc_to_link_info(s, s->pc + 4));
+ store_reg(r1, tmp2);
+@@ -4271,7 +4281,7 @@ static void disas_s390_insn(DisasContext *s)
+ s->is_jmp = DISAS_JUMP;
+ break;
+ case 0x4e: /* CVD R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_temp_new_i32();
+@@ -4283,7 +4293,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x50: /* st r1, d2(x2, b2) */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = load_reg(r1);
+ tcg_gen_qemu_st32(tmp2, tmp, get_mem_index(s));
+@@ -4291,7 +4301,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x55: /* CL R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_temp_new_i32();
+@@ -4307,7 +4317,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x54: /* N R1,D2(X2,B2) [RX] */
+ case 0x56: /* O R1,D2(X2,B2) [RX] */
+ case 0x57: /* X R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = load_reg32(r1);
+@@ -4323,7 +4333,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0x58: /* l r1, d2(x2, b2) */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_temp_new_i32();
+@@ -4335,7 +4345,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x59: /* C R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_temp_new_i32();
+@@ -4352,7 +4362,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x5b: /* S R1,D2(X2,B2) [RX] */
+ case 0x5e: /* AL R1,D2(X2,B2) [RX] */
+ case 0x5f: /* SL R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = tcg_temp_new_i32();
+@@ -4395,7 +4405,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x5c: /* M R1,D2(X2,B2) [RX] */
+ /* reg(r1, r1+1) = reg(r1+1) * *(s32*)addr */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld32s(tmp2, tmp, get_mem_index(s));
+@@ -4411,7 +4421,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp3);
+ break;
+ case 0x5d: /* D R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp3 = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp32_1 = load_reg32(r1);
+ tmp32_2 = load_reg32(r1 + 1);
+@@ -4445,7 +4455,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp3);
+ break;
+ case 0x60: /* STD R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = load_freg(r1);
+ tcg_gen_qemu_st64(tmp2, tmp, get_mem_index(s));
+@@ -4453,7 +4463,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x68: /* LD R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld64(tmp2, tmp, get_mem_index(s));
+@@ -4462,7 +4472,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x70: /* STE R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = load_freg32(r1);
+@@ -4473,7 +4483,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0x71: /* MS R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = load_reg32(r1);
+@@ -4488,7 +4498,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0x78: /* LE R1,D2(X2,B2) [RX] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp2 = tcg_temp_new_i64();
+ tmp32_1 = tcg_temp_new_i32();
+@@ -4502,8 +4512,8 @@ static void disas_s390_insn(DisasContext *s)
+ #ifndef CONFIG_USER_ONLY
+ case 0x80: /* SSM D2(B2) [S] */
+ /* Set System Mask */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -4518,8 +4528,8 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x82: /* LPSW D2(B2) [S] */
+ /* Load PSW */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = tcg_temp_new_i64();
+@@ -4536,9 +4546,9 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x83: /* DIAG R1,R3,D2 [RS] */
+ /* Diagnose call (KVM hypercall) */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ potential_page_fault(s);
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp32_1 = tcg_const_i32(insn & 0xfff);
+ tmp2 = load_reg(2);
+@@ -4553,7 +4563,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x88: /* SRL R1,D2(B2) [RS] */
+ case 0x89: /* SLL R1,D2(B2) [RS] */
+ case 0x8a: /* SRA R1,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = load_reg32(r1);
+@@ -4582,7 +4592,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x8c: /* SRDL R1,D2(B2) [RS] */
+ case 0x8d: /* SLDL R1,D2(B2) [RS] */
+ case 0x8e: /* SRDA R1,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2); /* shift */
+ tmp2 = tcg_temp_new_i64();
+@@ -4611,7 +4621,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0x98: /* LM R1,R3,D2(B2) [RS] */
+ case 0x90: /* STM R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+
+ tmp = get_address(s, 0, b2, d2);
+@@ -4637,7 +4647,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp4);
+ break;
+ case 0x91: /* TM D1(B1),I2 [SI] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_si(s, insn, &i2, &b1, &d1);
+ tmp2 = tcg_const_i64(i2);
+ tcg_gen_qemu_ld8u(tmp, tmp, get_mem_index(s));
+@@ -4646,7 +4656,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x92: /* MVI D1(B1),I2 [SI] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_si(s, insn, &i2, &b1, &d1);
+ tmp2 = tcg_const_i64(i2);
+ tcg_gen_qemu_st8(tmp2, tmp, get_mem_index(s));
+@@ -4656,7 +4666,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0x94: /* NI D1(B1),I2 [SI] */
+ case 0x96: /* OI D1(B1),I2 [SI] */
+ case 0x97: /* XI D1(B1),I2 [SI] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_si(s, insn, &i2, &b1, &d1);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld8u(tmp2, tmp, get_mem_index(s));
+@@ -4679,7 +4689,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x95: /* CLI D1(B1),I2 [SI] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_si(s, insn, &i2, &b1, &d1);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_qemu_ld8u(tmp2, tmp, get_mem_index(s));
+@@ -4688,7 +4698,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0x9a: /* LAM R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4700,7 +4710,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0x9b: /* STAM R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4712,21 +4722,21 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0xa5:
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ r1 = (insn >> 20) & 0xf;
+ op = (insn >> 16) & 0xf;
+ i2 = insn & 0xffff;
+- disas_a5(s, op, r1, i2);
++ disas_a5(env, s, op, r1, i2);
+ break;
+ case 0xa7:
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ r1 = (insn >> 20) & 0xf;
+ op = (insn >> 16) & 0xf;
+ i2 = (short)insn;
+- disas_a7(s, op, r1, i2);
++ disas_a7(env, s, op, r1, i2);
+ break;
+ case 0xa8: /* MVCLE R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4739,7 +4749,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0xa9: /* CLCLE R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4754,8 +4764,8 @@ static void disas_s390_insn(DisasContext *s)
+ #ifndef CONFIG_USER_ONLY
+ case 0xac: /* STNSM D1(B1),I2 [SI] */
+ case 0xad: /* STOSM D1(B1),I2 [SI] */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_si(s, insn, &i2, &b1, &d1);
+ tmp2 = tcg_temp_new_i64();
+ tcg_gen_shri_i64(tmp2, psw_mask, 56);
+@@ -4770,8 +4780,8 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ case 0xae: /* SIGP R1,R3,D2(B2) [RS] */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp2 = load_reg(r3);
+@@ -4784,8 +4794,8 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_1);
+ break;
+ case 0xb1: /* LRA R1,D2(X2, B2) [RX] */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ tmp = decode_rx(s, insn, &r1, &x2, &b2, &d2);
+ tmp32_1 = tcg_const_i32(r1);
+ potential_page_fault(s);
+@@ -4796,7 +4806,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ #endif
+ case 0xb2:
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ op = (insn >> 16) & 0xff;
+ switch (op) {
+ case 0x9c: /* STFPC D2(B2) [S] */
+@@ -4813,23 +4823,23 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i64(tmp2);
+ break;
+ default:
+- disas_b2(s, op, insn);
++ disas_b2(env, s, op, insn);
+ break;
+ }
+ break;
+ case 0xb3:
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ op = (insn >> 16) & 0xff;
+ r3 = (insn >> 12) & 0xf; /* aka m3 */
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+- disas_b3(s, op, r3, r1, r2);
++ disas_b3(env, s, op, r3, r1, r2);
+ break;
+ #ifndef CONFIG_USER_ONLY
+ case 0xb6: /* STCTL R1,R3,D2(B2) [RS] */
+ /* Store Control */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4842,8 +4852,8 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0xb7: /* LCTL R1,R3,D2(B2) [RS] */
+ /* Load Control */
+- check_privileged(s, ilc);
+- insn = ld_code4(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4856,14 +4866,14 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ #endif
+ case 0xb9:
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ r1 = (insn >> 4) & 0xf;
+ r2 = insn & 0xf;
+ op = (insn >> 16) & 0xff;
+- disas_b9(s, op, r1, r2);
++ disas_b9(env, s, op, r1, r2);
+ break;
+ case 0xba: /* CS R1,R3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = tcg_const_i32(r1);
+@@ -4876,7 +4886,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0xbd: /* CLM R1,M3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = load_reg32(r1);
+@@ -4889,7 +4899,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0xbe: /* STCM R1,M3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ tmp = get_address(s, 0, b2, d2);
+ tmp32_1 = load_reg32(r1);
+@@ -4901,7 +4911,7 @@ static void disas_s390_insn(DisasContext *s)
+ tcg_temp_free_i32(tmp32_2);
+ break;
+ case 0xbf: /* ICM R1,M3,D2(B2) [RS] */
+- insn = ld_code4(s->pc);
++ insn = ld_code4(env, s->pc);
+ decode_rs(s, insn, &r1, &r3, &b2, &d2);
+ if (r3 == 15) {
+ /* effectively a 32-bit load */
+@@ -4956,16 +4966,16 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ case 0xc0:
+ case 0xc2:
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ r1 = (insn >> 36) & 0xf;
+ op = (insn >> 32) & 0xf;
+ i2 = (int)insn;
+ switch (opc) {
+ case 0xc0:
+- disas_c0(s, op, r1, i2);
++ disas_c0(env, s, op, r1, i2);
+ break;
+ case 0xc2:
+- disas_c2(s, op, r1, i2);
++ disas_c2(env, s, op, r1, i2);
+ break;
+ default:
+ tcg_abort();
+@@ -4978,7 +4988,7 @@ static void disas_s390_insn(DisasContext *s)
+ case 0xd7: /* XC D1(L,B1),D2(B2) [SS] */
+ case 0xdc: /* TR D1(L,B1),D2(B2) [SS] */
+ case 0xf3: /* UNPK D1(L1,B1),D2(L2,B2) [SS] */
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ vl = tcg_const_i32((insn >> 32) & 0xff);
+ b1 = (insn >> 28) & 0xf;
+ b2 = (insn >> 12) & 0xf;
+@@ -5026,9 +5036,9 @@ static void disas_s390_insn(DisasContext *s)
+ #ifndef CONFIG_USER_ONLY
+ case 0xda: /* MVCP D1(R1,B1),D2(B2),R3 [SS] */
+ case 0xdb: /* MVCS D1(R1,B1),D2(B2),R3 [SS] */
+- check_privileged(s, ilc);
++ check_privileged(env, s, ilc);
+ potential_page_fault(s);
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ r1 = (insn >> 36) & 0xf;
+ r3 = (insn >> 32) & 0xf;
+ b1 = (insn >> 28) & 0xf;
+@@ -5051,7 +5061,7 @@ static void disas_s390_insn(DisasContext *s)
+ break;
+ #endif
+ case 0xe3:
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ debug_insn(insn);
+ op = insn & 0xff;
+ r1 = (insn >> 36) & 0xf;
+@@ -5059,19 +5069,19 @@ static void disas_s390_insn(DisasContext *s)
+ b2 = (insn >> 28) & 0xf;
+ d2 = ((int)((((insn >> 16) & 0xfff)
+ | ((insn << 4) & 0xff000)) << 12)) >> 12;
+- disas_e3(s, op, r1, x2, b2, d2 );
++ disas_e3(env, s, op, r1, x2, b2, d2 );
+ break;
+ #ifndef CONFIG_USER_ONLY
+ case 0xe5:
+ /* Test Protection */
+- check_privileged(s, ilc);
+- insn = ld_code6(s->pc);
++ check_privileged(env, s, ilc);
++ insn = ld_code6(env, s->pc);
+ debug_insn(insn);
+- disas_e5(s, insn);
++ disas_e5(env, s, insn);
+ break;
+ #endif
+ case 0xeb:
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ debug_insn(insn);
+ op = insn & 0xff;
+ r1 = (insn >> 36) & 0xf;
+@@ -5079,10 +5089,10 @@ static void disas_s390_insn(DisasContext *s)
+ b2 = (insn >> 28) & 0xf;
+ d2 = ((int)((((insn >> 16) & 0xfff)
+ | ((insn << 4) & 0xff000)) << 12)) >> 12;
+- disas_eb(s, op, r1, r3, b2, d2);
++ disas_eb(env, s, op, r1, r3, b2, d2);
+ break;
+ case 0xed:
+- insn = ld_code6(s->pc);
++ insn = ld_code6(env, s->pc);
+ debug_insn(insn);
+ op = insn & 0xff;
+ r1 = (insn >> 36) & 0xf;
+@@ -5090,11 +5100,11 @@ static void disas_s390_insn(DisasContext *s)
+ b2 = (insn >> 28) & 0xf;
+ d2 = (short)((insn >> 16) & 0xfff);
+ r1b = (insn >> 12) & 0xf;
+- disas_ed(s, op, r1, x2, b2, d2, r1b);
++ disas_ed(env, s, op, r1, x2, b2, d2, r1b);
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "unimplemented opcode 0x%x\n", opc);
+- gen_illegal_opcode(s, ilc);
++ gen_illegal_opcode(env, s, ilc);
+ break;
+ }
+
+@@ -5167,7 +5177,7 @@ static inline void gen_intermediate_code_internal(CPUS390XState *env,
+ LOG_DISAS("pc " TARGET_FMT_lx "\n",
+ dc.pc);
+ #endif
+- disas_s390_insn(&dc);
++ disas_s390_insn(env, &dc);
+
+ num_insns++;
+ if (env->singlestep_enabled) {
+--
+1.7.12.1
+
--- /dev/null
+From 25e9a95d0571c40738daa479467d757eb477739e Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 06:57:17 +0000
+Subject: [PATCH] target-lm32: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-lm32/Makefile.objs | 2 --
+ target-lm32/helper.h | 20 ++++++++++----------
+ target-lm32/op_helper.c | 29 +++++++++++------------------
+ target-lm32/translate.c | 28 +++++++++++++---------------
+ 5 files changed, 35 insertions(+), 46 deletions(-)
+
+diff --git a/configure b/configure
+index 3ad6f74..1e3ea7f 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | i386 | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
++ alpha | i386 | lm32 | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-lm32/Makefile.objs b/target-lm32/Makefile.objs
+index 2e0e093..ca20f21 100644
+--- a/target-lm32/Makefile.objs
++++ b/target-lm32/Makefile.objs
+@@ -1,4 +1,2 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-lm32/helper.h b/target-lm32/helper.h
+index 9d335ef..07f5670 100644
+--- a/target-lm32/helper.h
++++ b/target-lm32/helper.h
+@@ -1,14 +1,14 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_1(raise_exception, void, i32)
+-DEF_HELPER_0(hlt, void)
+-DEF_HELPER_1(wcsr_im, void, i32)
+-DEF_HELPER_1(wcsr_ip, void, i32)
+-DEF_HELPER_1(wcsr_jtx, void, i32)
+-DEF_HELPER_1(wcsr_jrx, void, i32)
+-DEF_HELPER_0(rcsr_im, i32)
+-DEF_HELPER_0(rcsr_ip, i32)
+-DEF_HELPER_0(rcsr_jtx, i32)
+-DEF_HELPER_0(rcsr_jrx, i32)
++DEF_HELPER_2(raise_exception, void, env, i32)
++DEF_HELPER_1(hlt, void, env)
++DEF_HELPER_2(wcsr_im, void, env, i32)
++DEF_HELPER_2(wcsr_ip, void, env, i32)
++DEF_HELPER_2(wcsr_jtx, void, env, i32)
++DEF_HELPER_2(wcsr_jrx, void, env, i32)
++DEF_HELPER_1(rcsr_im, i32, env)
++DEF_HELPER_1(rcsr_ip, i32, env)
++DEF_HELPER_1(rcsr_jtx, i32, env)
++DEF_HELPER_1(rcsr_jrx, i32, env)
+
+ #include "def-helper.h"
+diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
+index 51edc1a..7b91d8c 100644
+--- a/target-lm32/op_helper.c
++++ b/target-lm32/op_helper.c
+@@ -1,6 +1,5 @@
+ #include <assert.h>
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+ #include "host-utils.h"
+
+@@ -18,55 +17,55 @@
+ #define SHIFT 3
+ #include "softmmu_template.h"
+
+-void helper_raise_exception(uint32_t index)
++void helper_raise_exception(CPULM32State *env, uint32_t index)
+ {
+ env->exception_index = index;
+ cpu_loop_exit(env);
+ }
+
+-void helper_hlt(void)
++void helper_hlt(CPULM32State *env)
+ {
+ env->halted = 1;
+ env->exception_index = EXCP_HLT;
+ cpu_loop_exit(env);
+ }
+
+-void helper_wcsr_im(uint32_t im)
++void helper_wcsr_im(CPULM32State *env, uint32_t im)
+ {
+ lm32_pic_set_im(env->pic_state, im);
+ }
+
+-void helper_wcsr_ip(uint32_t im)
++void helper_wcsr_ip(CPULM32State *env, uint32_t im)
+ {
+ lm32_pic_set_ip(env->pic_state, im);
+ }
+
+-void helper_wcsr_jtx(uint32_t jtx)
++void helper_wcsr_jtx(CPULM32State *env, uint32_t jtx)
+ {
+ lm32_juart_set_jtx(env->juart_state, jtx);
+ }
+
+-void helper_wcsr_jrx(uint32_t jrx)
++void helper_wcsr_jrx(CPULM32State *env, uint32_t jrx)
+ {
+ lm32_juart_set_jrx(env->juart_state, jrx);
+ }
+
+-uint32_t helper_rcsr_im(void)
++uint32_t helper_rcsr_im(CPULM32State *env)
+ {
+ return lm32_pic_get_im(env->pic_state);
+ }
+
+-uint32_t helper_rcsr_ip(void)
++uint32_t helper_rcsr_ip(CPULM32State *env)
+ {
+ return lm32_pic_get_ip(env->pic_state);
+ }
+
+-uint32_t helper_rcsr_jtx(void)
++uint32_t helper_rcsr_jtx(CPULM32State *env)
+ {
+ return lm32_juart_get_jtx(env->juart_state);
+ }
+
+-uint32_t helper_rcsr_jrx(void)
++uint32_t helper_rcsr_jrx(CPULM32State *env)
+ {
+ return lm32_juart_get_jrx(env->juart_state);
+ }
+@@ -74,17 +73,12 @@ uint32_t helper_rcsr_jrx(void)
+ /* Try to fill the TLB and return an exception if error. If retaddr is
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPULM32State *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPULM32State *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPULM32State *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+-
+ ret = cpu_lm32_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret)) {
+ if (retaddr) {
+@@ -98,7 +92,6 @@ void tlb_fill(CPULM32State *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+ #endif
+
+diff --git a/target-lm32/translate.c b/target-lm32/translate.c
+index 872a2ba..5f6dcba 100644
+--- a/target-lm32/translate.c
++++ b/target-lm32/translate.c
+@@ -116,7 +116,7 @@ static inline void t_gen_raise_exception(DisasContext *dc, uint32_t index)
+ {
+ TCGv_i32 tmp = tcg_const_i32(index);
+
+- gen_helper_raise_exception(tmp);
++ gen_helper_raise_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ }
+
+@@ -179,7 +179,7 @@ static void dec_and(DisasContext *dc)
+ } else {
+ if (dc->r0 == 0 && dc->r1 == 0 && dc->r2 == 0) {
+ tcg_gen_movi_tl(cpu_pc, dc->pc + 4);
+- gen_helper_hlt();
++ gen_helper_hlt(cpu_env);
+ } else {
+ tcg_gen_and_tl(cpu_R[dc->r2], cpu_R[dc->r0], cpu_R[dc->r1]);
+ }
+@@ -601,10 +601,10 @@ static void dec_rcsr(DisasContext *dc)
+ tcg_gen_mov_tl(cpu_R[dc->r2], cpu_ie);
+ break;
+ case CSR_IM:
+- gen_helper_rcsr_im(cpu_R[dc->r2]);
++ gen_helper_rcsr_im(cpu_R[dc->r2], cpu_env);
+ break;
+ case CSR_IP:
+- gen_helper_rcsr_ip(cpu_R[dc->r2]);
++ gen_helper_rcsr_ip(cpu_R[dc->r2], cpu_env);
+ break;
+ case CSR_CC:
+ tcg_gen_mov_tl(cpu_R[dc->r2], cpu_cc);
+@@ -622,10 +622,10 @@ static void dec_rcsr(DisasContext *dc)
+ tcg_gen_mov_tl(cpu_R[dc->r2], cpu_deba);
+ break;
+ case CSR_JTX:
+- gen_helper_rcsr_jtx(cpu_R[dc->r2]);
++ gen_helper_rcsr_jtx(cpu_R[dc->r2], cpu_env);
+ break;
+ case CSR_JRX:
+- gen_helper_rcsr_jrx(cpu_R[dc->r2]);
++ gen_helper_rcsr_jrx(cpu_R[dc->r2], cpu_env);
+ break;
+ case CSR_ICC:
+ case CSR_DCC:
+@@ -812,7 +812,7 @@ static void dec_wcsr(DisasContext *dc)
+ if (use_icount) {
+ gen_io_start();
+ }
+- gen_helper_wcsr_im(cpu_R[dc->r1]);
++ gen_helper_wcsr_im(cpu_env, cpu_R[dc->r1]);
+ tcg_gen_movi_tl(cpu_pc, dc->pc + 4);
+ if (use_icount) {
+ gen_io_end();
+@@ -824,7 +824,7 @@ static void dec_wcsr(DisasContext *dc)
+ if (use_icount) {
+ gen_io_start();
+ }
+- gen_helper_wcsr_ip(cpu_R[dc->r1]);
++ gen_helper_wcsr_ip(cpu_env, cpu_R[dc->r1]);
+ tcg_gen_movi_tl(cpu_pc, dc->pc + 4);
+ if (use_icount) {
+ gen_io_end();
+@@ -844,10 +844,10 @@ static void dec_wcsr(DisasContext *dc)
+ tcg_gen_mov_tl(cpu_deba, cpu_R[dc->r1]);
+ break;
+ case CSR_JTX:
+- gen_helper_wcsr_jtx(cpu_R[dc->r1]);
++ gen_helper_wcsr_jtx(cpu_env, cpu_R[dc->r1]);
+ break;
+ case CSR_JRX:
+- gen_helper_wcsr_jrx(cpu_R[dc->r1]);
++ gen_helper_wcsr_jrx(cpu_env, cpu_R[dc->r1]);
+ break;
+ case CSR_DC:
+ tcg_gen_mov_tl(cpu_dc, cpu_R[dc->r1]);
+@@ -940,15 +940,13 @@ static const DecoderInfo decinfo[] = {
+ dec_cmpne
+ };
+
+-static inline void decode(DisasContext *dc)
++static inline void decode(DisasContext *dc, uint32_t ir)
+ {
+- uint32_t ir;
+-
+ if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP))) {
+ tcg_gen_debug_insn_start(dc->pc);
+ }
+
+- dc->ir = ir = ldl_code(dc->pc);
++ dc->ir = ir;
+ LOG_DIS("%8.8x\t", dc->ir);
+
+ /* try guessing 'empty' instruction memory, although it may be a valid
+@@ -1068,7 +1066,7 @@ static void gen_intermediate_code_internal(CPULM32State *env,
+ gen_io_start();
+ }
+
+- decode(dc);
++ decode(dc, cpu_ldl_code(env, dc->pc));
+ dc->pc += 4;
+ num_insns++;
+
+--
+1.7.12.1
+
--- /dev/null
+From 2ace9fd11db103aecebf451aff3bc23838248667 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:27:38 +0000
+Subject: [PATCH] target-m68k: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-m68k/Makefile.objs | 2 --
+ target-m68k/helpers.h | 2 +-
+ target-m68k/op_helper.c | 68 +++++++++++++++++-------------------------
+ target-m68k/translate.c | 76 ++++++++++++++++++++++++-----------------------
+ 5 files changed, 68 insertions(+), 82 deletions(-)
+
+diff --git a/configure b/configure
+index 1e3ea7f..af03942 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | i386 | lm32 | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
++ alpha | i386 | lm32 | m68k | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-m68k/Makefile.objs b/target-m68k/Makefile.objs
+index cda6015..7eccfab 100644
+--- a/target-m68k/Makefile.objs
++++ b/target-m68k/Makefile.objs
+@@ -1,5 +1,3 @@
+ obj-y += m68k-semi.o
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-m68k/helpers.h b/target-m68k/helpers.h
+index cb8a0c7..8112b44 100644
+--- a/target-m68k/helpers.h
++++ b/target-m68k/helpers.h
+@@ -49,6 +49,6 @@ DEF_HELPER_3(set_mac_exts, void, env, i32, i32)
+ DEF_HELPER_3(set_mac_extu, void, env, i32, i32)
+
+ DEF_HELPER_2(flush_flags, void, env, i32)
+-DEF_HELPER_1(raise_exception, void, i32)
++DEF_HELPER_2(raise_exception, void, env, i32)
+
+ #include "def-helper.h"
+diff --git a/target-m68k/op_helper.c b/target-m68k/op_helper.c
+index 1971a57..3116287 100644
+--- a/target-m68k/op_helper.c
++++ b/target-m68k/op_helper.c
+@@ -17,17 +17,16 @@
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helpers.h"
+
+ #if defined(CONFIG_USER_ONLY)
+
+-void do_interrupt(CPUM68KState *env1)
++void do_interrupt(CPUM68KState *env)
+ {
+- env1->exception_index = -1;
++ env->exception_index = -1;
+ }
+
+-void do_interrupt_m68k_hardirq(CPUM68KState *env1)
++void do_interrupt_m68k_hardirq(CPUM68KState *env)
+ {
+ }
+
+@@ -54,16 +53,12 @@ extern int semihosting_enabled;
+ /* Try to fill the TLB and return an exception if error. If retaddr is
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPUM68KState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUM68KState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUM68KState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = cpu_m68k_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret)) {
+ if (retaddr) {
+@@ -77,24 +72,23 @@ void tlb_fill(CPUM68KState *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+
+-static void do_rte(void)
++static void do_rte(CPUM68KState *env)
+ {
+ uint32_t sp;
+ uint32_t fmt;
+
+ sp = env->aregs[7];
+- fmt = ldl_kernel(sp);
+- env->pc = ldl_kernel(sp + 4);
++ fmt = cpu_ldl_kernel(env, sp);
++ env->pc = cpu_ldl_kernel(env, sp + 4);
+ sp |= (fmt >> 28) & 3;
+ env->sr = fmt & 0xffff;
+ m68k_switch_sp(env);
+ env->aregs[7] = sp + 8;
+ }
+
+-static void do_interrupt_all(int is_hw)
++static void do_interrupt_all(CPUM68KState *env, int is_hw)
+ {
+ uint32_t sp;
+ uint32_t fmt;
+@@ -108,14 +102,14 @@ static void do_interrupt_all(int is_hw)
+ switch (env->exception_index) {
+ case EXCP_RTE:
+ /* Return from an exception. */
+- do_rte();
++ do_rte(env);
+ return;
+ case EXCP_HALT_INSN:
+ if (semihosting_enabled
+ && (env->sr & SR_S) != 0
+ && (env->pc & 3) == 0
+- && lduw_code(env->pc - 4) == 0x4e71
+- && ldl_code(env->pc) == 0x4e7bf000) {
++ && cpu_lduw_code(env, env->pc - 4) == 0x4e71
++ && cpu_ldl_code(env, env->pc) == 0x4e7bf000) {
+ env->pc += 4;
+ do_m68k_semihosting(env, env->dregs[0]);
+ return;
+@@ -151,44 +145,34 @@ static void do_interrupt_all(int is_hw)
+ /* ??? This could cause MMU faults. */
+ sp &= ~3;
+ sp -= 4;
+- stl_kernel(sp, retaddr);
++ cpu_stl_kernel(env, sp, retaddr);
+ sp -= 4;
+- stl_kernel(sp, fmt);
++ cpu_stl_kernel(env, sp, fmt);
+ env->aregs[7] = sp;
+ /* Jump to vector. */
+- env->pc = ldl_kernel(env->vbr + vector);
++ env->pc = cpu_ldl_kernel(env, env->vbr + vector);
+ }
+
+-void do_interrupt(CPUM68KState *env1)
++void do_interrupt(CPUM68KState *env)
+ {
+- CPUM68KState *saved_env;
+-
+- saved_env = env;
+- env = env1;
+- do_interrupt_all(0);
+- env = saved_env;
++ do_interrupt_all(env, 0);
+ }
+
+-void do_interrupt_m68k_hardirq(CPUM68KState *env1)
++void do_interrupt_m68k_hardirq(CPUM68KState *env)
+ {
+- CPUM68KState *saved_env;
+-
+- saved_env = env;
+- env = env1;
+- do_interrupt_all(1);
+- env = saved_env;
++ do_interrupt_all(env, 1);
+ }
+ #endif
+
+-static void raise_exception(int tt)
++static void raise_exception(CPUM68KState *env, int tt)
+ {
+ env->exception_index = tt;
+ cpu_loop_exit(env);
+ }
+
+-void HELPER(raise_exception)(uint32_t tt)
++void HELPER(raise_exception)(CPUM68KState *env, uint32_t tt)
+ {
+- raise_exception(tt);
++ raise_exception(env, tt);
+ }
+
+ void HELPER(divu)(CPUM68KState *env, uint32_t word)
+@@ -202,8 +186,9 @@ void HELPER(divu)(CPUM68KState *env, uint32_t word)
+ num = env->div1;
+ den = env->div2;
+ /* ??? This needs to make sure the throwing location is accurate. */
+- if (den == 0)
+- raise_exception(EXCP_DIV0);
++ if (den == 0) {
++ raise_exception(env, EXCP_DIV0);
++ }
+ quot = num / den;
+ rem = num % den;
+ flags = 0;
+@@ -231,8 +216,9 @@ void HELPER(divs)(CPUM68KState *env, uint32_t word)
+
+ num = env->div1;
+ den = env->div2;
+- if (den == 0)
+- raise_exception(EXCP_DIV0);
++ if (den == 0) {
++ raise_exception(env, EXCP_DIV0);
++ }
+ quot = num / den;
+ rem = num % den;
+ flags = 0;
+diff --git a/target-m68k/translate.c b/target-m68k/translate.c
+index 9fc1e31..10bb303 100644
+--- a/target-m68k/translate.c
++++ b/target-m68k/translate.c
+@@ -260,9 +260,9 @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
+ static inline uint32_t read_im32(DisasContext *s)
+ {
+ uint32_t im;
+- im = ((uint32_t)lduw_code(s->pc)) << 16;
++ im = ((uint32_t)cpu_lduw_code(cpu_single_env, s->pc)) << 16;
+ s->pc += 2;
+- im |= lduw_code(s->pc);
++ im |= cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ return im;
+ }
+@@ -297,7 +297,7 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ uint32_t bd, od;
+
+ offset = s->pc;
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+
+ if ((ext & 0x800) == 0 && !m68k_feature(s->env, M68K_FEATURE_WORD_INDEX))
+@@ -311,7 +311,7 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ if ((ext & 0x30) > 0x10) {
+ /* base displacement */
+ if ((ext & 0x30) == 0x20) {
+- bd = (int16_t)lduw_code(s->pc);
++ bd = (int16_t)cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ } else {
+ bd = read_im32(s);
+@@ -360,7 +360,7 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ if ((ext & 3) > 1) {
+ /* outer displacement */
+ if ((ext & 3) == 2) {
+- od = (int16_t)lduw_code(s->pc);
++ od = (int16_t)cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ } else {
+ od = read_im32(s);
+@@ -514,7 +514,7 @@ static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
+ case 5: /* Indirect displacement. */
+ reg = AREG(insn, 0);
+ tmp = tcg_temp_new();
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp, reg, (int16_t)ext);
+ return tmp;
+@@ -524,7 +524,7 @@ static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
+ case 7: /* Other */
+ switch (insn & 7) {
+ case 0: /* Absolute short. */
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ return tcg_const_i32(offset);
+ case 1: /* Absolute long. */
+@@ -532,7 +532,7 @@ static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
+ return tcg_const_i32(offset);
+ case 2: /* pc displacement */
+ offset = s->pc;
+- offset += ldsw_code(s->pc);
++ offset += cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ return tcg_const_i32(offset);
+ case 3: /* pc index+displacement. */
+@@ -638,17 +638,19 @@ static TCGv gen_ea(DisasContext *s, uint16_t insn, int opsize, TCGv val,
+ /* Sign extend values for consistency. */
+ switch (opsize) {
+ case OS_BYTE:
+- if (what == EA_LOADS)
+- offset = ldsb_code(s->pc + 1);
+- else
+- offset = ldub_code(s->pc + 1);
++ if (what == EA_LOADS) {
++ offset = cpu_ldsb_code(cpu_single_env, s->pc + 1);
++ } else {
++ offset = cpu_ldub_code(cpu_single_env, s->pc + 1);
++ }
+ s->pc += 2;
+ break;
+ case OS_WORD:
+- if (what == EA_LOADS)
+- offset = ldsw_code(s->pc);
+- else
+- offset = lduw_code(s->pc);
++ if (what == EA_LOADS) {
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ } else {
++ offset = cpu_lduw_code(cpu_single_env, s->pc);
++ }
+ s->pc += 2;
+ break;
+ case OS_LONG:
+@@ -815,7 +817,7 @@ static void gen_exception(DisasContext *s, uint32_t where, int nr)
+ {
+ gen_flush_cc_op(s);
+ gen_jmp_im(s, where);
+- gen_helper_raise_exception(tcg_const_i32(nr));
++ gen_helper_raise_exception(cpu_env, tcg_const_i32(nr));
+ }
+
+ static inline void gen_addr_fault(DisasContext *s)
+@@ -934,7 +936,7 @@ DISAS_INSN(divl)
+ TCGv reg;
+ uint16_t ext;
+
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (ext & 0x87f8) {
+ gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+@@ -1086,7 +1088,7 @@ DISAS_INSN(movem)
+ TCGv tmp;
+ int is_load;
+
+- mask = lduw_code(s->pc);
++ mask = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ tmp = gen_lea(s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp)) {
+@@ -1130,7 +1132,7 @@ DISAS_INSN(bitop_im)
+ opsize = OS_LONG;
+ op = (insn >> 6) & 3;
+
+- bitnum = lduw_code(s->pc);
++ bitnum = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (bitnum & 0xff00) {
+ disas_undef(s, insn);
+@@ -1383,7 +1385,7 @@ static void gen_set_sr(DisasContext *s, uint16_t insn, int ccr_only)
+ else if ((insn & 0x3f) == 0x3c)
+ {
+ uint16_t val;
+- val = lduw_code(s->pc);
++ val = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ gen_set_sr_im(s, val, ccr_only);
+ }
+@@ -1507,7 +1509,7 @@ DISAS_INSN(mull)
+
+ /* The upper 32 bits of the product are discarded, so
+ muls.l and mulu.l are functionally equivalent. */
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (ext & 0x87ff) {
+ gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+@@ -1528,7 +1530,7 @@ DISAS_INSN(link)
+ TCGv reg;
+ TCGv tmp;
+
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ reg = AREG(insn, 0);
+ tmp = tcg_temp_new();
+@@ -1649,7 +1651,7 @@ DISAS_INSN(branch)
+ op = (insn >> 8) & 0xf;
+ offset = (int8_t)insn;
+ if (offset == 0) {
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ } else if (offset == -1) {
+ offset = read_im32(s);
+@@ -1934,13 +1936,13 @@ DISAS_INSN(strldsr)
+ uint32_t addr;
+
+ addr = s->pc - 2;
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (ext != 0x46FC) {
+ gen_exception(s, addr, EXCP_UNSUPPORTED);
+ return;
+ }
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (IS_USER(s) || (ext & SR_S) == 0) {
+ gen_exception(s, addr, EXCP_PRIVILEGE);
+@@ -2008,7 +2010,7 @@ DISAS_INSN(stop)
+ return;
+ }
+
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+
+ gen_set_sr_im(s, ext, 0);
+@@ -2035,7 +2037,7 @@ DISAS_INSN(movec)
+ return;
+ }
+
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+
+ if (ext & 0x8000) {
+@@ -2100,7 +2102,7 @@ DISAS_INSN(fpu)
+ int set_dest;
+ int opsize;
+
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ opmode = ext & 0x7f;
+ switch ((ext >> 13) & 7) {
+@@ -2136,7 +2138,7 @@ DISAS_INSN(fpu)
+ tcg_gen_addi_i32(tmp32, tmp32, -8);
+ break;
+ case 5:
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+ break;
+@@ -2250,12 +2252,12 @@ DISAS_INSN(fpu)
+ tcg_gen_addi_i32(tmp32, tmp32, -8);
+ break;
+ case 5:
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+ break;
+ case 7:
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ offset += s->pc - 2;
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+@@ -2381,10 +2383,10 @@ DISAS_INSN(fbcc)
+ int l1;
+
+ addr = s->pc;
+- offset = ldsw_code(s->pc);
++ offset = cpu_ldsw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ if (insn & (1 << 6)) {
+- offset = (offset << 16) | lduw_code(s->pc);
++ offset = (offset << 16) | cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+ }
+
+@@ -2506,7 +2508,7 @@ DISAS_INSN(mac)
+ s->done_mac = 1;
+ }
+
+- ext = lduw_code(s->pc);
++ ext = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+
+ acc = ((insn >> 7) & 1) | ((ext >> 3) & 2);
+@@ -2941,7 +2943,7 @@ static void disas_m68k_insn(CPUM68KState * env, DisasContext *s)
+ {
+ uint16_t insn;
+
+- insn = lduw_code(s->pc);
++ insn = cpu_lduw_code(cpu_single_env, s->pc);
+ s->pc += 2;
+
+ opcode_table[insn](s, insn);
+@@ -3028,7 +3030,7 @@ gen_intermediate_code_internal(CPUM68KState *env, TranslationBlock *tb,
+ gen_flush_cc_op(dc);
+ tcg_gen_movi_i32(QREG_PC, dc->pc);
+ }
+- gen_helper_raise_exception(tcg_const_i32(EXCP_DEBUG));
++ gen_helper_raise_exception(cpu_env, tcg_const_i32(EXCP_DEBUG));
+ } else {
+ switch(dc->is_jmp) {
+ case DISAS_NEXT:
+--
+1.7.12.1
+
--- /dev/null
+From 5560cd783146734a60c446f43227044cbb580edd Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sat, 8 Sep 2012 10:48:20 +0000
+Subject: [PATCH] target-m68k: avoid using cpu_single_env
+
+Pass around CPUState instead of using global cpu_single_env.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-m68k/translate.c | 270 +++++++++++++++++++++++++-----------------------
+ 1 file changed, 140 insertions(+), 130 deletions(-)
+
+diff --git a/target-m68k/translate.c b/target-m68k/translate.c
+index 10bb303..fb707f2 100644
+--- a/target-m68k/translate.c
++++ b/target-m68k/translate.c
+@@ -150,18 +150,24 @@ static void *gen_throws_exception;
+ #define OS_SINGLE 4
+ #define OS_DOUBLE 5
+
+-typedef void (*disas_proc)(DisasContext *, uint16_t);
++typedef void (*disas_proc)(CPUM68KState *env, DisasContext *s, uint16_t insn);
+
+ #ifdef DEBUG_DISPATCH
+-#define DISAS_INSN(name) \
+- static void real_disas_##name (DisasContext *s, uint16_t insn); \
+- static void disas_##name (DisasContext *s, uint16_t insn) { \
+- qemu_log("Dispatch " #name "\n"); \
+- real_disas_##name(s, insn); } \
+- static void real_disas_##name (DisasContext *s, uint16_t insn)
++#define DISAS_INSN(name) \
++ static void real_disas_##name(CPUM68KState *env, DisasContext *s, \
++ uint16_t insn); \
++ static void disas_##name(CPUM68KState *env, DisasContext *s, \
++ uint16_t insn) \
++ { \
++ qemu_log("Dispatch " #name "\n"); \
++ real_disas_##name(s, env, insn); \
++ } \
++ static void real_disas_##name(CPUM68KState *env, DisasContext *s, \
++ uint16_t insn)
+ #else
+-#define DISAS_INSN(name) \
+- static void disas_##name (DisasContext *s, uint16_t insn)
++#define DISAS_INSN(name) \
++ static void disas_##name(CPUM68KState *env, DisasContext *s, \
++ uint16_t insn)
+ #endif
+
+ /* Generate a load from the specified address. Narrow values are
+@@ -257,12 +263,12 @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
+ }
+
+ /* Read a 32-bit immediate constant. */
+-static inline uint32_t read_im32(DisasContext *s)
++static inline uint32_t read_im32(CPUM68KState *env, DisasContext *s)
+ {
+ uint32_t im;
+- im = ((uint32_t)cpu_lduw_code(cpu_single_env, s->pc)) << 16;
++ im = ((uint32_t)cpu_lduw_code(env, s->pc)) << 16;
+ s->pc += 2;
+- im |= cpu_lduw_code(cpu_single_env, s->pc);
++ im |= cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ return im;
+ }
+@@ -288,7 +294,8 @@ static TCGv gen_addr_index(uint16_t ext, TCGv tmp)
+
+ /* Handle a base + index + displacement effective addresss.
+ A NULL_QREG base means pc-relative. */
+-static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
++static TCGv gen_lea_indexed(CPUM68KState *env, DisasContext *s, int opsize,
++ TCGv base)
+ {
+ uint32_t offset;
+ uint16_t ext;
+@@ -297,7 +304,7 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ uint32_t bd, od;
+
+ offset = s->pc;
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+
+ if ((ext & 0x800) == 0 && !m68k_feature(s->env, M68K_FEATURE_WORD_INDEX))
+@@ -311,10 +318,10 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ if ((ext & 0x30) > 0x10) {
+ /* base displacement */
+ if ((ext & 0x30) == 0x20) {
+- bd = (int16_t)cpu_lduw_code(cpu_single_env, s->pc);
++ bd = (int16_t)cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ } else {
+- bd = read_im32(s);
++ bd = read_im32(env, s);
+ }
+ } else {
+ bd = 0;
+@@ -360,10 +367,10 @@ static TCGv gen_lea_indexed(DisasContext *s, int opsize, TCGv base)
+ if ((ext & 3) > 1) {
+ /* outer displacement */
+ if ((ext & 3) == 2) {
+- od = (int16_t)cpu_lduw_code(cpu_single_env, s->pc);
++ od = (int16_t)cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ } else {
+- od = read_im32(s);
++ od = read_im32(env, s);
+ }
+ } else {
+ od = 0;
+@@ -492,7 +499,8 @@ static inline TCGv gen_extend(TCGv val, int opsize, int sign)
+
+ /* Generate code for an "effective address". Does not adjust the base
+ register for autoincrement addressing modes. */
+-static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
++static TCGv gen_lea(CPUM68KState *env, DisasContext *s, uint16_t insn,
++ int opsize)
+ {
+ TCGv reg;
+ TCGv tmp;
+@@ -514,29 +522,29 @@ static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
+ case 5: /* Indirect displacement. */
+ reg = AREG(insn, 0);
+ tmp = tcg_temp_new();
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp, reg, (int16_t)ext);
+ return tmp;
+ case 6: /* Indirect index + displacement. */
+ reg = AREG(insn, 0);
+- return gen_lea_indexed(s, opsize, reg);
++ return gen_lea_indexed(env, s, opsize, reg);
+ case 7: /* Other */
+ switch (insn & 7) {
+ case 0: /* Absolute short. */
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ return tcg_const_i32(offset);
+ case 1: /* Absolute long. */
+- offset = read_im32(s);
++ offset = read_im32(env, s);
+ return tcg_const_i32(offset);
+ case 2: /* pc displacement */
+ offset = s->pc;
+- offset += cpu_ldsw_code(cpu_single_env, s->pc);
++ offset += cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ return tcg_const_i32(offset);
+ case 3: /* pc index+displacement. */
+- return gen_lea_indexed(s, opsize, NULL_QREG);
++ return gen_lea_indexed(env, s, opsize, NULL_QREG);
+ case 4: /* Immediate. */
+ default:
+ return NULL_QREG;
+@@ -548,15 +556,16 @@ static TCGv gen_lea(DisasContext *s, uint16_t insn, int opsize)
+
+ /* Helper function for gen_ea. Reuse the computed address between the
+ for read/write operands. */
+-static inline TCGv gen_ea_once(DisasContext *s, uint16_t insn, int opsize,
+- TCGv val, TCGv *addrp, ea_what what)
++static inline TCGv gen_ea_once(CPUM68KState *env, DisasContext *s,
++ uint16_t insn, int opsize, TCGv val,
++ TCGv *addrp, ea_what what)
+ {
+ TCGv tmp;
+
+ if (addrp && what == EA_STORE) {
+ tmp = *addrp;
+ } else {
+- tmp = gen_lea(s, insn, opsize);
++ tmp = gen_lea(env, s, insn, opsize);
+ if (IS_NULL_QREG(tmp))
+ return tmp;
+ if (addrp)
+@@ -568,8 +577,8 @@ static inline TCGv gen_ea_once(DisasContext *s, uint16_t insn, int opsize,
+ /* Generate code to load/store a value ito/from an EA. If VAL > 0 this is
+ a write otherwise it is a read (0 == sign extend, -1 == zero extend).
+ ADDRP is non-null for readwrite operands. */
+-static TCGv gen_ea(DisasContext *s, uint16_t insn, int opsize, TCGv val,
+- TCGv *addrp, ea_what what)
++static TCGv gen_ea(CPUM68KState *env, DisasContext *s, uint16_t insn,
++ int opsize, TCGv val, TCGv *addrp, ea_what what)
+ {
+ TCGv reg;
+ TCGv result;
+@@ -609,7 +618,7 @@ static TCGv gen_ea(DisasContext *s, uint16_t insn, int opsize, TCGv val,
+ if (addrp && what == EA_STORE) {
+ tmp = *addrp;
+ } else {
+- tmp = gen_lea(s, insn, opsize);
++ tmp = gen_lea(env, s, insn, opsize);
+ if (IS_NULL_QREG(tmp))
+ return tmp;
+ if (addrp)
+@@ -626,35 +635,35 @@ static TCGv gen_ea(DisasContext *s, uint16_t insn, int opsize, TCGv val,
+ return result;
+ case 5: /* Indirect displacement. */
+ case 6: /* Indirect index + displacement. */
+- return gen_ea_once(s, insn, opsize, val, addrp, what);
++ return gen_ea_once(env, s, insn, opsize, val, addrp, what);
+ case 7: /* Other */
+ switch (insn & 7) {
+ case 0: /* Absolute short. */
+ case 1: /* Absolute long. */
+ case 2: /* pc displacement */
+ case 3: /* pc index+displacement. */
+- return gen_ea_once(s, insn, opsize, val, addrp, what);
++ return gen_ea_once(env, s, insn, opsize, val, addrp, what);
+ case 4: /* Immediate. */
+ /* Sign extend values for consistency. */
+ switch (opsize) {
+ case OS_BYTE:
+ if (what == EA_LOADS) {
+- offset = cpu_ldsb_code(cpu_single_env, s->pc + 1);
++ offset = cpu_ldsb_code(env, s->pc + 1);
+ } else {
+- offset = cpu_ldub_code(cpu_single_env, s->pc + 1);
++ offset = cpu_ldub_code(env, s->pc + 1);
+ }
+ s->pc += 2;
+ break;
+ case OS_WORD:
+ if (what == EA_LOADS) {
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ } else {
+- offset = cpu_lduw_code(cpu_single_env, s->pc);
++ offset = cpu_lduw_code(env, s->pc);
+ }
+ s->pc += 2;
+ break;
+ case OS_LONG:
+- offset = read_im32(s);
++ offset = read_im32(env, s);
+ break;
+ default:
+ qemu_assert(0, "Bad immediate operand");
+@@ -825,20 +834,21 @@ static inline void gen_addr_fault(DisasContext *s)
+ gen_exception(s, s->insn_pc, EXCP_ADDRESS);
+ }
+
+-#define SRC_EA(result, opsize, op_sign, addrp) do { \
+- result = gen_ea(s, insn, opsize, NULL_QREG, addrp, op_sign ? EA_LOADS : EA_LOADU); \
+- if (IS_NULL_QREG(result)) { \
+- gen_addr_fault(s); \
+- return; \
+- } \
++#define SRC_EA(env, result, opsize, op_sign, addrp) do { \
++ result = gen_ea(env, s, insn, opsize, NULL_QREG, addrp, \
++ op_sign ? EA_LOADS : EA_LOADU); \
++ if (IS_NULL_QREG(result)) { \
++ gen_addr_fault(s); \
++ return; \
++ } \
+ } while (0)
+
+-#define DEST_EA(insn, opsize, val, addrp) do { \
+- TCGv ea_result = gen_ea(s, insn, opsize, val, addrp, EA_STORE); \
+- if (IS_NULL_QREG(ea_result)) { \
+- gen_addr_fault(s); \
+- return; \
+- } \
++#define DEST_EA(env, insn, opsize, val, addrp) do { \
++ TCGv ea_result = gen_ea(env, s, insn, opsize, val, addrp, EA_STORE); \
++ if (IS_NULL_QREG(ea_result)) { \
++ gen_addr_fault(s); \
++ return; \
++ } \
+ } while (0)
+
+ /* Generate a jump to an immediate address. */
+@@ -874,8 +884,7 @@ DISAS_INSN(undef_fpu)
+ DISAS_INSN(undef)
+ {
+ gen_exception(s, s->pc - 2, EXCP_UNSUPPORTED);
+- cpu_abort(cpu_single_env, "Illegal instruction: %04x @ %08x",
+- insn, s->pc - 2);
++ cpu_abort(env, "Illegal instruction: %04x @ %08x", insn, s->pc - 2);
+ }
+
+ DISAS_INSN(mulw)
+@@ -892,7 +901,7 @@ DISAS_INSN(mulw)
+ tcg_gen_ext16s_i32(tmp, reg);
+ else
+ tcg_gen_ext16u_i32(tmp, reg);
+- SRC_EA(src, OS_WORD, sign, NULL);
++ SRC_EA(env, src, OS_WORD, sign, NULL);
+ tcg_gen_mul_i32(tmp, tmp, src);
+ tcg_gen_mov_i32(reg, tmp);
+ /* Unlike m68k, coldfire always clears the overflow bit. */
+@@ -913,7 +922,7 @@ DISAS_INSN(divw)
+ } else {
+ tcg_gen_ext16u_i32(QREG_DIV1, reg);
+ }
+- SRC_EA(src, OS_WORD, sign, NULL);
++ SRC_EA(env, src, OS_WORD, sign, NULL);
+ tcg_gen_mov_i32(QREG_DIV2, src);
+ if (sign) {
+ gen_helper_divs(cpu_env, tcg_const_i32(1));
+@@ -936,7 +945,7 @@ DISAS_INSN(divl)
+ TCGv reg;
+ uint16_t ext;
+
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ if (ext & 0x87f8) {
+ gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+@@ -945,7 +954,7 @@ DISAS_INSN(divl)
+ num = DREG(ext, 12);
+ reg = DREG(ext, 0);
+ tcg_gen_mov_i32(QREG_DIV1, num);
+- SRC_EA(den, OS_LONG, 0, NULL);
++ SRC_EA(env, den, OS_LONG, 0, NULL);
+ tcg_gen_mov_i32(QREG_DIV2, den);
+ if (ext & 0x0800) {
+ gen_helper_divs(cpu_env, tcg_const_i32(0));
+@@ -975,11 +984,11 @@ DISAS_INSN(addsub)
+ reg = DREG(insn, 9);
+ dest = tcg_temp_new();
+ if (insn & 0x100) {
+- SRC_EA(tmp, OS_LONG, 0, &addr);
++ SRC_EA(env, tmp, OS_LONG, 0, &addr);
+ src = reg;
+ } else {
+ tmp = reg;
+- SRC_EA(src, OS_LONG, 0, NULL);
++ SRC_EA(env, src, OS_LONG, 0, NULL);
+ }
+ if (add) {
+ tcg_gen_add_i32(dest, tmp, src);
+@@ -992,7 +1001,7 @@ DISAS_INSN(addsub)
+ }
+ gen_update_cc_add(dest, src);
+ if (insn & 0x100) {
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ } else {
+ tcg_gen_mov_i32(reg, dest);
+ }
+@@ -1022,7 +1031,7 @@ DISAS_INSN(bitop_reg)
+ else
+ opsize = OS_LONG;
+ op = (insn >> 6) & 3;
+- SRC_EA(src1, opsize, 0, op ? &addr: NULL);
++ SRC_EA(env, src1, opsize, 0, op ? &addr: NULL);
+ src2 = DREG(insn, 9);
+ dest = tcg_temp_new();
+
+@@ -1057,7 +1066,7 @@ DISAS_INSN(bitop_reg)
+ break;
+ }
+ if (op)
+- DEST_EA(insn, opsize, dest, &addr);
++ DEST_EA(env, insn, opsize, dest, &addr);
+ }
+
+ DISAS_INSN(sats)
+@@ -1088,9 +1097,9 @@ DISAS_INSN(movem)
+ TCGv tmp;
+ int is_load;
+
+- mask = cpu_lduw_code(cpu_single_env, s->pc);
++ mask = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+- tmp = gen_lea(s, insn, OS_LONG);
++ tmp = gen_lea(env, s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp)) {
+ gen_addr_fault(s);
+ return;
+@@ -1132,14 +1141,14 @@ DISAS_INSN(bitop_im)
+ opsize = OS_LONG;
+ op = (insn >> 6) & 3;
+
+- bitnum = cpu_lduw_code(cpu_single_env, s->pc);
++ bitnum = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ if (bitnum & 0xff00) {
+- disas_undef(s, insn);
++ disas_undef(env, s, insn);
+ return;
+ }
+
+- SRC_EA(src1, opsize, 0, op ? &addr: NULL);
++ SRC_EA(env, src1, opsize, 0, op ? &addr: NULL);
+
+ gen_flush_flags(s);
+ if (opsize == OS_BYTE)
+@@ -1174,7 +1183,7 @@ DISAS_INSN(bitop_im)
+ default: /* btst */
+ break;
+ }
+- DEST_EA(insn, opsize, tmp, &addr);
++ DEST_EA(env, insn, opsize, tmp, &addr);
+ }
+ }
+
+@@ -1187,8 +1196,8 @@ DISAS_INSN(arith_im)
+ TCGv addr;
+
+ op = (insn >> 9) & 7;
+- SRC_EA(src1, OS_LONG, 0, (op == 6) ? NULL : &addr);
+- im = read_im32(s);
++ SRC_EA(env, src1, OS_LONG, 0, (op == 6) ? NULL : &addr);
++ im = read_im32(env, s);
+ dest = tcg_temp_new();
+ switch (op) {
+ case 0: /* ori */
+@@ -1227,7 +1236,7 @@ DISAS_INSN(arith_im)
+ abort();
+ }
+ if (op != 6) {
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ }
+ }
+
+@@ -1259,7 +1268,7 @@ DISAS_INSN(move)
+ default:
+ abort();
+ }
+- SRC_EA(src, opsize, 1, NULL);
++ SRC_EA(env, src, opsize, 1, NULL);
+ op = (insn >> 6) & 7;
+ if (op == 1) {
+ /* movea */
+@@ -1270,7 +1279,7 @@ DISAS_INSN(move)
+ /* normal move */
+ uint16_t dest_ea;
+ dest_ea = ((insn >> 9) & 7) | (op << 3);
+- DEST_EA(dest_ea, opsize, src, NULL);
++ DEST_EA(env, dest_ea, opsize, src, NULL);
+ /* This will be correct because loads sign extend. */
+ gen_logic_cc(s, src);
+ }
+@@ -1291,7 +1300,7 @@ DISAS_INSN(lea)
+ TCGv tmp;
+
+ reg = AREG(insn, 9);
+- tmp = gen_lea(s, insn, OS_LONG);
++ tmp = gen_lea(env, s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp)) {
+ gen_addr_fault(s);
+ return;
+@@ -1316,7 +1325,7 @@ DISAS_INSN(clr)
+ default:
+ abort();
+ }
+- DEST_EA(insn, opsize, tcg_const_i32(0), NULL);
++ DEST_EA(env, insn, opsize, tcg_const_i32(0), NULL);
+ gen_logic_cc(s, tcg_const_i32(0));
+ }
+
+@@ -1365,7 +1374,8 @@ static void gen_set_sr_im(DisasContext *s, uint16_t val, int ccr_only)
+ }
+ }
+
+-static void gen_set_sr(DisasContext *s, uint16_t insn, int ccr_only)
++static void gen_set_sr(CPUM68KState *env, DisasContext *s, uint16_t insn,
++ int ccr_only)
+ {
+ TCGv tmp;
+ TCGv reg;
+@@ -1385,17 +1395,17 @@ static void gen_set_sr(DisasContext *s, uint16_t insn, int ccr_only)
+ else if ((insn & 0x3f) == 0x3c)
+ {
+ uint16_t val;
+- val = cpu_lduw_code(cpu_single_env, s->pc);
++ val = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ gen_set_sr_im(s, val, ccr_only);
+ }
+ else
+- disas_undef(s, insn);
++ disas_undef(env, s, insn);
+ }
+
+ DISAS_INSN(move_to_ccr)
+ {
+- gen_set_sr(s, insn, 1);
++ gen_set_sr(env, s, insn, 1);
+ }
+
+ DISAS_INSN(not)
+@@ -1426,7 +1436,7 @@ DISAS_INSN(pea)
+ {
+ TCGv tmp;
+
+- tmp = gen_lea(s, insn, OS_LONG);
++ tmp = gen_lea(env, s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp)) {
+ gen_addr_fault(s);
+ return;
+@@ -1472,7 +1482,7 @@ DISAS_INSN(tst)
+ default:
+ abort();
+ }
+- SRC_EA(tmp, opsize, 1, NULL);
++ SRC_EA(env, tmp, opsize, 1, NULL);
+ gen_logic_cc(s, tmp);
+ }
+
+@@ -1494,10 +1504,10 @@ DISAS_INSN(tas)
+ TCGv addr;
+
+ dest = tcg_temp_new();
+- SRC_EA(src1, OS_BYTE, 1, &addr);
++ SRC_EA(env, src1, OS_BYTE, 1, &addr);
+ gen_logic_cc(s, src1);
+ tcg_gen_ori_i32(dest, src1, 0x80);
+- DEST_EA(insn, OS_BYTE, dest, &addr);
++ DEST_EA(env, insn, OS_BYTE, dest, &addr);
+ }
+
+ DISAS_INSN(mull)
+@@ -1509,14 +1519,14 @@ DISAS_INSN(mull)
+
+ /* The upper 32 bits of the product are discarded, so
+ muls.l and mulu.l are functionally equivalent. */
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ if (ext & 0x87ff) {
+ gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+ return;
+ }
+ reg = DREG(ext, 12);
+- SRC_EA(src1, OS_LONG, 0, NULL);
++ SRC_EA(env, src1, OS_LONG, 0, NULL);
+ dest = tcg_temp_new();
+ tcg_gen_mul_i32(dest, src1, reg);
+ tcg_gen_mov_i32(reg, dest);
+@@ -1530,7 +1540,7 @@ DISAS_INSN(link)
+ TCGv reg;
+ TCGv tmp;
+
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ reg = AREG(insn, 0);
+ tmp = tcg_temp_new();
+@@ -1574,7 +1584,7 @@ DISAS_INSN(jump)
+
+ /* Load the target address first to ensure correct exception
+ behavior. */
+- tmp = gen_lea(s, insn, OS_LONG);
++ tmp = gen_lea(env, s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp)) {
+ gen_addr_fault(s);
+ return;
+@@ -1594,7 +1604,7 @@ DISAS_INSN(addsubq)
+ int val;
+ TCGv addr;
+
+- SRC_EA(src1, OS_LONG, 0, &addr);
++ SRC_EA(env, src1, OS_LONG, 0, &addr);
+ val = (insn >> 9) & 7;
+ if (val == 0)
+ val = 8;
+@@ -1621,7 +1631,7 @@ DISAS_INSN(addsubq)
+ }
+ gen_update_cc_add(dest, src2);
+ }
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ }
+
+ DISAS_INSN(tpf)
+@@ -1636,7 +1646,7 @@ DISAS_INSN(tpf)
+ case 4: /* No extension words. */
+ break;
+ default:
+- disas_undef(s, insn);
++ disas_undef(env, s, insn);
+ }
+ }
+
+@@ -1651,10 +1661,10 @@ DISAS_INSN(branch)
+ op = (insn >> 8) & 0xf;
+ offset = (int8_t)insn;
+ if (offset == 0) {
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ } else if (offset == -1) {
+- offset = read_im32(s);
++ offset = read_im32(env, s);
+ }
+ if (op == 1) {
+ /* bsr */
+@@ -1693,7 +1703,7 @@ DISAS_INSN(mvzs)
+ opsize = OS_WORD;
+ else
+ opsize = OS_BYTE;
+- SRC_EA(src, opsize, (insn & 0x80) == 0, NULL);
++ SRC_EA(env, src, opsize, (insn & 0x80) == 0, NULL);
+ reg = DREG(insn, 9);
+ tcg_gen_mov_i32(reg, src);
+ gen_logic_cc(s, src);
+@@ -1709,11 +1719,11 @@ DISAS_INSN(or)
+ reg = DREG(insn, 9);
+ dest = tcg_temp_new();
+ if (insn & 0x100) {
+- SRC_EA(src, OS_LONG, 0, &addr);
++ SRC_EA(env, src, OS_LONG, 0, &addr);
+ tcg_gen_or_i32(dest, src, reg);
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ } else {
+- SRC_EA(src, OS_LONG, 0, NULL);
++ SRC_EA(env, src, OS_LONG, 0, NULL);
+ tcg_gen_or_i32(dest, src, reg);
+ tcg_gen_mov_i32(reg, dest);
+ }
+@@ -1725,7 +1735,7 @@ DISAS_INSN(suba)
+ TCGv src;
+ TCGv reg;
+
+- SRC_EA(src, OS_LONG, 0, NULL);
++ SRC_EA(env, src, OS_LONG, 0, NULL);
+ reg = AREG(insn, 9);
+ tcg_gen_sub_i32(reg, reg, src);
+ }
+@@ -1751,7 +1761,7 @@ DISAS_INSN(mov3q)
+ val = -1;
+ src = tcg_const_i32(val);
+ gen_logic_cc(s, src);
+- DEST_EA(insn, OS_LONG, src, NULL);
++ DEST_EA(env, insn, OS_LONG, src, NULL);
+ }
+
+ DISAS_INSN(cmp)
+@@ -1779,7 +1789,7 @@ DISAS_INSN(cmp)
+ default:
+ abort();
+ }
+- SRC_EA(src, opsize, 1, NULL);
++ SRC_EA(env, src, opsize, 1, NULL);
+ reg = DREG(insn, 9);
+ dest = tcg_temp_new();
+ tcg_gen_sub_i32(dest, reg, src);
+@@ -1798,7 +1808,7 @@ DISAS_INSN(cmpa)
+ } else {
+ opsize = OS_WORD;
+ }
+- SRC_EA(src, opsize, 1, NULL);
++ SRC_EA(env, src, opsize, 1, NULL);
+ reg = AREG(insn, 9);
+ dest = tcg_temp_new();
+ tcg_gen_sub_i32(dest, reg, src);
+@@ -1813,12 +1823,12 @@ DISAS_INSN(eor)
+ TCGv dest;
+ TCGv addr;
+
+- SRC_EA(src, OS_LONG, 0, &addr);
++ SRC_EA(env, src, OS_LONG, 0, &addr);
+ reg = DREG(insn, 9);
+ dest = tcg_temp_new();
+ tcg_gen_xor_i32(dest, src, reg);
+ gen_logic_cc(s, dest);
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ }
+
+ DISAS_INSN(and)
+@@ -1831,11 +1841,11 @@ DISAS_INSN(and)
+ reg = DREG(insn, 9);
+ dest = tcg_temp_new();
+ if (insn & 0x100) {
+- SRC_EA(src, OS_LONG, 0, &addr);
++ SRC_EA(env, src, OS_LONG, 0, &addr);
+ tcg_gen_and_i32(dest, src, reg);
+- DEST_EA(insn, OS_LONG, dest, &addr);
++ DEST_EA(env, insn, OS_LONG, dest, &addr);
+ } else {
+- SRC_EA(src, OS_LONG, 0, NULL);
++ SRC_EA(env, src, OS_LONG, 0, NULL);
+ tcg_gen_and_i32(dest, src, reg);
+ tcg_gen_mov_i32(reg, dest);
+ }
+@@ -1847,7 +1857,7 @@ DISAS_INSN(adda)
+ TCGv src;
+ TCGv reg;
+
+- SRC_EA(src, OS_LONG, 0, NULL);
++ SRC_EA(env, src, OS_LONG, 0, NULL);
+ reg = AREG(insn, 9);
+ tcg_gen_add_i32(reg, reg, src);
+ }
+@@ -1936,13 +1946,13 @@ DISAS_INSN(strldsr)
+ uint32_t addr;
+
+ addr = s->pc - 2;
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ if (ext != 0x46FC) {
+ gen_exception(s, addr, EXCP_UNSUPPORTED);
+ return;
+ }
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ if (IS_USER(s) || (ext & SR_S) == 0) {
+ gen_exception(s, addr, EXCP_PRIVILEGE);
+@@ -1972,7 +1982,7 @@ DISAS_INSN(move_to_sr)
+ gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+ return;
+ }
+- gen_set_sr(s, insn, 0);
++ gen_set_sr(env, s, insn, 0);
+ gen_lookup_tb(s);
+ }
+
+@@ -2010,7 +2020,7 @@ DISAS_INSN(stop)
+ return;
+ }
+
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+
+ gen_set_sr_im(s, ext, 0);
+@@ -2037,7 +2047,7 @@ DISAS_INSN(movec)
+ return;
+ }
+
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+
+ if (ext & 0x8000) {
+@@ -2102,7 +2112,7 @@ DISAS_INSN(fpu)
+ int set_dest;
+ int opsize;
+
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ opmode = ext & 0x7f;
+ switch ((ext >> 13) & 7) {
+@@ -2138,7 +2148,7 @@ DISAS_INSN(fpu)
+ tcg_gen_addi_i32(tmp32, tmp32, -8);
+ break;
+ case 5:
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+ break;
+@@ -2164,7 +2174,7 @@ DISAS_INSN(fpu)
+ default:
+ goto undef;
+ }
+- DEST_EA(insn, opsize, tmp32, NULL);
++ DEST_EA(env, insn, opsize, tmp32, NULL);
+ tcg_temp_free_i32(tmp32);
+ return;
+ case 4: /* fmove to control register. */
+@@ -2192,7 +2202,7 @@ DISAS_INSN(fpu)
+ (ext >> 10) & 7);
+ goto undef;
+ }
+- DEST_EA(insn, OS_LONG, tmp32, NULL);
++ DEST_EA(env, insn, OS_LONG, tmp32, NULL);
+ break;
+ case 6: /* fmovem */
+ case 7:
+@@ -2202,7 +2212,7 @@ DISAS_INSN(fpu)
+ int i;
+ if ((ext & 0x1f00) != 0x1000 || (ext & 0xff) == 0)
+ goto undef;
+- tmp32 = gen_lea(s, insn, OS_LONG);
++ tmp32 = gen_lea(env, s, insn, OS_LONG);
+ if (IS_NULL_QREG(tmp32)) {
+ gen_addr_fault(s);
+ return;
+@@ -2252,12 +2262,12 @@ DISAS_INSN(fpu)
+ tcg_gen_addi_i32(tmp32, tmp32, -8);
+ break;
+ case 5:
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+ break;
+ case 7:
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ offset += s->pc - 2;
+ s->pc += 2;
+ tcg_gen_addi_i32(tmp32, tmp32, offset);
+@@ -2277,7 +2287,7 @@ DISAS_INSN(fpu)
+ }
+ tcg_temp_free_i32(tmp32);
+ } else {
+- SRC_EA(tmp32, opsize, 1, NULL);
++ SRC_EA(env, tmp32, opsize, 1, NULL);
+ src = tcg_temp_new_i64();
+ switch (opsize) {
+ case OS_LONG:
+@@ -2372,7 +2382,7 @@ DISAS_INSN(fpu)
+ undef:
+ /* FIXME: Is this right for offset addressing modes? */
+ s->pc -= 2;
+- disas_undef_fpu(s, insn);
++ disas_undef_fpu(env, s, insn);
+ }
+
+ DISAS_INSN(fbcc)
+@@ -2383,10 +2393,10 @@ DISAS_INSN(fbcc)
+ int l1;
+
+ addr = s->pc;
+- offset = cpu_ldsw_code(cpu_single_env, s->pc);
++ offset = cpu_ldsw_code(env, s->pc);
+ s->pc += 2;
+ if (insn & (1 << 6)) {
+- offset = (offset << 16) | cpu_lduw_code(cpu_single_env, s->pc);
++ offset = (offset << 16) | cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+ }
+
+@@ -2508,18 +2518,18 @@ DISAS_INSN(mac)
+ s->done_mac = 1;
+ }
+
+- ext = cpu_lduw_code(cpu_single_env, s->pc);
++ ext = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+
+ acc = ((insn >> 7) & 1) | ((ext >> 3) & 2);
+ dual = ((insn & 0x30) != 0 && (ext & 3) != 0);
+ if (dual && !m68k_feature(s->env, M68K_FEATURE_CF_EMAC_B)) {
+- disas_undef(s, insn);
++ disas_undef(env, s, insn);
+ return;
+ }
+ if (insn & 0x30) {
+ /* MAC with load. */
+- tmp = gen_lea(s, insn, OS_LONG);
++ tmp = gen_lea(env, s, insn, OS_LONG);
+ addr = tcg_temp_new();
+ tcg_gen_and_i32(addr, tmp, QREG_MAC_MASK);
+ /* Load the value now to ensure correct exception behavior.
+@@ -2733,7 +2743,7 @@ DISAS_INSN(to_mac)
+ int accnum;
+ accnum = (insn >> 9) & 3;
+ acc = MACREG(accnum);
+- SRC_EA(val, OS_LONG, 0, NULL);
++ SRC_EA(env, val, OS_LONG, 0, NULL);
+ if (s->env->macsr & MACSR_FI) {
+ tcg_gen_ext_i32_i64(acc, val);
+ tcg_gen_shli_i64(acc, acc, 8);
+@@ -2750,7 +2760,7 @@ DISAS_INSN(to_mac)
+ DISAS_INSN(to_macsr)
+ {
+ TCGv val;
+- SRC_EA(val, OS_LONG, 0, NULL);
++ SRC_EA(env, val, OS_LONG, 0, NULL);
+ gen_helper_set_macsr(cpu_env, val);
+ gen_lookup_tb(s);
+ }
+@@ -2758,7 +2768,7 @@ DISAS_INSN(to_macsr)
+ DISAS_INSN(to_mask)
+ {
+ TCGv val;
+- SRC_EA(val, OS_LONG, 0, NULL);
++ SRC_EA(env, val, OS_LONG, 0, NULL);
+ tcg_gen_ori_i32(QREG_MAC_MASK, val, 0xffff0000);
+ }
+
+@@ -2766,7 +2776,7 @@ DISAS_INSN(to_mext)
+ {
+ TCGv val;
+ TCGv acc;
+- SRC_EA(val, OS_LONG, 0, NULL);
++ SRC_EA(env, val, OS_LONG, 0, NULL);
+ acc = tcg_const_i32((insn & 0x400) ? 2 : 0);
+ if (s->env->macsr & MACSR_FI)
+ gen_helper_set_mac_extf(cpu_env, val, acc);
+@@ -2943,10 +2953,10 @@ static void disas_m68k_insn(CPUM68KState * env, DisasContext *s)
+ {
+ uint16_t insn;
+
+- insn = cpu_lduw_code(cpu_single_env, s->pc);
++ insn = cpu_lduw_code(env, s->pc);
+ s->pc += 2;
+
+- opcode_table[insn](s, insn);
++ opcode_table[insn](env, s, insn);
+ }
+
+ /* generate intermediate code for basic block 'tb'. */
+--
+1.7.12.1
+
--- /dev/null
+From 23ff6fa6a883d210aab33e09d0bb9470df5083fc Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 07:42:33 +0000
+Subject: [PATCH] target-unicore32: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Tested-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-unicore32/Makefile.objs | 2 --
+ target-unicore32/helper.h | 26 ++++++++---------
+ target-unicore32/op_helper.c | 65 ++++++++++++++++--------------------------
+ target-unicore32/translate.c | 38 ++++++++++++------------
+ 5 files changed, 58 insertions(+), 75 deletions(-)
+
+diff --git a/configure b/configure
+index af03942..a8827ba 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | i386 | lm32 | m68k | or32 | s390x | sparc* | x86_64 | xtensa* | ppc*)
++ alpha | i386 | lm32 | m68k | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-unicore32/Makefile.objs b/target-unicore32/Makefile.objs
+index 777f01f..8e143da 100644
+--- a/target-unicore32/Makefile.objs
++++ b/target-unicore32/Makefile.objs
+@@ -2,5 +2,3 @@ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-y += ucf64_helper.o
+
+ obj-$(CONFIG_SOFTMMU) += machine.o softmmu.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-unicore32/helper.h b/target-unicore32/helper.h
+index 305318a..a4b8149 100644
+--- a/target-unicore32/helper.h
++++ b/target-unicore32/helper.h
+@@ -17,26 +17,26 @@ DEF_HELPER_1(cp1_putc, void, i32)
+ DEF_HELPER_1(clz, i32, i32)
+ DEF_HELPER_1(clo, i32, i32)
+
+-DEF_HELPER_1(exception, void, i32)
++DEF_HELPER_2(exception, void, env, i32)
+
+-DEF_HELPER_2(asr_write, void, i32, i32)
+-DEF_HELPER_0(asr_read, i32)
++DEF_HELPER_3(asr_write, void, env, i32, i32)
++DEF_HELPER_1(asr_read, i32, env)
+
+-DEF_HELPER_1(get_user_reg, i32, i32)
+-DEF_HELPER_2(set_user_reg, void, i32, i32)
++DEF_HELPER_2(get_user_reg, i32, env, i32)
++DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+
+-DEF_HELPER_2(add_cc, i32, i32, i32)
+-DEF_HELPER_2(adc_cc, i32, i32, i32)
+-DEF_HELPER_2(sub_cc, i32, i32, i32)
+-DEF_HELPER_2(sbc_cc, i32, i32, i32)
++DEF_HELPER_3(add_cc, i32, env, i32, i32)
++DEF_HELPER_3(adc_cc, i32, env, i32, i32)
++DEF_HELPER_3(sub_cc, i32, env, i32, i32)
++DEF_HELPER_3(sbc_cc, i32, env, i32, i32)
+
+ DEF_HELPER_2(shl, i32, i32, i32)
+ DEF_HELPER_2(shr, i32, i32, i32)
+ DEF_HELPER_2(sar, i32, i32, i32)
+-DEF_HELPER_2(shl_cc, i32, i32, i32)
+-DEF_HELPER_2(shr_cc, i32, i32, i32)
+-DEF_HELPER_2(sar_cc, i32, i32, i32)
+-DEF_HELPER_2(ror_cc, i32, i32, i32)
++DEF_HELPER_3(shl_cc, i32, env, i32, i32)
++DEF_HELPER_3(shr_cc, i32, env, i32, i32)
++DEF_HELPER_3(sar_cc, i32, env, i32, i32)
++DEF_HELPER_3(ror_cc, i32, env, i32, i32)
+
+ DEF_HELPER_1(ucf64_get_fpscr, i32, env)
+ DEF_HELPER_2(ucf64_set_fpscr, void, env, i32)
+diff --git a/target-unicore32/op_helper.c b/target-unicore32/op_helper.c
+index c63789d..f474d1b 100644
+--- a/target-unicore32/op_helper.c
++++ b/target-unicore32/op_helper.c
+@@ -9,19 +9,18 @@
+ * later version. See the COPYING file in the top-level directory.
+ */
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+ #define SIGNBIT (uint32_t)0x80000000
+ #define SIGNBIT64 ((uint64_t)1 << 63)
+
+-void HELPER(exception)(uint32_t excp)
++void HELPER(exception)(CPUUniCore32State *env, uint32_t excp)
+ {
+ env->exception_index = excp;
+ cpu_loop_exit(env);
+ }
+
+-static target_ulong asr_read(void)
++static target_ulong asr_read(CPUUniCore32State *env)
+ {
+ int ZF;
+ ZF = (env->ZF == 0);
+@@ -29,24 +28,18 @@ static target_ulong asr_read(void)
+ (env->CF << 29) | ((env->VF & 0x80000000) >> 3);
+ }
+
+-target_ulong cpu_asr_read(CPUUniCore32State *env1)
++target_ulong cpu_asr_read(CPUUniCore32State *env)
+ {
+- CPUUniCore32State *saved_env;
+- target_ulong ret;
+-
+- saved_env = env;
+- env = env1;
+- ret = asr_read();
+- env = saved_env;
+- return ret;
++ return asr_read(env);
+ }
+
+-target_ulong HELPER(asr_read)(void)
++target_ulong HELPER(asr_read)(CPUUniCore32State *env)
+ {
+- return asr_read();
++ return asr_read(env);
+ }
+
+-static void asr_write(target_ulong val, target_ulong mask)
++static void asr_write(CPUUniCore32State *env, target_ulong val,
++ target_ulong mask)
+ {
+ if (mask & ASR_NZCV) {
+ env->ZF = (~val) & ASR_Z;
+@@ -62,23 +55,19 @@ static void asr_write(target_ulong val, target_ulong mask)
+ env->uncached_asr = (env->uncached_asr & ~mask) | (val & mask);
+ }
+
+-void cpu_asr_write(CPUUniCore32State *env1, target_ulong val, target_ulong mask)
++void cpu_asr_write(CPUUniCore32State *env, target_ulong val, target_ulong mask)
+ {
+- CPUUniCore32State *saved_env;
+-
+- saved_env = env;
+- env = env1;
+- asr_write(val, mask);
+- env = saved_env;
++ asr_write(env, val, mask);
+ }
+
+-void HELPER(asr_write)(target_ulong val, target_ulong mask)
++void HELPER(asr_write)(CPUUniCore32State *env, target_ulong val,
++ target_ulong mask)
+ {
+- asr_write(val, mask);
++ asr_write(env, val, mask);
+ }
+
+ /* Access to user mode registers from privileged modes. */
+-uint32_t HELPER(get_user_reg)(uint32_t regno)
++uint32_t HELPER(get_user_reg)(CPUUniCore32State *env, uint32_t regno)
+ {
+ uint32_t val;
+
+@@ -92,7 +81,7 @@ uint32_t HELPER(get_user_reg)(uint32_t regno)
+ return val;
+ }
+
+-void HELPER(set_user_reg)(uint32_t regno, uint32_t val)
++void HELPER(set_user_reg)(CPUUniCore32State *env, uint32_t regno, uint32_t val)
+ {
+ if (regno == 29) {
+ env->banked_r29[0] = val;
+@@ -107,7 +96,7 @@ void HELPER(set_user_reg)(uint32_t regno, uint32_t val)
+ The only way to do that in TCG is a conditional branch, which clobbers
+ all our temporaries. For now implement these as helper functions. */
+
+-uint32_t HELPER(add_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(add_cc)(CPUUniCore32State *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ result = a + b;
+@@ -117,7 +106,7 @@ uint32_t HELPER(add_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(adc_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(adc_cc)(CPUUniCore32State *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ if (!env->CF) {
+@@ -132,7 +121,7 @@ uint32_t HELPER(adc_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(sub_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(sub_cc)(CPUUniCore32State *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ result = a - b;
+@@ -142,7 +131,7 @@ uint32_t HELPER(sub_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(sbc_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(sbc_cc)(CPUUniCore32State *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ if (!env->CF) {
+@@ -186,7 +175,7 @@ uint32_t HELPER(sar)(uint32_t x, uint32_t i)
+ return (int32_t)x >> shift;
+ }
+
+-uint32_t HELPER(shl_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(shl_cc)(CPUUniCore32State *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -203,7 +192,7 @@ uint32_t HELPER(shl_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(shr_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(shr_cc)(CPUUniCore32State *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -220,7 +209,7 @@ uint32_t HELPER(shr_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(sar_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(sar_cc)(CPUUniCore32State *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -233,7 +222,7 @@ uint32_t HELPER(sar_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(ror_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(ror_cc)(CPUUniCore32State *env, uint32_t x, uint32_t i)
+ {
+ int shift1, shift;
+ shift1 = i & 0xff;
+@@ -264,16 +253,13 @@ uint32_t HELPER(ror_cc)(uint32_t x, uint32_t i)
+ #define SHIFT 3
+ #include "softmmu_template.h"
+
+-void tlb_fill(CPUUniCore32State *env1, target_ulong addr, int is_write,
+- int mmu_idx, uintptr_t retaddr)
++void tlb_fill(CPUUniCore32State *env, target_ulong addr, int is_write,
++ int mmu_idx, uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUUniCore32State *saved_env;
+ unsigned long pc;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = uc32_cpu_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret)) {
+ if (retaddr) {
+@@ -287,6 +273,5 @@ void tlb_fill(CPUUniCore32State *env1, target_ulong addr, int is_write,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+ #endif
+diff --git a/target-unicore32/translate.c b/target-unicore32/translate.c
+index 188bf8c..b786a6b 100644
+--- a/target-unicore32/translate.c
++++ b/target-unicore32/translate.c
+@@ -253,7 +253,7 @@ static void disas_ocd_insn(CPUUniCore32State *env, DisasContext *s,
+ static inline void gen_set_asr(TCGv var, uint32_t mask)
+ {
+ TCGv tmp_mask = tcg_const_i32(mask);
+- gen_helper_asr_write(var, tmp_mask);
++ gen_helper_asr_write(cpu_env, var, tmp_mask);
+ tcg_temp_free_i32(tmp_mask);
+ }
+ /* Set NZCV flags from the high 4 bits of var. */
+@@ -263,7 +263,7 @@ static void gen_exception(int excp)
+ {
+ TCGv tmp = new_tmp();
+ tcg_gen_movi_i32(tmp, excp);
+- gen_helper_exception(tmp);
++ gen_helper_exception(cpu_env, tmp);
+ dead_tmp(tmp);
+ }
+
+@@ -416,16 +416,16 @@ static inline void gen_uc32_shift_reg(TCGv var, int shiftop,
+ if (flags) {
+ switch (shiftop) {
+ case 0:
+- gen_helper_shl_cc(var, var, shift);
++ gen_helper_shl_cc(var, cpu_env, var, shift);
+ break;
+ case 1:
+- gen_helper_shr_cc(var, var, shift);
++ gen_helper_shr_cc(var, cpu_env, var, shift);
+ break;
+ case 2:
+- gen_helper_sar_cc(var, var, shift);
++ gen_helper_sar_cc(var, cpu_env, var, shift);
+ break;
+ case 3:
+- gen_helper_ror_cc(var, var, shift);
++ gen_helper_ror_cc(var, cpu_env, var, shift);
+ break;
+ }
+ } else {
+@@ -1323,11 +1323,11 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ if (IS_USER(s)) {
+ ILLEGAL;
+ }
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ gen_exception_return(s, tmp);
+ } else {
+ if (UCOP_SET_S) {
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ tcg_gen_sub_i32(tmp, tmp, tmp2);
+ }
+@@ -1336,7 +1336,7 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x03:
+ if (UCOP_SET_S) {
+- gen_helper_sub_cc(tmp, tmp2, tmp);
++ gen_helper_sub_cc(tmp, cpu_env, tmp2, tmp);
+ } else {
+ tcg_gen_sub_i32(tmp, tmp2, tmp);
+ }
+@@ -1344,7 +1344,7 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x04:
+ if (UCOP_SET_S) {
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ tcg_gen_add_i32(tmp, tmp, tmp2);
+ }
+@@ -1352,7 +1352,7 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x05:
+ if (UCOP_SET_S) {
+- gen_helper_adc_cc(tmp, tmp, tmp2);
++ gen_helper_adc_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ gen_add_carry(tmp, tmp, tmp2);
+ }
+@@ -1360,7 +1360,7 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x06:
+ if (UCOP_SET_S) {
+- gen_helper_sbc_cc(tmp, tmp, tmp2);
++ gen_helper_sbc_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ gen_sub_carry(tmp, tmp, tmp2);
+ }
+@@ -1368,7 +1368,7 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x07:
+ if (UCOP_SET_S) {
+- gen_helper_sbc_cc(tmp, tmp2, tmp);
++ gen_helper_sbc_cc(tmp, cpu_env, tmp2, tmp);
+ } else {
+ gen_sub_carry(tmp, tmp2, tmp);
+ }
+@@ -1390,13 +1390,13 @@ static void do_datap(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ break;
+ case 0x0a:
+ if (UCOP_SET_S) {
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ }
+ dead_tmp(tmp);
+ break;
+ case 0x0b:
+ if (UCOP_SET_S) {
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ }
+ dead_tmp(tmp);
+ break;
+@@ -1536,7 +1536,7 @@ static void do_misc(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ tmp = load_cpu_field(bsr);
+ } else {
+ tmp = new_tmp();
+- gen_helper_asr_read(tmp);
++ gen_helper_asr_read(tmp, cpu_env);
+ }
+ store_reg(s, UCOP_REG_D, tmp);
+ return;
+@@ -1760,7 +1760,7 @@ static void do_ldst_m(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ gen_bx(s, tmp);
+ } else if (user) {
+ tmp2 = tcg_const_i32(reg);
+- gen_helper_set_user_reg(tmp2, tmp);
++ gen_helper_set_user_reg(cpu_env, tmp2, tmp);
+ tcg_temp_free_i32(tmp2);
+ dead_tmp(tmp);
+ } else if (reg == UCOP_REG_N) {
+@@ -1778,7 +1778,7 @@ static void do_ldst_m(CPUUniCore32State *env, DisasContext *s, uint32_t insn)
+ } else if (user) {
+ tmp = new_tmp();
+ tmp2 = tcg_const_i32(reg);
+- gen_helper_get_user_reg(tmp, tmp2);
++ gen_helper_get_user_reg(tmp, cpu_env, tmp2);
+ tcg_temp_free_i32(tmp2);
+ } else {
+ tmp = load_reg(s, reg);
+@@ -1861,7 +1861,7 @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
+ {
+ unsigned int insn;
+
+- insn = ldl_code(s->pc);
++ insn = cpu_ldl_code(env, s->pc);
+ s->pc += 4;
+
+ /* UniCore instructions class:
+--
+1.7.12.1
+
--- /dev/null
+From 140048c58e4ceb4f3bac87d7154d2731bb2bcd5d Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Tue, 4 Sep 2012 20:08:34 +0000
+Subject: [PATCH] target-arm: convert void helpers
+
+Add an explicit CPUState parameter instead of relying on AREG0.
+
+For easier review, convert only op helpers which don't return any value.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-arm/helper.h | 8 ++++----
+ target-arm/op_helper.c | 20 ++++++++++----------
+ target-arm/translate.c | 8 ++++----
+ 3 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/target-arm/helper.h b/target-arm/helper.h
+index 21e9cfe..106aacd 100644
+--- a/target-arm/helper.h
++++ b/target-arm/helper.h
+@@ -50,10 +50,10 @@ DEF_HELPER_2(usad8, i32, i32, i32)
+ DEF_HELPER_1(logicq_cc, i32, i64)
+
+ DEF_HELPER_3(sel_flags, i32, i32, i32, i32)
+-DEF_HELPER_1(exception, void, i32)
+-DEF_HELPER_0(wfi, void)
++DEF_HELPER_2(exception, void, env, i32)
++DEF_HELPER_1(wfi, void, env)
+
+-DEF_HELPER_2(cpsr_write, void, i32, i32)
++DEF_HELPER_3(cpsr_write, void, env, i32, i32)
+ DEF_HELPER_0(cpsr_read, i32)
+
+ DEF_HELPER_3(v7m_msr, void, env, i32, i32)
+@@ -68,7 +68,7 @@ DEF_HELPER_2(get_r13_banked, i32, env, i32)
+ DEF_HELPER_3(set_r13_banked, void, env, i32, i32)
+
+ DEF_HELPER_1(get_user_reg, i32, i32)
+-DEF_HELPER_2(set_user_reg, void, i32, i32)
++DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+
+ DEF_HELPER_1(vfp_get_fpscr, i32, env)
+ DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
+diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
+index d77bfab..b1adce3 100644
+--- a/target-arm/op_helper.c
++++ b/target-arm/op_helper.c
+@@ -23,7 +23,7 @@
+ #define SIGNBIT (uint32_t)0x80000000
+ #define SIGNBIT64 ((uint64_t)1 << 63)
+
+-static void raise_exception(int tt)
++static void raise_exception(CPUARMState *env, int tt)
+ {
+ env->exception_index = tt;
+ cpu_loop_exit(env);
+@@ -93,7 +93,7 @@ void tlb_fill(CPUARMState *env1, target_ulong addr, int is_write, int mmu_idx,
+ cpu_restore_state(tb, env, retaddr);
+ }
+ }
+- raise_exception(env->exception_index);
++ raise_exception(env, env->exception_index);
+ }
+ env = saved_env;
+ }
+@@ -230,14 +230,14 @@ uint32_t HELPER(usat16)(uint32_t x, uint32_t shift)
+ return res;
+ }
+
+-void HELPER(wfi)(void)
++void HELPER(wfi)(CPUARMState *env)
+ {
+ env->exception_index = EXCP_HLT;
+ env->halted = 1;
+ cpu_loop_exit(env);
+ }
+
+-void HELPER(exception)(uint32_t excp)
++void HELPER(exception)(CPUARMState *env, uint32_t excp)
+ {
+ env->exception_index = excp;
+ cpu_loop_exit(env);
+@@ -248,7 +248,7 @@ uint32_t HELPER(cpsr_read)(void)
+ return cpsr_read(env) & ~CPSR_EXEC;
+ }
+
+-void HELPER(cpsr_write)(uint32_t val, uint32_t mask)
++void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
+ {
+ cpsr_write(env, val, mask);
+ }
+@@ -271,7 +271,7 @@ uint32_t HELPER(get_user_reg)(uint32_t regno)
+ return val;
+ }
+
+-void HELPER(set_user_reg)(uint32_t regno, uint32_t val)
++void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
+ {
+ if (regno == 13) {
+ env->banked_r13[0] = val;
+@@ -290,7 +290,7 @@ void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
+ const ARMCPRegInfo *ri = rip;
+ int excp = ri->writefn(env, ri, value);
+ if (excp) {
+- raise_exception(excp);
++ raise_exception(env, excp);
+ }
+ }
+
+@@ -300,7 +300,7 @@ uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
+ uint64_t value;
+ int excp = ri->readfn(env, ri, &value);
+ if (excp) {
+- raise_exception(excp);
++ raise_exception(env, excp);
+ }
+ return value;
+ }
+@@ -310,7 +310,7 @@ void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
+ const ARMCPRegInfo *ri = rip;
+ int excp = ri->writefn(env, ri, value);
+ if (excp) {
+- raise_exception(excp);
++ raise_exception(env, excp);
+ }
+ }
+
+@@ -320,7 +320,7 @@ uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
+ uint64_t value;
+ int excp = ri->readfn(env, ri, &value);
+ if (excp) {
+- raise_exception(excp);
++ raise_exception(env, excp);
+ }
+ return value;
+ }
+diff --git a/target-arm/translate.c b/target-arm/translate.c
+index edef79a..6f651d9 100644
+--- a/target-arm/translate.c
++++ b/target-arm/translate.c
+@@ -199,7 +199,7 @@ static void store_reg(DisasContext *s, int reg, TCGv var)
+ static inline void gen_set_cpsr(TCGv var, uint32_t mask)
+ {
+ TCGv tmp_mask = tcg_const_i32(mask);
+- gen_helper_cpsr_write(var, tmp_mask);
++ gen_helper_cpsr_write(cpu_env, var, tmp_mask);
+ tcg_temp_free_i32(tmp_mask);
+ }
+ /* Set NZCV flags from the high 4 bits of var. */
+@@ -209,7 +209,7 @@ static void gen_exception(int excp)
+ {
+ TCGv tmp = tcg_temp_new_i32();
+ tcg_gen_movi_i32(tmp, excp);
+- gen_helper_exception(tmp);
++ gen_helper_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ }
+
+@@ -7719,7 +7719,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ tmp = gen_ld32(addr, IS_USER(s));
+ if (user) {
+ tmp2 = tcg_const_i32(i);
+- gen_helper_set_user_reg(tmp2, tmp);
++ gen_helper_set_user_reg(cpu_env, tmp2, tmp);
+ tcg_temp_free_i32(tmp2);
+ tcg_temp_free_i32(tmp);
+ } else if (i == rn) {
+@@ -9913,7 +9913,7 @@ static inline void gen_intermediate_code_internal(CPUARMState *env,
+ /* nothing more to generate */
+ break;
+ case DISAS_WFI:
+- gen_helper_wfi();
++ gen_helper_wfi(cpu_env);
+ break;
+ case DISAS_SWI:
+ gen_exception(EXCP_SWI);
+--
+1.7.12.1
+
--- /dev/null
+From 18e713cf6b5ae2e7c48bb412c959c10322bef5e5 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Tue, 4 Sep 2012 20:19:15 +0000
+Subject: [PATCH] target-arm: convert remaining helpers
+
+Convert remaining helpers to AREG0 free mode: add an explicit
+CPUState parameter instead of relying on AREG0.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-arm/helper.h | 52 +++++++++----------
+ target-arm/op_helper.c | 64 +++++++++++------------
+ target-arm/translate.c | 134 ++++++++++++++++++++++++-------------------------
+ 3 files changed, 125 insertions(+), 125 deletions(-)
+
+diff --git a/target-arm/helper.h b/target-arm/helper.h
+index 106aacd..afdb2b5 100644
+--- a/target-arm/helper.h
++++ b/target-arm/helper.h
+@@ -4,12 +4,12 @@ DEF_HELPER_1(clz, i32, i32)
+ DEF_HELPER_1(sxtb16, i32, i32)
+ DEF_HELPER_1(uxtb16, i32, i32)
+
+-DEF_HELPER_2(add_setq, i32, i32, i32)
+-DEF_HELPER_2(add_saturate, i32, i32, i32)
+-DEF_HELPER_2(sub_saturate, i32, i32, i32)
+-DEF_HELPER_2(add_usaturate, i32, i32, i32)
+-DEF_HELPER_2(sub_usaturate, i32, i32, i32)
+-DEF_HELPER_1(double_saturate, i32, s32)
++DEF_HELPER_3(add_setq, i32, env, i32, i32)
++DEF_HELPER_3(add_saturate, i32, env, i32, i32)
++DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
++DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
++DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
++DEF_HELPER_2(double_saturate, i32, env, s32)
+ DEF_HELPER_2(sdiv, s32, s32, s32)
+ DEF_HELPER_2(udiv, i32, i32, i32)
+ DEF_HELPER_1(rbit, i32, i32)
+@@ -40,10 +40,10 @@ PAS_OP(uq)
+ PAS_OP(uh)
+ #undef PAS_OP
+
+-DEF_HELPER_2(ssat, i32, i32, i32)
+-DEF_HELPER_2(usat, i32, i32, i32)
+-DEF_HELPER_2(ssat16, i32, i32, i32)
+-DEF_HELPER_2(usat16, i32, i32, i32)
++DEF_HELPER_3(ssat, i32, env, i32, i32)
++DEF_HELPER_3(usat, i32, env, i32, i32)
++DEF_HELPER_3(ssat16, i32, env, i32, i32)
++DEF_HELPER_3(usat16, i32, env, i32, i32)
+
+ DEF_HELPER_2(usad8, i32, i32, i32)
+
+@@ -54,7 +54,7 @@ DEF_HELPER_2(exception, void, env, i32)
+ DEF_HELPER_1(wfi, void, env)
+
+ DEF_HELPER_3(cpsr_write, void, env, i32, i32)
+-DEF_HELPER_0(cpsr_read, i32)
++DEF_HELPER_1(cpsr_read, i32, env)
+
+ DEF_HELPER_3(v7m_msr, void, env, i32, i32)
+ DEF_HELPER_2(v7m_mrs, i32, env, i32)
+@@ -67,7 +67,7 @@ DEF_HELPER_2(get_cp_reg64, i64, env, ptr)
+ DEF_HELPER_2(get_r13_banked, i32, env, i32)
+ DEF_HELPER_3(set_r13_banked, void, env, i32, i32)
+
+-DEF_HELPER_1(get_user_reg, i32, i32)
++DEF_HELPER_2(get_user_reg, i32, env, i32)
+ DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+
+ DEF_HELPER_1(vfp_get_fpscr, i32, env)
+@@ -140,20 +140,20 @@ DEF_HELPER_2(recpe_f32, f32, f32, env)
+ DEF_HELPER_2(rsqrte_f32, f32, f32, env)
+ DEF_HELPER_2(recpe_u32, i32, i32, env)
+ DEF_HELPER_2(rsqrte_u32, i32, i32, env)
+-DEF_HELPER_4(neon_tbl, i32, i32, i32, i32, i32)
+-
+-DEF_HELPER_2(add_cc, i32, i32, i32)
+-DEF_HELPER_2(adc_cc, i32, i32, i32)
+-DEF_HELPER_2(sub_cc, i32, i32, i32)
+-DEF_HELPER_2(sbc_cc, i32, i32, i32)
+-
+-DEF_HELPER_2(shl, i32, i32, i32)
+-DEF_HELPER_2(shr, i32, i32, i32)
+-DEF_HELPER_2(sar, i32, i32, i32)
+-DEF_HELPER_2(shl_cc, i32, i32, i32)
+-DEF_HELPER_2(shr_cc, i32, i32, i32)
+-DEF_HELPER_2(sar_cc, i32, i32, i32)
+-DEF_HELPER_2(ror_cc, i32, i32, i32)
++DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
++
++DEF_HELPER_3(add_cc, i32, env, i32, i32)
++DEF_HELPER_3(adc_cc, i32, env, i32, i32)
++DEF_HELPER_3(sub_cc, i32, env, i32, i32)
++DEF_HELPER_3(sbc_cc, i32, env, i32, i32)
++
++DEF_HELPER_3(shl, i32, env, i32, i32)
++DEF_HELPER_3(shr, i32, env, i32, i32)
++DEF_HELPER_3(sar, i32, env, i32, i32)
++DEF_HELPER_3(shl_cc, i32, env, i32, i32)
++DEF_HELPER_3(shr_cc, i32, env, i32, i32)
++DEF_HELPER_3(sar_cc, i32, env, i32, i32)
++DEF_HELPER_3(ror_cc, i32, env, i32, i32)
+
+ /* neon_helper.c */
+ DEF_HELPER_3(neon_qadd_u8, i32, env, i32, i32)
+diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
+index b1adce3..5b868bf 100644
+--- a/target-arm/op_helper.c
++++ b/target-arm/op_helper.c
+@@ -29,7 +29,7 @@ static void raise_exception(CPUARMState *env, int tt)
+ cpu_loop_exit(env);
+ }
+
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def,
++uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
+ uint32_t rn, uint32_t maxindex)
+ {
+ uint32_t val;
+@@ -101,7 +101,7 @@ void tlb_fill(CPUARMState *env1, target_ulong addr, int is_write, int mmu_idx,
+
+ /* FIXME: Pass an explicit pointer to QF to CPUARMState, and move saturating
+ instructions into helper.c */
+-uint32_t HELPER(add_setq)(uint32_t a, uint32_t b)
++uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t res = a + b;
+ if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
+@@ -109,7 +109,7 @@ uint32_t HELPER(add_setq)(uint32_t a, uint32_t b)
+ return res;
+ }
+
+-uint32_t HELPER(add_saturate)(uint32_t a, uint32_t b)
++uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t res = a + b;
+ if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
+@@ -119,7 +119,7 @@ uint32_t HELPER(add_saturate)(uint32_t a, uint32_t b)
+ return res;
+ }
+
+-uint32_t HELPER(sub_saturate)(uint32_t a, uint32_t b)
++uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t res = a - b;
+ if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
+@@ -129,7 +129,7 @@ uint32_t HELPER(sub_saturate)(uint32_t a, uint32_t b)
+ return res;
+ }
+
+-uint32_t HELPER(double_saturate)(int32_t val)
++uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
+ {
+ uint32_t res;
+ if (val >= 0x40000000) {
+@@ -144,7 +144,7 @@ uint32_t HELPER(double_saturate)(int32_t val)
+ return res;
+ }
+
+-uint32_t HELPER(add_usaturate)(uint32_t a, uint32_t b)
++uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t res = a + b;
+ if (res < a) {
+@@ -154,7 +154,7 @@ uint32_t HELPER(add_usaturate)(uint32_t a, uint32_t b)
+ return res;
+ }
+
+-uint32_t HELPER(sub_usaturate)(uint32_t a, uint32_t b)
++uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t res = a - b;
+ if (res > a) {
+@@ -165,7 +165,7 @@ uint32_t HELPER(sub_usaturate)(uint32_t a, uint32_t b)
+ }
+
+ /* Signed saturation. */
+-static inline uint32_t do_ssat(int32_t val, int shift)
++static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
+ {
+ int32_t top;
+ uint32_t mask;
+@@ -183,7 +183,7 @@ static inline uint32_t do_ssat(int32_t val, int shift)
+ }
+
+ /* Unsigned saturation. */
+-static inline uint32_t do_usat(int32_t val, int shift)
++static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
+ {
+ uint32_t max;
+
+@@ -199,34 +199,34 @@ static inline uint32_t do_usat(int32_t val, int shift)
+ }
+
+ /* Signed saturate. */
+-uint32_t HELPER(ssat)(uint32_t x, uint32_t shift)
++uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
+ {
+- return do_ssat(x, shift);
++ return do_ssat(env, x, shift);
+ }
+
+ /* Dual halfword signed saturate. */
+-uint32_t HELPER(ssat16)(uint32_t x, uint32_t shift)
++uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
+ {
+ uint32_t res;
+
+- res = (uint16_t)do_ssat((int16_t)x, shift);
+- res |= do_ssat(((int32_t)x) >> 16, shift) << 16;
++ res = (uint16_t)do_ssat(env, (int16_t)x, shift);
++ res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
+ return res;
+ }
+
+ /* Unsigned saturate. */
+-uint32_t HELPER(usat)(uint32_t x, uint32_t shift)
++uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
+ {
+- return do_usat(x, shift);
++ return do_usat(env, x, shift);
+ }
+
+ /* Dual halfword unsigned saturate. */
+-uint32_t HELPER(usat16)(uint32_t x, uint32_t shift)
++uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
+ {
+ uint32_t res;
+
+- res = (uint16_t)do_usat((int16_t)x, shift);
+- res |= do_usat(((int32_t)x) >> 16, shift) << 16;
++ res = (uint16_t)do_usat(env, (int16_t)x, shift);
++ res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
+ return res;
+ }
+
+@@ -243,7 +243,7 @@ void HELPER(exception)(CPUARMState *env, uint32_t excp)
+ cpu_loop_exit(env);
+ }
+
+-uint32_t HELPER(cpsr_read)(void)
++uint32_t HELPER(cpsr_read)(CPUARMState *env)
+ {
+ return cpsr_read(env) & ~CPSR_EXEC;
+ }
+@@ -254,7 +254,7 @@ void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
+ }
+
+ /* Access to user mode registers from privileged modes. */
+-uint32_t HELPER(get_user_reg)(uint32_t regno)
++uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
+ {
+ uint32_t val;
+
+@@ -329,7 +329,7 @@ uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
+ The only way to do that in TCG is a conditional branch, which clobbers
+ all our temporaries. For now implement these as helper functions. */
+
+-uint32_t HELPER (add_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER (add_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ result = a + b;
+@@ -339,7 +339,7 @@ uint32_t HELPER (add_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(adc_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(adc_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ if (!env->CF) {
+@@ -354,7 +354,7 @@ uint32_t HELPER(adc_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(sub_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(sub_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ result = a - b;
+@@ -364,7 +364,7 @@ uint32_t HELPER(sub_cc)(uint32_t a, uint32_t b)
+ return result;
+ }
+
+-uint32_t HELPER(sbc_cc)(uint32_t a, uint32_t b)
++uint32_t HELPER(sbc_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+ {
+ uint32_t result;
+ if (!env->CF) {
+@@ -381,7 +381,7 @@ uint32_t HELPER(sbc_cc)(uint32_t a, uint32_t b)
+
+ /* Similarly for variable shift instructions. */
+
+-uint32_t HELPER(shl)(uint32_t x, uint32_t i)
++uint32_t HELPER(shl)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32)
+@@ -389,7 +389,7 @@ uint32_t HELPER(shl)(uint32_t x, uint32_t i)
+ return x << shift;
+ }
+
+-uint32_t HELPER(shr)(uint32_t x, uint32_t i)
++uint32_t HELPER(shr)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32)
+@@ -397,7 +397,7 @@ uint32_t HELPER(shr)(uint32_t x, uint32_t i)
+ return (uint32_t)x >> shift;
+ }
+
+-uint32_t HELPER(sar)(uint32_t x, uint32_t i)
++uint32_t HELPER(sar)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32)
+@@ -405,7 +405,7 @@ uint32_t HELPER(sar)(uint32_t x, uint32_t i)
+ return (int32_t)x >> shift;
+ }
+
+-uint32_t HELPER(shl_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -421,7 +421,7 @@ uint32_t HELPER(shl_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(shr_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -437,7 +437,7 @@ uint32_t HELPER(shr_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(sar_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift = i & 0xff;
+ if (shift >= 32) {
+@@ -450,7 +450,7 @@ uint32_t HELPER(sar_cc)(uint32_t x, uint32_t i)
+ return x;
+ }
+
+-uint32_t HELPER(ror_cc)(uint32_t x, uint32_t i)
++uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+ {
+ int shift1, shift;
+ shift1 = i & 0xff;
+diff --git a/target-arm/translate.c b/target-arm/translate.c
+index 6f651d9..9ae3b26 100644
+--- a/target-arm/translate.c
++++ b/target-arm/translate.c
+@@ -490,16 +490,16 @@ static inline void gen_arm_shift_reg(TCGv var, int shiftop,
+ {
+ if (flags) {
+ switch (shiftop) {
+- case 0: gen_helper_shl_cc(var, var, shift); break;
+- case 1: gen_helper_shr_cc(var, var, shift); break;
+- case 2: gen_helper_sar_cc(var, var, shift); break;
+- case 3: gen_helper_ror_cc(var, var, shift); break;
++ case 0: gen_helper_shl_cc(var, cpu_env, var, shift); break;
++ case 1: gen_helper_shr_cc(var, cpu_env, var, shift); break;
++ case 2: gen_helper_sar_cc(var, cpu_env, var, shift); break;
++ case 3: gen_helper_ror_cc(var, cpu_env, var, shift); break;
+ }
+ } else {
+ switch (shiftop) {
+- case 0: gen_helper_shl(var, var, shift); break;
+- case 1: gen_helper_shr(var, var, shift); break;
+- case 2: gen_helper_sar(var, var, shift); break;
++ case 0: gen_helper_shl(var, cpu_env, var, shift); break;
++ case 1: gen_helper_shr(var, cpu_env, var, shift); break;
++ case 2: gen_helper_sar(var, cpu_env, var, shift); break;
+ case 3: tcg_gen_andi_i32(shift, shift, 0x1f);
+ tcg_gen_rotr_i32(var, var, shift); break;
+ }
+@@ -6121,7 +6121,7 @@ static int disas_neon_data_insn(CPUARMState * env, DisasContext *s, uint32_t ins
+ tmp2 = neon_load_reg(rm, 0);
+ tmp4 = tcg_const_i32(rn);
+ tmp5 = tcg_const_i32(n);
+- gen_helper_neon_tbl(tmp2, tmp2, tmp, tmp4, tmp5);
++ gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
+ tcg_temp_free_i32(tmp);
+ if (insn & (1 << 6)) {
+ tmp = neon_load_reg(rd, 1);
+@@ -6130,7 +6130,7 @@ static int disas_neon_data_insn(CPUARMState * env, DisasContext *s, uint32_t ins
+ tcg_gen_movi_i32(tmp, 0);
+ }
+ tmp3 = neon_load_reg(rm, 1);
+- gen_helper_neon_tbl(tmp3, tmp3, tmp, tmp4, tmp5);
++ gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
+ tcg_temp_free_i32(tmp5);
+ tcg_temp_free_i32(tmp4);
+ neon_store_reg(rd, 0, tmp2);
+@@ -6818,7 +6818,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ tmp = load_cpu_field(spsr);
+ } else {
+ tmp = tcg_temp_new_i32();
+- gen_helper_cpsr_read(tmp);
++ gen_helper_cpsr_read(tmp, cpu_env);
+ }
+ store_reg(s, rd, tmp);
+ }
+@@ -6869,11 +6869,11 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ tmp = load_reg(s, rm);
+ tmp2 = load_reg(s, rn);
+ if (op1 & 2)
+- gen_helper_double_saturate(tmp2, tmp2);
++ gen_helper_double_saturate(tmp2, cpu_env, tmp2);
+ if (op1 & 1)
+- gen_helper_sub_saturate(tmp, tmp, tmp2);
++ gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
+ else
+- gen_helper_add_saturate(tmp, tmp, tmp2);
++ gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+ break;
+@@ -6911,7 +6911,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ tcg_temp_free_i64(tmp64);
+ if ((sh & 2) == 0) {
+ tmp2 = load_reg(s, rn);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ store_reg(s, rd, tmp);
+@@ -6931,7 +6931,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ } else {
+ if (op1 == 0) {
+ tmp2 = load_reg(s, rn);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ store_reg(s, rd, tmp);
+@@ -7005,11 +7005,11 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ if (IS_USER(s)) {
+ goto illegal_op;
+ }
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ gen_exception_return(s, tmp);
+ } else {
+ if (set_cc) {
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ tcg_gen_sub_i32(tmp, tmp, tmp2);
+ }
+@@ -7018,7 +7018,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x03:
+ if (set_cc) {
+- gen_helper_sub_cc(tmp, tmp2, tmp);
++ gen_helper_sub_cc(tmp, cpu_env, tmp2, tmp);
+ } else {
+ tcg_gen_sub_i32(tmp, tmp2, tmp);
+ }
+@@ -7026,7 +7026,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x04:
+ if (set_cc) {
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ tcg_gen_add_i32(tmp, tmp, tmp2);
+ }
+@@ -7034,7 +7034,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x05:
+ if (set_cc) {
+- gen_helper_adc_cc(tmp, tmp, tmp2);
++ gen_helper_adc_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ gen_add_carry(tmp, tmp, tmp2);
+ }
+@@ -7042,7 +7042,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x06:
+ if (set_cc) {
+- gen_helper_sbc_cc(tmp, tmp, tmp2);
++ gen_helper_sbc_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ gen_sub_carry(tmp, tmp, tmp2);
+ }
+@@ -7050,7 +7050,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x07:
+ if (set_cc) {
+- gen_helper_sbc_cc(tmp, tmp2, tmp);
++ gen_helper_sbc_cc(tmp, cpu_env, tmp2, tmp);
+ } else {
+ gen_sub_carry(tmp, tmp2, tmp);
+ }
+@@ -7072,13 +7072,13 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ break;
+ case 0x0a:
+ if (set_cc) {
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp);
+ break;
+ case 0x0b:
+ if (set_cc) {
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp);
+ break;
+@@ -7395,9 +7395,9 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ sh = (insn >> 16) & 0x1f;
+ tmp2 = tcg_const_i32(sh);
+ if (insn & (1 << 22))
+- gen_helper_usat(tmp, tmp, tmp2);
++ gen_helper_usat(tmp, cpu_env, tmp, tmp2);
+ else
+- gen_helper_ssat(tmp, tmp, tmp2);
++ gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+ } else if ((insn & 0x00300fe0) == 0x00200f20) {
+@@ -7406,9 +7406,9 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ sh = (insn >> 16) & 0x1f;
+ tmp2 = tcg_const_i32(sh);
+ if (insn & (1 << 22))
+- gen_helper_usat16(tmp, tmp, tmp2);
++ gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
+ else
+- gen_helper_ssat16(tmp, tmp, tmp2);
++ gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+ } else if ((insn & 0x00700fe0) == 0x00000fa0) {
+@@ -7518,7 +7518,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ * however it may overflow considered as a signed
+ * operation, in which case we must set the Q flag.
+ */
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp2);
+ if (insn & (1 << 22)) {
+@@ -7534,7 +7534,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ if (rd != 15)
+ {
+ tmp2 = load_reg(s, rd);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ store_reg(s, rn, tmp);
+@@ -7738,7 +7738,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ } else if (user) {
+ tmp = tcg_temp_new_i32();
+ tmp2 = tcg_const_i32(i);
+- gen_helper_get_user_reg(tmp, tmp2);
++ gen_helper_get_user_reg(tmp, cpu_env, tmp2);
+ tcg_temp_free_i32(tmp2);
+ } else {
+ tmp = load_reg(s, i);
+@@ -7865,31 +7865,31 @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out, TCG
+ break;
+ case 8: /* add */
+ if (conds)
+- gen_helper_add_cc(t0, t0, t1);
++ gen_helper_add_cc(t0, cpu_env, t0, t1);
+ else
+ tcg_gen_add_i32(t0, t0, t1);
+ break;
+ case 10: /* adc */
+ if (conds)
+- gen_helper_adc_cc(t0, t0, t1);
++ gen_helper_adc_cc(t0, cpu_env, t0, t1);
+ else
+ gen_adc(t0, t1);
+ break;
+ case 11: /* sbc */
+ if (conds)
+- gen_helper_sbc_cc(t0, t0, t1);
++ gen_helper_sbc_cc(t0, cpu_env, t0, t1);
+ else
+ gen_sub_carry(t0, t0, t1);
+ break;
+ case 13: /* sub */
+ if (conds)
+- gen_helper_sub_cc(t0, t0, t1);
++ gen_helper_sub_cc(t0, cpu_env, t0, t1);
+ else
+ tcg_gen_sub_i32(t0, t0, t1);
+ break;
+ case 14: /* rsb */
+ if (conds)
+- gen_helper_sub_cc(t0, t1, t0);
++ gen_helper_sub_cc(t0, cpu_env, t1, t0);
+ else
+ tcg_gen_sub_i32(t0, t1, t0);
+ break;
+@@ -8111,7 +8111,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ gen_st32(tmp, addr, 0);
+ tcg_gen_addi_i32(addr, addr, 4);
+ tmp = tcg_temp_new_i32();
+- gen_helper_cpsr_read(tmp);
++ gen_helper_cpsr_read(tmp, cpu_env);
+ gen_st32(tmp, addr, 0);
+ if (insn & (1 << 21)) {
+ if ((insn & (1 << 24)) == 0) {
+@@ -8293,11 +8293,11 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ tmp = load_reg(s, rn);
+ tmp2 = load_reg(s, rm);
+ if (op & 1)
+- gen_helper_double_saturate(tmp, tmp);
++ gen_helper_double_saturate(tmp, cpu_env, tmp);
+ if (op & 2)
+- gen_helper_sub_saturate(tmp, tmp2, tmp);
++ gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
+ else
+- gen_helper_add_saturate(tmp, tmp, tmp2);
++ gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ } else {
+ tmp = load_reg(s, rn);
+@@ -8353,7 +8353,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ tcg_temp_free_i32(tmp2);
+ if (rs != 15) {
+ tmp2 = load_reg(s, rs);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ break;
+@@ -8370,13 +8370,13 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ * however it may overflow considered as a signed
+ * operation, in which case we must set the Q flag.
+ */
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp2);
+ if (rs != 15)
+ {
+ tmp2 = load_reg(s, rs);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ break;
+@@ -8393,7 +8393,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ if (rs != 15)
+ {
+ tmp2 = load_reg(s, rs);
+- gen_helper_add_setq(tmp, tmp, tmp2);
++ gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ }
+ break;
+@@ -8632,7 +8632,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ gen_helper_v7m_mrs(tmp, cpu_env, addr);
+ tcg_temp_free_i32(addr);
+ } else {
+- gen_helper_cpsr_read(tmp);
++ gen_helper_cpsr_read(tmp, cpu_env);
+ }
+ store_reg(s, rd, tmp);
+ break;
+@@ -8721,15 +8721,15 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ if (op & 4) {
+ /* Unsigned. */
+ if ((op & 1) && shift == 0)
+- gen_helper_usat16(tmp, tmp, tmp2);
++ gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
+ else
+- gen_helper_usat(tmp, tmp, tmp2);
++ gen_helper_usat(tmp, cpu_env, tmp, tmp2);
+ } else {
+ /* Signed. */
+ if ((op & 1) && shift == 0)
+- gen_helper_ssat16(tmp, tmp, tmp2);
++ gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
+ else
+- gen_helper_ssat(tmp, tmp, tmp2);
++ gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp2);
+ break;
+@@ -9017,12 +9017,12 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ if (s->condexec_mask)
+ tcg_gen_sub_i32(tmp, tmp, tmp2);
+ else
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ } else {
+ if (s->condexec_mask)
+ tcg_gen_add_i32(tmp, tmp, tmp2);
+ else
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ }
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+@@ -9053,7 +9053,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ tcg_gen_movi_i32(tmp2, insn & 0xff);
+ switch (op) {
+ case 1: /* cmp */
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp);
+ tcg_temp_free_i32(tmp2);
+ break;
+@@ -9061,7 +9061,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ if (s->condexec_mask)
+ tcg_gen_add_i32(tmp, tmp, tmp2);
+ else
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+ break;
+@@ -9069,7 +9069,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ if (s->condexec_mask)
+ tcg_gen_sub_i32(tmp, tmp, tmp2);
+ else
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ store_reg(s, rd, tmp);
+ break;
+@@ -9105,7 +9105,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ case 1: /* cmp */
+ tmp = load_reg(s, rd);
+ tmp2 = load_reg(s, rm);
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ tcg_temp_free_i32(tmp2);
+ tcg_temp_free_i32(tmp);
+ break;
+@@ -9166,25 +9166,25 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ break;
+ case 0x2: /* lsl */
+ if (s->condexec_mask) {
+- gen_helper_shl(tmp2, tmp2, tmp);
++ gen_helper_shl(tmp2, cpu_env, tmp2, tmp);
+ } else {
+- gen_helper_shl_cc(tmp2, tmp2, tmp);
++ gen_helper_shl_cc(tmp2, cpu_env, tmp2, tmp);
+ gen_logic_CC(tmp2);
+ }
+ break;
+ case 0x3: /* lsr */
+ if (s->condexec_mask) {
+- gen_helper_shr(tmp2, tmp2, tmp);
++ gen_helper_shr(tmp2, cpu_env, tmp2, tmp);
+ } else {
+- gen_helper_shr_cc(tmp2, tmp2, tmp);
++ gen_helper_shr_cc(tmp2, cpu_env, tmp2, tmp);
+ gen_logic_CC(tmp2);
+ }
+ break;
+ case 0x4: /* asr */
+ if (s->condexec_mask) {
+- gen_helper_sar(tmp2, tmp2, tmp);
++ gen_helper_sar(tmp2, cpu_env, tmp2, tmp);
+ } else {
+- gen_helper_sar_cc(tmp2, tmp2, tmp);
++ gen_helper_sar_cc(tmp2, cpu_env, tmp2, tmp);
+ gen_logic_CC(tmp2);
+ }
+ break;
+@@ -9192,20 +9192,20 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ if (s->condexec_mask)
+ gen_adc(tmp, tmp2);
+ else
+- gen_helper_adc_cc(tmp, tmp, tmp2);
++ gen_helper_adc_cc(tmp, cpu_env, tmp, tmp2);
+ break;
+ case 0x6: /* sbc */
+ if (s->condexec_mask)
+ gen_sub_carry(tmp, tmp, tmp2);
+ else
+- gen_helper_sbc_cc(tmp, tmp, tmp2);
++ gen_helper_sbc_cc(tmp, cpu_env, tmp, tmp2);
+ break;
+ case 0x7: /* ror */
+ if (s->condexec_mask) {
+ tcg_gen_andi_i32(tmp, tmp, 0x1f);
+ tcg_gen_rotr_i32(tmp2, tmp2, tmp);
+ } else {
+- gen_helper_ror_cc(tmp2, tmp2, tmp);
++ gen_helper_ror_cc(tmp2, cpu_env, tmp2, tmp);
+ gen_logic_CC(tmp2);
+ }
+ break;
+@@ -9218,14 +9218,14 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ if (s->condexec_mask)
+ tcg_gen_neg_i32(tmp, tmp2);
+ else
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ break;
+ case 0xa: /* cmp */
+- gen_helper_sub_cc(tmp, tmp, tmp2);
++ gen_helper_sub_cc(tmp, cpu_env, tmp, tmp2);
+ rd = 16;
+ break;
+ case 0xb: /* cmn */
+- gen_helper_add_cc(tmp, tmp, tmp2);
++ gen_helper_add_cc(tmp, cpu_env, tmp, tmp2);
+ rd = 16;
+ break;
+ case 0xc: /* orr */
+--
+1.7.12.1
+
--- /dev/null
+From 28b8f097f9fb107882aa51bd25ba87619beb033e Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Tue, 4 Sep 2012 20:25:59 +0000
+Subject: [PATCH] target-arm: final conversion to AREG0 free mode
+
+Convert code load functions and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-arm/Makefile.objs | 2 --
+ target-arm/cpu.h | 10 ++++++----
+ target-arm/helper.c | 9 +++++----
+ target-arm/op_helper.c | 8 +-------
+ target-arm/translate.c | 6 +++---
+ 6 files changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/configure b/configure
+index a8827ba..e8806f0 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | i386 | lm32 | m68k | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
++ alpha | arm* | i386 | lm32 | m68k | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-arm/Makefile.objs b/target-arm/Makefile.objs
+index f447c4f..b6f1a9e 100644
+--- a/target-arm/Makefile.objs
++++ b/target-arm/Makefile.objs
+@@ -2,5 +2,3 @@ obj-y += arm-semi.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-y += neon_helper.o iwmmxt_helper.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-arm/cpu.h b/target-arm/cpu.h
+index d7f93d9..7fac94f 100644
+--- a/target-arm/cpu.h
++++ b/target-arm/cpu.h
+@@ -734,9 +734,10 @@ static inline void cpu_pc_from_tb(CPUARMState *env, TranslationBlock *tb)
+ }
+
+ /* Load an instruction and return it in the standard little-endian order */
+-static inline uint32_t arm_ldl_code(uint32_t addr, bool do_swap)
++static inline uint32_t arm_ldl_code(CPUARMState *env, uint32_t addr,
++ bool do_swap)
+ {
+- uint32_t insn = ldl_code(addr);
++ uint32_t insn = cpu_ldl_code(env, addr);
+ if (do_swap) {
+ return bswap32(insn);
+ }
+@@ -744,9 +745,10 @@ static inline uint32_t arm_ldl_code(uint32_t addr, bool do_swap)
+ }
+
+ /* Ditto, for a halfword (Thumb) instruction */
+-static inline uint16_t arm_lduw_code(uint32_t addr, bool do_swap)
++static inline uint16_t arm_lduw_code(CPUARMState *env, uint32_t addr,
++ bool do_swap)
+ {
+- uint16_t insn = lduw_code(addr);
++ uint16_t insn = cpu_lduw_code(env, addr);
+ if (do_swap) {
+ return bswap16(insn);
+ }
+diff --git a/target-arm/helper.c b/target-arm/helper.c
+index e27df96..58340bd 100644
+--- a/target-arm/helper.c
++++ b/target-arm/helper.c
+@@ -1756,7 +1756,7 @@ static void do_interrupt_v7m(CPUARMState *env)
+ case EXCP_BKPT:
+ if (semihosting_enabled) {
+ int nr;
+- nr = arm_lduw_code(env->regs[15], env->bswap_code) & 0xff;
++ nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
+ if (nr == 0xab) {
+ env->regs[15] += 2;
+ env->regs[0] = do_arm_semihosting(env);
+@@ -1828,9 +1828,10 @@ void do_interrupt(CPUARMState *env)
+ if (semihosting_enabled) {
+ /* Check for semihosting interrupt. */
+ if (env->thumb) {
+- mask = arm_lduw_code(env->regs[15] - 2, env->bswap_code) & 0xff;
++ mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
++ & 0xff;
+ } else {
+- mask = arm_ldl_code(env->regs[15] - 4, env->bswap_code)
++ mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
+ & 0xffffff;
+ }
+ /* Only intercept calls from privileged modes, to provide some
+@@ -1851,7 +1852,7 @@ void do_interrupt(CPUARMState *env)
+ case EXCP_BKPT:
+ /* See if this is a semihosting syscall. */
+ if (env->thumb && semihosting_enabled) {
+- mask = arm_lduw_code(env->regs[15], env->bswap_code) & 0xff;
++ mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
+ if (mask == 0xab
+ && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
+ env->regs[15] += 2;
+diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
+index 5b868bf..f13fc3a 100644
+--- a/target-arm/op_helper.c
++++ b/target-arm/op_helper.c
+@@ -17,7 +17,6 @@
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+ #define SIGNBIT (uint32_t)0x80000000
+@@ -72,16 +71,12 @@ uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
+ /* try to fill the TLB and return an exception if error. If retaddr is
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPUARMState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUARMState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUARMState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = cpu_arm_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret)) {
+ if (retaddr) {
+@@ -95,7 +90,6 @@ void tlb_fill(CPUARMState *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ raise_exception(env, env->exception_index);
+ }
+- env = saved_env;
+ }
+ #endif
+
+diff --git a/target-arm/translate.c b/target-arm/translate.c
+index 9ae3b26..f4b447a 100644
+--- a/target-arm/translate.c
++++ b/target-arm/translate.c
+@@ -6534,7 +6534,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
+ TCGv addr;
+ TCGv_i64 tmp64;
+
+- insn = arm_ldl_code(s->pc, s->bswap_code);
++ insn = arm_ldl_code(env, s->pc, s->bswap_code);
+ s->pc += 4;
+
+ /* M variants do not implement ARM mode. */
+@@ -7962,7 +7962,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+ /* Fall through to 32-bit decode. */
+ }
+
+- insn = arm_lduw_code(s->pc, s->bswap_code);
++ insn = arm_lduw_code(env, s->pc, s->bswap_code);
+ s->pc += 2;
+ insn |= (uint32_t)insn_hw1 << 16;
+
+@@ -8992,7 +8992,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+ }
+ }
+
+- insn = arm_lduw_code(s->pc, s->bswap_code);
++ insn = arm_lduw_code(env, s->pc, s->bswap_code);
+ s->pc += 2;
+
+ switch (insn >> 12) {
+--
+1.7.12.1
+
--- /dev/null
+From 449d4f2cfbdd2b5fd00e3e82c78bf580bd81551d Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 08:39:22 +0000
+Subject: [PATCH] target-microblaze: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-microblaze/Makefile.objs | 2 -
+ target-microblaze/helper.h | 48 ++++++++---------
+ target-microblaze/op_helper.c | 115 ++++++++++++++++++----------------------
+ target-microblaze/translate.c | 61 +++++++++++----------
+ 5 files changed, 110 insertions(+), 118 deletions(-)
+
+diff --git a/configure b/configure
+index e8806f0..0b4ef4a 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | arm* | i386 | lm32 | m68k | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
++ alpha | arm* | i386 | lm32 | m68k | microblaze* | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-microblaze/Makefile.objs b/target-microblaze/Makefile.objs
+index 4b09e8c..afb87bc 100644
+--- a/target-microblaze/Makefile.objs
++++ b/target-microblaze/Makefile.objs
+@@ -1,4 +1,2 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += mmu.o machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-microblaze/helper.h b/target-microblaze/helper.h
+index 9dcfb0f..a1a732c 100644
+--- a/target-microblaze/helper.h
++++ b/target-microblaze/helper.h
+@@ -1,39 +1,39 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_1(raise_exception, void, i32)
+-DEF_HELPER_0(debug, void)
++DEF_HELPER_2(raise_exception, void, env, i32)
++DEF_HELPER_1(debug, void, env)
+ DEF_HELPER_FLAGS_3(carry, TCG_CALL_PURE | TCG_CALL_CONST, i32, i32, i32, i32)
+ DEF_HELPER_2(cmp, i32, i32, i32)
+ DEF_HELPER_2(cmpu, i32, i32, i32)
+ DEF_HELPER_FLAGS_1(clz, TCG_CALL_PURE | TCG_CALL_CONST, i32, i32)
+
+-DEF_HELPER_2(divs, i32, i32, i32)
+-DEF_HELPER_2(divu, i32, i32, i32)
+-
+-DEF_HELPER_2(fadd, i32, i32, i32)
+-DEF_HELPER_2(frsub, i32, i32, i32)
+-DEF_HELPER_2(fmul, i32, i32, i32)
+-DEF_HELPER_2(fdiv, i32, i32, i32)
+-DEF_HELPER_1(flt, i32, i32)
+-DEF_HELPER_1(fint, i32, i32)
+-DEF_HELPER_1(fsqrt, i32, i32)
+-
+-DEF_HELPER_2(fcmp_un, i32, i32, i32)
+-DEF_HELPER_2(fcmp_lt, i32, i32, i32)
+-DEF_HELPER_2(fcmp_eq, i32, i32, i32)
+-DEF_HELPER_2(fcmp_le, i32, i32, i32)
+-DEF_HELPER_2(fcmp_gt, i32, i32, i32)
+-DEF_HELPER_2(fcmp_ne, i32, i32, i32)
+-DEF_HELPER_2(fcmp_ge, i32, i32, i32)
++DEF_HELPER_3(divs, i32, env, i32, i32)
++DEF_HELPER_3(divu, i32, env, i32, i32)
++
++DEF_HELPER_3(fadd, i32, env, i32, i32)
++DEF_HELPER_3(frsub, i32, env, i32, i32)
++DEF_HELPER_3(fmul, i32, env, i32, i32)
++DEF_HELPER_3(fdiv, i32, env, i32, i32)
++DEF_HELPER_2(flt, i32, env, i32)
++DEF_HELPER_2(fint, i32, env, i32)
++DEF_HELPER_2(fsqrt, i32, env, i32)
++
++DEF_HELPER_3(fcmp_un, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_lt, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_eq, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_le, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_gt, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_ne, i32, env, i32, i32)
++DEF_HELPER_3(fcmp_ge, i32, env, i32, i32)
+
+ DEF_HELPER_FLAGS_2(pcmpbf, TCG_CALL_PURE | TCG_CALL_CONST, i32, i32, i32)
+ #if !defined(CONFIG_USER_ONLY)
+-DEF_HELPER_1(mmu_read, i32, i32)
+-DEF_HELPER_2(mmu_write, void, i32, i32)
++DEF_HELPER_2(mmu_read, i32, env, i32)
++DEF_HELPER_3(mmu_write, void, env, i32, i32)
+ #endif
+
+-DEF_HELPER_4(memalign, void, i32, i32, i32, i32)
+-DEF_HELPER_1(stackprot, void, i32)
++DEF_HELPER_5(memalign, void, env, i32, i32, i32, i32)
++DEF_HELPER_2(stackprot, void, env, i32)
+
+ DEF_HELPER_2(get, i32, i32, i32)
+ DEF_HELPER_3(put, void, i32, i32, i32)
+diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
+index 3b1f072..c9789f4 100644
+--- a/target-microblaze/op_helper.c
++++ b/target-microblaze/op_helper.c
+@@ -20,7 +20,6 @@
+
+ #include <assert.h>
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+ #include "host-utils.h"
+
+@@ -42,17 +41,12 @@
+ /* Try to fill the TLB and return an exception if error. If retaddr is
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPUMBState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUMBState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUMBState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+-
+ ret = cpu_mb_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (unlikely(ret)) {
+ if (retaddr) {
+@@ -66,7 +60,6 @@ void tlb_fill(CPUMBState *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+ #endif
+
+@@ -105,13 +98,13 @@ uint32_t helper_get(uint32_t id, uint32_t ctrl)
+ return 0xdead0000 | id;
+ }
+
+-void helper_raise_exception(uint32_t index)
++void helper_raise_exception(CPUMBState *env, uint32_t index)
+ {
+ env->exception_index = index;
+ cpu_loop_exit(env);
+ }
+
+-void helper_debug(void)
++void helper_debug(CPUMBState *env)
+ {
+ int i;
+
+@@ -176,7 +169,7 @@ uint32_t helper_carry(uint32_t a, uint32_t b, uint32_t cf)
+ return ncf;
+ }
+
+-static inline int div_prepare(uint32_t a, uint32_t b)
++static inline int div_prepare(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ if (b == 0) {
+ env->sregs[SR_MSR] |= MSR_DZ;
+@@ -184,7 +177,7 @@ static inline int div_prepare(uint32_t a, uint32_t b)
+ if ((env->sregs[SR_MSR] & MSR_EE)
+ && !(env->pvr.regs[2] & PVR2_DIV_ZERO_EXC_MASK)) {
+ env->sregs[SR_ESR] = ESR_EC_DIVZERO;
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+ return 0;
+ }
+@@ -192,28 +185,30 @@ static inline int div_prepare(uint32_t a, uint32_t b)
+ return 1;
+ }
+
+-uint32_t helper_divs(uint32_t a, uint32_t b)
++uint32_t helper_divs(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+- if (!div_prepare(a, b))
++ if (!div_prepare(env, a, b)) {
+ return 0;
++ }
+ return (int32_t)a / (int32_t)b;
+ }
+
+-uint32_t helper_divu(uint32_t a, uint32_t b)
++uint32_t helper_divu(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+- if (!div_prepare(a, b))
++ if (!div_prepare(env, a, b)) {
+ return 0;
++ }
+ return a / b;
+ }
+
+ /* raise FPU exception. */
+-static void raise_fpu_exception(void)
++static void raise_fpu_exception(CPUMBState *env)
+ {
+ env->sregs[SR_ESR] = ESR_EC_FPU;
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+
+-static void update_fpu_flags(int flags)
++static void update_fpu_flags(CPUMBState *env, int flags)
+ {
+ int raise = 0;
+
+@@ -236,11 +231,11 @@ static void update_fpu_flags(int flags)
+ if (raise
+ && (env->pvr.regs[2] & PVR2_FPU_EXC_MASK)
+ && (env->sregs[SR_MSR] & MSR_EE)) {
+- raise_fpu_exception();
++ raise_fpu_exception(env);
+ }
+ }
+
+-uint32_t helper_fadd(uint32_t a, uint32_t b)
++uint32_t helper_fadd(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fd, fa, fb;
+ int flags;
+@@ -251,11 +246,11 @@ uint32_t helper_fadd(uint32_t a, uint32_t b)
+ fd.f = float32_add(fa.f, fb.f, &env->fp_status);
+
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+ return fd.l;
+ }
+
+-uint32_t helper_frsub(uint32_t a, uint32_t b)
++uint32_t helper_frsub(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fd, fa, fb;
+ int flags;
+@@ -265,11 +260,11 @@ uint32_t helper_frsub(uint32_t a, uint32_t b)
+ fb.l = b;
+ fd.f = float32_sub(fb.f, fa.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+ return fd.l;
+ }
+
+-uint32_t helper_fmul(uint32_t a, uint32_t b)
++uint32_t helper_fmul(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fd, fa, fb;
+ int flags;
+@@ -279,12 +274,12 @@ uint32_t helper_fmul(uint32_t a, uint32_t b)
+ fb.l = b;
+ fd.f = float32_mul(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+
+ return fd.l;
+ }
+
+-uint32_t helper_fdiv(uint32_t a, uint32_t b)
++uint32_t helper_fdiv(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fd, fa, fb;
+ int flags;
+@@ -294,12 +289,12 @@ uint32_t helper_fdiv(uint32_t a, uint32_t b)
+ fb.l = b;
+ fd.f = float32_div(fb.f, fa.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+
+ return fd.l;
+ }
+
+-uint32_t helper_fcmp_un(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_un(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ uint32_t r = 0;
+@@ -308,7 +303,7 @@ uint32_t helper_fcmp_un(uint32_t a, uint32_t b)
+ fb.l = b;
+
+ if (float32_is_signaling_nan(fa.f) || float32_is_signaling_nan(fb.f)) {
+- update_fpu_flags(float_flag_invalid);
++ update_fpu_flags(env, float_flag_invalid);
+ r = 1;
+ }
+
+@@ -319,7 +314,7 @@ uint32_t helper_fcmp_un(uint32_t a, uint32_t b)
+ return r;
+ }
+
+-uint32_t helper_fcmp_lt(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_lt(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int r;
+@@ -330,12 +325,12 @@ uint32_t helper_fcmp_lt(uint32_t a, uint32_t b)
+ fb.l = b;
+ r = float32_lt(fb.f, fa.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+
+ return r;
+ }
+
+-uint32_t helper_fcmp_eq(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_eq(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int flags;
+@@ -346,12 +341,12 @@ uint32_t helper_fcmp_eq(uint32_t a, uint32_t b)
+ fb.l = b;
+ r = float32_eq_quiet(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+
+ return r;
+ }
+
+-uint32_t helper_fcmp_le(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_le(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int flags;
+@@ -362,13 +357,13 @@ uint32_t helper_fcmp_le(uint32_t a, uint32_t b)
+ set_float_exception_flags(0, &env->fp_status);
+ r = float32_le(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+
+
+ return r;
+ }
+
+-uint32_t helper_fcmp_gt(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_gt(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int flags, r;
+@@ -378,11 +373,11 @@ uint32_t helper_fcmp_gt(uint32_t a, uint32_t b)
+ set_float_exception_flags(0, &env->fp_status);
+ r = float32_lt(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+ return r;
+ }
+
+-uint32_t helper_fcmp_ne(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_ne(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int flags, r;
+@@ -392,12 +387,12 @@ uint32_t helper_fcmp_ne(uint32_t a, uint32_t b)
+ set_float_exception_flags(0, &env->fp_status);
+ r = !float32_eq_quiet(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+
+ return r;
+ }
+
+-uint32_t helper_fcmp_ge(uint32_t a, uint32_t b)
++uint32_t helper_fcmp_ge(CPUMBState *env, uint32_t a, uint32_t b)
+ {
+ CPU_FloatU fa, fb;
+ int flags, r;
+@@ -407,12 +402,12 @@ uint32_t helper_fcmp_ge(uint32_t a, uint32_t b)
+ set_float_exception_flags(0, &env->fp_status);
+ r = !float32_lt(fa.f, fb.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags & float_flag_invalid);
++ update_fpu_flags(env, flags & float_flag_invalid);
+
+ return r;
+ }
+
+-uint32_t helper_flt(uint32_t a)
++uint32_t helper_flt(CPUMBState *env, uint32_t a)
+ {
+ CPU_FloatU fd, fa;
+
+@@ -421,7 +416,7 @@ uint32_t helper_flt(uint32_t a)
+ return fd.l;
+ }
+
+-uint32_t helper_fint(uint32_t a)
++uint32_t helper_fint(CPUMBState *env, uint32_t a)
+ {
+ CPU_FloatU fa;
+ uint32_t r;
+@@ -431,12 +426,12 @@ uint32_t helper_fint(uint32_t a)
+ fa.l = a;
+ r = float32_to_int32(fa.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+
+ return r;
+ }
+
+-uint32_t helper_fsqrt(uint32_t a)
++uint32_t helper_fsqrt(CPUMBState *env, uint32_t a)
+ {
+ CPU_FloatU fd, fa;
+ int flags;
+@@ -445,7 +440,7 @@ uint32_t helper_fsqrt(uint32_t a)
+ fa.l = a;
+ fd.l = float32_sqrt(fa.f, &env->fp_status);
+ flags = get_float_exception_flags(&env->fp_status);
+- update_fpu_flags(flags);
++ update_fpu_flags(env, flags);
+
+ return fd.l;
+ }
+@@ -463,7 +458,8 @@ uint32_t helper_pcmpbf(uint32_t a, uint32_t b)
+ return 0;
+ }
+
+-void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t mask)
++void helper_memalign(CPUMBState *env, uint32_t addr, uint32_t dr, uint32_t wr,
++ uint32_t mask)
+ {
+ if (addr & mask) {
+ qemu_log_mask(CPU_LOG_INT,
+@@ -478,45 +474,39 @@ void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t mask)
+ if (!(env->sregs[SR_MSR] & MSR_EE)) {
+ return;
+ }
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+ }
+
+-void helper_stackprot(uint32_t addr)
++void helper_stackprot(CPUMBState *env, uint32_t addr)
+ {
+ if (addr < env->slr || addr > env->shr) {
+ qemu_log("Stack protector violation at %x %x %x\n",
+ addr, env->slr, env->shr);
+ env->sregs[SR_EAR] = addr;
+ env->sregs[SR_ESR] = ESR_EC_STACKPROT;
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+ }
+
+ #if !defined(CONFIG_USER_ONLY)
+ /* Writes/reads to the MMU's special regs end up here. */
+-uint32_t helper_mmu_read(uint32_t rn)
++uint32_t helper_mmu_read(CPUMBState *env, uint32_t rn)
+ {
+ return mmu_read(env, rn);
+ }
+
+-void helper_mmu_write(uint32_t rn, uint32_t v)
++void helper_mmu_write(CPUMBState *env, uint32_t rn, uint32_t v)
+ {
+ mmu_write(env, rn, v);
+ }
+
+-void cpu_unassigned_access(CPUMBState *env1, target_phys_addr_t addr,
++void cpu_unassigned_access(CPUMBState *env, target_phys_addr_t addr,
+ int is_write, int is_exec, int is_asi, int size)
+ {
+- CPUMBState *saved_env;
+-
+- saved_env = env;
+- env = env1;
+-
+ qemu_log_mask(CPU_LOG_INT, "Unassigned " TARGET_FMT_plx " wr=%d exe=%d\n",
+ addr, is_write, is_exec);
+ if (!(env->sregs[SR_MSR] & MSR_EE)) {
+- env = saved_env;
+ return;
+ }
+
+@@ -524,14 +514,13 @@ void cpu_unassigned_access(CPUMBState *env1, target_phys_addr_t addr,
+ if (is_exec) {
+ if ((env->pvr.regs[2] & PVR2_IOPB_BUS_EXC_MASK)) {
+ env->sregs[SR_ESR] = ESR_EC_INSN_BUS;
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+ } else {
+ if ((env->pvr.regs[2] & PVR2_DOPB_BUS_EXC_MASK)) {
+ env->sregs[SR_ESR] = ESR_EC_DATA_BUS;
+- helper_raise_exception(EXCP_HW_EXCP);
++ helper_raise_exception(env, EXCP_HW_EXCP);
+ }
+ }
+- env = saved_env;
+ }
+ #endif
+diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
+index 7470149..9c7d77f 100644
+--- a/target-microblaze/translate.c
++++ b/target-microblaze/translate.c
+@@ -126,7 +126,7 @@ static inline void t_gen_raise_exception(DisasContext *dc, uint32_t index)
+
+ t_sync_flags(dc);
+ tcg_gen_movi_tl(cpu_SR[SR_PC], dc->pc);
+- gen_helper_raise_exception(tmp);
++ gen_helper_raise_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ dc->is_jmp = DISAS_UPDATE;
+ }
+@@ -503,9 +503,9 @@ static void dec_msr(DisasContext *dc)
+ sr &= 7;
+ LOG_DIS("m%ss sr%d r%d imm=%x\n", to ? "t" : "f", sr, dc->ra, dc->imm);
+ if (to)
+- gen_helper_mmu_write(tcg_const_tl(sr), cpu_R[dc->ra]);
++ gen_helper_mmu_write(cpu_env, tcg_const_tl(sr), cpu_R[dc->ra]);
+ else
+- gen_helper_mmu_read(cpu_R[dc->rd], tcg_const_tl(sr));
++ gen_helper_mmu_read(cpu_R[dc->rd], cpu_env, tcg_const_tl(sr));
+ return;
+ }
+ #endif
+@@ -704,9 +704,11 @@ static void dec_div(DisasContext *dc)
+ }
+
+ if (u)
+- gen_helper_divu(cpu_R[dc->rd], *(dec_alu_op_b(dc)), cpu_R[dc->ra]);
++ gen_helper_divu(cpu_R[dc->rd], cpu_env, *(dec_alu_op_b(dc)),
++ cpu_R[dc->ra]);
+ else
+- gen_helper_divs(cpu_R[dc->rd], *(dec_alu_op_b(dc)), cpu_R[dc->ra]);
++ gen_helper_divs(cpu_R[dc->rd], cpu_env, *(dec_alu_op_b(dc)),
++ cpu_R[dc->ra]);
+ if (!dc->rd)
+ tcg_gen_movi_tl(cpu_R[dc->rd], 0);
+ }
+@@ -912,7 +914,7 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t)
+ tcg_gen_add_tl(*t, cpu_R[dc->ra], cpu_R[dc->rb]);
+
+ if (stackprot) {
+- gen_helper_stackprot(*t);
++ gen_helper_stackprot(cpu_env, *t);
+ }
+ return t;
+ }
+@@ -930,7 +932,7 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t)
+ }
+
+ if (stackprot) {
+- gen_helper_stackprot(*t);
++ gen_helper_stackprot(cpu_env, *t);
+ }
+ return t;
+ }
+@@ -1056,7 +1058,7 @@ static void dec_load(DisasContext *dc)
+ gen_load(dc, v, *addr, size);
+
+ tcg_gen_movi_tl(cpu_SR[SR_PC], dc->pc);
+- gen_helper_memalign(*addr, tcg_const_tl(dc->rd),
++ gen_helper_memalign(cpu_env, *addr, tcg_const_tl(dc->rd),
+ tcg_const_tl(0), tcg_const_tl(size - 1));
+ if (dc->rd) {
+ if (rev) {
+@@ -1218,7 +1220,7 @@ static void dec_store(DisasContext *dc)
+ * the alignment checks in between the probe and the mem
+ * access.
+ */
+- gen_helper_memalign(*addr, tcg_const_tl(dc->rd),
++ gen_helper_memalign(cpu_env, *addr, tcg_const_tl(dc->rd),
+ tcg_const_tl(1), tcg_const_tl(size - 1));
+ }
+
+@@ -1493,49 +1495,53 @@ static void dec_fpu(DisasContext *dc)
+
+ switch (fpu_insn) {
+ case 0:
+- gen_helper_fadd(cpu_R[dc->rd], cpu_R[dc->ra], cpu_R[dc->rb]);
++ gen_helper_fadd(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra],
++ cpu_R[dc->rb]);
+ break;
+
+ case 1:
+- gen_helper_frsub(cpu_R[dc->rd], cpu_R[dc->ra], cpu_R[dc->rb]);
++ gen_helper_frsub(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra],
++ cpu_R[dc->rb]);
+ break;
+
+ case 2:
+- gen_helper_fmul(cpu_R[dc->rd], cpu_R[dc->ra], cpu_R[dc->rb]);
++ gen_helper_fmul(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra],
++ cpu_R[dc->rb]);
+ break;
+
+ case 3:
+- gen_helper_fdiv(cpu_R[dc->rd], cpu_R[dc->ra], cpu_R[dc->rb]);
++ gen_helper_fdiv(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra],
++ cpu_R[dc->rb]);
+ break;
+
+ case 4:
+ switch ((dc->ir >> 4) & 7) {
+ case 0:
+- gen_helper_fcmp_un(cpu_R[dc->rd],
++ gen_helper_fcmp_un(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 1:
+- gen_helper_fcmp_lt(cpu_R[dc->rd],
++ gen_helper_fcmp_lt(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 2:
+- gen_helper_fcmp_eq(cpu_R[dc->rd],
++ gen_helper_fcmp_eq(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 3:
+- gen_helper_fcmp_le(cpu_R[dc->rd],
++ gen_helper_fcmp_le(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 4:
+- gen_helper_fcmp_gt(cpu_R[dc->rd],
++ gen_helper_fcmp_gt(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 5:
+- gen_helper_fcmp_ne(cpu_R[dc->rd],
++ gen_helper_fcmp_ne(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ case 6:
+- gen_helper_fcmp_ge(cpu_R[dc->rd],
++ gen_helper_fcmp_ge(cpu_R[dc->rd], cpu_env,
+ cpu_R[dc->ra], cpu_R[dc->rb]);
+ break;
+ default:
+@@ -1552,21 +1558,21 @@ static void dec_fpu(DisasContext *dc)
+ if (!dec_check_fpuv2(dc)) {
+ return;
+ }
+- gen_helper_flt(cpu_R[dc->rd], cpu_R[dc->ra]);
++ gen_helper_flt(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra]);
+ break;
+
+ case 6:
+ if (!dec_check_fpuv2(dc)) {
+ return;
+ }
+- gen_helper_fint(cpu_R[dc->rd], cpu_R[dc->ra]);
++ gen_helper_fint(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra]);
+ break;
+
+ case 7:
+ if (!dec_check_fpuv2(dc)) {
+ return;
+ }
+- gen_helper_fsqrt(cpu_R[dc->rd], cpu_R[dc->ra]);
++ gen_helper_fsqrt(cpu_R[dc->rd], cpu_env, cpu_R[dc->ra]);
+ break;
+
+ default:
+@@ -1654,15 +1660,14 @@ static struct decoder_info {
+ {{0, 0}, dec_null}
+ };
+
+-static inline void decode(DisasContext *dc)
++static inline void decode(DisasContext *dc, uint32_t ir)
+ {
+- uint32_t ir;
+ int i;
+
+ if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)))
+ tcg_gen_debug_insn_start(dc->pc);
+
+- dc->ir = ir = ldl_code(dc->pc);
++ dc->ir = ir;
+ LOG_DIS("%8.8x\t", dc->ir);
+
+ if (dc->ir)
+@@ -1796,7 +1801,7 @@ gen_intermediate_code_internal(CPUMBState *env, TranslationBlock *tb,
+ gen_io_start();
+
+ dc->clear_imm = 1;
+- decode(dc);
++ decode(dc, cpu_ldl_code(env, dc->pc));
+ if (dc->clear_imm)
+ dc->tb_flags &= ~IMM_FLAG;
+ dc->pc += 4;
+@@ -1871,7 +1876,7 @@ gen_intermediate_code_internal(CPUMBState *env, TranslationBlock *tb,
+ if (dc->is_jmp != DISAS_JUMP) {
+ tcg_gen_movi_tl(cpu_SR[SR_PC], npc);
+ }
+- gen_helper_raise_exception(tmp);
++ gen_helper_raise_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ } else {
+ switch(dc->is_jmp) {
+--
+1.7.12.1
+
--- /dev/null
+From 1e3916b0cbfd39cb3fc8996423d5574068583145 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Thu, 30 Aug 2012 16:56:39 +0200
+Subject: [PATCH] target-cris: Avoid AREG0 for helpers
+
+Add an explicit CPUCRISState parameter instead of relying on AREG0.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-cris/helper.h | 37 +++++++++++----------
+ target-cris/op_helper.c | 80 ++++++++++++++++++++++++---------------------
+ target-cris/translate.c | 44 +++++++++++++------------
+ target-cris/translate_v10.c | 4 +--
+ 4 files changed, 88 insertions(+), 77 deletions(-)
+
+diff --git a/target-cris/helper.h b/target-cris/helper.h
+index 093063a..99fb326 100644
+--- a/target-cris/helper.h
++++ b/target-cris/helper.h
+@@ -1,26 +1,29 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_1(raise_exception, void, i32)
+-DEF_HELPER_1(tlb_flush_pid, void, i32)
+-DEF_HELPER_1(spc_write, void, i32)
++DEF_HELPER_2(raise_exception, void, env, i32)
++DEF_HELPER_2(tlb_flush_pid, void, env, i32)
++DEF_HELPER_2(spc_write, void, env, i32)
+ DEF_HELPER_3(dump, void, i32, i32, i32)
+-DEF_HELPER_0(rfe, void);
+-DEF_HELPER_0(rfn, void);
++DEF_HELPER_1(rfe, void, env);
++DEF_HELPER_1(rfn, void, env);
+
+-DEF_HELPER_2(movl_sreg_reg, void, i32, i32)
+-DEF_HELPER_2(movl_reg_sreg, void, i32, i32)
++DEF_HELPER_3(movl_sreg_reg, void, env, i32, i32)
++DEF_HELPER_3(movl_reg_sreg, void, env, i32, i32)
+
+ DEF_HELPER_FLAGS_1(lz, TCG_CALL_PURE, i32, i32);
+-DEF_HELPER_FLAGS_3(btst, TCG_CALL_PURE, i32, i32, i32, i32);
++DEF_HELPER_FLAGS_4(btst, TCG_CALL_PURE, i32, env, i32, i32, i32);
+
+-DEF_HELPER_FLAGS_3(evaluate_flags_muls, TCG_CALL_PURE, i32, i32, i32, i32)
+-DEF_HELPER_FLAGS_3(evaluate_flags_mulu, TCG_CALL_PURE, i32, i32, i32, i32)
+-DEF_HELPER_FLAGS_4(evaluate_flags_mcp, TCG_CALL_PURE, i32, i32, i32, i32, i32)
+-DEF_HELPER_FLAGS_4(evaluate_flags_alu_4, TCG_CALL_PURE, i32, i32, i32, i32, i32)
+-DEF_HELPER_FLAGS_4(evaluate_flags_sub_4, TCG_CALL_PURE, i32, i32, i32, i32, i32)
+-DEF_HELPER_FLAGS_2(evaluate_flags_move_4, TCG_CALL_PURE, i32, i32, i32)
+-DEF_HELPER_FLAGS_2(evaluate_flags_move_2, TCG_CALL_PURE, i32, i32, i32)
+-DEF_HELPER_0(evaluate_flags, void)
+-DEF_HELPER_0(top_evaluate_flags, void)
++DEF_HELPER_FLAGS_4(evaluate_flags_muls, TCG_CALL_PURE, i32, env, i32, i32, i32)
++DEF_HELPER_FLAGS_4(evaluate_flags_mulu, TCG_CALL_PURE, i32, env, i32, i32, i32)
++DEF_HELPER_FLAGS_5(evaluate_flags_mcp, TCG_CALL_PURE, i32, env,
++ i32, i32, i32, i32)
++DEF_HELPER_FLAGS_5(evaluate_flags_alu_4, TCG_CALL_PURE, i32, env,
++ i32, i32, i32, i32)
++DEF_HELPER_FLAGS_5(evaluate_flags_sub_4, TCG_CALL_PURE, i32, env,
++ i32, i32, i32, i32)
++DEF_HELPER_FLAGS_3(evaluate_flags_move_4, TCG_CALL_PURE, i32, env, i32, i32)
++DEF_HELPER_FLAGS_3(evaluate_flags_move_2, TCG_CALL_PURE, i32, env, i32, i32)
++DEF_HELPER_1(evaluate_flags, void, env)
++DEF_HELPER_1(top_evaluate_flags, void, env)
+
+ #include "def-helper.h"
+diff --git a/target-cris/op_helper.c b/target-cris/op_helper.c
+index ac7c98c..5ca85a0 100644
+--- a/target-cris/op_helper.c
++++ b/target-cris/op_helper.c
+@@ -79,7 +79,7 @@ void tlb_fill(CPUCRISState *env1, target_ulong addr, int is_write, int mmu_idx,
+ cpu_restore_state(tb, env, retaddr);
+
+ /* Evaluate flags after retranslation. */
+- helper_top_evaluate_flags();
++ helper_top_evaluate_flags(env);
+ }
+ }
+ cpu_loop_exit(env);
+@@ -89,13 +89,13 @@ void tlb_fill(CPUCRISState *env1, target_ulong addr, int is_write, int mmu_idx,
+
+ #endif
+
+-void helper_raise_exception(uint32_t index)
++void helper_raise_exception(CPUCRISState *env, uint32_t index)
+ {
+ env->exception_index = index;
+ cpu_loop_exit(env);
+ }
+
+-void helper_tlb_flush_pid(uint32_t pid)
++void helper_tlb_flush_pid(CPUCRISState *env, uint32_t pid)
+ {
+ #if !defined(CONFIG_USER_ONLY)
+ pid &= 0xff;
+@@ -104,7 +104,7 @@ void helper_tlb_flush_pid(uint32_t pid)
+ #endif
+ }
+
+-void helper_spc_write(uint32_t new_spc)
++void helper_spc_write(CPUCRISState *env, uint32_t new_spc)
+ {
+ #if !defined(CONFIG_USER_ONLY)
+ tlb_flush_page(env, env->pregs[PR_SPC]);
+@@ -121,7 +121,7 @@ void helper_dump(uint32_t a0, uint32_t a1, uint32_t a2)
+ #define EXTRACT_FIELD(src, start, end) \
+ (((src) >> start) & ((1 << (end - start + 1)) - 1))
+
+-void helper_movl_sreg_reg (uint32_t sreg, uint32_t reg)
++void helper_movl_sreg_reg(CPUCRISState *env, uint32_t sreg, uint32_t reg)
+ {
+ uint32_t srs;
+ srs = env->pregs[PR_SRS];
+@@ -171,7 +171,7 @@ void helper_movl_sreg_reg (uint32_t sreg, uint32_t reg)
+ #endif
+ }
+
+-void helper_movl_reg_sreg (uint32_t reg, uint32_t sreg)
++void helper_movl_reg_sreg(CPUCRISState *env, uint32_t reg, uint32_t sreg)
+ {
+ uint32_t srs;
+ env->pregs[PR_SRS] &= 3;
+@@ -216,7 +216,7 @@ static void cris_ccs_rshift(CPUCRISState *env)
+ env->pregs[PR_CCS] = ccs;
+ }
+
+-void helper_rfe(void)
++void helper_rfe(CPUCRISState *env)
+ {
+ int rflag = env->pregs[PR_CCS] & R_FLAG;
+
+@@ -232,7 +232,7 @@ void helper_rfe(void)
+ env->pregs[PR_CCS] |= P_FLAG;
+ }
+
+-void helper_rfn(void)
++void helper_rfn(CPUCRISState *env)
+ {
+ int rflag = env->pregs[PR_CCS] & R_FLAG;
+
+@@ -256,7 +256,7 @@ uint32_t helper_lz(uint32_t t0)
+ return clz32(t0);
+ }
+
+-uint32_t helper_btst(uint32_t t0, uint32_t t1, uint32_t ccs)
++uint32_t helper_btst(CPUCRISState *env, uint32_t t0, uint32_t t1, uint32_t ccs)
+ {
+ /* FIXME: clean this up. */
+
+@@ -284,7 +284,8 @@ uint32_t helper_btst(uint32_t t0, uint32_t t1, uint32_t ccs)
+ return ccs;
+ }
+
+-static inline uint32_t evaluate_flags_writeback(uint32_t flags, uint32_t ccs)
++static inline uint32_t evaluate_flags_writeback(CPUCRISState *env,
++ uint32_t flags, uint32_t ccs)
+ {
+ unsigned int x, z, mask;
+
+@@ -303,7 +304,8 @@ static inline uint32_t evaluate_flags_writeback(uint32_t flags, uint32_t ccs)
+ return ccs;
+ }
+
+-uint32_t helper_evaluate_flags_muls(uint32_t ccs, uint32_t res, uint32_t mof)
++uint32_t helper_evaluate_flags_muls(CPUCRISState *env,
++ uint32_t ccs, uint32_t res, uint32_t mof)
+ {
+ uint32_t flags = 0;
+ int64_t tmp;
+@@ -321,10 +323,11 @@ uint32_t helper_evaluate_flags_muls(uint32_t ccs, uint32_t res, uint32_t mof)
+ if ((dneg && mof != -1)
+ || (!dneg && mof != 0))
+ flags |= V_FLAG;
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+-uint32_t helper_evaluate_flags_mulu(uint32_t ccs, uint32_t res, uint32_t mof)
++uint32_t helper_evaluate_flags_mulu(CPUCRISState *env,
++ uint32_t ccs, uint32_t res, uint32_t mof)
+ {
+ uint32_t flags = 0;
+ uint64_t tmp;
+@@ -339,10 +342,10 @@ uint32_t helper_evaluate_flags_mulu(uint32_t ccs, uint32_t res, uint32_t mof)
+ if (mof)
+ flags |= V_FLAG;
+
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+-uint32_t helper_evaluate_flags_mcp(uint32_t ccs,
++uint32_t helper_evaluate_flags_mcp(CPUCRISState *env, uint32_t ccs,
+ uint32_t src, uint32_t dst, uint32_t res)
+ {
+ uint32_t flags = 0;
+@@ -368,10 +371,10 @@ uint32_t helper_evaluate_flags_mcp(uint32_t ccs,
+ flags |= R_FLAG;
+ }
+
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+-uint32_t helper_evaluate_flags_alu_4(uint32_t ccs,
++uint32_t helper_evaluate_flags_alu_4(CPUCRISState *env, uint32_t ccs,
+ uint32_t src, uint32_t dst, uint32_t res)
+ {
+ uint32_t flags = 0;
+@@ -397,10 +400,10 @@ uint32_t helper_evaluate_flags_alu_4(uint32_t ccs,
+ flags |= C_FLAG;
+ }
+
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+-uint32_t helper_evaluate_flags_sub_4(uint32_t ccs,
++uint32_t helper_evaluate_flags_sub_4(CPUCRISState *env, uint32_t ccs,
+ uint32_t src, uint32_t dst, uint32_t res)
+ {
+ uint32_t flags = 0;
+@@ -427,10 +430,11 @@ uint32_t helper_evaluate_flags_sub_4(uint32_t ccs,
+ }
+
+ flags ^= C_FLAG;
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+-uint32_t helper_evaluate_flags_move_4(uint32_t ccs, uint32_t res)
++uint32_t helper_evaluate_flags_move_4(CPUCRISState *env,
++ uint32_t ccs, uint32_t res)
+ {
+ uint32_t flags = 0;
+
+@@ -439,9 +443,10 @@ uint32_t helper_evaluate_flags_move_4(uint32_t ccs, uint32_t res)
+ else if (res == 0L)
+ flags |= Z_FLAG;
+
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+-uint32_t helper_evaluate_flags_move_2(uint32_t ccs, uint32_t res)
++uint32_t helper_evaluate_flags_move_2(CPUCRISState *env,
++ uint32_t ccs, uint32_t res)
+ {
+ uint32_t flags = 0;
+
+@@ -450,12 +455,12 @@ uint32_t helper_evaluate_flags_move_2(uint32_t ccs, uint32_t res)
+ else if (res == 0)
+ flags |= Z_FLAG;
+
+- return evaluate_flags_writeback(flags, ccs);
++ return evaluate_flags_writeback(env, flags, ccs);
+ }
+
+ /* TODO: This is expensive. We could split things up and only evaluate part of
+ CCR on a need to know basis. For now, we simply re-evaluate everything. */
+-void helper_evaluate_flags(void)
++void helper_evaluate_flags(CPUCRISState *env)
+ {
+ uint32_t src, dst, res;
+ uint32_t flags = 0;
+@@ -571,25 +576,26 @@ void helper_evaluate_flags(void)
+ if (env->cc_op == CC_OP_SUB || env->cc_op == CC_OP_CMP)
+ flags ^= C_FLAG;
+
+- env->pregs[PR_CCS] = evaluate_flags_writeback(flags, env->pregs[PR_CCS]);
++ env->pregs[PR_CCS] = evaluate_flags_writeback(env, flags,
++ env->pregs[PR_CCS]);
+ }
+
+-void helper_top_evaluate_flags(void)
++void helper_top_evaluate_flags(CPUCRISState *env)
+ {
+ switch (env->cc_op)
+ {
+ case CC_OP_MCP:
+- env->pregs[PR_CCS] = helper_evaluate_flags_mcp(
++ env->pregs[PR_CCS] = helper_evaluate_flags_mcp(env,
+ env->pregs[PR_CCS], env->cc_src,
+ env->cc_dest, env->cc_result);
+ break;
+ case CC_OP_MULS:
+- env->pregs[PR_CCS] = helper_evaluate_flags_muls(
++ env->pregs[PR_CCS] = helper_evaluate_flags_muls(env,
+ env->pregs[PR_CCS], env->cc_result,
+ env->pregs[PR_MOF]);
+ break;
+ case CC_OP_MULU:
+- env->pregs[PR_CCS] = helper_evaluate_flags_mulu(
++ env->pregs[PR_CCS] = helper_evaluate_flags_mulu(env,
+ env->pregs[PR_CCS], env->cc_result,
+ env->pregs[PR_MOF]);
+ break;
+@@ -604,18 +610,18 @@ void helper_top_evaluate_flags(void)
+ {
+ case 4:
+ env->pregs[PR_CCS] =
+- helper_evaluate_flags_move_4(
++ helper_evaluate_flags_move_4(env,
+ env->pregs[PR_CCS],
+ env->cc_result);
+ break;
+ case 2:
+ env->pregs[PR_CCS] =
+- helper_evaluate_flags_move_2(
++ helper_evaluate_flags_move_2(env,
+ env->pregs[PR_CCS],
+ env->cc_result);
+ break;
+ default:
+- helper_evaluate_flags();
++ helper_evaluate_flags(env);
+ break;
+ }
+ break;
+@@ -626,12 +632,12 @@ void helper_top_evaluate_flags(void)
+ case CC_OP_CMP:
+ if (env->cc_size == 4)
+ env->pregs[PR_CCS] =
+- helper_evaluate_flags_sub_4(
++ helper_evaluate_flags_sub_4(env,
+ env->pregs[PR_CCS],
+ env->cc_src, env->cc_dest,
+ env->cc_result);
+ else
+- helper_evaluate_flags();
++ helper_evaluate_flags(env);
+ break;
+ default:
+ {
+@@ -639,13 +645,13 @@ void helper_top_evaluate_flags(void)
+ {
+ case 4:
+ env->pregs[PR_CCS] =
+- helper_evaluate_flags_alu_4(
++ helper_evaluate_flags_alu_4(env,
+ env->pregs[PR_CCS],
+ env->cc_src, env->cc_dest,
+ env->cc_result);
+ break;
+ default:
+- helper_evaluate_flags();
++ helper_evaluate_flags(env);
+ break;
+ }
+ }
+diff --git a/target-cris/translate.c b/target-cris/translate.c
+index ad31877..283dd98 100644
+--- a/target-cris/translate.c
++++ b/target-cris/translate.c
+@@ -211,9 +211,9 @@ static inline void t_gen_mov_preg_TN(DisasContext *dc, int r, TCGv tn)
+ tcg_gen_andi_tl(cpu_PR[r], tn, 3);
+ else {
+ if (r == PR_PID)
+- gen_helper_tlb_flush_pid(tn);
++ gen_helper_tlb_flush_pid(cpu_env, tn);
+ if (dc->tb_flags & S_FLAG && r == PR_SPC)
+- gen_helper_spc_write(tn);
++ gen_helper_spc_write(cpu_env, tn);
+ else if (r == PR_CCS)
+ dc->cpustate_changed = 1;
+ tcg_gen_mov_tl(cpu_PR[r], tn);
+@@ -278,7 +278,7 @@ static void cris_lock_irq(DisasContext *dc)
+ static inline void t_gen_raise_exception(uint32_t index)
+ {
+ TCGv_i32 tmp = tcg_const_i32(index);
+- gen_helper_raise_exception(tmp);
++ gen_helper_raise_exception(cpu_env, tmp);
+ tcg_temp_free_i32(tmp);
+ }
+
+@@ -624,17 +624,17 @@ static void cris_evaluate_flags(DisasContext *dc)
+ switch (dc->cc_op)
+ {
+ case CC_OP_MCP:
+- gen_helper_evaluate_flags_mcp(cpu_PR[PR_CCS],
++ gen_helper_evaluate_flags_mcp(cpu_PR[PR_CCS], cpu_env,
+ cpu_PR[PR_CCS], cc_src,
+ cc_dest, cc_result);
+ break;
+ case CC_OP_MULS:
+- gen_helper_evaluate_flags_muls(cpu_PR[PR_CCS],
++ gen_helper_evaluate_flags_muls(cpu_PR[PR_CCS], cpu_env,
+ cpu_PR[PR_CCS], cc_result,
+ cpu_PR[PR_MOF]);
+ break;
+ case CC_OP_MULU:
+- gen_helper_evaluate_flags_mulu(cpu_PR[PR_CCS],
++ gen_helper_evaluate_flags_mulu(cpu_PR[PR_CCS], cpu_env,
+ cpu_PR[PR_CCS], cc_result,
+ cpu_PR[PR_MOF]);
+ break;
+@@ -648,15 +648,15 @@ static void cris_evaluate_flags(DisasContext *dc)
+ switch (dc->cc_size)
+ {
+ case 4:
+- gen_helper_evaluate_flags_move_4(cpu_PR[PR_CCS],
+- cpu_PR[PR_CCS], cc_result);
++ gen_helper_evaluate_flags_move_4(cpu_PR[PR_CCS],
++ cpu_env, cpu_PR[PR_CCS], cc_result);
+ break;
+ case 2:
+- gen_helper_evaluate_flags_move_2(cpu_PR[PR_CCS],
+- cpu_PR[PR_CCS], cc_result);
++ gen_helper_evaluate_flags_move_2(cpu_PR[PR_CCS],
++ cpu_env, cpu_PR[PR_CCS], cc_result);
+ break;
+ default:
+- gen_helper_evaluate_flags();
++ gen_helper_evaluate_flags(cpu_env);
+ break;
+ }
+ break;
+@@ -666,21 +666,21 @@ static void cris_evaluate_flags(DisasContext *dc)
+ case CC_OP_SUB:
+ case CC_OP_CMP:
+ if (dc->cc_size == 4)
+- gen_helper_evaluate_flags_sub_4(cpu_PR[PR_CCS],
++ gen_helper_evaluate_flags_sub_4(cpu_PR[PR_CCS], cpu_env,
+ cpu_PR[PR_CCS], cc_src, cc_dest, cc_result);
+ else
+- gen_helper_evaluate_flags();
++ gen_helper_evaluate_flags(cpu_env);
+
+ break;
+ default:
+ switch (dc->cc_size)
+ {
+ case 4:
+- gen_helper_evaluate_flags_alu_4(cpu_PR[PR_CCS],
++ gen_helper_evaluate_flags_alu_4(cpu_PR[PR_CCS], cpu_env,
+ cpu_PR[PR_CCS], cc_src, cc_dest, cc_result);
+ break;
+ default:
+- gen_helper_evaluate_flags();
++ gen_helper_evaluate_flags(cpu_env);
+ break;
+ }
+ break;
+@@ -1475,7 +1475,7 @@ static int dec_btstq(DisasContext *dc)
+
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_evaluate_flags(dc);
+- gen_helper_btst(cpu_PR[PR_CCS], cpu_R[dc->op2],
++ gen_helper_btst(cpu_PR[PR_CCS], cpu_env, cpu_R[dc->op2],
+ tcg_const_tl(dc->op1), cpu_PR[PR_CCS]);
+ cris_alu(dc, CC_OP_MOVE,
+ cpu_R[dc->op2], cpu_R[dc->op2], cpu_R[dc->op2], 4);
+@@ -1925,7 +1925,7 @@ static int dec_btst_r(DisasContext *dc)
+ dc->op1, dc->op2);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_evaluate_flags(dc);
+- gen_helper_btst(cpu_PR[PR_CCS], cpu_R[dc->op2],
++ gen_helper_btst(cpu_PR[PR_CCS], cpu_env, cpu_R[dc->op2],
+ cpu_R[dc->op1], cpu_PR[PR_CCS]);
+ cris_alu(dc, CC_OP_MOVE, cpu_R[dc->op2],
+ cpu_R[dc->op2], cpu_R[dc->op2], 4);
+@@ -2135,14 +2135,16 @@ static int dec_move_rs(DisasContext *dc)
+ {
+ LOG_DIS("move $r%u, $s%u\n", dc->op1, dc->op2);
+ cris_cc_mask(dc, 0);
+- gen_helper_movl_sreg_reg(tcg_const_tl(dc->op2), tcg_const_tl(dc->op1));
++ gen_helper_movl_sreg_reg(cpu_env, tcg_const_tl(dc->op2),
++ tcg_const_tl(dc->op1));
+ return 2;
+ }
+ static int dec_move_sr(DisasContext *dc)
+ {
+ LOG_DIS("move $s%u, $r%u\n", dc->op2, dc->op1);
+ cris_cc_mask(dc, 0);
+- gen_helper_movl_reg_sreg(tcg_const_tl(dc->op1), tcg_const_tl(dc->op2));
++ gen_helper_movl_reg_sreg(cpu_env, tcg_const_tl(dc->op1),
++ tcg_const_tl(dc->op2));
+ return 2;
+ }
+
+@@ -2906,14 +2908,14 @@ static int dec_rfe_etc(DisasContext *dc)
+ /* rfe. */
+ LOG_DIS("rfe\n");
+ cris_evaluate_flags(dc);
+- gen_helper_rfe();
++ gen_helper_rfe(cpu_env);
+ dc->is_jmp = DISAS_UPDATE;
+ break;
+ case 5:
+ /* rfn. */
+ LOG_DIS("rfn\n");
+ cris_evaluate_flags(dc);
+- gen_helper_rfn();
++ gen_helper_rfn(cpu_env);
+ dc->is_jmp = DISAS_UPDATE;
+ break;
+ case 6:
+diff --git a/target-cris/translate_v10.c b/target-cris/translate_v10.c
+index 3629629..9a39c6a 100644
+--- a/target-cris/translate_v10.c
++++ b/target-cris/translate_v10.c
+@@ -289,7 +289,7 @@ static unsigned int dec10_quick_imm(DisasContext *dc)
+ } else {
+ /* BTST */
+ cris_update_cc_op(dc, CC_OP_FLAGS, 4);
+- gen_helper_btst(cpu_PR[PR_CCS], cpu_R[dc->dst],
++ gen_helper_btst(cpu_PR[PR_CCS], cpu_env, cpu_R[dc->dst],
+ tcg_const_tl(imm), cpu_PR[PR_CCS]);
+ }
+ break;
+@@ -723,7 +723,7 @@ static unsigned int dec10_reg(DisasContext *dc)
+ LOG_DIS("btst $r%d, $r%d sz=%d\n", dc->src, dc->dst, size);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_update_cc_op(dc, CC_OP_FLAGS, 4);
+- gen_helper_btst(cpu_PR[PR_CCS], cpu_R[dc->dst],
++ gen_helper_btst(cpu_PR[PR_CCS], cpu_env, cpu_R[dc->dst],
+ cpu_R[dc->src], cpu_PR[PR_CCS]);
+ break;
+ case CRISV10_REG_DSTEP:
+--
+1.7.12.1
+
--- /dev/null
+From 327937b3765d53776e42ffd3990e0b551c98b0e6 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 7 Sep 2012 16:13:27 +0200
+Subject: [PATCH] target-cris: Switch to AREG0 free mode
+
+Add an explicit CPUCRISState parameter instead of relying on AREG0, and
+use cpu_ld* in translation and interrupt handling. Remove AREG0 swapping
+in tlb_fill(). Switch to AREG0 free mode
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-cris/Makefile.objs | 2 -
+ target-cris/helper.c | 4 +-
+ target-cris/op_helper.c | 9 +-
+ target-cris/translate.c | 256 ++++++++++++++++++++++----------------------
+ target-cris/translate_v10.c | 95 ++++++++--------
+ 6 files changed, 181 insertions(+), 187 deletions(-)
+
+diff --git a/configure b/configure
+index 0b4ef4a..2a12022 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | arm* | i386 | lm32 | m68k | microblaze* | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
++ alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-cris/Makefile.objs b/target-cris/Makefile.objs
+index 4b09e8c..afb87bc 100644
+--- a/target-cris/Makefile.objs
++++ b/target-cris/Makefile.objs
+@@ -1,4 +1,2 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += mmu.o machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-cris/helper.c b/target-cris/helper.c
+index bfbc29e..1bdb7e2 100644
+--- a/target-cris/helper.c
++++ b/target-cris/helper.c
+@@ -151,7 +151,7 @@ static void do_interruptv10(CPUCRISState *env)
+ }
+
+ /* Now that we are in kernel mode, load the handlers address. */
+- env->pc = ldl_code(env->pregs[PR_EBP] + ex_vec * 4);
++ env->pc = cpu_ldl_code(env, env->pregs[PR_EBP] + ex_vec * 4);
+ env->locked_irq = 1;
+ env->pregs[PR_CCS] |= F_FLAG_V10; /* set F. */
+
+@@ -233,7 +233,7 @@ void do_interrupt(CPUCRISState *env)
+ /* Now that we are in kernel mode, load the handlers address.
+ This load may not fault, real hw leaves that behaviour as
+ undefined. */
+- env->pc = ldl_code(env->pregs[PR_EBP] + ex_vec * 4);
++ env->pc = cpu_ldl_code(env, env->pregs[PR_EBP] + ex_vec * 4);
+
+ /* Clear the excption_index to avoid spurios hw_aborts for recursive
+ bus faults. */
+diff --git a/target-cris/op_helper.c b/target-cris/op_helper.c
+index 5ca85a0..a7468d4 100644
+--- a/target-cris/op_helper.c
++++ b/target-cris/op_helper.c
+@@ -19,7 +19,6 @@
+ */
+
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "mmu.h"
+ #include "helper.h"
+ #include "host-utils.h"
+@@ -55,17 +54,12 @@
+ /* Try to fill the TLB and return an exception if error. If retaddr is
+ NULL, it means that the function was called in C code (i.e. not
+ from generated code or from helper.c) */
+-/* XXX: fix it to restore all registers */
+-void tlb_fill(CPUCRISState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUCRISState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUCRISState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+-
+ D_LOG("%s pc=%x tpc=%x ra=%p\n", __func__,
+ env->pc, env->debug1, (void *)retaddr);
+ ret = cpu_cris_handle_mmu_fault(env, addr, is_write, mmu_idx);
+@@ -84,7 +78,6 @@ void tlb_fill(CPUCRISState *env1, target_ulong addr, int is_write, int mmu_idx,
+ }
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+
+ #endif
+diff --git a/target-cris/translate.c b/target-cris/translate.c
+index 283dd98..19144b5 100644
+--- a/target-cris/translate.c
++++ b/target-cris/translate.c
+@@ -78,7 +78,7 @@ typedef struct DisasContext {
+ target_ulong pc, ppc;
+
+ /* Decoder. */
+- unsigned int (*decoder)(struct DisasContext *dc);
++ unsigned int (*decoder)(CPUCRISState *env, struct DisasContext *dc);
+ uint32_t ir;
+ uint32_t opcode;
+ unsigned int op1;
+@@ -233,7 +233,7 @@ static int sign_extend(unsigned int val, unsigned int width)
+ return sval;
+ }
+
+-static int cris_fetch(DisasContext *dc, uint32_t addr,
++static int cris_fetch(CPUCRISState *env, DisasContext *dc, uint32_t addr,
+ unsigned int size, unsigned int sign)
+ {
+ int r;
+@@ -241,24 +241,24 @@ static int cris_fetch(DisasContext *dc, uint32_t addr,
+ switch (size) {
+ case 4:
+ {
+- r = ldl_code(addr);
++ r = cpu_ldl_code(env, addr);
+ break;
+ }
+ case 2:
+ {
+ if (sign) {
+- r = ldsw_code(addr);
++ r = cpu_ldsw_code(env, addr);
+ } else {
+- r = lduw_code(addr);
++ r = cpu_lduw_code(env, addr);
+ }
+ break;
+ }
+ case 1:
+ {
+ if (sign) {
+- r = ldsb_code(addr);
++ r = cpu_ldsb_code(env, addr);
+ } else {
+- r = ldub_code(addr);
++ r = cpu_ldub_code(env, addr);
+ }
+ break;
+ }
+@@ -1304,8 +1304,8 @@ static void dec_prep_alu_r(DisasContext *dc, int rs, int rd,
+ t_gen_zext(dst, cpu_R[rd], size);
+ }
+
+-static int dec_prep_move_m(DisasContext *dc, int s_ext, int memsize,
+- TCGv dst)
++static int dec_prep_move_m(CPUCRISState *env, DisasContext *dc,
++ int s_ext, int memsize, TCGv dst)
+ {
+ unsigned int rs;
+ uint32_t imm;
+@@ -1321,7 +1321,7 @@ static int dec_prep_move_m(DisasContext *dc, int s_ext, int memsize,
+ if (memsize == 1)
+ insn_len++;
+
+- imm = cris_fetch(dc, dc->pc + 2, memsize, s_ext);
++ imm = cris_fetch(env, dc, dc->pc + 2, memsize, s_ext);
+ tcg_gen_movi_tl(dst, imm);
+ dc->postinc = 0;
+ } else {
+@@ -1338,12 +1338,12 @@ static int dec_prep_move_m(DisasContext *dc, int s_ext, int memsize,
+ /* Prepare T0 and T1 for a memory + alu operation.
+ s_ext decides if the operand1 should be sign-extended or zero-extended when
+ needed. */
+-static int dec_prep_alu_m(DisasContext *dc, int s_ext, int memsize,
+- TCGv dst, TCGv src)
++static int dec_prep_alu_m(CPUCRISState *env, DisasContext *dc,
++ int s_ext, int memsize, TCGv dst, TCGv src)
+ {
+ int insn_len;
+
+- insn_len = dec_prep_move_m(dc, s_ext, memsize, src);
++ insn_len = dec_prep_move_m(env, dc, s_ext, memsize, src);
+ tcg_gen_mov_tl(dst, cpu_R[dc->op2]);
+ return insn_len;
+ }
+@@ -1362,7 +1362,7 @@ static const char *cc_name(int cc)
+
+ /* Start of insn decoders. */
+
+-static int dec_bccq(DisasContext *dc)
++static int dec_bccq(CPUCRISState *env, DisasContext *dc)
+ {
+ int32_t offset;
+ int sign;
+@@ -1382,7 +1382,7 @@ static int dec_bccq(DisasContext *dc)
+ cris_prepare_cc_branch (dc, offset, cond);
+ return 2;
+ }
+-static int dec_addoq(DisasContext *dc)
++static int dec_addoq(CPUCRISState *env, DisasContext *dc)
+ {
+ int32_t imm;
+
+@@ -1396,7 +1396,7 @@ static int dec_addoq(DisasContext *dc)
+
+ return 2;
+ }
+-static int dec_addq(DisasContext *dc)
++static int dec_addq(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("addq %u, $r%u\n", dc->op1, dc->op2);
+
+@@ -1408,7 +1408,7 @@ static int dec_addq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], tcg_const_tl(dc->op1), 4);
+ return 2;
+ }
+-static int dec_moveq(DisasContext *dc)
++static int dec_moveq(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+
+@@ -1419,7 +1419,7 @@ static int dec_moveq(DisasContext *dc)
+ tcg_gen_movi_tl(cpu_R[dc->op2], imm);
+ return 2;
+ }
+-static int dec_subq(DisasContext *dc)
++static int dec_subq(CPUCRISState *env, DisasContext *dc)
+ {
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+
+@@ -1430,7 +1430,7 @@ static int dec_subq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], tcg_const_tl(dc->op1), 4);
+ return 2;
+ }
+-static int dec_cmpq(DisasContext *dc)
++static int dec_cmpq(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+@@ -1443,7 +1443,7 @@ static int dec_cmpq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], tcg_const_tl(imm), 4);
+ return 2;
+ }
+-static int dec_andq(DisasContext *dc)
++static int dec_andq(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+@@ -1456,7 +1456,7 @@ static int dec_andq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], tcg_const_tl(imm), 4);
+ return 2;
+ }
+-static int dec_orq(DisasContext *dc)
++static int dec_orq(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+@@ -1468,7 +1468,7 @@ static int dec_orq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], tcg_const_tl(imm), 4);
+ return 2;
+ }
+-static int dec_btstq(DisasContext *dc)
++static int dec_btstq(CPUCRISState *env, DisasContext *dc)
+ {
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+ LOG_DIS("btstq %u, $r%d\n", dc->op1, dc->op2);
+@@ -1483,7 +1483,7 @@ static int dec_btstq(DisasContext *dc)
+ dc->flags_uptodate = 1;
+ return 2;
+ }
+-static int dec_asrq(DisasContext *dc)
++static int dec_asrq(CPUCRISState *env, DisasContext *dc)
+ {
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+ LOG_DIS("asrq %u, $r%d\n", dc->op1, dc->op2);
+@@ -1495,7 +1495,7 @@ static int dec_asrq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], 4);
+ return 2;
+ }
+-static int dec_lslq(DisasContext *dc)
++static int dec_lslq(CPUCRISState *env, DisasContext *dc)
+ {
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+ LOG_DIS("lslq %u, $r%d\n", dc->op1, dc->op2);
+@@ -1509,7 +1509,7 @@ static int dec_lslq(DisasContext *dc)
+ cpu_R[dc->op2], cpu_R[dc->op2], 4);
+ return 2;
+ }
+-static int dec_lsrq(DisasContext *dc)
++static int dec_lsrq(CPUCRISState *env, DisasContext *dc)
+ {
+ dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+ LOG_DIS("lsrq %u, $r%d\n", dc->op1, dc->op2);
+@@ -1523,7 +1523,7 @@ static int dec_lsrq(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_move_r(DisasContext *dc)
++static int dec_move_r(CPUCRISState *env, DisasContext *dc)
+ {
+ int size = memsize_zz(dc);
+
+@@ -1551,7 +1551,7 @@ static int dec_move_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_scc_r(DisasContext *dc)
++static int dec_scc_r(CPUCRISState *env, DisasContext *dc)
+ {
+ int cond = dc->op2;
+
+@@ -1594,7 +1594,7 @@ static inline void cris_alu_free_temps(DisasContext *dc, int size, TCGv *t)
+ }
+ }
+
+-static int dec_and_r(DisasContext *dc)
++static int dec_and_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1611,7 +1611,7 @@ static int dec_and_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_lz_r(DisasContext *dc)
++static int dec_lz_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ LOG_DIS("lz $r%u, $r%u\n",
+@@ -1624,7 +1624,7 @@ static int dec_lz_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_lsl_r(DisasContext *dc)
++static int dec_lsl_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1641,7 +1641,7 @@ static int dec_lsl_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_lsr_r(DisasContext *dc)
++static int dec_lsr_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1658,7 +1658,7 @@ static int dec_lsr_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_asr_r(DisasContext *dc)
++static int dec_asr_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1675,7 +1675,7 @@ static int dec_asr_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_muls_r(DisasContext *dc)
++static int dec_muls_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1691,7 +1691,7 @@ static int dec_muls_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_mulu_r(DisasContext *dc)
++static int dec_mulu_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1708,7 +1708,7 @@ static int dec_mulu_r(DisasContext *dc)
+ }
+
+
+-static int dec_dstep_r(DisasContext *dc)
++static int dec_dstep_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("dstep $r%u, $r%u\n", dc->op1, dc->op2);
+ cris_cc_mask(dc, CC_MASK_NZ);
+@@ -1717,7 +1717,7 @@ static int dec_dstep_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_xor_r(DisasContext *dc)
++static int dec_xor_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1733,7 +1733,7 @@ static int dec_xor_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_bound_r(DisasContext *dc)
++static int dec_bound_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv l0;
+ int size = memsize_zz(dc);
+@@ -1747,7 +1747,7 @@ static int dec_bound_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_cmp_r(DisasContext *dc)
++static int dec_cmp_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1762,7 +1762,7 @@ static int dec_cmp_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_abs_r(DisasContext *dc)
++static int dec_abs_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+
+@@ -1781,7 +1781,7 @@ static int dec_abs_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_add_r(DisasContext *dc)
++static int dec_add_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1796,7 +1796,7 @@ static int dec_add_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_addc_r(DisasContext *dc)
++static int dec_addc_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("addc $r%u, $r%u\n",
+ dc->op1, dc->op2);
+@@ -1811,7 +1811,7 @@ static int dec_addc_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_mcp_r(DisasContext *dc)
++static int dec_mcp_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("mcp $p%u, $r%u\n",
+ dc->op2, dc->op1);
+@@ -1838,7 +1838,7 @@ static char * swapmode_name(int mode, char *modename) {
+ }
+ #endif
+
+-static int dec_swap_r(DisasContext *dc)
++static int dec_swap_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ #if DISAS_CRIS
+@@ -1864,7 +1864,7 @@ static int dec_swap_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_or_r(DisasContext *dc)
++static int dec_or_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1878,7 +1878,7 @@ static int dec_or_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_addi_r(DisasContext *dc)
++static int dec_addi_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ LOG_DIS("addi.%c $r%u, $r%u\n",
+@@ -1891,7 +1891,7 @@ static int dec_addi_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_addi_acr(DisasContext *dc)
++static int dec_addi_acr(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ LOG_DIS("addi.%c $r%u, $r%u, $acr\n",
+@@ -1904,7 +1904,7 @@ static int dec_addi_acr(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_neg_r(DisasContext *dc)
++static int dec_neg_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1919,7 +1919,7 @@ static int dec_neg_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_btst_r(DisasContext *dc)
++static int dec_btst_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("btst $r%u, $r%u\n",
+ dc->op1, dc->op2);
+@@ -1934,7 +1934,7 @@ static int dec_btst_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_sub_r(DisasContext *dc)
++static int dec_sub_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int size = memsize_zz(dc);
+@@ -1949,7 +1949,7 @@ static int dec_sub_r(DisasContext *dc)
+ }
+
+ /* Zero extension. From size to dword. */
+-static int dec_movu_r(DisasContext *dc)
++static int dec_movu_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -1966,7 +1966,7 @@ static int dec_movu_r(DisasContext *dc)
+ }
+
+ /* Sign extension. From size to dword. */
+-static int dec_movs_r(DisasContext *dc)
++static int dec_movs_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -1985,7 +1985,7 @@ static int dec_movs_r(DisasContext *dc)
+ }
+
+ /* zero extension. From size to dword. */
+-static int dec_addu_r(DisasContext *dc)
++static int dec_addu_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -2004,7 +2004,7 @@ static int dec_addu_r(DisasContext *dc)
+ }
+
+ /* Sign extension. From size to dword. */
+-static int dec_adds_r(DisasContext *dc)
++static int dec_adds_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -2023,7 +2023,7 @@ static int dec_adds_r(DisasContext *dc)
+ }
+
+ /* Zero extension. From size to dword. */
+-static int dec_subu_r(DisasContext *dc)
++static int dec_subu_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -2042,7 +2042,7 @@ static int dec_subu_r(DisasContext *dc)
+ }
+
+ /* Sign extension. From size to dword. */
+-static int dec_subs_r(DisasContext *dc)
++static int dec_subs_r(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int size = memsize_z(dc);
+@@ -2060,7 +2060,7 @@ static int dec_subs_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_setclrf(DisasContext *dc)
++static int dec_setclrf(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t flags;
+ int set = (~dc->opcode >> 2) & 1;
+@@ -2131,7 +2131,7 @@ static int dec_setclrf(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_move_rs(DisasContext *dc)
++static int dec_move_rs(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("move $r%u, $s%u\n", dc->op1, dc->op2);
+ cris_cc_mask(dc, 0);
+@@ -2139,7 +2139,7 @@ static int dec_move_rs(DisasContext *dc)
+ tcg_const_tl(dc->op1));
+ return 2;
+ }
+-static int dec_move_sr(DisasContext *dc)
++static int dec_move_sr(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("move $s%u, $r%u\n", dc->op2, dc->op1);
+ cris_cc_mask(dc, 0);
+@@ -2148,7 +2148,7 @@ static int dec_move_sr(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_move_rp(DisasContext *dc)
++static int dec_move_rp(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ LOG_DIS("move $r%u, $p%u\n", dc->op1, dc->op2);
+@@ -2178,7 +2178,7 @@ static int dec_move_rp(DisasContext *dc)
+ tcg_temp_free(t[0]);
+ return 2;
+ }
+-static int dec_move_pr(DisasContext *dc)
++static int dec_move_pr(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ LOG_DIS("move $p%u, $r%u\n", dc->op2, dc->op1);
+@@ -2200,7 +2200,7 @@ static int dec_move_pr(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_move_mr(DisasContext *dc)
++static int dec_move_mr(CPUCRISState *env, DisasContext *dc)
+ {
+ int memsize = memsize_zz(dc);
+ int insn_len;
+@@ -2210,7 +2210,7 @@ static int dec_move_mr(DisasContext *dc)
+ dc->op2);
+
+ if (memsize == 4) {
+- insn_len = dec_prep_move_m(dc, 0, 4, cpu_R[dc->op2]);
++ insn_len = dec_prep_move_m(env, dc, 0, 4, cpu_R[dc->op2]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_update_cc_op(dc, CC_OP_MOVE, 4);
+ cris_update_cc_x(dc);
+@@ -2220,7 +2220,7 @@ static int dec_move_mr(DisasContext *dc)
+ TCGv t0;
+
+ t0 = tcg_temp_new();
+- insn_len = dec_prep_move_m(dc, 0, memsize, t0);
++ insn_len = dec_prep_move_m(env, dc, 0, memsize, t0);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_MOVE,
+ cpu_R[dc->op2], cpu_R[dc->op2], t0, memsize);
+@@ -2242,7 +2242,7 @@ static inline void cris_alu_m_free_temps(TCGv *t)
+ tcg_temp_free(t[1]);
+ }
+
+-static int dec_movs_m(DisasContext *dc)
++static int dec_movs_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2254,7 +2254,7 @@ static int dec_movs_m(DisasContext *dc)
+
+ cris_alu_m_alloc_temps(t);
+ /* sign extend. */
+- insn_len = dec_prep_alu_m(dc, 1, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 1, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_MOVE,
+ cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+@@ -2263,7 +2263,7 @@ static int dec_movs_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_addu_m(DisasContext *dc)
++static int dec_addu_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2275,7 +2275,7 @@ static int dec_addu_m(DisasContext *dc)
+
+ cris_alu_m_alloc_temps(t);
+ /* sign extend. */
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_ADD,
+ cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+@@ -2284,7 +2284,7 @@ static int dec_addu_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_adds_m(DisasContext *dc)
++static int dec_adds_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2296,7 +2296,7 @@ static int dec_adds_m(DisasContext *dc)
+
+ cris_alu_m_alloc_temps(t);
+ /* sign extend. */
+- insn_len = dec_prep_alu_m(dc, 1, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 1, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_ADD, cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2304,7 +2304,7 @@ static int dec_adds_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_subu_m(DisasContext *dc)
++static int dec_subu_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2316,7 +2316,7 @@ static int dec_subu_m(DisasContext *dc)
+
+ cris_alu_m_alloc_temps(t);
+ /* sign extend. */
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_SUB, cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2324,7 +2324,7 @@ static int dec_subu_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_subs_m(DisasContext *dc)
++static int dec_subs_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2336,7 +2336,7 @@ static int dec_subs_m(DisasContext *dc)
+
+ cris_alu_m_alloc_temps(t);
+ /* sign extend. */
+- insn_len = dec_prep_alu_m(dc, 1, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 1, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_SUB, cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2344,7 +2344,7 @@ static int dec_subs_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_movu_m(DisasContext *dc)
++static int dec_movu_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2356,7 +2356,7 @@ static int dec_movu_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_MOVE, cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2364,7 +2364,7 @@ static int dec_movu_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_cmpu_m(DisasContext *dc)
++static int dec_cmpu_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2375,7 +2375,7 @@ static int dec_cmpu_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_CMP, cpu_R[dc->op2], cpu_R[dc->op2], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2383,7 +2383,7 @@ static int dec_cmpu_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_cmps_m(DisasContext *dc)
++static int dec_cmps_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_z(dc);
+@@ -2394,7 +2394,7 @@ static int dec_cmps_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 1, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 1, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_CMP,
+ cpu_R[dc->op2], cpu_R[dc->op2], t[1],
+@@ -2404,7 +2404,7 @@ static int dec_cmps_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_cmp_m(DisasContext *dc)
++static int dec_cmp_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2415,7 +2415,7 @@ static int dec_cmp_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_CMP,
+ cpu_R[dc->op2], cpu_R[dc->op2], t[1],
+@@ -2425,7 +2425,7 @@ static int dec_cmp_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_test_m(DisasContext *dc)
++static int dec_test_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2438,7 +2438,7 @@ static int dec_test_m(DisasContext *dc)
+ cris_evaluate_flags(dc);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~3);
+
+@@ -2449,7 +2449,7 @@ static int dec_test_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_and_m(DisasContext *dc)
++static int dec_and_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2460,7 +2460,7 @@ static int dec_and_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_AND, cpu_R[dc->op2], t[0], t[1], memsize_zz(dc));
+ do_postinc(dc, memsize);
+@@ -2468,7 +2468,7 @@ static int dec_and_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_add_m(DisasContext *dc)
++static int dec_add_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2479,7 +2479,7 @@ static int dec_add_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_ADD,
+ cpu_R[dc->op2], t[0], t[1], memsize_zz(dc));
+@@ -2488,7 +2488,7 @@ static int dec_add_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_addo_m(DisasContext *dc)
++static int dec_addo_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2499,7 +2499,7 @@ static int dec_addo_m(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 1, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 1, memsize, t[0], t[1]);
+ cris_cc_mask(dc, 0);
+ cris_alu(dc, CC_OP_ADD, cpu_R[R_ACR], t[0], t[1], 4);
+ do_postinc(dc, memsize);
+@@ -2507,7 +2507,7 @@ static int dec_addo_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_bound_m(DisasContext *dc)
++static int dec_bound_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv l[2];
+ int memsize = memsize_zz(dc);
+@@ -2519,7 +2519,7 @@ static int dec_bound_m(DisasContext *dc)
+
+ l[0] = tcg_temp_local_new();
+ l[1] = tcg_temp_local_new();
+- insn_len = dec_prep_alu_m(dc, 0, memsize, l[0], l[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, l[0], l[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_BOUND, cpu_R[dc->op2], l[0], l[1], 4);
+ do_postinc(dc, memsize);
+@@ -2528,7 +2528,7 @@ static int dec_bound_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_addc_mr(DisasContext *dc)
++static int dec_addc_mr(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int insn_len = 2;
+@@ -2543,7 +2543,7 @@ static int dec_addc_mr(DisasContext *dc)
+ dc->flags_x = X_FLAG;
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, 4, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, 4, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_ADDC, cpu_R[dc->op2], t[0], t[1], 4);
+ do_postinc(dc, 4);
+@@ -2551,7 +2551,7 @@ static int dec_addc_mr(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_sub_m(DisasContext *dc)
++static int dec_sub_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2562,7 +2562,7 @@ static int dec_sub_m(DisasContext *dc)
+ dc->op2, dc->ir, dc->zzsize);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu(dc, CC_OP_SUB, cpu_R[dc->op2], t[0], t[1], memsize);
+ do_postinc(dc, memsize);
+@@ -2570,7 +2570,7 @@ static int dec_sub_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_or_m(DisasContext *dc)
++static int dec_or_m(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2581,7 +2581,7 @@ static int dec_or_m(DisasContext *dc)
+ dc->op2, dc->pc);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, CC_MASK_NZ);
+ cris_alu(dc, CC_OP_OR,
+ cpu_R[dc->op2], t[0], t[1], memsize_zz(dc));
+@@ -2590,7 +2590,7 @@ static int dec_or_m(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_move_mp(DisasContext *dc)
++static int dec_move_mp(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t[2];
+ int memsize = memsize_zz(dc);
+@@ -2603,7 +2603,7 @@ static int dec_move_mp(DisasContext *dc)
+ dc->op2);
+
+ cris_alu_m_alloc_temps(t);
+- insn_len = dec_prep_alu_m(dc, 0, memsize, t[0], t[1]);
++ insn_len = dec_prep_alu_m(env, dc, 0, memsize, t[0], t[1]);
+ cris_cc_mask(dc, 0);
+ if (dc->op2 == PR_CCS) {
+ cris_evaluate_flags(dc);
+@@ -2622,7 +2622,7 @@ static int dec_move_mp(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec_move_pm(DisasContext *dc)
++static int dec_move_pm(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv t0;
+ int memsize;
+@@ -2648,7 +2648,7 @@ static int dec_move_pm(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_movem_mr(DisasContext *dc)
++static int dec_movem_mr(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv_i64 tmp[16];
+ TCGv tmp32;
+@@ -2695,7 +2695,7 @@ static int dec_movem_mr(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_movem_rm(DisasContext *dc)
++static int dec_movem_rm(CPUCRISState *env, DisasContext *dc)
+ {
+ TCGv tmp;
+ TCGv addr;
+@@ -2724,7 +2724,7 @@ static int dec_movem_rm(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_move_rm(DisasContext *dc)
++static int dec_move_rm(CPUCRISState *env, DisasContext *dc)
+ {
+ int memsize;
+
+@@ -2743,7 +2743,7 @@ static int dec_move_rm(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_lapcq(DisasContext *dc)
++static int dec_lapcq(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("lapcq %x, $r%u\n",
+ dc->pc + dc->op1*2, dc->op2);
+@@ -2752,7 +2752,7 @@ static int dec_lapcq(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_lapc_im(DisasContext *dc)
++static int dec_lapc_im(CPUCRISState *env, DisasContext *dc)
+ {
+ unsigned int rd;
+ int32_t imm;
+@@ -2761,7 +2761,7 @@ static int dec_lapc_im(DisasContext *dc)
+ rd = dc->op2;
+
+ cris_cc_mask(dc, 0);
+- imm = cris_fetch(dc, dc->pc + 2, 4, 0);
++ imm = cris_fetch(env, dc, dc->pc + 2, 4, 0);
+ LOG_DIS("lapc 0x%x, $r%u\n", imm + dc->pc, dc->op2);
+
+ pc = dc->pc;
+@@ -2771,7 +2771,7 @@ static int dec_lapc_im(DisasContext *dc)
+ }
+
+ /* Jump to special reg. */
+-static int dec_jump_p(DisasContext *dc)
++static int dec_jump_p(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("jump $p%u\n", dc->op2);
+
+@@ -2786,7 +2786,7 @@ static int dec_jump_p(DisasContext *dc)
+ }
+
+ /* Jump and save. */
+-static int dec_jas_r(DisasContext *dc)
++static int dec_jas_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("jas $r%u, $p%u\n", dc->op1, dc->op2);
+ cris_cc_mask(dc, 0);
+@@ -2800,11 +2800,11 @@ static int dec_jas_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_jas_im(DisasContext *dc)
++static int dec_jas_im(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+
+- imm = cris_fetch(dc, dc->pc + 2, 4, 0);
++ imm = cris_fetch(env, dc, dc->pc + 2, 4, 0);
+
+ LOG_DIS("jas 0x%x\n", imm);
+ cris_cc_mask(dc, 0);
+@@ -2816,11 +2816,11 @@ static int dec_jas_im(DisasContext *dc)
+ return 6;
+ }
+
+-static int dec_jasc_im(DisasContext *dc)
++static int dec_jasc_im(CPUCRISState *env, DisasContext *dc)
+ {
+ uint32_t imm;
+
+- imm = cris_fetch(dc, dc->pc + 2, 4, 0);
++ imm = cris_fetch(env, dc, dc->pc + 2, 4, 0);
+
+ LOG_DIS("jasc 0x%x\n", imm);
+ cris_cc_mask(dc, 0);
+@@ -2832,7 +2832,7 @@ static int dec_jasc_im(DisasContext *dc)
+ return 6;
+ }
+
+-static int dec_jasc_r(DisasContext *dc)
++static int dec_jasc_r(CPUCRISState *env, DisasContext *dc)
+ {
+ LOG_DIS("jasc_r $r%u, $p%u\n", dc->op1, dc->op2);
+ cris_cc_mask(dc, 0);
+@@ -2843,12 +2843,12 @@ static int dec_jasc_r(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_bcc_im(DisasContext *dc)
++static int dec_bcc_im(CPUCRISState *env, DisasContext *dc)
+ {
+ int32_t offset;
+ uint32_t cond = dc->op2;
+
+- offset = cris_fetch(dc, dc->pc + 2, 2, 1);
++ offset = cris_fetch(env, dc, dc->pc + 2, 2, 1);
+
+ LOG_DIS("b%s %d pc=%x dst=%x\n",
+ cc_name(cond), offset,
+@@ -2860,12 +2860,12 @@ static int dec_bcc_im(DisasContext *dc)
+ return 4;
+ }
+
+-static int dec_bas_im(DisasContext *dc)
++static int dec_bas_im(CPUCRISState *env, DisasContext *dc)
+ {
+ int32_t simm;
+
+
+- simm = cris_fetch(dc, dc->pc + 2, 4, 0);
++ simm = cris_fetch(env, dc, dc->pc + 2, 4, 0);
+
+ LOG_DIS("bas 0x%x, $p%u\n", dc->pc + simm, dc->op2);
+ cris_cc_mask(dc, 0);
+@@ -2877,10 +2877,10 @@ static int dec_bas_im(DisasContext *dc)
+ return 6;
+ }
+
+-static int dec_basc_im(DisasContext *dc)
++static int dec_basc_im(CPUCRISState *env, DisasContext *dc)
+ {
+ int32_t simm;
+- simm = cris_fetch(dc, dc->pc + 2, 4, 0);
++ simm = cris_fetch(env, dc, dc->pc + 2, 4, 0);
+
+ LOG_DIS("basc 0x%x, $p%u\n", dc->pc + simm, dc->op2);
+ cris_cc_mask(dc, 0);
+@@ -2892,7 +2892,7 @@ static int dec_basc_im(DisasContext *dc)
+ return 6;
+ }
+
+-static int dec_rfe_etc(DisasContext *dc)
++static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
+ {
+ cris_cc_mask(dc, 0);
+
+@@ -2939,17 +2939,17 @@ static int dec_rfe_etc(DisasContext *dc)
+ return 2;
+ }
+
+-static int dec_ftag_fidx_d_m(DisasContext *dc)
++static int dec_ftag_fidx_d_m(CPUCRISState *env, DisasContext *dc)
+ {
+ return 2;
+ }
+
+-static int dec_ftag_fidx_i_m(DisasContext *dc)
++static int dec_ftag_fidx_i_m(CPUCRISState *env, DisasContext *dc)
+ {
+ return 2;
+ }
+
+-static int dec_null(DisasContext *dc)
++static int dec_null(CPUCRISState *env, DisasContext *dc)
+ {
+ printf ("unknown insn pc=%x opc=%x op1=%x op2=%x\n",
+ dc->pc, dc->opcode, dc->op1, dc->op2);
+@@ -2963,7 +2963,7 @@ static struct decoder_info {
+ uint32_t bits;
+ uint32_t mask;
+ };
+- int (*dec)(DisasContext *dc);
++ int (*dec)(CPUCRISState *env, DisasContext *dc);
+ } decinfo[] = {
+ /* Order matters here. */
+ {DEC_MOVEQ, dec_moveq},
+@@ -3069,7 +3069,7 @@ static struct decoder_info {
+ {{0, 0}, dec_null}
+ };
+
+-static unsigned int crisv32_decoder(DisasContext *dc)
++static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
+ {
+ int insn_len = 2;
+ int i;
+@@ -3078,7 +3078,7 @@ static unsigned int crisv32_decoder(DisasContext *dc)
+ tcg_gen_debug_insn_start(dc->pc);
+
+ /* Load a halfword onto the instruction register. */
+- dc->ir = cris_fetch(dc, dc->pc, 2, 0);
++ dc->ir = cris_fetch(env, dc, dc->pc, 2, 0);
+
+ /* Now decode it. */
+ dc->opcode = EXTRACT_FIELD(dc->ir, 4, 11);
+@@ -3092,7 +3092,7 @@ static unsigned int crisv32_decoder(DisasContext *dc)
+ for (i = 0; i < ARRAY_SIZE(decinfo); i++) {
+ if ((dc->opcode & decinfo[i].mask) == decinfo[i].bits)
+ {
+- insn_len = decinfo[i].dec(dc);
++ insn_len = decinfo[i].dec(env, dc);
+ break;
+ }
+ }
+@@ -3286,7 +3286,7 @@ gen_intermediate_code_internal(CPUCRISState *env, TranslationBlock *tb,
+ gen_io_start();
+ dc->clear_x = 1;
+
+- insn_len = dc->decoder(dc);
++ insn_len = dc->decoder(env, dc);
+ dc->ppc = dc->pc;
+ dc->pc += insn_len;
+ if (dc->clear_x)
+diff --git a/target-cris/translate_v10.c b/target-cris/translate_v10.c
+index 9a39c6a..d2cca89 100644
+--- a/target-cris/translate_v10.c
++++ b/target-cris/translate_v10.c
+@@ -164,8 +164,8 @@ static unsigned int crisv10_post_memaddr(DisasContext *dc, unsigned int size)
+ return insn_len;
+ }
+
+-static int dec10_prep_move_m(DisasContext *dc, int s_ext, int memsize,
+- TCGv dst)
++static int dec10_prep_move_m(CPUCRISState *env, DisasContext *dc,
++ int s_ext, int memsize, TCGv dst)
+ {
+ unsigned int rs;
+ uint32_t imm;
+@@ -182,17 +182,17 @@ static int dec10_prep_move_m(DisasContext *dc, int s_ext, int memsize,
+ if (memsize != 4) {
+ if (s_ext) {
+ if (memsize == 1)
+- imm = ldsb_code(dc->pc + 2);
++ imm = cpu_ldsb_code(env, dc->pc + 2);
+ else
+- imm = ldsw_code(dc->pc + 2);
++ imm = cpu_ldsw_code(env, dc->pc + 2);
+ } else {
+ if (memsize == 1)
+- imm = ldub_code(dc->pc + 2);
++ imm = cpu_ldub_code(env, dc->pc + 2);
+ else
+- imm = lduw_code(dc->pc + 2);
++ imm = cpu_lduw_code(env, dc->pc + 2);
+ }
+ } else
+- imm = ldl_code(dc->pc + 2);
++ imm = cpu_ldl_code(env, dc->pc + 2);
+
+ tcg_gen_movi_tl(dst, imm);
+
+@@ -752,7 +752,8 @@ static unsigned int dec10_reg(DisasContext *dc)
+ return insn_len;
+ }
+
+-static unsigned int dec10_ind_move_m_r(DisasContext *dc, unsigned int size)
++static unsigned int dec10_ind_move_m_r(CPUCRISState *env, DisasContext *dc,
++ unsigned int size)
+ {
+ unsigned int insn_len = 2;
+ TCGv t;
+@@ -762,7 +763,7 @@ static unsigned int dec10_ind_move_m_r(DisasContext *dc, unsigned int size)
+
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ t = tcg_temp_new();
+- insn_len += dec10_prep_move_m(dc, 0, size, t);
++ insn_len += dec10_prep_move_m(env, dc, 0, size, t);
+ cris_alu(dc, CC_OP_MOVE, cpu_R[dc->dst], cpu_R[dc->dst], t, size);
+ if (dc->dst == 15) {
+ tcg_gen_mov_tl(env_btarget, cpu_R[dc->dst]);
+@@ -789,7 +790,7 @@ static unsigned int dec10_ind_move_r_m(DisasContext *dc, unsigned int size)
+ return insn_len;
+ }
+
+-static unsigned int dec10_ind_move_m_pr(DisasContext *dc)
++static unsigned int dec10_ind_move_m_pr(CPUCRISState *env, DisasContext *dc)
+ {
+ unsigned int insn_len = 2, rd = dc->dst;
+ TCGv t, addr;
+@@ -799,7 +800,7 @@ static unsigned int dec10_ind_move_m_pr(DisasContext *dc)
+
+ addr = tcg_temp_new();
+ t = tcg_temp_new();
+- insn_len += dec10_prep_move_m(dc, 0, 4, t);
++ insn_len += dec10_prep_move_m(env, dc, 0, 4, t);
+ if (rd == 15) {
+ tcg_gen_mov_tl(env_btarget, t);
+ cris_prepare_jmp(dc, JMP_INDIRECT);
+@@ -899,14 +900,15 @@ static void dec10_movem_m_r(DisasContext *dc)
+ tcg_temp_free(t0);
+ }
+
+-static int dec10_ind_alu(DisasContext *dc, int op, unsigned int size)
++static int dec10_ind_alu(CPUCRISState *env, DisasContext *dc,
++ int op, unsigned int size)
+ {
+ int insn_len = 0;
+ int rd = dc->dst;
+ TCGv t[2];
+
+ cris_alu_m_alloc_temps(t);
+- insn_len += dec10_prep_move_m(dc, 0, size, t[0]);
++ insn_len += dec10_prep_move_m(env, dc, 0, size, t[0]);
+ cris_alu(dc, op, cpu_R[dc->dst], cpu_R[rd], t[0], size);
+ if (dc->dst == 15) {
+ tcg_gen_mov_tl(env_btarget, cpu_R[dc->dst]);
+@@ -920,14 +922,15 @@ static int dec10_ind_alu(DisasContext *dc, int op, unsigned int size)
+ return insn_len;
+ }
+
+-static int dec10_ind_bound(DisasContext *dc, unsigned int size)
++static int dec10_ind_bound(CPUCRISState *env, DisasContext *dc,
++ unsigned int size)
+ {
+ int insn_len = 0;
+ int rd = dc->dst;
+ TCGv t;
+
+ t = tcg_temp_local_new();
+- insn_len += dec10_prep_move_m(dc, 0, size, t);
++ insn_len += dec10_prep_move_m(env, dc, 0, size, t);
+ cris_alu(dc, CC_OP_BOUND, cpu_R[dc->dst], cpu_R[rd], t, 4);
+ if (dc->dst == 15) {
+ tcg_gen_mov_tl(env_btarget, cpu_R[dc->dst]);
+@@ -940,7 +943,7 @@ static int dec10_ind_bound(DisasContext *dc, unsigned int size)
+ return insn_len;
+ }
+
+-static int dec10_alux_m(DisasContext *dc, int op)
++static int dec10_alux_m(CPUCRISState *env, DisasContext *dc, int op)
+ {
+ unsigned int size = (dc->size & 1) ? 2 : 1;
+ unsigned int sx = !!(dc->size & 2);
+@@ -953,7 +956,7 @@ static int dec10_alux_m(DisasContext *dc, int op)
+ t = tcg_temp_new();
+
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_prep_move_m(dc, sx, size, t);
++ insn_len += dec10_prep_move_m(env, dc, sx, size, t);
+ cris_alu(dc, op, cpu_R[dc->dst], cpu_R[rd], t, 4);
+ if (dc->dst == 15) {
+ tcg_gen_mov_tl(env_btarget, cpu_R[dc->dst]);
+@@ -966,7 +969,7 @@ static int dec10_alux_m(DisasContext *dc, int op)
+ return insn_len;
+ }
+
+-static int dec10_dip(DisasContext *dc)
++static int dec10_dip(CPUCRISState *env, DisasContext *dc)
+ {
+ int insn_len = 2;
+ uint32_t imm;
+@@ -974,7 +977,7 @@ static int dec10_dip(DisasContext *dc)
+ LOG_DIS("dip pc=%x opcode=%d r%d r%d\n",
+ dc->pc, dc->opcode, dc->src, dc->dst);
+ if (dc->src == 15) {
+- imm = ldl_code(dc->pc + 2);
++ imm = cpu_ldl_code(env, dc->pc + 2);
+ tcg_gen_movi_tl(cpu_PR[PR_PREFIX], imm);
+ if (dc->postinc)
+ insn_len += 4;
+@@ -989,7 +992,7 @@ static int dec10_dip(DisasContext *dc)
+ return insn_len;
+ }
+
+-static int dec10_bdap_m(DisasContext *dc, int size)
++static int dec10_bdap_m(CPUCRISState *env, DisasContext *dc, int size)
+ {
+ int insn_len = 2;
+ int rd = dc->dst;
+@@ -1014,13 +1017,13 @@ static int dec10_bdap_m(DisasContext *dc, int size)
+ }
+ #endif
+ /* Now the rest of the modes are truly indirect. */
+- insn_len += dec10_prep_move_m(dc, 1, size, cpu_PR[PR_PREFIX]);
++ insn_len += dec10_prep_move_m(env, dc, 1, size, cpu_PR[PR_PREFIX]);
+ tcg_gen_add_tl(cpu_PR[PR_PREFIX], cpu_PR[PR_PREFIX], cpu_R[rd]);
+ cris_set_prefix(dc);
+ return insn_len;
+ }
+
+-static unsigned int dec10_ind(DisasContext *dc)
++static unsigned int dec10_ind(CPUCRISState *env, DisasContext *dc)
+ {
+ unsigned int insn_len = 2;
+ unsigned int size = dec10_size(dc->size);
+@@ -1031,7 +1034,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ if (dc->size != 3) {
+ switch (dc->opcode) {
+ case CRISV10_IND_MOVE_M_R:
+- return dec10_ind_move_m_r(dc, size);
++ return dec10_ind_move_m_r(env, dc, size);
+ break;
+ case CRISV10_IND_MOVE_R_M:
+ return dec10_ind_move_r_m(dc, size);
+@@ -1039,7 +1042,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ case CRISV10_IND_CMP:
+ LOG_DIS("cmp size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_alu(dc, CC_OP_CMP, size);
++ insn_len += dec10_ind_alu(env, dc, CC_OP_CMP, size);
+ break;
+ case CRISV10_IND_TEST:
+ LOG_DIS("test size=%d op=%d %d\n", size, dc->src, dc->dst);
+@@ -1047,7 +1050,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ cris_evaluate_flags(dc);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+ cris_alu_m_alloc_temps(t);
+- insn_len += dec10_prep_move_m(dc, 0, size, t[0]);
++ insn_len += dec10_prep_move_m(env, dc, 0, size, t[0]);
+ tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~3);
+ cris_alu(dc, CC_OP_CMP, cpu_R[dc->dst],
+ t[0], tcg_const_tl(0), size);
+@@ -1056,39 +1059,39 @@ static unsigned int dec10_ind(DisasContext *dc)
+ case CRISV10_IND_ADD:
+ LOG_DIS("add size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_alu(dc, CC_OP_ADD, size);
++ insn_len += dec10_ind_alu(env, dc, CC_OP_ADD, size);
+ break;
+ case CRISV10_IND_SUB:
+ LOG_DIS("sub size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_alu(dc, CC_OP_SUB, size);
++ insn_len += dec10_ind_alu(env, dc, CC_OP_SUB, size);
+ break;
+ case CRISV10_IND_BOUND:
+ LOG_DIS("bound size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_bound(dc, size);
++ insn_len += dec10_ind_bound(env, dc, size);
+ break;
+ case CRISV10_IND_AND:
+ LOG_DIS("and size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_alu(dc, CC_OP_AND, size);
++ insn_len += dec10_ind_alu(env, dc, CC_OP_AND, size);
+ break;
+ case CRISV10_IND_OR:
+ LOG_DIS("or size=%d op=%d %d\n", size, dc->src, dc->dst);
+ cris_cc_mask(dc, CC_MASK_NZVC);
+- insn_len += dec10_ind_alu(dc, CC_OP_OR, size);
++ insn_len += dec10_ind_alu(env, dc, CC_OP_OR, size);
+ break;
+ case CRISV10_IND_MOVX:
+- insn_len = dec10_alux_m(dc, CC_OP_MOVE);
++ insn_len = dec10_alux_m(env, dc, CC_OP_MOVE);
+ break;
+ case CRISV10_IND_ADDX:
+- insn_len = dec10_alux_m(dc, CC_OP_ADD);
++ insn_len = dec10_alux_m(env, dc, CC_OP_ADD);
+ break;
+ case CRISV10_IND_SUBX:
+- insn_len = dec10_alux_m(dc, CC_OP_SUB);
++ insn_len = dec10_alux_m(env, dc, CC_OP_SUB);
+ break;
+ case CRISV10_IND_CMPX:
+- insn_len = dec10_alux_m(dc, CC_OP_CMP);
++ insn_len = dec10_alux_m(env, dc, CC_OP_CMP);
+ break;
+ case CRISV10_IND_MUL:
+ /* This is a reg insn coded in the mem indir space. */
+@@ -1097,7 +1100,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ dec10_reg_mul(dc, size, dc->ir & (1 << 10));
+ break;
+ case CRISV10_IND_BDAP_M:
+- insn_len = dec10_bdap_m(dc, size);
++ insn_len = dec10_bdap_m(env, dc, size);
+ break;
+ default:
+ LOG_DIS("pc=%x var-ind.%d %d r%d r%d\n",
+@@ -1110,7 +1113,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+
+ switch (dc->opcode) {
+ case CRISV10_IND_MOVE_M_SPR:
+- insn_len = dec10_ind_move_m_pr(dc);
++ insn_len = dec10_ind_move_m_pr(env, dc);
+ break;
+ case CRISV10_IND_MOVE_SPR_M:
+ insn_len = dec10_ind_move_pr_m(dc);
+@@ -1119,7 +1122,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ if (dc->src == 15) {
+ LOG_DIS("jump.%d %d r%d r%d direct\n", size,
+ dc->opcode, dc->src, dc->dst);
+- imm = ldl_code(dc->pc + 2);
++ imm = cpu_ldl_code(env, dc->pc + 2);
+ if (dc->mode == CRISV10_MODE_AUTOINC)
+ insn_len += size;
+
+@@ -1168,24 +1171,24 @@ static unsigned int dec10_ind(DisasContext *dc)
+ dc->delayed_branch--; /* v10 has no dslot here. */
+ break;
+ case CRISV10_IND_MOVX:
+- insn_len = dec10_alux_m(dc, CC_OP_MOVE);
++ insn_len = dec10_alux_m(env, dc, CC_OP_MOVE);
+ break;
+ case CRISV10_IND_ADDX:
+- insn_len = dec10_alux_m(dc, CC_OP_ADD);
++ insn_len = dec10_alux_m(env, dc, CC_OP_ADD);
+ break;
+ case CRISV10_IND_SUBX:
+- insn_len = dec10_alux_m(dc, CC_OP_SUB);
++ insn_len = dec10_alux_m(env, dc, CC_OP_SUB);
+ break;
+ case CRISV10_IND_CMPX:
+- insn_len = dec10_alux_m(dc, CC_OP_CMP);
++ insn_len = dec10_alux_m(env, dc, CC_OP_CMP);
+ break;
+ case CRISV10_IND_DIP:
+- insn_len = dec10_dip(dc);
++ insn_len = dec10_dip(env, dc);
+ break;
+ case CRISV10_IND_BCC_M:
+
+ cris_cc_mask(dc, 0);
+- imm = ldsw_code(dc->pc + 2);
++ imm = cpu_ldsw_code(env, dc->pc + 2);
+ simm = (int16_t)imm;
+ simm += 4;
+
+@@ -1202,7 +1205,7 @@ static unsigned int dec10_ind(DisasContext *dc)
+ return insn_len;
+ }
+
+-static unsigned int crisv10_decoder(DisasContext *dc)
++static unsigned int crisv10_decoder(CPUCRISState *env, DisasContext *dc)
+ {
+ unsigned int insn_len = 2;
+
+@@ -1210,7 +1213,7 @@ static unsigned int crisv10_decoder(DisasContext *dc)
+ tcg_gen_debug_insn_start(dc->pc);
+
+ /* Load a halfword onto the instruction register. */
+- dc->ir = lduw_code(dc->pc);
++ dc->ir = cpu_lduw_code(env, dc->pc);
+
+ /* Now decode it. */
+ dc->opcode = EXTRACT_FIELD(dc->ir, 6, 9);
+@@ -1235,7 +1238,7 @@ static unsigned int crisv10_decoder(DisasContext *dc)
+ break;
+ case CRISV10_MODE_AUTOINC:
+ case CRISV10_MODE_INDIRECT:
+- insn_len = dec10_ind(dc);
++ insn_len = dec10_ind(env, dc);
+ break;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 22bb4c416286bbfc340f65e5c7f286d96a731cc7 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 10:37:06 +0000
+Subject: [PATCH] target-sh4: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Acked-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-sh4/Makefile.objs | 2 -
+ target-sh4/helper.h | 84 +++++++++++-----------
+ target-sh4/op_helper.c | 182 +++++++++++++++++++++++------------------------
+ target-sh4/translate.c | 114 ++++++++++++++++-------------
+ 5 files changed, 195 insertions(+), 189 deletions(-)
+
+diff --git a/configure b/configure
+index 2a12022..03ce76e 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | or32 | s390x | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
++ alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | or32 | s390x | sh4* | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-sh4/Makefile.objs b/target-sh4/Makefile.objs
+index 2e0e093..ca20f21 100644
+--- a/target-sh4/Makefile.objs
++++ b/target-sh4/Makefile.objs
+@@ -1,4 +1,2 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-sh4/helper.h b/target-sh4/helper.h
+index 95e3c7c..6e4f108 100644
+--- a/target-sh4/helper.h
++++ b/target-sh4/helper.h
+@@ -1,54 +1,54 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_0(ldtlb, void)
+-DEF_HELPER_0(raise_illegal_instruction, void)
+-DEF_HELPER_0(raise_slot_illegal_instruction, void)
+-DEF_HELPER_0(raise_fpu_disable, void)
+-DEF_HELPER_0(raise_slot_fpu_disable, void)
+-DEF_HELPER_0(debug, void)
+-DEF_HELPER_1(sleep, void, i32)
+-DEF_HELPER_1(trapa, void, i32)
++DEF_HELPER_1(ldtlb, void, env)
++DEF_HELPER_1(raise_illegal_instruction, void, env)
++DEF_HELPER_1(raise_slot_illegal_instruction, void, env)
++DEF_HELPER_1(raise_fpu_disable, void, env)
++DEF_HELPER_1(raise_slot_fpu_disable, void, env)
++DEF_HELPER_1(debug, void, env)
++DEF_HELPER_2(sleep, void, env, i32)
++DEF_HELPER_2(trapa, void, env, i32)
+
+-DEF_HELPER_2(movcal, void, i32, i32)
+-DEF_HELPER_0(discard_movcal_backup, void)
+-DEF_HELPER_1(ocbi, void, i32)
++DEF_HELPER_3(movcal, void, env, i32, i32)
++DEF_HELPER_1(discard_movcal_backup, void, env)
++DEF_HELPER_2(ocbi, void, env, i32)
+
+-DEF_HELPER_2(addv, i32, i32, i32)
+-DEF_HELPER_2(addc, i32, i32, i32)
+-DEF_HELPER_2(subv, i32, i32, i32)
+-DEF_HELPER_2(subc, i32, i32, i32)
+-DEF_HELPER_2(div1, i32, i32, i32)
+-DEF_HELPER_2(macl, void, i32, i32)
+-DEF_HELPER_2(macw, void, i32, i32)
++DEF_HELPER_3(addv, i32, env, i32, i32)
++DEF_HELPER_3(addc, i32, env, i32, i32)
++DEF_HELPER_3(subv, i32, env, i32, i32)
++DEF_HELPER_3(subc, i32, env, i32, i32)
++DEF_HELPER_3(div1, i32, env, i32, i32)
++DEF_HELPER_3(macl, void, env, i32, i32)
++DEF_HELPER_3(macw, void, env, i32, i32)
+
+-DEF_HELPER_1(ld_fpscr, void, i32)
++DEF_HELPER_2(ld_fpscr, void, env, i32)
+
+ DEF_HELPER_1(fabs_FT, f32, f32)
+ DEF_HELPER_1(fabs_DT, f64, f64)
+-DEF_HELPER_2(fadd_FT, f32, f32, f32)
+-DEF_HELPER_2(fadd_DT, f64, f64, f64)
+-DEF_HELPER_1(fcnvsd_FT_DT, f64, f32)
+-DEF_HELPER_1(fcnvds_DT_FT, f32, f64)
++DEF_HELPER_3(fadd_FT, f32, env, f32, f32)
++DEF_HELPER_3(fadd_DT, f64, env, f64, f64)
++DEF_HELPER_2(fcnvsd_FT_DT, f64, env, f32)
++DEF_HELPER_2(fcnvds_DT_FT, f32, env, f64)
+
+-DEF_HELPER_2(fcmp_eq_FT, void, f32, f32)
+-DEF_HELPER_2(fcmp_eq_DT, void, f64, f64)
+-DEF_HELPER_2(fcmp_gt_FT, void, f32, f32)
+-DEF_HELPER_2(fcmp_gt_DT, void, f64, f64)
+-DEF_HELPER_2(fdiv_FT, f32, f32, f32)
+-DEF_HELPER_2(fdiv_DT, f64, f64, f64)
+-DEF_HELPER_1(float_FT, f32, i32)
+-DEF_HELPER_1(float_DT, f64, i32)
+-DEF_HELPER_3(fmac_FT, f32, f32, f32, f32)
+-DEF_HELPER_2(fmul_FT, f32, f32, f32)
+-DEF_HELPER_2(fmul_DT, f64, f64, f64)
++DEF_HELPER_3(fcmp_eq_FT, void, env, f32, f32)
++DEF_HELPER_3(fcmp_eq_DT, void, env, f64, f64)
++DEF_HELPER_3(fcmp_gt_FT, void, env, f32, f32)
++DEF_HELPER_3(fcmp_gt_DT, void, env, f64, f64)
++DEF_HELPER_3(fdiv_FT, f32, env, f32, f32)
++DEF_HELPER_3(fdiv_DT, f64, env, f64, f64)
++DEF_HELPER_2(float_FT, f32, env, i32)
++DEF_HELPER_2(float_DT, f64, env, i32)
++DEF_HELPER_4(fmac_FT, f32, env, f32, f32, f32)
++DEF_HELPER_3(fmul_FT, f32, env, f32, f32)
++DEF_HELPER_3(fmul_DT, f64, env, f64, f64)
+ DEF_HELPER_1(fneg_T, f32, f32)
+-DEF_HELPER_2(fsub_FT, f32, f32, f32)
+-DEF_HELPER_2(fsub_DT, f64, f64, f64)
+-DEF_HELPER_1(fsqrt_FT, f32, f32)
+-DEF_HELPER_1(fsqrt_DT, f64, f64)
+-DEF_HELPER_1(ftrc_FT, i32, f32)
+-DEF_HELPER_1(ftrc_DT, i32, f64)
+-DEF_HELPER_2(fipr, void, i32, i32)
+-DEF_HELPER_1(ftrv, void, i32)
++DEF_HELPER_3(fsub_FT, f32, env, f32, f32)
++DEF_HELPER_3(fsub_DT, f64, env, f64, f64)
++DEF_HELPER_2(fsqrt_FT, f32, env, f32)
++DEF_HELPER_2(fsqrt_DT, f64, env, f64)
++DEF_HELPER_2(ftrc_FT, i32, env, f32)
++DEF_HELPER_2(ftrc_DT, i32, env, f64)
++DEF_HELPER_3(fipr, void, env, i32, i32)
++DEF_HELPER_2(ftrv, void, env, i32)
+
+ #include "def-helper.h"
+diff --git a/target-sh4/op_helper.c b/target-sh4/op_helper.c
+index 4054791..9b4328d 100644
+--- a/target-sh4/op_helper.c
++++ b/target-sh4/op_helper.c
+@@ -19,10 +19,9 @@
+ #include <assert.h>
+ #include <stdlib.h>
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "helper.h"
+
+-static void cpu_restore_state_from_retaddr(uintptr_t retaddr)
++static void cpu_restore_state_from_retaddr(CPUSH4State *env, uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+
+@@ -53,26 +52,22 @@ static void cpu_restore_state_from_retaddr(uintptr_t retaddr)
+ #define SHIFT 3
+ #include "softmmu_template.h"
+
+-void tlb_fill(CPUSH4State *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUSH4State *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+- CPUSH4State *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = cpu_sh4_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (ret) {
+ /* now we have a real cpu fault */
+- cpu_restore_state_from_retaddr(retaddr);
++ cpu_restore_state_from_retaddr(env, retaddr);
+ cpu_loop_exit(env);
+ }
+- env = saved_env;
+ }
+
+ #endif
+
+-void helper_ldtlb(void)
++void helper_ldtlb(CPUSH4State *env)
+ {
+ #ifdef CONFIG_USER_ONLY
+ /* XXXXX */
+@@ -82,40 +77,41 @@ void helper_ldtlb(void)
+ #endif
+ }
+
+-static inline void raise_exception(int index, uintptr_t retaddr)
++static inline void raise_exception(CPUSH4State *env, int index,
++ uintptr_t retaddr)
+ {
+ env->exception_index = index;
+- cpu_restore_state_from_retaddr(retaddr);
++ cpu_restore_state_from_retaddr(env, retaddr);
+ cpu_loop_exit(env);
+ }
+
+-void helper_raise_illegal_instruction(void)
++void helper_raise_illegal_instruction(CPUSH4State *env)
+ {
+- raise_exception(0x180, GETPC());
++ raise_exception(env, 0x180, GETPC());
+ }
+
+-void helper_raise_slot_illegal_instruction(void)
++void helper_raise_slot_illegal_instruction(CPUSH4State *env)
+ {
+- raise_exception(0x1a0, GETPC());
++ raise_exception(env, 0x1a0, GETPC());
+ }
+
+-void helper_raise_fpu_disable(void)
++void helper_raise_fpu_disable(CPUSH4State *env)
+ {
+- raise_exception(0x800, GETPC());
++ raise_exception(env, 0x800, GETPC());
+ }
+
+-void helper_raise_slot_fpu_disable(void)
++void helper_raise_slot_fpu_disable(CPUSH4State *env)
+ {
+- raise_exception(0x820, GETPC());
++ raise_exception(env, 0x820, GETPC());
+ }
+
+-void helper_debug(void)
++void helper_debug(CPUSH4State *env)
+ {
+ env->exception_index = EXCP_DEBUG;
+ cpu_loop_exit(env);
+ }
+
+-void helper_sleep(uint32_t next_pc)
++void helper_sleep(CPUSH4State *env, uint32_t next_pc)
+ {
+ env->halted = 1;
+ env->in_sleep = 1;
+@@ -124,13 +120,13 @@ void helper_sleep(uint32_t next_pc)
+ cpu_loop_exit(env);
+ }
+
+-void helper_trapa(uint32_t tra)
++void helper_trapa(CPUSH4State *env, uint32_t tra)
+ {
+ env->tra = tra << 2;
+- raise_exception(0x160, GETPC());
++ raise_exception(env, 0x160, GETPC());
+ }
+
+-void helper_movcal(uint32_t address, uint32_t value)
++void helper_movcal(CPUSH4State *env, uint32_t address, uint32_t value)
+ {
+ if (cpu_sh4_is_cached (env, address))
+ {
+@@ -144,7 +140,7 @@ void helper_movcal(uint32_t address, uint32_t value)
+ }
+ }
+
+-void helper_discard_movcal_backup(void)
++void helper_discard_movcal_backup(CPUSH4State *env)
+ {
+ memory_content *current = env->movcal_backup;
+
+@@ -158,7 +154,7 @@ void helper_discard_movcal_backup(void)
+ }
+ }
+
+-void helper_ocbi(uint32_t address)
++void helper_ocbi(CPUSH4State *env, uint32_t address)
+ {
+ memory_content **current = &(env->movcal_backup);
+ while (*current)
+@@ -167,7 +163,7 @@ void helper_ocbi(uint32_t address)
+ if ((a & ~0x1F) == (address & ~0x1F))
+ {
+ memory_content *next = (*current)->next;
+- stl(a, (*current)->value);
++ cpu_stl_data(env, a, (*current)->value);
+
+ if (next == NULL)
+ {
+@@ -181,7 +177,7 @@ void helper_ocbi(uint32_t address)
+ }
+ }
+
+-uint32_t helper_addc(uint32_t arg0, uint32_t arg1)
++uint32_t helper_addc(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ uint32_t tmp0, tmp1;
+
+@@ -197,7 +193,7 @@ uint32_t helper_addc(uint32_t arg0, uint32_t arg1)
+ return arg1;
+ }
+
+-uint32_t helper_addv(uint32_t arg0, uint32_t arg1)
++uint32_t helper_addv(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ uint32_t dest, src, ans;
+
+@@ -236,7 +232,7 @@ uint32_t helper_addv(uint32_t arg0, uint32_t arg1)
+ #define SETM env->sr |= SR_M
+ #define CLRM env->sr &= ~SR_M
+
+-uint32_t helper_div1(uint32_t arg0, uint32_t arg1)
++uint32_t helper_div1(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ uint32_t tmp0, tmp2;
+ uint8_t old_q, tmp1 = 0xff;
+@@ -344,7 +340,7 @@ uint32_t helper_div1(uint32_t arg0, uint32_t arg1)
+ return arg1;
+ }
+
+-void helper_macl(uint32_t arg0, uint32_t arg1)
++void helper_macl(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ int64_t res;
+
+@@ -360,7 +356,7 @@ void helper_macl(uint32_t arg0, uint32_t arg1)
+ }
+ }
+
+-void helper_macw(uint32_t arg0, uint32_t arg1)
++void helper_macw(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ int64_t res;
+
+@@ -379,7 +375,7 @@ void helper_macw(uint32_t arg0, uint32_t arg1)
+ }
+ }
+
+-uint32_t helper_subc(uint32_t arg0, uint32_t arg1)
++uint32_t helper_subc(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ uint32_t tmp0, tmp1;
+
+@@ -395,7 +391,7 @@ uint32_t helper_subc(uint32_t arg0, uint32_t arg1)
+ return arg1;
+ }
+
+-uint32_t helper_subv(uint32_t arg0, uint32_t arg1)
++uint32_t helper_subv(CPUSH4State *env, uint32_t arg0, uint32_t arg1)
+ {
+ int32_t dest, src, ans;
+
+@@ -424,17 +420,17 @@ uint32_t helper_subv(uint32_t arg0, uint32_t arg1)
+ return arg1;
+ }
+
+-static inline void set_t(void)
++static inline void set_t(CPUSH4State *env)
+ {
+ env->sr |= SR_T;
+ }
+
+-static inline void clr_t(void)
++static inline void clr_t(CPUSH4State *env)
+ {
+ env->sr &= ~SR_T;
+ }
+
+-void helper_ld_fpscr(uint32_t val)
++void helper_ld_fpscr(CPUSH4State *env, uint32_t val)
+ {
+ env->fpscr = val & FPSCR_MASK;
+ if ((val & FPSCR_RM_MASK) == FPSCR_RM_ZERO) {
+@@ -445,7 +441,7 @@ void helper_ld_fpscr(uint32_t val)
+ set_flush_to_zero((val & FPSCR_DN) != 0, &env->fp_status);
+ }
+
+-static void update_fpscr(uintptr_t retaddr)
++static void update_fpscr(CPUSH4State *env, uintptr_t retaddr)
+ {
+ int xcpt, cause, enable;
+
+@@ -479,7 +475,7 @@ static void update_fpscr(uintptr_t retaddr)
+ cause = (env->fpscr & FPSCR_CAUSE_MASK) >> FPSCR_CAUSE_SHIFT;
+ enable = (env->fpscr & FPSCR_ENABLE_MASK) >> FPSCR_ENABLE_SHIFT;
+ if (cause & enable) {
+- cpu_restore_state_from_retaddr(retaddr);
++ cpu_restore_state_from_retaddr(env, retaddr);
+ env->exception_index = 0x120;
+ cpu_loop_exit(env);
+ }
+@@ -496,156 +492,156 @@ float64 helper_fabs_DT(float64 t0)
+ return float64_abs(t0);
+ }
+
+-float32 helper_fadd_FT(float32 t0, float32 t1)
++float32 helper_fadd_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_add(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float64 helper_fadd_DT(float64 t0, float64 t1)
++float64 helper_fadd_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float64_add(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-void helper_fcmp_eq_FT(float32 t0, float32 t1)
++void helper_fcmp_eq_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ int relation;
+
+ set_float_exception_flags(0, &env->fp_status);
+ relation = float32_compare(t0, t1, &env->fp_status);
+ if (unlikely(relation == float_relation_unordered)) {
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ } else if (relation == float_relation_equal) {
+- set_t();
++ set_t(env);
+ } else {
+- clr_t();
++ clr_t(env);
+ }
+ }
+
+-void helper_fcmp_eq_DT(float64 t0, float64 t1)
++void helper_fcmp_eq_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ int relation;
+
+ set_float_exception_flags(0, &env->fp_status);
+ relation = float64_compare(t0, t1, &env->fp_status);
+ if (unlikely(relation == float_relation_unordered)) {
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ } else if (relation == float_relation_equal) {
+- set_t();
++ set_t(env);
+ } else {
+- clr_t();
++ clr_t(env);
+ }
+ }
+
+-void helper_fcmp_gt_FT(float32 t0, float32 t1)
++void helper_fcmp_gt_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ int relation;
+
+ set_float_exception_flags(0, &env->fp_status);
+ relation = float32_compare(t0, t1, &env->fp_status);
+ if (unlikely(relation == float_relation_unordered)) {
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ } else if (relation == float_relation_greater) {
+- set_t();
++ set_t(env);
+ } else {
+- clr_t();
++ clr_t(env);
+ }
+ }
+
+-void helper_fcmp_gt_DT(float64 t0, float64 t1)
++void helper_fcmp_gt_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ int relation;
+
+ set_float_exception_flags(0, &env->fp_status);
+ relation = float64_compare(t0, t1, &env->fp_status);
+ if (unlikely(relation == float_relation_unordered)) {
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ } else if (relation == float_relation_greater) {
+- set_t();
++ set_t(env);
+ } else {
+- clr_t();
++ clr_t(env);
+ }
+ }
+
+-float64 helper_fcnvsd_FT_DT(float32 t0)
++float64 helper_fcnvsd_FT_DT(CPUSH4State *env, float32 t0)
+ {
+ float64 ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = float32_to_float64(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-float32 helper_fcnvds_DT_FT(float64 t0)
++float32 helper_fcnvds_DT_FT(CPUSH4State *env, float64 t0)
+ {
+ float32 ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = float64_to_float32(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-float32 helper_fdiv_FT(float32 t0, float32 t1)
++float32 helper_fdiv_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_div(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float64 helper_fdiv_DT(float64 t0, float64 t1)
++float64 helper_fdiv_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float64_div(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float32 helper_float_FT(uint32_t t0)
++float32 helper_float_FT(CPUSH4State *env, uint32_t t0)
+ {
+ float32 ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = int32_to_float32(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-float64 helper_float_DT(uint32_t t0)
++float64 helper_float_DT(CPUSH4State *env, uint32_t t0)
+ {
+ float64 ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = int32_to_float64(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-float32 helper_fmac_FT(float32 t0, float32 t1, float32 t2)
++float32 helper_fmac_FT(CPUSH4State *env, float32 t0, float32 t1, float32 t2)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_mul(t0, t1, &env->fp_status);
+ t0 = float32_add(t0, t2, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float32 helper_fmul_FT(float32 t0, float32 t1)
++float32 helper_fmul_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_mul(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float64 helper_fmul_DT(float64 t0, float64 t1)
++float64 helper_fmul_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float64_mul(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+@@ -654,57 +650,57 @@ float32 helper_fneg_T(float32 t0)
+ return float32_chs(t0);
+ }
+
+-float32 helper_fsqrt_FT(float32 t0)
++float32 helper_fsqrt_FT(CPUSH4State *env, float32 t0)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_sqrt(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float64 helper_fsqrt_DT(float64 t0)
++float64 helper_fsqrt_DT(CPUSH4State *env, float64 t0)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float64_sqrt(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float32 helper_fsub_FT(float32 t0, float32 t1)
++float32 helper_fsub_FT(CPUSH4State *env, float32 t0, float32 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float32_sub(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-float64 helper_fsub_DT(float64 t0, float64 t1)
++float64 helper_fsub_DT(CPUSH4State *env, float64 t0, float64 t1)
+ {
+ set_float_exception_flags(0, &env->fp_status);
+ t0 = float64_sub(t0, t1, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return t0;
+ }
+
+-uint32_t helper_ftrc_FT(float32 t0)
++uint32_t helper_ftrc_FT(CPUSH4State *env, float32 t0)
+ {
+ uint32_t ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = float32_to_int32_round_to_zero(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-uint32_t helper_ftrc_DT(float64 t0)
++uint32_t helper_ftrc_DT(CPUSH4State *env, float64 t0)
+ {
+ uint32_t ret;
+ set_float_exception_flags(0, &env->fp_status);
+ ret = float64_to_int32_round_to_zero(t0, &env->fp_status);
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+ return ret;
+ }
+
+-void helper_fipr(uint32_t m, uint32_t n)
++void helper_fipr(CPUSH4State *env, uint32_t m, uint32_t n)
+ {
+ int bank, i;
+ float32 r, p;
+@@ -719,12 +715,12 @@ void helper_fipr(uint32_t m, uint32_t n)
+ &env->fp_status);
+ r = float32_add(r, p, &env->fp_status);
+ }
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+
+ env->fregs[bank + n + 3] = r;
+ }
+
+-void helper_ftrv(uint32_t n)
++void helper_ftrv(CPUSH4State *env, uint32_t n)
+ {
+ int bank_matrix, bank_vector;
+ int i, j;
+@@ -743,7 +739,7 @@ void helper_ftrv(uint32_t n)
+ r[i] = float32_add(r[i], p, &env->fp_status);
+ }
+ }
+- update_fpscr(GETPC());
++ update_fpscr(env, GETPC());
+
+ for (i = 0 ; i < 4 ; i++) {
+ env->fregs[bank_vector + i] = r[i];
+diff --git a/target-sh4/translate.c b/target-sh4/translate.c
+index 6532ad2..d05c74c 100644
+--- a/target-sh4/translate.c
++++ b/target-sh4/translate.c
+@@ -276,7 +276,7 @@ static void gen_goto_tb(DisasContext * ctx, int n, target_ulong dest)
+ } else {
+ tcg_gen_movi_i32(cpu_pc, dest);
+ if (ctx->singlestep_enabled)
+- gen_helper_debug();
++ gen_helper_debug(cpu_env);
+ tcg_gen_exit_tb(0);
+ }
+ }
+@@ -288,7 +288,7 @@ static void gen_jump(DisasContext * ctx)
+ delayed jump as immediate jump are conditinal jumps */
+ tcg_gen_mov_i32(cpu_pc, cpu_delayed_pc);
+ if (ctx->singlestep_enabled)
+- gen_helper_debug();
++ gen_helper_debug(cpu_env);
+ tcg_gen_exit_tb(0);
+ } else {
+ gen_goto_tb(ctx, 0, ctx->delayed_pc);
+@@ -437,7 +437,7 @@ static inline void gen_store_fpr64 (TCGv_i64 t, int reg)
+ #define CHECK_NOT_DELAY_SLOT \
+ if (ctx->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) \
+ { \
+- gen_helper_raise_slot_illegal_instruction(); \
++ gen_helper_raise_slot_illegal_instruction(cpu_env); \
+ ctx->bstate = BS_EXCP; \
+ return; \
+ }
+@@ -445,9 +445,9 @@ static inline void gen_store_fpr64 (TCGv_i64 t, int reg)
+ #define CHECK_PRIVILEGED \
+ if (IS_USER(ctx)) { \
+ if (ctx->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) { \
+- gen_helper_raise_slot_illegal_instruction(); \
++ gen_helper_raise_slot_illegal_instruction(cpu_env); \
+ } else { \
+- gen_helper_raise_illegal_instruction(); \
++ gen_helper_raise_illegal_instruction(cpu_env); \
+ } \
+ ctx->bstate = BS_EXCP; \
+ return; \
+@@ -456,9 +456,9 @@ static inline void gen_store_fpr64 (TCGv_i64 t, int reg)
+ #define CHECK_FPU_ENABLED \
+ if (ctx->flags & SR_FD) { \
+ if (ctx->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) { \
+- gen_helper_raise_slot_fpu_disable(); \
++ gen_helper_raise_slot_fpu_disable(cpu_env); \
+ } else { \
+- gen_helper_raise_fpu_disable(); \
++ gen_helper_raise_fpu_disable(cpu_env); \
+ } \
+ ctx->bstate = BS_EXCP; \
+ return; \
+@@ -492,7 +492,7 @@ static void _decode_opc(DisasContext * ctx)
+ if (opcode != 0x0093 /* ocbi */
+ && opcode != 0x00c3 /* movca.l */)
+ {
+- gen_helper_discard_movcal_backup ();
++ gen_helper_discard_movcal_backup(cpu_env);
+ ctx->has_movcal = 0;
+ }
+ }
+@@ -523,7 +523,7 @@ static void _decode_opc(DisasContext * ctx)
+ return;
+ case 0x0038: /* ldtlb */
+ CHECK_PRIVILEGED
+- gen_helper_ldtlb();
++ gen_helper_ldtlb(cpu_env);
+ return;
+ case 0x002b: /* rte */
+ CHECK_PRIVILEGED
+@@ -551,7 +551,7 @@ static void _decode_opc(DisasContext * ctx)
+ return;
+ case 0x001b: /* sleep */
+ CHECK_PRIVILEGED
+- gen_helper_sleep(tcg_const_i32(ctx->pc + 2));
++ gen_helper_sleep(cpu_env, tcg_const_i32(ctx->pc + 2));
+ return;
+ }
+
+@@ -761,10 +761,10 @@ static void _decode_opc(DisasContext * ctx)
+ tcg_gen_add_i32(REG(B11_8), REG(B11_8), REG(B7_4));
+ return;
+ case 0x300e: /* addc Rm,Rn */
+- gen_helper_addc(REG(B11_8), REG(B7_4), REG(B11_8));
++ gen_helper_addc(REG(B11_8), cpu_env, REG(B7_4), REG(B11_8));
+ return;
+ case 0x300f: /* addv Rm,Rn */
+- gen_helper_addv(REG(B11_8), REG(B7_4), REG(B11_8));
++ gen_helper_addv(REG(B11_8), cpu_env, REG(B7_4), REG(B11_8));
+ return;
+ case 0x2009: /* and Rm,Rn */
+ tcg_gen_and_i32(REG(B11_8), REG(B11_8), REG(B7_4));
+@@ -817,7 +817,7 @@ static void _decode_opc(DisasContext * ctx)
+ }
+ return;
+ case 0x3004: /* div1 Rm,Rn */
+- gen_helper_div1(REG(B11_8), REG(B7_4), REG(B11_8));
++ gen_helper_div1(REG(B11_8), cpu_env, REG(B7_4), REG(B11_8));
+ return;
+ case 0x300d: /* dmuls.l Rm,Rn */
+ {
+@@ -870,7 +870,7 @@ static void _decode_opc(DisasContext * ctx)
+ tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx);
+ arg1 = tcg_temp_new();
+ tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx);
+- gen_helper_macl(arg0, arg1);
++ gen_helper_macl(cpu_env, arg0, arg1);
+ tcg_temp_free(arg1);
+ tcg_temp_free(arg0);
+ tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4);
+@@ -884,7 +884,7 @@ static void _decode_opc(DisasContext * ctx)
+ tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx);
+ arg1 = tcg_temp_new();
+ tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx);
+- gen_helper_macw(arg0, arg1);
++ gen_helper_macw(cpu_env, arg0, arg1);
+ tcg_temp_free(arg1);
+ tcg_temp_free(arg0);
+ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 2);
+@@ -1013,10 +1013,10 @@ static void _decode_opc(DisasContext * ctx)
+ tcg_gen_sub_i32(REG(B11_8), REG(B11_8), REG(B7_4));
+ return;
+ case 0x300a: /* subc Rm,Rn */
+- gen_helper_subc(REG(B11_8), REG(B7_4), REG(B11_8));
++ gen_helper_subc(REG(B11_8), cpu_env, REG(B7_4), REG(B11_8));
+ return;
+ case 0x300b: /* subv Rm,Rn */
+- gen_helper_subv(REG(B11_8), REG(B7_4), REG(B11_8));
++ gen_helper_subv(REG(B11_8), cpu_env, REG(B7_4), REG(B11_8));
+ return;
+ case 0x2008: /* tst Rm,Rn */
+ {
+@@ -1152,22 +1152,22 @@ static void _decode_opc(DisasContext * ctx)
+ gen_load_fpr64(fp1, DREG(B7_4));
+ switch (ctx->opcode & 0xf00f) {
+ case 0xf000: /* fadd Rm,Rn */
+- gen_helper_fadd_DT(fp0, fp0, fp1);
++ gen_helper_fadd_DT(fp0, cpu_env, fp0, fp1);
+ break;
+ case 0xf001: /* fsub Rm,Rn */
+- gen_helper_fsub_DT(fp0, fp0, fp1);
++ gen_helper_fsub_DT(fp0, cpu_env, fp0, fp1);
+ break;
+ case 0xf002: /* fmul Rm,Rn */
+- gen_helper_fmul_DT(fp0, fp0, fp1);
++ gen_helper_fmul_DT(fp0, cpu_env, fp0, fp1);
+ break;
+ case 0xf003: /* fdiv Rm,Rn */
+- gen_helper_fdiv_DT(fp0, fp0, fp1);
++ gen_helper_fdiv_DT(fp0, cpu_env, fp0, fp1);
+ break;
+ case 0xf004: /* fcmp/eq Rm,Rn */
+- gen_helper_fcmp_eq_DT(fp0, fp1);
++ gen_helper_fcmp_eq_DT(cpu_env, fp0, fp1);
+ return;
+ case 0xf005: /* fcmp/gt Rm,Rn */
+- gen_helper_fcmp_gt_DT(fp0, fp1);
++ gen_helper_fcmp_gt_DT(cpu_env, fp0, fp1);
+ return;
+ }
+ gen_store_fpr64(fp0, DREG(B11_8));
+@@ -1176,22 +1176,32 @@ static void _decode_opc(DisasContext * ctx)
+ } else {
+ switch (ctx->opcode & 0xf00f) {
+ case 0xf000: /* fadd Rm,Rn */
+- gen_helper_fadd_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fadd_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ break;
+ case 0xf001: /* fsub Rm,Rn */
+- gen_helper_fsub_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fsub_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ break;
+ case 0xf002: /* fmul Rm,Rn */
+- gen_helper_fmul_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fmul_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ break;
+ case 0xf003: /* fdiv Rm,Rn */
+- gen_helper_fdiv_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fdiv_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ break;
+ case 0xf004: /* fcmp/eq Rm,Rn */
+- gen_helper_fcmp_eq_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fcmp_eq_FT(cpu_env, cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ return;
+ case 0xf005: /* fcmp/gt Rm,Rn */
+- gen_helper_fcmp_gt_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]);
++ gen_helper_fcmp_gt_FT(cpu_env, cpu_fregs[FREG(B11_8)],
++ cpu_fregs[FREG(B7_4)]);
+ return;
+ }
+ }
+@@ -1203,8 +1213,9 @@ static void _decode_opc(DisasContext * ctx)
+ if (ctx->fpscr & FPSCR_PR) {
+ break; /* illegal instruction */
+ } else {
+- gen_helper_fmac_FT(cpu_fregs[FREG(B11_8)],
+- cpu_fregs[FREG(0)], cpu_fregs[FREG(B7_4)], cpu_fregs[FREG(B11_8)]);
++ gen_helper_fmac_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(0)], cpu_fregs[FREG(B7_4)],
++ cpu_fregs[FREG(B11_8)]);
+ return;
+ }
+ }
+@@ -1356,7 +1367,7 @@ static void _decode_opc(DisasContext * ctx)
+ TCGv imm;
+ CHECK_NOT_DELAY_SLOT
+ imm = tcg_const_i32(B7_0);
+- gen_helper_trapa(imm);
++ gen_helper_trapa(cpu_env, imm);
+ tcg_temp_free(imm);
+ ctx->bstate = BS_BRANCH;
+ }
+@@ -1531,7 +1542,7 @@ static void _decode_opc(DisasContext * ctx)
+ LDST(fpul, 0x405a, 0x4056, 0x005a, 0x4052, {CHECK_FPU_ENABLED})
+ case 0x406a: /* lds Rm,FPSCR */
+ CHECK_FPU_ENABLED
+- gen_helper_ld_fpscr(REG(B11_8));
++ gen_helper_ld_fpscr(cpu_env, REG(B11_8));
+ ctx->bstate = BS_STOP;
+ return;
+ case 0x4066: /* lds.l @Rm+,FPSCR */
+@@ -1540,7 +1551,7 @@ static void _decode_opc(DisasContext * ctx)
+ TCGv addr = tcg_temp_new();
+ tcg_gen_qemu_ld32s(addr, REG(B11_8), ctx->memidx);
+ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4);
+- gen_helper_ld_fpscr(addr);
++ gen_helper_ld_fpscr(cpu_env, addr);
+ tcg_temp_free(addr);
+ ctx->bstate = BS_STOP;
+ }
+@@ -1567,7 +1578,7 @@ static void _decode_opc(DisasContext * ctx)
+ {
+ TCGv val = tcg_temp_new();
+ tcg_gen_qemu_ld32u(val, REG(B11_8), ctx->memidx);
+- gen_helper_movcal (REG(B11_8), val);
++ gen_helper_movcal(cpu_env, REG(B11_8), val);
+ tcg_gen_qemu_st32(REG(0), REG(B11_8), ctx->memidx);
+ }
+ ctx->has_movcal = 1;
+@@ -1619,7 +1630,7 @@ static void _decode_opc(DisasContext * ctx)
+ break;
+ case 0x0093: /* ocbi @Rn */
+ {
+- gen_helper_ocbi (REG(B11_8));
++ gen_helper_ocbi(cpu_env, REG(B11_8));
+ }
+ return;
+ case 0x00a3: /* ocbp @Rn */
+@@ -1733,12 +1744,12 @@ static void _decode_opc(DisasContext * ctx)
+ if (ctx->opcode & 0x0100)
+ break; /* illegal instruction */
+ fp = tcg_temp_new_i64();
+- gen_helper_float_DT(fp, cpu_fpul);
++ gen_helper_float_DT(fp, cpu_env, cpu_fpul);
+ gen_store_fpr64(fp, DREG(B11_8));
+ tcg_temp_free_i64(fp);
+ }
+ else {
+- gen_helper_float_FT(cpu_fregs[FREG(B11_8)], cpu_fpul);
++ gen_helper_float_FT(cpu_fregs[FREG(B11_8)], cpu_env, cpu_fpul);
+ }
+ return;
+ case 0xf03d: /* ftrc FRm/DRm,FPUL - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */
+@@ -1749,11 +1760,11 @@ static void _decode_opc(DisasContext * ctx)
+ break; /* illegal instruction */
+ fp = tcg_temp_new_i64();
+ gen_load_fpr64(fp, DREG(B11_8));
+- gen_helper_ftrc_DT(cpu_fpul, fp);
++ gen_helper_ftrc_DT(cpu_fpul, cpu_env, fp);
+ tcg_temp_free_i64(fp);
+ }
+ else {
+- gen_helper_ftrc_FT(cpu_fpul, cpu_fregs[FREG(B11_8)]);
++ gen_helper_ftrc_FT(cpu_fpul, cpu_env, cpu_fregs[FREG(B11_8)]);
+ }
+ return;
+ case 0xf04d: /* fneg FRn/DRn - FPSCR: Nothing */
+@@ -1783,11 +1794,12 @@ static void _decode_opc(DisasContext * ctx)
+ break; /* illegal instruction */
+ TCGv_i64 fp = tcg_temp_new_i64();
+ gen_load_fpr64(fp, DREG(B11_8));
+- gen_helper_fsqrt_DT(fp, fp);
++ gen_helper_fsqrt_DT(fp, cpu_env, fp);
+ gen_store_fpr64(fp, DREG(B11_8));
+ tcg_temp_free_i64(fp);
+ } else {
+- gen_helper_fsqrt_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)]);
++ gen_helper_fsqrt_FT(cpu_fregs[FREG(B11_8)], cpu_env,
++ cpu_fregs[FREG(B11_8)]);
+ }
+ return;
+ case 0xf07d: /* fsrra FRn */
+@@ -1809,7 +1821,7 @@ static void _decode_opc(DisasContext * ctx)
+ CHECK_FPU_ENABLED
+ {
+ TCGv_i64 fp = tcg_temp_new_i64();
+- gen_helper_fcnvsd_FT_DT(fp, cpu_fpul);
++ gen_helper_fcnvsd_FT_DT(fp, cpu_env, cpu_fpul);
+ gen_store_fpr64(fp, DREG(B11_8));
+ tcg_temp_free_i64(fp);
+ }
+@@ -1819,7 +1831,7 @@ static void _decode_opc(DisasContext * ctx)
+ {
+ TCGv_i64 fp = tcg_temp_new_i64();
+ gen_load_fpr64(fp, DREG(B11_8));
+- gen_helper_fcnvds_DT_FT(cpu_fpul, fp);
++ gen_helper_fcnvds_DT_FT(cpu_fpul, cpu_env, fp);
+ tcg_temp_free_i64(fp);
+ }
+ return;
+@@ -1829,7 +1841,7 @@ static void _decode_opc(DisasContext * ctx)
+ TCGv m, n;
+ m = tcg_const_i32((ctx->opcode >> 8) & 3);
+ n = tcg_const_i32((ctx->opcode >> 10) & 3);
+- gen_helper_fipr(m, n);
++ gen_helper_fipr(cpu_env, m, n);
+ tcg_temp_free(m);
+ tcg_temp_free(n);
+ return;
+@@ -1841,7 +1853,7 @@ static void _decode_opc(DisasContext * ctx)
+ (ctx->fpscr & FPSCR_PR) == 0) {
+ TCGv n;
+ n = tcg_const_i32((ctx->opcode >> 10) & 3);
+- gen_helper_ftrv(n);
++ gen_helper_ftrv(cpu_env, n);
+ tcg_temp_free(n);
+ return;
+ }
+@@ -1853,9 +1865,9 @@ static void _decode_opc(DisasContext * ctx)
+ fflush(stderr);
+ #endif
+ if (ctx->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) {
+- gen_helper_raise_slot_illegal_instruction();
++ gen_helper_raise_slot_illegal_instruction(cpu_env);
+ } else {
+- gen_helper_raise_illegal_instruction();
++ gen_helper_raise_illegal_instruction(cpu_env);
+ }
+ ctx->bstate = BS_EXCP;
+ }
+@@ -1934,7 +1946,7 @@ gen_intermediate_code_internal(CPUSH4State * env, TranslationBlock * tb,
+ if (ctx.pc == bp->pc) {
+ /* We have hit a breakpoint - make sure PC is up-to-date */
+ tcg_gen_movi_i32(cpu_pc, ctx.pc);
+- gen_helper_debug();
++ gen_helper_debug(cpu_env);
+ ctx.bstate = BS_EXCP;
+ break;
+ }
+@@ -1958,7 +1970,7 @@ gen_intermediate_code_internal(CPUSH4State * env, TranslationBlock * tb,
+ fprintf(stderr, "Loading opcode at address 0x%08x\n", ctx.pc);
+ fflush(stderr);
+ #endif
+- ctx.opcode = lduw_code(ctx.pc);
++ ctx.opcode = cpu_lduw_code(env, ctx.pc);
+ decode_opc(&ctx);
+ num_insns++;
+ ctx.pc += 2;
+@@ -1975,7 +1987,7 @@ gen_intermediate_code_internal(CPUSH4State * env, TranslationBlock * tb,
+ gen_io_end();
+ if (env->singlestep_enabled) {
+ tcg_gen_movi_i32(cpu_pc, ctx.pc);
+- gen_helper_debug();
++ gen_helper_debug(cpu_env);
+ } else {
+ switch (ctx.bstate) {
+ case BS_STOP:
+--
+1.7.12.1
+
--- /dev/null
+From 8ad14b12fbe7555da2b2f0f1f28e07b8a34b686c Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 14:52:59 +0000
+Subject: [PATCH] target-mips: switch to AREG0 free mode
+
+Add an explicit CPUState parameter instead of relying on AREG0
+and switch to AREG0 free mode.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Acked-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ target-mips/Makefile.objs | 2 -
+ target-mips/cpu.h | 16 +-
+ target-mips/helper.h | 410 ++++++++---------
+ target-mips/op_helper.c | 1065 ++++++++++++++++++++++++---------------------
+ target-mips/translate.c | 754 ++++++++++++++++----------------
+ 6 files changed, 1163 insertions(+), 1086 deletions(-)
+
+diff --git a/configure b/configure
+index 03ce76e..83b068d 100755
+--- a/configure
++++ b/configure
+@@ -3839,7 +3839,7 @@ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+
+ case "$target_arch2" in
+- alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | or32 | s390x | sh4* | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
++ alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | mips* | or32 | s390x | sh4* | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+ echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+ ;;
+ esac
+diff --git a/target-mips/Makefile.objs b/target-mips/Makefile.objs
+index 2e0e093..ca20f21 100644
+--- a/target-mips/Makefile.objs
++++ b/target-mips/Makefile.objs
+@@ -1,4 +1,2 @@
+ obj-y += translate.o op_helper.o helper.o cpu.o
+ obj-$(CONFIG_SOFTMMU) += machine.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/target-mips/cpu.h b/target-mips/cpu.h
+index ce3467f..be4f805 100644
+--- a/target-mips/cpu.h
++++ b/target-mips/cpu.h
+@@ -38,10 +38,10 @@ struct CPUMIPSTLBContext {
+ uint32_t nb_tlb;
+ uint32_t tlb_in_use;
+ int (*map_address) (struct CPUMIPSState *env, target_phys_addr_t *physical, int *prot, target_ulong address, int rw, int access_type);
+- void (*helper_tlbwi) (void);
+- void (*helper_tlbwr) (void);
+- void (*helper_tlbp) (void);
+- void (*helper_tlbr) (void);
++ void (*helper_tlbwi)(struct CPUMIPSState *env);
++ void (*helper_tlbwr)(struct CPUMIPSState *env);
++ void (*helper_tlbp)(struct CPUMIPSState *env);
++ void (*helper_tlbr)(struct CPUMIPSState *env);
+ union {
+ struct {
+ r4k_tlb_t tlb[MIPS_TLB_MAX];
+@@ -485,10 +485,10 @@ int fixed_mmu_map_address (CPUMIPSState *env, target_phys_addr_t *physical, int
+ target_ulong address, int rw, int access_type);
+ int r4k_map_address (CPUMIPSState *env, target_phys_addr_t *physical, int *prot,
+ target_ulong address, int rw, int access_type);
+-void r4k_helper_tlbwi (void);
+-void r4k_helper_tlbwr (void);
+-void r4k_helper_tlbp (void);
+-void r4k_helper_tlbr (void);
++void r4k_helper_tlbwi(CPUMIPSState *env);
++void r4k_helper_tlbwr(CPUMIPSState *env);
++void r4k_helper_tlbp(CPUMIPSState *env);
++void r4k_helper_tlbr(CPUMIPSState *env);
+
+ void cpu_unassigned_access(CPUMIPSState *env, target_phys_addr_t addr,
+ int is_write, int is_exec, int unused, int size);
+diff --git a/target-mips/helper.h b/target-mips/helper.h
+index 76fb451..109ac37 100644
+--- a/target-mips/helper.h
++++ b/target-mips/helper.h
+@@ -1,25 +1,25 @@
+ #include "def-helper.h"
+
+-DEF_HELPER_2(raise_exception_err, noreturn, i32, int)
+-DEF_HELPER_1(raise_exception, noreturn, i32)
++DEF_HELPER_3(raise_exception_err, noreturn, env, i32, int)
++DEF_HELPER_2(raise_exception, noreturn, env, i32)
+
+ #ifdef TARGET_MIPS64
+-DEF_HELPER_3(ldl, tl, tl, tl, int)
+-DEF_HELPER_3(ldr, tl, tl, tl, int)
+-DEF_HELPER_3(sdl, void, tl, tl, int)
+-DEF_HELPER_3(sdr, void, tl, tl, int)
++DEF_HELPER_4(ldl, tl, env, tl, tl, int)
++DEF_HELPER_4(ldr, tl, env, tl, tl, int)
++DEF_HELPER_4(sdl, void, env, tl, tl, int)
++DEF_HELPER_4(sdr, void, env, tl, tl, int)
+ #endif
+-DEF_HELPER_3(lwl, tl, tl, tl, int)
+-DEF_HELPER_3(lwr, tl, tl, tl, int)
+-DEF_HELPER_3(swl, void, tl, tl, int)
+-DEF_HELPER_3(swr, void, tl, tl, int)
++DEF_HELPER_4(lwl, tl, env, tl, tl, int)
++DEF_HELPER_4(lwr, tl, env, tl, tl, int)
++DEF_HELPER_4(swl, void, env, tl, tl, int)
++DEF_HELPER_4(swr, void, env, tl, tl, int)
+
+ #ifndef CONFIG_USER_ONLY
+-DEF_HELPER_2(ll, tl, tl, int)
+-DEF_HELPER_3(sc, tl, tl, tl, int)
++DEF_HELPER_3(ll, tl, env, tl, int)
++DEF_HELPER_4(sc, tl, env, tl, tl, int)
+ #ifdef TARGET_MIPS64
+-DEF_HELPER_2(lld, tl, tl, int)
+-DEF_HELPER_3(scd, tl, tl, tl, int)
++DEF_HELPER_3(lld, tl, env, tl, int)
++DEF_HELPER_4(scd, tl, env, tl, tl, int)
+ #endif
+ #endif
+
+@@ -28,195 +28,195 @@ DEF_HELPER_FLAGS_1(clz, TCG_CALL_CONST | TCG_CALL_PURE, tl, tl)
+ #ifdef TARGET_MIPS64
+ DEF_HELPER_FLAGS_1(dclo, TCG_CALL_CONST | TCG_CALL_PURE, tl, tl)
+ DEF_HELPER_FLAGS_1(dclz, TCG_CALL_CONST | TCG_CALL_PURE, tl, tl)
+-DEF_HELPER_2(dmult, void, tl, tl)
+-DEF_HELPER_2(dmultu, void, tl, tl)
++DEF_HELPER_3(dmult, void, env, tl, tl)
++DEF_HELPER_3(dmultu, void, env, tl, tl)
+ #endif
+
+-DEF_HELPER_2(muls, tl, tl, tl)
+-DEF_HELPER_2(mulsu, tl, tl, tl)
+-DEF_HELPER_2(macc, tl, tl, tl)
+-DEF_HELPER_2(maccu, tl, tl, tl)
+-DEF_HELPER_2(msac, tl, tl, tl)
+-DEF_HELPER_2(msacu, tl, tl, tl)
+-DEF_HELPER_2(mulhi, tl, tl, tl)
+-DEF_HELPER_2(mulhiu, tl, tl, tl)
+-DEF_HELPER_2(mulshi, tl, tl, tl)
+-DEF_HELPER_2(mulshiu, tl, tl, tl)
+-DEF_HELPER_2(macchi, tl, tl, tl)
+-DEF_HELPER_2(macchiu, tl, tl, tl)
+-DEF_HELPER_2(msachi, tl, tl, tl)
+-DEF_HELPER_2(msachiu, tl, tl, tl)
++DEF_HELPER_3(muls, tl, env, tl, tl)
++DEF_HELPER_3(mulsu, tl, env, tl, tl)
++DEF_HELPER_3(macc, tl, env, tl, tl)
++DEF_HELPER_3(maccu, tl, env, tl, tl)
++DEF_HELPER_3(msac, tl, env, tl, tl)
++DEF_HELPER_3(msacu, tl, env, tl, tl)
++DEF_HELPER_3(mulhi, tl, env, tl, tl)
++DEF_HELPER_3(mulhiu, tl, env, tl, tl)
++DEF_HELPER_3(mulshi, tl, env, tl, tl)
++DEF_HELPER_3(mulshiu, tl, env, tl, tl)
++DEF_HELPER_3(macchi, tl, env, tl, tl)
++DEF_HELPER_3(macchiu, tl, env, tl, tl)
++DEF_HELPER_3(msachi, tl, env, tl, tl)
++DEF_HELPER_3(msachiu, tl, env, tl, tl)
+
+ #ifndef CONFIG_USER_ONLY
+ /* CP0 helpers */
+-DEF_HELPER_0(mfc0_mvpcontrol, tl)
+-DEF_HELPER_0(mfc0_mvpconf0, tl)
+-DEF_HELPER_0(mfc0_mvpconf1, tl)
+-DEF_HELPER_0(mftc0_vpecontrol, tl)
+-DEF_HELPER_0(mftc0_vpeconf0, tl)
+-DEF_HELPER_0(mfc0_random, tl)
+-DEF_HELPER_0(mfc0_tcstatus, tl)
+-DEF_HELPER_0(mftc0_tcstatus, tl)
+-DEF_HELPER_0(mfc0_tcbind, tl)
+-DEF_HELPER_0(mftc0_tcbind, tl)
+-DEF_HELPER_0(mfc0_tcrestart, tl)
+-DEF_HELPER_0(mftc0_tcrestart, tl)
+-DEF_HELPER_0(mfc0_tchalt, tl)
+-DEF_HELPER_0(mftc0_tchalt, tl)
+-DEF_HELPER_0(mfc0_tccontext, tl)
+-DEF_HELPER_0(mftc0_tccontext, tl)
+-DEF_HELPER_0(mfc0_tcschedule, tl)
+-DEF_HELPER_0(mftc0_tcschedule, tl)
+-DEF_HELPER_0(mfc0_tcschefback, tl)
+-DEF_HELPER_0(mftc0_tcschefback, tl)
+-DEF_HELPER_0(mfc0_count, tl)
+-DEF_HELPER_0(mftc0_entryhi, tl)
+-DEF_HELPER_0(mftc0_status, tl)
+-DEF_HELPER_0(mftc0_cause, tl)
+-DEF_HELPER_0(mftc0_epc, tl)
+-DEF_HELPER_0(mftc0_ebase, tl)
+-DEF_HELPER_1(mftc0_configx, tl, tl)
+-DEF_HELPER_0(mfc0_lladdr, tl)
+-DEF_HELPER_1(mfc0_watchlo, tl, i32)
+-DEF_HELPER_1(mfc0_watchhi, tl, i32)
+-DEF_HELPER_0(mfc0_debug, tl)
+-DEF_HELPER_0(mftc0_debug, tl)
++DEF_HELPER_1(mfc0_mvpcontrol, tl, env)
++DEF_HELPER_1(mfc0_mvpconf0, tl, env)
++DEF_HELPER_1(mfc0_mvpconf1, tl, env)
++DEF_HELPER_1(mftc0_vpecontrol, tl, env)
++DEF_HELPER_1(mftc0_vpeconf0, tl, env)
++DEF_HELPER_1(mfc0_random, tl, env)
++DEF_HELPER_1(mfc0_tcstatus, tl, env)
++DEF_HELPER_1(mftc0_tcstatus, tl, env)
++DEF_HELPER_1(mfc0_tcbind, tl, env)
++DEF_HELPER_1(mftc0_tcbind, tl, env)
++DEF_HELPER_1(mfc0_tcrestart, tl, env)
++DEF_HELPER_1(mftc0_tcrestart, tl, env)
++DEF_HELPER_1(mfc0_tchalt, tl, env)
++DEF_HELPER_1(mftc0_tchalt, tl, env)
++DEF_HELPER_1(mfc0_tccontext, tl, env)
++DEF_HELPER_1(mftc0_tccontext, tl, env)
++DEF_HELPER_1(mfc0_tcschedule, tl, env)
++DEF_HELPER_1(mftc0_tcschedule, tl, env)
++DEF_HELPER_1(mfc0_tcschefback, tl, env)
++DEF_HELPER_1(mftc0_tcschefback, tl, env)
++DEF_HELPER_1(mfc0_count, tl, env)
++DEF_HELPER_1(mftc0_entryhi, tl, env)
++DEF_HELPER_1(mftc0_status, tl, env)
++DEF_HELPER_1(mftc0_cause, tl, env)
++DEF_HELPER_1(mftc0_epc, tl, env)
++DEF_HELPER_1(mftc0_ebase, tl, env)
++DEF_HELPER_2(mftc0_configx, tl, env, tl)
++DEF_HELPER_1(mfc0_lladdr, tl, env)
++DEF_HELPER_2(mfc0_watchlo, tl, env, i32)
++DEF_HELPER_2(mfc0_watchhi, tl, env, i32)
++DEF_HELPER_1(mfc0_debug, tl, env)
++DEF_HELPER_1(mftc0_debug, tl, env)
+ #ifdef TARGET_MIPS64
+-DEF_HELPER_0(dmfc0_tcrestart, tl)
+-DEF_HELPER_0(dmfc0_tchalt, tl)
+-DEF_HELPER_0(dmfc0_tccontext, tl)
+-DEF_HELPER_0(dmfc0_tcschedule, tl)
+-DEF_HELPER_0(dmfc0_tcschefback, tl)
+-DEF_HELPER_0(dmfc0_lladdr, tl)
+-DEF_HELPER_1(dmfc0_watchlo, tl, i32)
++DEF_HELPER_1(dmfc0_tcrestart, tl, env)
++DEF_HELPER_1(dmfc0_tchalt, tl, env)
++DEF_HELPER_1(dmfc0_tccontext, tl, env)
++DEF_HELPER_1(dmfc0_tcschedule, tl, env)
++DEF_HELPER_1(dmfc0_tcschefback, tl, env)
++DEF_HELPER_1(dmfc0_lladdr, tl, env)
++DEF_HELPER_2(dmfc0_watchlo, tl, env, i32)
+ #endif /* TARGET_MIPS64 */
+
+-DEF_HELPER_1(mtc0_index, void, tl)
+-DEF_HELPER_1(mtc0_mvpcontrol, void, tl)
+-DEF_HELPER_1(mtc0_vpecontrol, void, tl)
+-DEF_HELPER_1(mttc0_vpecontrol, void, tl)
+-DEF_HELPER_1(mtc0_vpeconf0, void, tl)
+-DEF_HELPER_1(mttc0_vpeconf0, void, tl)
+-DEF_HELPER_1(mtc0_vpeconf1, void, tl)
+-DEF_HELPER_1(mtc0_yqmask, void, tl)
+-DEF_HELPER_1(mtc0_vpeopt, void, tl)
+-DEF_HELPER_1(mtc0_entrylo0, void, tl)
+-DEF_HELPER_1(mtc0_tcstatus, void, tl)
+-DEF_HELPER_1(mttc0_tcstatus, void, tl)
+-DEF_HELPER_1(mtc0_tcbind, void, tl)
+-DEF_HELPER_1(mttc0_tcbind, void, tl)
+-DEF_HELPER_1(mtc0_tcrestart, void, tl)
+-DEF_HELPER_1(mttc0_tcrestart, void, tl)
+-DEF_HELPER_1(mtc0_tchalt, void, tl)
+-DEF_HELPER_1(mttc0_tchalt, void, tl)
+-DEF_HELPER_1(mtc0_tccontext, void, tl)
+-DEF_HELPER_1(mttc0_tccontext, void, tl)
+-DEF_HELPER_1(mtc0_tcschedule, void, tl)
+-DEF_HELPER_1(mttc0_tcschedule, void, tl)
+-DEF_HELPER_1(mtc0_tcschefback, void, tl)
+-DEF_HELPER_1(mttc0_tcschefback, void, tl)
+-DEF_HELPER_1(mtc0_entrylo1, void, tl)
+-DEF_HELPER_1(mtc0_context, void, tl)
+-DEF_HELPER_1(mtc0_pagemask, void, tl)
+-DEF_HELPER_1(mtc0_pagegrain, void, tl)
+-DEF_HELPER_1(mtc0_wired, void, tl)
+-DEF_HELPER_1(mtc0_srsconf0, void, tl)
+-DEF_HELPER_1(mtc0_srsconf1, void, tl)
+-DEF_HELPER_1(mtc0_srsconf2, void, tl)
+-DEF_HELPER_1(mtc0_srsconf3, void, tl)
+-DEF_HELPER_1(mtc0_srsconf4, void, tl)
+-DEF_HELPER_1(mtc0_hwrena, void, tl)
+-DEF_HELPER_1(mtc0_count, void, tl)
+-DEF_HELPER_1(mtc0_entryhi, void, tl)
+-DEF_HELPER_1(mttc0_entryhi, void, tl)
+-DEF_HELPER_1(mtc0_compare, void, tl)
+-DEF_HELPER_1(mtc0_status, void, tl)
+-DEF_HELPER_1(mttc0_status, void, tl)
+-DEF_HELPER_1(mtc0_intctl, void, tl)
+-DEF_HELPER_1(mtc0_srsctl, void, tl)
+-DEF_HELPER_1(mtc0_cause, void, tl)
+-DEF_HELPER_1(mttc0_cause, void, tl)
+-DEF_HELPER_1(mtc0_ebase, void, tl)
+-DEF_HELPER_1(mttc0_ebase, void, tl)
+-DEF_HELPER_1(mtc0_config0, void, tl)
+-DEF_HELPER_1(mtc0_config2, void, tl)
+-DEF_HELPER_1(mtc0_lladdr, void, tl)
+-DEF_HELPER_2(mtc0_watchlo, void, tl, i32)
+-DEF_HELPER_2(mtc0_watchhi, void, tl, i32)
+-DEF_HELPER_1(mtc0_xcontext, void, tl)
+-DEF_HELPER_1(mtc0_framemask, void, tl)
+-DEF_HELPER_1(mtc0_debug, void, tl)
+-DEF_HELPER_1(mttc0_debug, void, tl)
+-DEF_HELPER_1(mtc0_performance0, void, tl)
+-DEF_HELPER_1(mtc0_taglo, void, tl)
+-DEF_HELPER_1(mtc0_datalo, void, tl)
+-DEF_HELPER_1(mtc0_taghi, void, tl)
+-DEF_HELPER_1(mtc0_datahi, void, tl)
++DEF_HELPER_2(mtc0_index, void, env, tl)
++DEF_HELPER_2(mtc0_mvpcontrol, void, env, tl)
++DEF_HELPER_2(mtc0_vpecontrol, void, env, tl)
++DEF_HELPER_2(mttc0_vpecontrol, void, env, tl)
++DEF_HELPER_2(mtc0_vpeconf0, void, env, tl)
++DEF_HELPER_2(mttc0_vpeconf0, void, env, tl)
++DEF_HELPER_2(mtc0_vpeconf1, void, env, tl)
++DEF_HELPER_2(mtc0_yqmask, void, env, tl)
++DEF_HELPER_2(mtc0_vpeopt, void, env, tl)
++DEF_HELPER_2(mtc0_entrylo0, void, env, tl)
++DEF_HELPER_2(mtc0_tcstatus, void, env, tl)
++DEF_HELPER_2(mttc0_tcstatus, void, env, tl)
++DEF_HELPER_2(mtc0_tcbind, void, env, tl)
++DEF_HELPER_2(mttc0_tcbind, void, env, tl)
++DEF_HELPER_2(mtc0_tcrestart, void, env, tl)
++DEF_HELPER_2(mttc0_tcrestart, void, env, tl)
++DEF_HELPER_2(mtc0_tchalt, void, env, tl)
++DEF_HELPER_2(mttc0_tchalt, void, env, tl)
++DEF_HELPER_2(mtc0_tccontext, void, env, tl)
++DEF_HELPER_2(mttc0_tccontext, void, env, tl)
++DEF_HELPER_2(mtc0_tcschedule, void, env, tl)
++DEF_HELPER_2(mttc0_tcschedule, void, env, tl)
++DEF_HELPER_2(mtc0_tcschefback, void, env, tl)
++DEF_HELPER_2(mttc0_tcschefback, void, env, tl)
++DEF_HELPER_2(mtc0_entrylo1, void, env, tl)
++DEF_HELPER_2(mtc0_context, void, env, tl)
++DEF_HELPER_2(mtc0_pagemask, void, env, tl)
++DEF_HELPER_2(mtc0_pagegrain, void, env, tl)
++DEF_HELPER_2(mtc0_wired, void, env, tl)
++DEF_HELPER_2(mtc0_srsconf0, void, env, tl)
++DEF_HELPER_2(mtc0_srsconf1, void, env, tl)
++DEF_HELPER_2(mtc0_srsconf2, void, env, tl)
++DEF_HELPER_2(mtc0_srsconf3, void, env, tl)
++DEF_HELPER_2(mtc0_srsconf4, void, env, tl)
++DEF_HELPER_2(mtc0_hwrena, void, env, tl)
++DEF_HELPER_2(mtc0_count, void, env, tl)
++DEF_HELPER_2(mtc0_entryhi, void, env, tl)
++DEF_HELPER_2(mttc0_entryhi, void, env, tl)
++DEF_HELPER_2(mtc0_compare, void, env, tl)
++DEF_HELPER_2(mtc0_status, void, env, tl)
++DEF_HELPER_2(mttc0_status, void, env, tl)
++DEF_HELPER_2(mtc0_intctl, void, env, tl)
++DEF_HELPER_2(mtc0_srsctl, void, env, tl)
++DEF_HELPER_2(mtc0_cause, void, env, tl)
++DEF_HELPER_2(mttc0_cause, void, env, tl)
++DEF_HELPER_2(mtc0_ebase, void, env, tl)
++DEF_HELPER_2(mttc0_ebase, void, env, tl)
++DEF_HELPER_2(mtc0_config0, void, env, tl)
++DEF_HELPER_2(mtc0_config2, void, env, tl)
++DEF_HELPER_2(mtc0_lladdr, void, env, tl)
++DEF_HELPER_3(mtc0_watchlo, void, env, tl, i32)
++DEF_HELPER_3(mtc0_watchhi, void, env, tl, i32)
++DEF_HELPER_2(mtc0_xcontext, void, env, tl)
++DEF_HELPER_2(mtc0_framemask, void, env, tl)
++DEF_HELPER_2(mtc0_debug, void, env, tl)
++DEF_HELPER_2(mttc0_debug, void, env, tl)
++DEF_HELPER_2(mtc0_performance0, void, env, tl)
++DEF_HELPER_2(mtc0_taglo, void, env, tl)
++DEF_HELPER_2(mtc0_datalo, void, env, tl)
++DEF_HELPER_2(mtc0_taghi, void, env, tl)
++DEF_HELPER_2(mtc0_datahi, void, env, tl)
+
+ /* MIPS MT functions */
+-DEF_HELPER_1(mftgpr, tl, i32);
+-DEF_HELPER_1(mftlo, tl, i32)
+-DEF_HELPER_1(mfthi, tl, i32)
+-DEF_HELPER_1(mftacx, tl, i32)
+-DEF_HELPER_0(mftdsp, tl)
+-DEF_HELPER_2(mttgpr, void, tl, i32)
+-DEF_HELPER_2(mttlo, void, tl, i32)
+-DEF_HELPER_2(mtthi, void, tl, i32)
+-DEF_HELPER_2(mttacx, void, tl, i32)
+-DEF_HELPER_1(mttdsp, void, tl)
++DEF_HELPER_2(mftgpr, tl, env, i32);
++DEF_HELPER_2(mftlo, tl, env, i32)
++DEF_HELPER_2(mfthi, tl, env, i32)
++DEF_HELPER_2(mftacx, tl, env, i32)
++DEF_HELPER_1(mftdsp, tl, env)
++DEF_HELPER_3(mttgpr, void, env, tl, i32)
++DEF_HELPER_3(mttlo, void, env, tl, i32)
++DEF_HELPER_3(mtthi, void, env, tl, i32)
++DEF_HELPER_3(mttacx, void, env, tl, i32)
++DEF_HELPER_2(mttdsp, void, env, tl)
+ DEF_HELPER_0(dmt, tl)
+ DEF_HELPER_0(emt, tl)
+-DEF_HELPER_0(dvpe, tl)
+-DEF_HELPER_0(evpe, tl)
++DEF_HELPER_1(dvpe, tl, env)
++DEF_HELPER_1(evpe, tl, env)
+ #endif /* !CONFIG_USER_ONLY */
+
+ /* microMIPS functions */
+-DEF_HELPER_3(lwm, void, tl, tl, i32);
+-DEF_HELPER_3(swm, void, tl, tl, i32);
++DEF_HELPER_4(lwm, void, env, tl, tl, i32);
++DEF_HELPER_4(swm, void, env, tl, tl, i32);
+ #ifdef TARGET_MIPS64
+-DEF_HELPER_3(ldm, void, tl, tl, i32);
+-DEF_HELPER_3(sdm, void, tl, tl, i32);
++DEF_HELPER_4(ldm, void, env, tl, tl, i32);
++DEF_HELPER_4(sdm, void, env, tl, tl, i32);
+ #endif
+
+ DEF_HELPER_2(fork, void, tl, tl)
+-DEF_HELPER_1(yield, tl, tl)
++DEF_HELPER_2(yield, tl, env, tl)
+
+ /* CP1 functions */
+-DEF_HELPER_1(cfc1, tl, i32)
+-DEF_HELPER_2(ctc1, void, tl, i32)
++DEF_HELPER_2(cfc1, tl, env, i32)
++DEF_HELPER_3(ctc1, void, env, tl, i32)
+
+-DEF_HELPER_1(float_cvtd_s, i64, i32)
+-DEF_HELPER_1(float_cvtd_w, i64, i32)
+-DEF_HELPER_1(float_cvtd_l, i64, i64)
+-DEF_HELPER_1(float_cvtl_d, i64, i64)
+-DEF_HELPER_1(float_cvtl_s, i64, i32)
+-DEF_HELPER_1(float_cvtps_pw, i64, i64)
+-DEF_HELPER_1(float_cvtpw_ps, i64, i64)
+-DEF_HELPER_1(float_cvts_d, i32, i64)
+-DEF_HELPER_1(float_cvts_w, i32, i32)
+-DEF_HELPER_1(float_cvts_l, i32, i64)
+-DEF_HELPER_1(float_cvts_pl, i32, i32)
+-DEF_HELPER_1(float_cvts_pu, i32, i32)
+-DEF_HELPER_1(float_cvtw_s, i32, i32)
+-DEF_HELPER_1(float_cvtw_d, i32, i64)
++DEF_HELPER_2(float_cvtd_s, i64, env, i32)
++DEF_HELPER_2(float_cvtd_w, i64, env, i32)
++DEF_HELPER_2(float_cvtd_l, i64, env, i64)
++DEF_HELPER_2(float_cvtl_d, i64, env, i64)
++DEF_HELPER_2(float_cvtl_s, i64, env, i32)
++DEF_HELPER_2(float_cvtps_pw, i64, env, i64)
++DEF_HELPER_2(float_cvtpw_ps, i64, env, i64)
++DEF_HELPER_2(float_cvts_d, i32, env, i64)
++DEF_HELPER_2(float_cvts_w, i32, env, i32)
++DEF_HELPER_2(float_cvts_l, i32, env, i64)
++DEF_HELPER_2(float_cvts_pl, i32, env, i32)
++DEF_HELPER_2(float_cvts_pu, i32, env, i32)
++DEF_HELPER_2(float_cvtw_s, i32, env, i32)
++DEF_HELPER_2(float_cvtw_d, i32, env, i64)
+
+-DEF_HELPER_2(float_addr_ps, i64, i64, i64)
+-DEF_HELPER_2(float_mulr_ps, i64, i64, i64)
++DEF_HELPER_3(float_addr_ps, i64, env, i64, i64)
++DEF_HELPER_3(float_mulr_ps, i64, env, i64, i64)
+
+-#define FOP_PROTO(op) \
+-DEF_HELPER_1(float_ ## op ## l_s, i64, i32) \
+-DEF_HELPER_1(float_ ## op ## l_d, i64, i64) \
+-DEF_HELPER_1(float_ ## op ## w_s, i32, i32) \
+-DEF_HELPER_1(float_ ## op ## w_d, i32, i64)
++#define FOP_PROTO(op) \
++DEF_HELPER_2(float_ ## op ## l_s, i64, env, i32) \
++DEF_HELPER_2(float_ ## op ## l_d, i64, env, i64) \
++DEF_HELPER_2(float_ ## op ## w_s, i32, env, i32) \
++DEF_HELPER_2(float_ ## op ## w_d, i32, env, i64)
+ FOP_PROTO(round)
+ FOP_PROTO(trunc)
+ FOP_PROTO(ceil)
+ FOP_PROTO(floor)
+ #undef FOP_PROTO
+
+-#define FOP_PROTO(op) \
+-DEF_HELPER_1(float_ ## op ## _s, i32, i32) \
+-DEF_HELPER_1(float_ ## op ## _d, i64, i64)
++#define FOP_PROTO(op) \
++DEF_HELPER_2(float_ ## op ## _s, i32, env, i32) \
++DEF_HELPER_2(float_ ## op ## _d, i64, env, i64)
+ FOP_PROTO(sqrt)
+ FOP_PROTO(rsqrt)
+ FOP_PROTO(recip)
+@@ -228,14 +228,20 @@ DEF_HELPER_1(float_ ## op ## _d, i64, i64) \
+ DEF_HELPER_1(float_ ## op ## _ps, i64, i64)
+ FOP_PROTO(abs)
+ FOP_PROTO(chs)
++#undef FOP_PROTO
++
++#define FOP_PROTO(op) \
++DEF_HELPER_2(float_ ## op ## _s, i32, env, i32) \
++DEF_HELPER_2(float_ ## op ## _d, i64, env, i64) \
++DEF_HELPER_2(float_ ## op ## _ps, i64, env, i64)
+ FOP_PROTO(recip1)
+ FOP_PROTO(rsqrt1)
+ #undef FOP_PROTO
+
+-#define FOP_PROTO(op) \
+-DEF_HELPER_2(float_ ## op ## _s, i32, i32, i32) \
+-DEF_HELPER_2(float_ ## op ## _d, i64, i64, i64) \
+-DEF_HELPER_2(float_ ## op ## _ps, i64, i64, i64)
++#define FOP_PROTO(op) \
++DEF_HELPER_3(float_ ## op ## _s, i32, env, i32, i32) \
++DEF_HELPER_3(float_ ## op ## _d, i64, env, i64, i64) \
++DEF_HELPER_3(float_ ## op ## _ps, i64, env, i64, i64)
+ FOP_PROTO(add)
+ FOP_PROTO(sub)
+ FOP_PROTO(mul)
+@@ -244,23 +250,23 @@ FOP_PROTO(recip2)
+ FOP_PROTO(rsqrt2)
+ #undef FOP_PROTO
+
+-#define FOP_PROTO(op) \
+-DEF_HELPER_3(float_ ## op ## _s, i32, i32, i32, i32) \
+-DEF_HELPER_3(float_ ## op ## _d, i64, i64, i64, i64) \
+-DEF_HELPER_3(float_ ## op ## _ps, i64, i64, i64, i64)
++#define FOP_PROTO(op) \
++DEF_HELPER_4(float_ ## op ## _s, i32, env, i32, i32, i32) \
++DEF_HELPER_4(float_ ## op ## _d, i64, env, i64, i64, i64) \
++DEF_HELPER_4(float_ ## op ## _ps, i64, env, i64, i64, i64)
+ FOP_PROTO(muladd)
+ FOP_PROTO(mulsub)
+ FOP_PROTO(nmuladd)
+ FOP_PROTO(nmulsub)
+ #undef FOP_PROTO
+
+-#define FOP_PROTO(op) \
+-DEF_HELPER_3(cmp_d_ ## op, void, i64, i64, int) \
+-DEF_HELPER_3(cmpabs_d_ ## op, void, i64, i64, int) \
+-DEF_HELPER_3(cmp_s_ ## op, void, i32, i32, int) \
+-DEF_HELPER_3(cmpabs_s_ ## op, void, i32, i32, int) \
+-DEF_HELPER_3(cmp_ps_ ## op, void, i64, i64, int) \
+-DEF_HELPER_3(cmpabs_ps_ ## op, void, i64, i64, int)
++#define FOP_PROTO(op) \
++DEF_HELPER_4(cmp_d_ ## op, void, env, i64, i64, int) \
++DEF_HELPER_4(cmpabs_d_ ## op, void, env, i64, i64, int) \
++DEF_HELPER_4(cmp_s_ ## op, void, env, i32, i32, int) \
++DEF_HELPER_4(cmpabs_s_ ## op, void, env, i32, i32, int) \
++DEF_HELPER_4(cmp_ps_ ## op, void, env, i64, i64, int) \
++DEF_HELPER_4(cmpabs_ps_ ## op, void, env, i64, i64, int)
+ FOP_PROTO(f)
+ FOP_PROTO(un)
+ FOP_PROTO(eq)
+@@ -281,20 +287,20 @@ FOP_PROTO(ngt)
+
+ /* Special functions */
+ #ifndef CONFIG_USER_ONLY
+-DEF_HELPER_0(tlbwi, void)
+-DEF_HELPER_0(tlbwr, void)
+-DEF_HELPER_0(tlbp, void)
+-DEF_HELPER_0(tlbr, void)
+-DEF_HELPER_0(di, tl)
+-DEF_HELPER_0(ei, tl)
+-DEF_HELPER_0(eret, void)
+-DEF_HELPER_0(deret, void)
++DEF_HELPER_1(tlbwi, void, env)
++DEF_HELPER_1(tlbwr, void, env)
++DEF_HELPER_1(tlbp, void, env)
++DEF_HELPER_1(tlbr, void, env)
++DEF_HELPER_1(di, tl, env)
++DEF_HELPER_1(ei, tl, env)
++DEF_HELPER_1(eret, void, env)
++DEF_HELPER_1(deret, void, env)
+ #endif /* !CONFIG_USER_ONLY */
+-DEF_HELPER_0(rdhwr_cpunum, tl)
+-DEF_HELPER_0(rdhwr_synci_step, tl)
+-DEF_HELPER_0(rdhwr_cc, tl)
+-DEF_HELPER_0(rdhwr_ccres, tl)
+-DEF_HELPER_1(pmon, void, int)
+-DEF_HELPER_0(wait, void)
++DEF_HELPER_1(rdhwr_cpunum, tl, env)
++DEF_HELPER_1(rdhwr_synci_step, tl, env)
++DEF_HELPER_1(rdhwr_cc, tl, env)
++DEF_HELPER_1(rdhwr_ccres, tl, env)
++DEF_HELPER_2(pmon, void, env, int)
++DEF_HELPER_1(wait, void, env)
+
+ #include "def-helper.h"
+diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
+index e5bc93e..d2a8a55 100644
+--- a/target-mips/op_helper.c
++++ b/target-mips/op_helper.c
+@@ -18,8 +18,6 @@
+ */
+ #include <stdlib.h>
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+-
+ #include "host-utils.h"
+
+ #include "helper.h"
+@@ -84,7 +82,8 @@ static inline void compute_hflags(CPUMIPSState *env)
+ /*****************************************************************************/
+ /* Exceptions processing helpers */
+
+-void helper_raise_exception_err (uint32_t exception, int error_code)
++void helper_raise_exception_err(CPUMIPSState *env, uint32_t exception,
++ int error_code)
+ {
+ #if 1
+ if (exception < 0x100)
+@@ -95,13 +94,13 @@ void helper_raise_exception_err (uint32_t exception, int error_code)
+ cpu_loop_exit(env);
+ }
+
+-void helper_raise_exception (uint32_t exception)
++void helper_raise_exception(CPUMIPSState *env, uint32_t exception)
+ {
+- helper_raise_exception_err(exception, 0);
++ helper_raise_exception_err(env, exception, 0);
+ }
+
+ #if !defined(CONFIG_USER_ONLY)
+-static void do_restore_state(uintptr_t pc)
++static void do_restore_state(CPUMIPSState *env, uintptr_t pc)
+ {
+ TranslationBlock *tb;
+
+@@ -114,20 +113,22 @@ static void do_restore_state(uintptr_t pc)
+
+ #if defined(CONFIG_USER_ONLY)
+ #define HELPER_LD(name, insn, type) \
+-static inline type do_##name(target_ulong addr, int mem_idx) \
++static inline type do_##name(CPUMIPSState *env, target_ulong addr, \
++ int mem_idx) \
+ { \
+ return (type) insn##_raw(addr); \
+ }
+ #else
+ #define HELPER_LD(name, insn, type) \
+-static inline type do_##name(target_ulong addr, int mem_idx) \
++static inline type do_##name(CPUMIPSState *env, target_ulong addr, \
++ int mem_idx) \
+ { \
+ switch (mem_idx) \
+ { \
+- case 0: return (type) insn##_kernel(addr); break; \
+- case 1: return (type) insn##_super(addr); break; \
++ case 0: return (type) cpu_##insn##_kernel(env, addr); break; \
++ case 1: return (type) cpu_##insn##_super(env, addr); break; \
+ default: \
+- case 2: return (type) insn##_user(addr); break; \
++ case 2: return (type) cpu_##insn##_user(env, addr); break; \
+ } \
+ }
+ #endif
+@@ -140,20 +141,22 @@ HELPER_LD(ld, ldq, int64_t)
+
+ #if defined(CONFIG_USER_ONLY)
+ #define HELPER_ST(name, insn, type) \
+-static inline void do_##name(target_ulong addr, type val, int mem_idx) \
++static inline void do_##name(CPUMIPSState *env, target_ulong addr, \
++ type val, int mem_idx) \
+ { \
+ insn##_raw(addr, val); \
+ }
+ #else
+ #define HELPER_ST(name, insn, type) \
+-static inline void do_##name(target_ulong addr, type val, int mem_idx) \
++static inline void do_##name(CPUMIPSState *env, target_ulong addr, \
++ type val, int mem_idx) \
+ { \
+ switch (mem_idx) \
+ { \
+- case 0: insn##_kernel(addr, val); break; \
+- case 1: insn##_super(addr, val); break; \
++ case 0: cpu_##insn##_kernel(env, addr, val); break; \
++ case 1: cpu_##insn##_super(env, addr, val); break; \
+ default: \
+- case 2: insn##_user(addr, val); break; \
++ case 2: cpu_##insn##_user(env, addr, val); break; \
+ } \
+ }
+ #endif
+@@ -187,12 +190,12 @@ target_ulong helper_dclz (target_ulong arg1)
+ #endif /* TARGET_MIPS64 */
+
+ /* 64 bits arithmetic for 32 bits hosts */
+-static inline uint64_t get_HILO (void)
++static inline uint64_t get_HILO(CPUMIPSState *env)
+ {
+ return ((uint64_t)(env->active_tc.HI[0]) << 32) | (uint32_t)env->active_tc.LO[0];
+ }
+
+-static inline target_ulong set_HIT0_LO(uint64_t HILO)
++static inline target_ulong set_HIT0_LO(CPUMIPSState *env, uint64_t HILO)
+ {
+ target_ulong tmp;
+ env->active_tc.LO[0] = (int32_t)(HILO & 0xFFFFFFFF);
+@@ -200,7 +203,7 @@ static inline target_ulong set_HIT0_LO(uint64_t HILO)
+ return tmp;
+ }
+
+-static inline target_ulong set_HI_LOT0(uint64_t HILO)
++static inline target_ulong set_HI_LOT0(CPUMIPSState *env, uint64_t HILO)
+ {
+ target_ulong tmp = env->active_tc.LO[0] = (int32_t)(HILO & 0xFFFFFFFF);
+ env->active_tc.HI[0] = (int32_t)(HILO >> 32);
+@@ -208,91 +211,110 @@ static inline target_ulong set_HI_LOT0(uint64_t HILO)
+ }
+
+ /* Multiplication variants of the vr54xx. */
+-target_ulong helper_muls (target_ulong arg1, target_ulong arg2)
++target_ulong helper_muls(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0(0 - ((int64_t)(int32_t)arg1 * (int64_t)(int32_t)arg2));
++ return set_HI_LOT0(env, 0 - ((int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2));
+ }
+
+-target_ulong helper_mulsu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_mulsu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0(0 - (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
++ return set_HI_LOT0(env, 0 - (uint64_t)(uint32_t)arg1 *
++ (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_macc (target_ulong arg1, target_ulong arg2)
++target_ulong helper_macc(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0((int64_t)get_HILO() + (int64_t)(int32_t)arg1 *
+- (int64_t)(int32_t)arg2);
++ return set_HI_LOT0(env, (int64_t)get_HILO(env) + (int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_macchi (target_ulong arg1, target_ulong arg2)
++target_ulong helper_macchi(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((int64_t)get_HILO() + (int64_t)(int32_t)arg1 *
+- (int64_t)(int32_t)arg2);
++ return set_HIT0_LO(env, (int64_t)get_HILO(env) + (int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_maccu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_maccu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0((uint64_t)get_HILO() + (uint64_t)(uint32_t)arg1 *
+- (uint64_t)(uint32_t)arg2);
++ return set_HI_LOT0(env, (uint64_t)get_HILO(env) +
++ (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_macchiu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_macchiu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((uint64_t)get_HILO() + (uint64_t)(uint32_t)arg1 *
+- (uint64_t)(uint32_t)arg2);
++ return set_HIT0_LO(env, (uint64_t)get_HILO(env) +
++ (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_msac (target_ulong arg1, target_ulong arg2)
++target_ulong helper_msac(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0((int64_t)get_HILO() - (int64_t)(int32_t)arg1 *
+- (int64_t)(int32_t)arg2);
++ return set_HI_LOT0(env, (int64_t)get_HILO(env) - (int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_msachi (target_ulong arg1, target_ulong arg2)
++target_ulong helper_msachi(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((int64_t)get_HILO() - (int64_t)(int32_t)arg1 *
+- (int64_t)(int32_t)arg2);
++ return set_HIT0_LO(env, (int64_t)get_HILO(env) - (int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_msacu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_msacu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HI_LOT0((uint64_t)get_HILO() - (uint64_t)(uint32_t)arg1 *
+- (uint64_t)(uint32_t)arg2);
++ return set_HI_LOT0(env, (uint64_t)get_HILO(env) -
++ (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_msachiu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_msachiu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((uint64_t)get_HILO() - (uint64_t)(uint32_t)arg1 *
+- (uint64_t)(uint32_t)arg2);
++ return set_HIT0_LO(env, (uint64_t)get_HILO(env) -
++ (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_mulhi (target_ulong arg1, target_ulong arg2)
++target_ulong helper_mulhi(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((int64_t)(int32_t)arg1 * (int64_t)(int32_t)arg2);
++ return set_HIT0_LO(env, (int64_t)(int32_t)arg1 * (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_mulhiu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_mulhiu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO((uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
++ return set_HIT0_LO(env, (uint64_t)(uint32_t)arg1 *
++ (uint64_t)(uint32_t)arg2);
+ }
+
+-target_ulong helper_mulshi (target_ulong arg1, target_ulong arg2)
++target_ulong helper_mulshi(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO(0 - (int64_t)(int32_t)arg1 * (int64_t)(int32_t)arg2);
++ return set_HIT0_LO(env, 0 - (int64_t)(int32_t)arg1 *
++ (int64_t)(int32_t)arg2);
+ }
+
+-target_ulong helper_mulshiu (target_ulong arg1, target_ulong arg2)
++target_ulong helper_mulshiu(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2)
+ {
+- return set_HIT0_LO(0 - (uint64_t)(uint32_t)arg1 * (uint64_t)(uint32_t)arg2);
++ return set_HIT0_LO(env, 0 - (uint64_t)(uint32_t)arg1 *
++ (uint64_t)(uint32_t)arg2);
+ }
+
+ #ifdef TARGET_MIPS64
+-void helper_dmult (target_ulong arg1, target_ulong arg2)
++void helper_dmult(CPUMIPSState *env, target_ulong arg1, target_ulong arg2)
+ {
+ muls64(&(env->active_tc.LO[0]), &(env->active_tc.HI[0]), arg1, arg2);
+ }
+
+-void helper_dmultu (target_ulong arg1, target_ulong arg2)
++void helper_dmultu(CPUMIPSState *env, target_ulong arg1, target_ulong arg2)
+ {
+ mulu64(&(env->active_tc.LO[0]), &(env->active_tc.HI[0]), arg1, arg2);
+ }
+@@ -300,7 +322,9 @@ void helper_dmultu (target_ulong arg1, target_ulong arg2)
+
+ #ifndef CONFIG_USER_ONLY
+
+-static inline target_phys_addr_t do_translate_address(target_ulong address, int rw)
++static inline target_phys_addr_t do_translate_address(CPUMIPSState *env,
++ target_ulong address,
++ int rw)
+ {
+ target_phys_addr_t lladdr;
+
+@@ -314,10 +338,10 @@ static inline target_phys_addr_t do_translate_address(target_ulong address, int
+ }
+
+ #define HELPER_LD_ATOMIC(name, insn) \
+-target_ulong helper_##name(target_ulong arg, int mem_idx) \
++target_ulong helper_##name(CPUMIPSState *env, target_ulong arg, int mem_idx) \
+ { \
+- env->lladdr = do_translate_address(arg, 0); \
+- env->llval = do_##insn(arg, mem_idx); \
++ env->lladdr = do_translate_address(env, arg, 0); \
++ env->llval = do_##insn(env, arg, mem_idx); \
+ return env->llval; \
+ }
+ HELPER_LD_ATOMIC(ll, lw)
+@@ -327,18 +351,19 @@ HELPER_LD_ATOMIC(lld, ld)
+ #undef HELPER_LD_ATOMIC
+
+ #define HELPER_ST_ATOMIC(name, ld_insn, st_insn, almask) \
+-target_ulong helper_##name(target_ulong arg1, target_ulong arg2, int mem_idx) \
++target_ulong helper_##name(CPUMIPSState *env, target_ulong arg1, \
++ target_ulong arg2, int mem_idx) \
+ { \
+ target_long tmp; \
+ \
+ if (arg2 & almask) { \
+ env->CP0_BadVAddr = arg2; \
+- helper_raise_exception(EXCP_AdES); \
++ helper_raise_exception(env, EXCP_AdES); \
+ } \
+- if (do_translate_address(arg2, 1) == env->lladdr) { \
+- tmp = do_##ld_insn(arg2, mem_idx); \
++ if (do_translate_address(env, arg2, 1) == env->lladdr) { \
++ tmp = do_##ld_insn(env, arg2, mem_idx); \
+ if (tmp == env->llval) { \
+- do_##st_insn(arg2, arg1, mem_idx); \
++ do_##st_insn(env, arg2, arg1, mem_idx); \
+ return 1; \
+ } \
+ } \
+@@ -359,80 +384,84 @@ HELPER_ST_ATOMIC(scd, ld, sd, 0x7)
+ #define GET_OFFSET(addr, offset) (addr - (offset))
+ #endif
+
+-target_ulong helper_lwl(target_ulong arg1, target_ulong arg2, int mem_idx)
++target_ulong helper_lwl(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2, int mem_idx)
+ {
+ target_ulong tmp;
+
+- tmp = do_lbu(arg2, mem_idx);
++ tmp = do_lbu(env, arg2, mem_idx);
+ arg1 = (arg1 & 0x00FFFFFF) | (tmp << 24);
+
+ if (GET_LMASK(arg2) <= 2) {
+- tmp = do_lbu(GET_OFFSET(arg2, 1), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 1), mem_idx);
+ arg1 = (arg1 & 0xFF00FFFF) | (tmp << 16);
+ }
+
+ if (GET_LMASK(arg2) <= 1) {
+- tmp = do_lbu(GET_OFFSET(arg2, 2), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 2), mem_idx);
+ arg1 = (arg1 & 0xFFFF00FF) | (tmp << 8);
+ }
+
+ if (GET_LMASK(arg2) == 0) {
+- tmp = do_lbu(GET_OFFSET(arg2, 3), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 3), mem_idx);
+ arg1 = (arg1 & 0xFFFFFF00) | tmp;
+ }
+ return (int32_t)arg1;
+ }
+
+-target_ulong helper_lwr(target_ulong arg1, target_ulong arg2, int mem_idx)
++target_ulong helper_lwr(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2, int mem_idx)
+ {
+ target_ulong tmp;
+
+- tmp = do_lbu(arg2, mem_idx);
++ tmp = do_lbu(env, arg2, mem_idx);
+ arg1 = (arg1 & 0xFFFFFF00) | tmp;
+
+ if (GET_LMASK(arg2) >= 1) {
+- tmp = do_lbu(GET_OFFSET(arg2, -1), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -1), mem_idx);
+ arg1 = (arg1 & 0xFFFF00FF) | (tmp << 8);
+ }
+
+ if (GET_LMASK(arg2) >= 2) {
+- tmp = do_lbu(GET_OFFSET(arg2, -2), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -2), mem_idx);
+ arg1 = (arg1 & 0xFF00FFFF) | (tmp << 16);
+ }
+
+ if (GET_LMASK(arg2) == 3) {
+- tmp = do_lbu(GET_OFFSET(arg2, -3), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -3), mem_idx);
+ arg1 = (arg1 & 0x00FFFFFF) | (tmp << 24);
+ }
+ return (int32_t)arg1;
+ }
+
+-void helper_swl(target_ulong arg1, target_ulong arg2, int mem_idx)
++void helper_swl(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
++ int mem_idx)
+ {
+- do_sb(arg2, (uint8_t)(arg1 >> 24), mem_idx);
++ do_sb(env, arg2, (uint8_t)(arg1 >> 24), mem_idx);
+
+ if (GET_LMASK(arg2) <= 2)
+- do_sb(GET_OFFSET(arg2, 1), (uint8_t)(arg1 >> 16), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 1), (uint8_t)(arg1 >> 16), mem_idx);
+
+ if (GET_LMASK(arg2) <= 1)
+- do_sb(GET_OFFSET(arg2, 2), (uint8_t)(arg1 >> 8), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 2), (uint8_t)(arg1 >> 8), mem_idx);
+
+ if (GET_LMASK(arg2) == 0)
+- do_sb(GET_OFFSET(arg2, 3), (uint8_t)arg1, mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 3), (uint8_t)arg1, mem_idx);
+ }
+
+-void helper_swr(target_ulong arg1, target_ulong arg2, int mem_idx)
++void helper_swr(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
++ int mem_idx)
+ {
+- do_sb(arg2, (uint8_t)arg1, mem_idx);
++ do_sb(env, arg2, (uint8_t)arg1, mem_idx);
+
+ if (GET_LMASK(arg2) >= 1)
+- do_sb(GET_OFFSET(arg2, -1), (uint8_t)(arg1 >> 8), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -1), (uint8_t)(arg1 >> 8), mem_idx);
+
+ if (GET_LMASK(arg2) >= 2)
+- do_sb(GET_OFFSET(arg2, -2), (uint8_t)(arg1 >> 16), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -2), (uint8_t)(arg1 >> 16), mem_idx);
+
+ if (GET_LMASK(arg2) == 3)
+- do_sb(GET_OFFSET(arg2, -3), (uint8_t)(arg1 >> 24), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -3), (uint8_t)(arg1 >> 24), mem_idx);
+ }
+
+ #if defined(TARGET_MIPS64)
+@@ -445,167 +474,172 @@ void helper_swr(target_ulong arg1, target_ulong arg2, int mem_idx)
+ #define GET_LMASK64(v) (((v) & 7) ^ 7)
+ #endif
+
+-target_ulong helper_ldl(target_ulong arg1, target_ulong arg2, int mem_idx)
++target_ulong helper_ldl(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2, int mem_idx)
+ {
+ uint64_t tmp;
+
+- tmp = do_lbu(arg2, mem_idx);
++ tmp = do_lbu(env, arg2, mem_idx);
+ arg1 = (arg1 & 0x00FFFFFFFFFFFFFFULL) | (tmp << 56);
+
+ if (GET_LMASK64(arg2) <= 6) {
+- tmp = do_lbu(GET_OFFSET(arg2, 1), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 1), mem_idx);
+ arg1 = (arg1 & 0xFF00FFFFFFFFFFFFULL) | (tmp << 48);
+ }
+
+ if (GET_LMASK64(arg2) <= 5) {
+- tmp = do_lbu(GET_OFFSET(arg2, 2), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 2), mem_idx);
+ arg1 = (arg1 & 0xFFFF00FFFFFFFFFFULL) | (tmp << 40);
+ }
+
+ if (GET_LMASK64(arg2) <= 4) {
+- tmp = do_lbu(GET_OFFSET(arg2, 3), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 3), mem_idx);
+ arg1 = (arg1 & 0xFFFFFF00FFFFFFFFULL) | (tmp << 32);
+ }
+
+ if (GET_LMASK64(arg2) <= 3) {
+- tmp = do_lbu(GET_OFFSET(arg2, 4), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 4), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFF00FFFFFFULL) | (tmp << 24);
+ }
+
+ if (GET_LMASK64(arg2) <= 2) {
+- tmp = do_lbu(GET_OFFSET(arg2, 5), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 5), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFF00FFFFULL) | (tmp << 16);
+ }
+
+ if (GET_LMASK64(arg2) <= 1) {
+- tmp = do_lbu(GET_OFFSET(arg2, 6), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 6), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFFFF00FFULL) | (tmp << 8);
+ }
+
+ if (GET_LMASK64(arg2) == 0) {
+- tmp = do_lbu(GET_OFFSET(arg2, 7), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, 7), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFFFFFF00ULL) | tmp;
+ }
+
+ return arg1;
+ }
+
+-target_ulong helper_ldr(target_ulong arg1, target_ulong arg2, int mem_idx)
++target_ulong helper_ldr(CPUMIPSState *env, target_ulong arg1,
++ target_ulong arg2, int mem_idx)
+ {
+ uint64_t tmp;
+
+- tmp = do_lbu(arg2, mem_idx);
++ tmp = do_lbu(env, arg2, mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFFFFFF00ULL) | tmp;
+
+ if (GET_LMASK64(arg2) >= 1) {
+- tmp = do_lbu(GET_OFFSET(arg2, -1), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -1), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFFFF00FFULL) | (tmp << 8);
+ }
+
+ if (GET_LMASK64(arg2) >= 2) {
+- tmp = do_lbu(GET_OFFSET(arg2, -2), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -2), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFFFF00FFFFULL) | (tmp << 16);
+ }
+
+ if (GET_LMASK64(arg2) >= 3) {
+- tmp = do_lbu(GET_OFFSET(arg2, -3), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -3), mem_idx);
+ arg1 = (arg1 & 0xFFFFFFFF00FFFFFFULL) | (tmp << 24);
+ }
+
+ if (GET_LMASK64(arg2) >= 4) {
+- tmp = do_lbu(GET_OFFSET(arg2, -4), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -4), mem_idx);
+ arg1 = (arg1 & 0xFFFFFF00FFFFFFFFULL) | (tmp << 32);
+ }
+
+ if (GET_LMASK64(arg2) >= 5) {
+- tmp = do_lbu(GET_OFFSET(arg2, -5), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -5), mem_idx);
+ arg1 = (arg1 & 0xFFFF00FFFFFFFFFFULL) | (tmp << 40);
+ }
+
+ if (GET_LMASK64(arg2) >= 6) {
+- tmp = do_lbu(GET_OFFSET(arg2, -6), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -6), mem_idx);
+ arg1 = (arg1 & 0xFF00FFFFFFFFFFFFULL) | (tmp << 48);
+ }
+
+ if (GET_LMASK64(arg2) == 7) {
+- tmp = do_lbu(GET_OFFSET(arg2, -7), mem_idx);
++ tmp = do_lbu(env, GET_OFFSET(arg2, -7), mem_idx);
+ arg1 = (arg1 & 0x00FFFFFFFFFFFFFFULL) | (tmp << 56);
+ }
+
+ return arg1;
+ }
+
+-void helper_sdl(target_ulong arg1, target_ulong arg2, int mem_idx)
++void helper_sdl(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
++ int mem_idx)
+ {
+- do_sb(arg2, (uint8_t)(arg1 >> 56), mem_idx);
++ do_sb(env, arg2, (uint8_t)(arg1 >> 56), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 6)
+- do_sb(GET_OFFSET(arg2, 1), (uint8_t)(arg1 >> 48), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 1), (uint8_t)(arg1 >> 48), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 5)
+- do_sb(GET_OFFSET(arg2, 2), (uint8_t)(arg1 >> 40), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 2), (uint8_t)(arg1 >> 40), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 4)
+- do_sb(GET_OFFSET(arg2, 3), (uint8_t)(arg1 >> 32), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 3), (uint8_t)(arg1 >> 32), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 3)
+- do_sb(GET_OFFSET(arg2, 4), (uint8_t)(arg1 >> 24), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 4), (uint8_t)(arg1 >> 24), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 2)
+- do_sb(GET_OFFSET(arg2, 5), (uint8_t)(arg1 >> 16), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 5), (uint8_t)(arg1 >> 16), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 1)
+- do_sb(GET_OFFSET(arg2, 6), (uint8_t)(arg1 >> 8), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 6), (uint8_t)(arg1 >> 8), mem_idx);
+
+ if (GET_LMASK64(arg2) <= 0)
+- do_sb(GET_OFFSET(arg2, 7), (uint8_t)arg1, mem_idx);
++ do_sb(env, GET_OFFSET(arg2, 7), (uint8_t)arg1, mem_idx);
+ }
+
+-void helper_sdr(target_ulong arg1, target_ulong arg2, int mem_idx)
++void helper_sdr(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
++ int mem_idx)
+ {
+- do_sb(arg2, (uint8_t)arg1, mem_idx);
++ do_sb(env, arg2, (uint8_t)arg1, mem_idx);
+
+ if (GET_LMASK64(arg2) >= 1)
+- do_sb(GET_OFFSET(arg2, -1), (uint8_t)(arg1 >> 8), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -1), (uint8_t)(arg1 >> 8), mem_idx);
+
+ if (GET_LMASK64(arg2) >= 2)
+- do_sb(GET_OFFSET(arg2, -2), (uint8_t)(arg1 >> 16), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -2), (uint8_t)(arg1 >> 16), mem_idx);
+
+ if (GET_LMASK64(arg2) >= 3)
+- do_sb(GET_OFFSET(arg2, -3), (uint8_t)(arg1 >> 24), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -3), (uint8_t)(arg1 >> 24), mem_idx);
+
+ if (GET_LMASK64(arg2) >= 4)
+- do_sb(GET_OFFSET(arg2, -4), (uint8_t)(arg1 >> 32), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -4), (uint8_t)(arg1 >> 32), mem_idx);
+
+ if (GET_LMASK64(arg2) >= 5)
+- do_sb(GET_OFFSET(arg2, -5), (uint8_t)(arg1 >> 40), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -5), (uint8_t)(arg1 >> 40), mem_idx);
+
+ if (GET_LMASK64(arg2) >= 6)
+- do_sb(GET_OFFSET(arg2, -6), (uint8_t)(arg1 >> 48), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -6), (uint8_t)(arg1 >> 48), mem_idx);
+
+ if (GET_LMASK64(arg2) == 7)
+- do_sb(GET_OFFSET(arg2, -7), (uint8_t)(arg1 >> 56), mem_idx);
++ do_sb(env, GET_OFFSET(arg2, -7), (uint8_t)(arg1 >> 56), mem_idx);
+ }
+ #endif /* TARGET_MIPS64 */
+
+ static const int multiple_regs[] = { 16, 17, 18, 19, 20, 21, 22, 23, 30 };
+
+-void helper_lwm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
++void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
++ uint32_t mem_idx)
+ {
+ target_ulong base_reglist = reglist & 0xf;
+ target_ulong do_r31 = reglist & 0x10;
+ #ifdef CONFIG_USER_ONLY
+ #undef ldfun
+-#define ldfun ldl_raw
++#define ldfun(env, addr) ldl_raw(addr)
+ #else
+- uint32_t (*ldfun)(target_ulong);
++ uint32_t (*ldfun)(CPUMIPSState *env, target_ulong);
+
+ switch (mem_idx)
+ {
+- case 0: ldfun = ldl_kernel; break;
+- case 1: ldfun = ldl_super; break;
++ case 0: ldfun = cpu_ldl_kernel; break;
++ case 1: ldfun = cpu_ldl_super; break;
+ default:
+- case 2: ldfun = ldl_user; break;
++ case 2: ldfun = cpu_ldl_user; break;
+ }
+ #endif
+
+@@ -613,32 +647,33 @@ void helper_lwm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
+ target_ulong i;
+
+ for (i = 0; i < base_reglist; i++) {
+- env->active_tc.gpr[multiple_regs[i]] = (target_long) ldfun(addr);
++ env->active_tc.gpr[multiple_regs[i]] = (target_long)ldfun(env, addr);
+ addr += 4;
+ }
+ }
+
+ if (do_r31) {
+- env->active_tc.gpr[31] = (target_long) ldfun(addr);
++ env->active_tc.gpr[31] = (target_long)ldfun(env, addr);
+ }
+ }
+
+-void helper_swm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
++void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
++ uint32_t mem_idx)
+ {
+ target_ulong base_reglist = reglist & 0xf;
+ target_ulong do_r31 = reglist & 0x10;
+ #ifdef CONFIG_USER_ONLY
+ #undef stfun
+-#define stfun stl_raw
++#define stfun(env, addr, val) stl_raw(addr, val)
+ #else
+- void (*stfun)(target_ulong, uint32_t);
++ void (*stfun)(CPUMIPSState *env, target_ulong, uint32_t);
+
+ switch (mem_idx)
+ {
+- case 0: stfun = stl_kernel; break;
+- case 1: stfun = stl_super; break;
++ case 0: stfun = cpu_stl_kernel; break;
++ case 1: stfun = cpu_stl_super; break;
+ default:
+- case 2: stfun = stl_user; break;
++ case 2: stfun = cpu_stl_user; break;
+ }
+ #endif
+
+@@ -646,33 +681,34 @@ void helper_swm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
+ target_ulong i;
+
+ for (i = 0; i < base_reglist; i++) {
+- stfun(addr, env->active_tc.gpr[multiple_regs[i]]);
++ stfun(env, addr, env->active_tc.gpr[multiple_regs[i]]);
+ addr += 4;
+ }
+ }
+
+ if (do_r31) {
+- stfun(addr, env->active_tc.gpr[31]);
++ stfun(env, addr, env->active_tc.gpr[31]);
+ }
+ }
+
+ #if defined(TARGET_MIPS64)
+-void helper_ldm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
++void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
++ uint32_t mem_idx)
+ {
+ target_ulong base_reglist = reglist & 0xf;
+ target_ulong do_r31 = reglist & 0x10;
+ #ifdef CONFIG_USER_ONLY
+ #undef ldfun
+-#define ldfun ldq_raw
++#define ldfun(env, addr) ldq_raw(addr)
+ #else
+- uint64_t (*ldfun)(target_ulong);
++ uint64_t (*ldfun)(CPUMIPSState *env, target_ulong);
+
+ switch (mem_idx)
+ {
+- case 0: ldfun = ldq_kernel; break;
+- case 1: ldfun = ldq_super; break;
++ case 0: ldfun = cpu_ldq_kernel; break;
++ case 1: ldfun = cpu_ldq_super; break;
+ default:
+- case 2: ldfun = ldq_user; break;
++ case 2: ldfun = cpu_ldq_user; break;
+ }
+ #endif
+
+@@ -680,32 +716,33 @@ void helper_ldm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
+ target_ulong i;
+
+ for (i = 0; i < base_reglist; i++) {
+- env->active_tc.gpr[multiple_regs[i]] = ldfun(addr);
++ env->active_tc.gpr[multiple_regs[i]] = ldfun(env, addr);
+ addr += 8;
+ }
+ }
+
+ if (do_r31) {
+- env->active_tc.gpr[31] = ldfun(addr);
++ env->active_tc.gpr[31] = ldfun(env, addr);
+ }
+ }
+
+-void helper_sdm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
++void helper_sdm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
++ uint32_t mem_idx)
+ {
+ target_ulong base_reglist = reglist & 0xf;
+ target_ulong do_r31 = reglist & 0x10;
+ #ifdef CONFIG_USER_ONLY
+ #undef stfun
+-#define stfun stq_raw
++#define stfun(env, addr, val) stq_raw(addr, val)
+ #else
+- void (*stfun)(target_ulong, uint64_t);
++ void (*stfun)(CPUMIPSState *env, target_ulong, uint64_t);
+
+ switch (mem_idx)
+ {
+- case 0: stfun = stq_kernel; break;
+- case 1: stfun = stq_super; break;
++ case 0: stfun = cpu_stq_kernel; break;
++ case 1: stfun = cpu_stq_super; break;
+ default:
+- case 2: stfun = stq_user; break;
++ case 2: stfun = cpu_stq_user; break;
+ }
+ #endif
+
+@@ -713,13 +750,13 @@ void helper_sdm (target_ulong addr, target_ulong reglist, uint32_t mem_idx)
+ target_ulong i;
+
+ for (i = 0; i < base_reglist; i++) {
+- stfun(addr, env->active_tc.gpr[multiple_regs[i]]);
++ stfun(env, addr, env->active_tc.gpr[multiple_regs[i]]);
+ addr += 8;
+ }
+ }
+
+ if (do_r31) {
+- stfun(addr, env->active_tc.gpr[31]);
++ stfun(env, addr, env->active_tc.gpr[31]);
+ }
+ }
+ #endif
+@@ -772,7 +809,7 @@ static inline void mips_tc_sleep(CPUMIPSState *c, int tc)
+ FIXME: This code assumes that all VPEs have the same number of TCs,
+ which depends on runtime setup. Can probably be fixed by
+ walking the list of CPUMIPSStates. */
+-static CPUMIPSState *mips_cpu_map_tc(int *tc)
++static CPUMIPSState *mips_cpu_map_tc(CPUMIPSState *env, int *tc)
+ {
+ CPUMIPSState *other;
+ int vpe_idx, nr_threads = env->nr_threads;
+@@ -799,7 +836,7 @@ static CPUMIPSState *mips_cpu_map_tc(int *tc)
+ These helper call synchronizes the regs for a given cpu. */
+
+ /* Called for updates to CP0_Status. */
+-static void sync_c0_status(CPUMIPSState *cpu, int tc)
++static void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc)
+ {
+ int32_t tcstatus, *tcst;
+ uint32_t v = cpu->CP0_Status;
+@@ -834,7 +871,8 @@ static void sync_c0_status(CPUMIPSState *cpu, int tc)
+ }
+
+ /* Called for updates to CP0_TCStatus. */
+-static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc, target_ulong v)
++static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc,
++ target_ulong v)
+ {
+ uint32_t status;
+ uint32_t tcu, tmx, tasid, tksu;
+@@ -883,35 +921,35 @@ static void sync_c0_entryhi(CPUMIPSState *cpu, int tc)
+ }
+
+ /* CP0 helpers */
+-target_ulong helper_mfc0_mvpcontrol (void)
++target_ulong helper_mfc0_mvpcontrol(CPUMIPSState *env)
+ {
+ return env->mvp->CP0_MVPControl;
+ }
+
+-target_ulong helper_mfc0_mvpconf0 (void)
++target_ulong helper_mfc0_mvpconf0(CPUMIPSState *env)
+ {
+ return env->mvp->CP0_MVPConf0;
+ }
+
+-target_ulong helper_mfc0_mvpconf1 (void)
++target_ulong helper_mfc0_mvpconf1(CPUMIPSState *env)
+ {
+ return env->mvp->CP0_MVPConf1;
+ }
+
+-target_ulong helper_mfc0_random (void)
++target_ulong helper_mfc0_random(CPUMIPSState *env)
+ {
+ return (int32_t)cpu_mips_get_random(env);
+ }
+
+-target_ulong helper_mfc0_tcstatus (void)
++target_ulong helper_mfc0_tcstatus(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCStatus;
+ }
+
+-target_ulong helper_mftc0_tcstatus(void)
++target_ulong helper_mftc0_tcstatus(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCStatus;
+@@ -919,15 +957,15 @@ target_ulong helper_mftc0_tcstatus(void)
+ return other->tcs[other_tc].CP0_TCStatus;
+ }
+
+-target_ulong helper_mfc0_tcbind (void)
++target_ulong helper_mfc0_tcbind(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCBind;
+ }
+
+-target_ulong helper_mftc0_tcbind(void)
++target_ulong helper_mftc0_tcbind(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCBind;
+@@ -935,15 +973,15 @@ target_ulong helper_mftc0_tcbind(void)
+ return other->tcs[other_tc].CP0_TCBind;
+ }
+
+-target_ulong helper_mfc0_tcrestart (void)
++target_ulong helper_mfc0_tcrestart(CPUMIPSState *env)
+ {
+ return env->active_tc.PC;
+ }
+
+-target_ulong helper_mftc0_tcrestart(void)
++target_ulong helper_mftc0_tcrestart(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.PC;
+@@ -951,15 +989,15 @@ target_ulong helper_mftc0_tcrestart(void)
+ return other->tcs[other_tc].PC;
+ }
+
+-target_ulong helper_mfc0_tchalt (void)
++target_ulong helper_mfc0_tchalt(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCHalt;
+ }
+
+-target_ulong helper_mftc0_tchalt(void)
++target_ulong helper_mftc0_tchalt(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCHalt;
+@@ -967,15 +1005,15 @@ target_ulong helper_mftc0_tchalt(void)
+ return other->tcs[other_tc].CP0_TCHalt;
+ }
+
+-target_ulong helper_mfc0_tccontext (void)
++target_ulong helper_mfc0_tccontext(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCContext;
+ }
+
+-target_ulong helper_mftc0_tccontext(void)
++target_ulong helper_mftc0_tccontext(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCContext;
+@@ -983,15 +1021,15 @@ target_ulong helper_mftc0_tccontext(void)
+ return other->tcs[other_tc].CP0_TCContext;
+ }
+
+-target_ulong helper_mfc0_tcschedule (void)
++target_ulong helper_mfc0_tcschedule(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCSchedule;
+ }
+
+-target_ulong helper_mftc0_tcschedule(void)
++target_ulong helper_mftc0_tcschedule(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCSchedule;
+@@ -999,15 +1037,15 @@ target_ulong helper_mftc0_tcschedule(void)
+ return other->tcs[other_tc].CP0_TCSchedule;
+ }
+
+-target_ulong helper_mfc0_tcschefback (void)
++target_ulong helper_mfc0_tcschefback(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCScheFBack;
+ }
+
+-target_ulong helper_mftc0_tcschefback(void)
++target_ulong helper_mftc0_tcschefback(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.CP0_TCScheFBack;
+@@ -1015,24 +1053,24 @@ target_ulong helper_mftc0_tcschefback(void)
+ return other->tcs[other_tc].CP0_TCScheFBack;
+ }
+
+-target_ulong helper_mfc0_count (void)
++target_ulong helper_mfc0_count(CPUMIPSState *env)
+ {
+ return (int32_t)cpu_mips_get_count(env);
+ }
+
+-target_ulong helper_mftc0_entryhi(void)
++target_ulong helper_mftc0_entryhi(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ return other->CP0_EntryHi;
+ }
+
+-target_ulong helper_mftc0_cause(void)
++target_ulong helper_mftc0_cause(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+ int32_t tccause;
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc) {
+ tccause = other->CP0_Cause;
+@@ -1043,30 +1081,30 @@ target_ulong helper_mftc0_cause(void)
+ return tccause;
+ }
+
+-target_ulong helper_mftc0_status(void)
++target_ulong helper_mftc0_status(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ return other->CP0_Status;
+ }
+
+-target_ulong helper_mfc0_lladdr (void)
++target_ulong helper_mfc0_lladdr(CPUMIPSState *env)
+ {
+ return (int32_t)(env->lladdr >> env->CP0_LLAddr_shift);
+ }
+
+-target_ulong helper_mfc0_watchlo (uint32_t sel)
++target_ulong helper_mfc0_watchlo(CPUMIPSState *env, uint32_t sel)
+ {
+ return (int32_t)env->CP0_WatchLo[sel];
+ }
+
+-target_ulong helper_mfc0_watchhi (uint32_t sel)
++target_ulong helper_mfc0_watchhi(CPUMIPSState *env, uint32_t sel)
+ {
+ return env->CP0_WatchHi[sel];
+ }
+
+-target_ulong helper_mfc0_debug (void)
++target_ulong helper_mfc0_debug(CPUMIPSState *env)
+ {
+ target_ulong t0 = env->CP0_Debug;
+ if (env->hflags & MIPS_HFLAG_DM)
+@@ -1075,11 +1113,11 @@ target_ulong helper_mfc0_debug (void)
+ return t0;
+ }
+
+-target_ulong helper_mftc0_debug(void)
++target_ulong helper_mftc0_debug(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+ int32_t tcstatus;
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ tcstatus = other->active_tc.CP0_Debug_tcstatus;
+@@ -1092,43 +1130,43 @@ target_ulong helper_mftc0_debug(void)
+ }
+
+ #if defined(TARGET_MIPS64)
+-target_ulong helper_dmfc0_tcrestart (void)
++target_ulong helper_dmfc0_tcrestart(CPUMIPSState *env)
+ {
+ return env->active_tc.PC;
+ }
+
+-target_ulong helper_dmfc0_tchalt (void)
++target_ulong helper_dmfc0_tchalt(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCHalt;
+ }
+
+-target_ulong helper_dmfc0_tccontext (void)
++target_ulong helper_dmfc0_tccontext(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCContext;
+ }
+
+-target_ulong helper_dmfc0_tcschedule (void)
++target_ulong helper_dmfc0_tcschedule(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCSchedule;
+ }
+
+-target_ulong helper_dmfc0_tcschefback (void)
++target_ulong helper_dmfc0_tcschefback(CPUMIPSState *env)
+ {
+ return env->active_tc.CP0_TCScheFBack;
+ }
+
+-target_ulong helper_dmfc0_lladdr (void)
++target_ulong helper_dmfc0_lladdr(CPUMIPSState *env)
+ {
+ return env->lladdr >> env->CP0_LLAddr_shift;
+ }
+
+-target_ulong helper_dmfc0_watchlo (uint32_t sel)
++target_ulong helper_dmfc0_watchlo(CPUMIPSState *env, uint32_t sel)
+ {
+ return env->CP0_WatchLo[sel];
+ }
+ #endif /* TARGET_MIPS64 */
+
+-void helper_mtc0_index (target_ulong arg1)
++void helper_mtc0_index(CPUMIPSState *env, target_ulong arg1)
+ {
+ int num = 1;
+ unsigned int tmp = env->tlb->nb_tlb;
+@@ -1140,7 +1178,7 @@ void helper_mtc0_index (target_ulong arg1)
+ env->CP0_Index = (env->CP0_Index & 0x80000000) | (arg1 & (num - 1));
+ }
+
+-void helper_mtc0_mvpcontrol (target_ulong arg1)
++void helper_mtc0_mvpcontrol(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = 0;
+ uint32_t newval;
+@@ -1157,7 +1195,7 @@ void helper_mtc0_mvpcontrol (target_ulong arg1)
+ env->mvp->CP0_MVPControl = newval;
+ }
+
+-void helper_mtc0_vpecontrol (target_ulong arg1)
++void helper_mtc0_vpecontrol(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask;
+ uint32_t newval;
+@@ -1174,10 +1212,10 @@ void helper_mtc0_vpecontrol (target_ulong arg1)
+ env->CP0_VPEControl = newval;
+ }
+
+-void helper_mttc0_vpecontrol(target_ulong arg1)
++void helper_mttc0_vpecontrol(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+ uint32_t mask;
+ uint32_t newval;
+
+@@ -1190,23 +1228,23 @@ void helper_mttc0_vpecontrol(target_ulong arg1)
+ other->CP0_VPEControl = newval;
+ }
+
+-target_ulong helper_mftc0_vpecontrol(void)
++target_ulong helper_mftc0_vpecontrol(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+ /* FIXME: Mask away return zero on read bits. */
+ return other->CP0_VPEControl;
+ }
+
+-target_ulong helper_mftc0_vpeconf0(void)
++target_ulong helper_mftc0_vpeconf0(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ return other->CP0_VPEConf0;
+ }
+
+-void helper_mtc0_vpeconf0 (target_ulong arg1)
++void helper_mtc0_vpeconf0(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = 0;
+ uint32_t newval;
+@@ -1223,10 +1261,10 @@ void helper_mtc0_vpeconf0 (target_ulong arg1)
+ env->CP0_VPEConf0 = newval;
+ }
+
+-void helper_mttc0_vpeconf0(target_ulong arg1)
++void helper_mttc0_vpeconf0(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+ uint32_t mask = 0;
+ uint32_t newval;
+
+@@ -1237,7 +1275,7 @@ void helper_mttc0_vpeconf0(target_ulong arg1)
+ other->CP0_VPEConf0 = newval;
+ }
+
+-void helper_mtc0_vpeconf1 (target_ulong arg1)
++void helper_mtc0_vpeconf1(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = 0;
+ uint32_t newval;
+@@ -1255,25 +1293,25 @@ void helper_mtc0_vpeconf1 (target_ulong arg1)
+ env->CP0_VPEConf1 = newval;
+ }
+
+-void helper_mtc0_yqmask (target_ulong arg1)
++void helper_mtc0_yqmask(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* Yield qualifier inputs not implemented. */
+ env->CP0_YQMask = 0x00000000;
+ }
+
+-void helper_mtc0_vpeopt (target_ulong arg1)
++void helper_mtc0_vpeopt(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_VPEOpt = arg1 & 0x0000ffff;
+ }
+
+-void helper_mtc0_entrylo0 (target_ulong arg1)
++void helper_mtc0_entrylo0(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* Large physaddr (PABITS) not implemented */
+ /* 1k pages not implemented */
+ env->CP0_EntryLo0 = arg1 & 0x3FFFFFFF;
+ }
+
+-void helper_mtc0_tcstatus (target_ulong arg1)
++void helper_mtc0_tcstatus(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = env->CP0_TCStatus_rw_bitmask;
+ uint32_t newval;
+@@ -1284,10 +1322,10 @@ void helper_mtc0_tcstatus (target_ulong arg1)
+ sync_c0_tcstatus(env, env->current_tc, newval);
+ }
+
+-void helper_mttc0_tcstatus (target_ulong arg1)
++void helper_mttc0_tcstatus(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.CP0_TCStatus = arg1;
+@@ -1296,7 +1334,7 @@ void helper_mttc0_tcstatus (target_ulong arg1)
+ sync_c0_tcstatus(other, other_tc, arg1);
+ }
+
+-void helper_mtc0_tcbind (target_ulong arg1)
++void helper_mtc0_tcbind(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = (1 << CP0TCBd_TBE);
+ uint32_t newval;
+@@ -1307,12 +1345,12 @@ void helper_mtc0_tcbind (target_ulong arg1)
+ env->active_tc.CP0_TCBind = newval;
+ }
+
+-void helper_mttc0_tcbind (target_ulong arg1)
++void helper_mttc0_tcbind(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+ uint32_t mask = (1 << CP0TCBd_TBE);
+ uint32_t newval;
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+ mask |= (1 << CP0TCBd_CurVPE);
+@@ -1325,7 +1363,7 @@ void helper_mttc0_tcbind (target_ulong arg1)
+ }
+ }
+
+-void helper_mtc0_tcrestart (target_ulong arg1)
++void helper_mtc0_tcrestart(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->active_tc.PC = arg1;
+ env->active_tc.CP0_TCStatus &= ~(1 << CP0TCSt_TDS);
+@@ -1333,10 +1371,10 @@ void helper_mtc0_tcrestart (target_ulong arg1)
+ /* MIPS16 not implemented. */
+ }
+
+-void helper_mttc0_tcrestart (target_ulong arg1)
++void helper_mttc0_tcrestart(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc) {
+ other->active_tc.PC = arg1;
+@@ -1351,7 +1389,7 @@ void helper_mttc0_tcrestart (target_ulong arg1)
+ }
+ }
+
+-void helper_mtc0_tchalt (target_ulong arg1)
++void helper_mtc0_tchalt(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->active_tc.CP0_TCHalt = arg1 & 0x1;
+
+@@ -1363,10 +1401,10 @@ void helper_mtc0_tchalt (target_ulong arg1)
+ }
+ }
+
+-void helper_mttc0_tchalt (target_ulong arg1)
++void helper_mttc0_tchalt(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ // TODO: Halt TC / Restart (if allocated+active) TC.
+
+@@ -1382,15 +1420,15 @@ void helper_mttc0_tchalt (target_ulong arg1)
+ }
+ }
+
+-void helper_mtc0_tccontext (target_ulong arg1)
++void helper_mtc0_tccontext(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->active_tc.CP0_TCContext = arg1;
+ }
+
+-void helper_mttc0_tccontext (target_ulong arg1)
++void helper_mttc0_tccontext(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.CP0_TCContext = arg1;
+@@ -1398,15 +1436,15 @@ void helper_mttc0_tccontext (target_ulong arg1)
+ other->tcs[other_tc].CP0_TCContext = arg1;
+ }
+
+-void helper_mtc0_tcschedule (target_ulong arg1)
++void helper_mtc0_tcschedule(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->active_tc.CP0_TCSchedule = arg1;
+ }
+
+-void helper_mttc0_tcschedule (target_ulong arg1)
++void helper_mttc0_tcschedule(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.CP0_TCSchedule = arg1;
+@@ -1414,15 +1452,15 @@ void helper_mttc0_tcschedule (target_ulong arg1)
+ other->tcs[other_tc].CP0_TCSchedule = arg1;
+ }
+
+-void helper_mtc0_tcschefback (target_ulong arg1)
++void helper_mtc0_tcschefback(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->active_tc.CP0_TCScheFBack = arg1;
+ }
+
+-void helper_mttc0_tcschefback (target_ulong arg1)
++void helper_mttc0_tcschefback(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.CP0_TCScheFBack = arg1;
+@@ -1430,25 +1468,25 @@ void helper_mttc0_tcschefback (target_ulong arg1)
+ other->tcs[other_tc].CP0_TCScheFBack = arg1;
+ }
+
+-void helper_mtc0_entrylo1 (target_ulong arg1)
++void helper_mtc0_entrylo1(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* Large physaddr (PABITS) not implemented */
+ /* 1k pages not implemented */
+ env->CP0_EntryLo1 = arg1 & 0x3FFFFFFF;
+ }
+
+-void helper_mtc0_context (target_ulong arg1)
++void helper_mtc0_context(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Context = (env->CP0_Context & 0x007FFFFF) | (arg1 & ~0x007FFFFF);
+ }
+
+-void helper_mtc0_pagemask (target_ulong arg1)
++void helper_mtc0_pagemask(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* 1k pages not implemented */
+ env->CP0_PageMask = arg1 & (0x1FFFFFFF & (TARGET_PAGE_MASK << 1));
+ }
+
+-void helper_mtc0_pagegrain (target_ulong arg1)
++void helper_mtc0_pagegrain(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* SmartMIPS not implemented */
+ /* Large physaddr (PABITS) not implemented */
+@@ -1456,47 +1494,47 @@ void helper_mtc0_pagegrain (target_ulong arg1)
+ env->CP0_PageGrain = 0;
+ }
+
+-void helper_mtc0_wired (target_ulong arg1)
++void helper_mtc0_wired(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Wired = arg1 % env->tlb->nb_tlb;
+ }
+
+-void helper_mtc0_srsconf0 (target_ulong arg1)
++void helper_mtc0_srsconf0(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_SRSConf0 |= arg1 & env->CP0_SRSConf0_rw_bitmask;
+ }
+
+-void helper_mtc0_srsconf1 (target_ulong arg1)
++void helper_mtc0_srsconf1(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_SRSConf1 |= arg1 & env->CP0_SRSConf1_rw_bitmask;
+ }
+
+-void helper_mtc0_srsconf2 (target_ulong arg1)
++void helper_mtc0_srsconf2(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_SRSConf2 |= arg1 & env->CP0_SRSConf2_rw_bitmask;
+ }
+
+-void helper_mtc0_srsconf3 (target_ulong arg1)
++void helper_mtc0_srsconf3(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_SRSConf3 |= arg1 & env->CP0_SRSConf3_rw_bitmask;
+ }
+
+-void helper_mtc0_srsconf4 (target_ulong arg1)
++void helper_mtc0_srsconf4(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_SRSConf4 |= arg1 & env->CP0_SRSConf4_rw_bitmask;
+ }
+
+-void helper_mtc0_hwrena (target_ulong arg1)
++void helper_mtc0_hwrena(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_HWREna = arg1 & 0x0000000F;
+ }
+
+-void helper_mtc0_count (target_ulong arg1)
++void helper_mtc0_count(CPUMIPSState *env, target_ulong arg1)
+ {
+ cpu_mips_store_count(env, arg1);
+ }
+
+-void helper_mtc0_entryhi (target_ulong arg1)
++void helper_mtc0_entryhi(CPUMIPSState *env, target_ulong arg1)
+ {
+ target_ulong old, val;
+
+@@ -1515,21 +1553,21 @@ void helper_mtc0_entryhi (target_ulong arg1)
+ cpu_mips_tlb_flush(env, 1);
+ }
+
+-void helper_mttc0_entryhi(target_ulong arg1)
++void helper_mttc0_entryhi(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ other->CP0_EntryHi = arg1;
+ sync_c0_entryhi(other, other_tc);
+ }
+
+-void helper_mtc0_compare (target_ulong arg1)
++void helper_mtc0_compare(CPUMIPSState *env, target_ulong arg1)
+ {
+ cpu_mips_store_compare(env, arg1);
+ }
+
+-void helper_mtc0_status (target_ulong arg1)
++void helper_mtc0_status(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t val, old;
+ uint32_t mask = env->CP0_Status_rw_bitmask;
+@@ -1538,7 +1576,7 @@ void helper_mtc0_status (target_ulong arg1)
+ old = env->CP0_Status;
+ env->CP0_Status = (env->CP0_Status & ~mask) | val;
+ if (env->CP0_Config3 & (1 << CP0C3_MT)) {
+- sync_c0_status(env, env->current_tc);
++ sync_c0_status(env, env, env->current_tc);
+ } else {
+ compute_hflags(env);
+ }
+@@ -1557,22 +1595,22 @@ void helper_mtc0_status (target_ulong arg1)
+ }
+ }
+
+-void helper_mttc0_status(target_ulong arg1)
++void helper_mttc0_status(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ other->CP0_Status = arg1 & ~0xf1000018;
+- sync_c0_status(other, other_tc);
++ sync_c0_status(env, other, other_tc);
+ }
+
+-void helper_mtc0_intctl (target_ulong arg1)
++void helper_mtc0_intctl(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* vectored interrupts not implemented, no performance counters. */
+ env->CP0_IntCtl = (env->CP0_IntCtl & ~0x000003e0) | (arg1 & 0x000003e0);
+ }
+
+-void helper_mtc0_srsctl (target_ulong arg1)
++void helper_mtc0_srsctl(CPUMIPSState *env, target_ulong arg1)
+ {
+ uint32_t mask = (0xf << CP0SRSCtl_ESS) | (0xf << CP0SRSCtl_PSS);
+ env->CP0_SRSCtl = (env->CP0_SRSCtl & ~mask) | (arg1 & mask);
+@@ -1606,52 +1644,52 @@ static void mtc0_cause(CPUMIPSState *cpu, target_ulong arg1)
+ }
+ }
+
+-void helper_mtc0_cause(target_ulong arg1)
++void helper_mtc0_cause(CPUMIPSState *env, target_ulong arg1)
+ {
+ mtc0_cause(env, arg1);
+ }
+
+-void helper_mttc0_cause(target_ulong arg1)
++void helper_mttc0_cause(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ mtc0_cause(other, arg1);
+ }
+
+-target_ulong helper_mftc0_epc(void)
++target_ulong helper_mftc0_epc(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ return other->CP0_EPC;
+ }
+
+-target_ulong helper_mftc0_ebase(void)
++target_ulong helper_mftc0_ebase(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ return other->CP0_EBase;
+ }
+
+-void helper_mtc0_ebase (target_ulong arg1)
++void helper_mtc0_ebase(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* vectored interrupts not implemented */
+ env->CP0_EBase = (env->CP0_EBase & ~0x3FFFF000) | (arg1 & 0x3FFFF000);
+ }
+
+-void helper_mttc0_ebase(target_ulong arg1)
++void helper_mttc0_ebase(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+ other->CP0_EBase = (other->CP0_EBase & ~0x3FFFF000) | (arg1 & 0x3FFFF000);
+ }
+
+-target_ulong helper_mftc0_configx(target_ulong idx)
++target_ulong helper_mftc0_configx(CPUMIPSState *env, target_ulong idx)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ switch (idx) {
+ case 0: return other->CP0_Config0;
+@@ -1667,49 +1705,49 @@ target_ulong helper_mftc0_configx(target_ulong idx)
+ return 0;
+ }
+
+-void helper_mtc0_config0 (target_ulong arg1)
++void helper_mtc0_config0(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Config0 = (env->CP0_Config0 & 0x81FFFFF8) | (arg1 & 0x00000007);
+ }
+
+-void helper_mtc0_config2 (target_ulong arg1)
++void helper_mtc0_config2(CPUMIPSState *env, target_ulong arg1)
+ {
+ /* tertiary/secondary caches not implemented */
+ env->CP0_Config2 = (env->CP0_Config2 & 0x8FFF0FFF);
+ }
+
+-void helper_mtc0_lladdr (target_ulong arg1)
++void helper_mtc0_lladdr(CPUMIPSState *env, target_ulong arg1)
+ {
+ target_long mask = env->CP0_LLAddr_rw_bitmask;
+ arg1 = arg1 << env->CP0_LLAddr_shift;
+ env->lladdr = (env->lladdr & ~mask) | (arg1 & mask);
+ }
+
+-void helper_mtc0_watchlo (target_ulong arg1, uint32_t sel)
++void helper_mtc0_watchlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ /* Watch exceptions for instructions, data loads, data stores
+ not implemented. */
+ env->CP0_WatchLo[sel] = (arg1 & ~0x7);
+ }
+
+-void helper_mtc0_watchhi (target_ulong arg1, uint32_t sel)
++void helper_mtc0_watchhi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ env->CP0_WatchHi[sel] = (arg1 & 0x40FF0FF8);
+ env->CP0_WatchHi[sel] &= ~(env->CP0_WatchHi[sel] & arg1 & 0x7);
+ }
+
+-void helper_mtc0_xcontext (target_ulong arg1)
++void helper_mtc0_xcontext(CPUMIPSState *env, target_ulong arg1)
+ {
+ target_ulong mask = (1ULL << (env->SEGBITS - 7)) - 1;
+ env->CP0_XContext = (env->CP0_XContext & mask) | (arg1 & ~mask);
+ }
+
+-void helper_mtc0_framemask (target_ulong arg1)
++void helper_mtc0_framemask(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Framemask = arg1; /* XXX */
+ }
+
+-void helper_mtc0_debug (target_ulong arg1)
++void helper_mtc0_debug(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Debug = (env->CP0_Debug & 0x8C03FC1F) | (arg1 & 0x13300120);
+ if (arg1 & (1 << CP0DB_DM))
+@@ -1718,11 +1756,11 @@ void helper_mtc0_debug (target_ulong arg1)
+ env->hflags &= ~MIPS_HFLAG_DM;
+ }
+
+-void helper_mttc0_debug(target_ulong arg1)
++void helper_mttc0_debug(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+ uint32_t val = arg1 & ((1 << CP0DB_SSt) | (1 << CP0DB_Halt));
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ /* XXX: Might be wrong, check with EJTAG spec. */
+ if (other_tc == other->current_tc)
+@@ -1734,36 +1772,36 @@ void helper_mttc0_debug(target_ulong arg1)
+ (arg1 & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt)));
+ }
+
+-void helper_mtc0_performance0 (target_ulong arg1)
++void helper_mtc0_performance0(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_Performance0 = arg1 & 0x000007ff;
+ }
+
+-void helper_mtc0_taglo (target_ulong arg1)
++void helper_mtc0_taglo(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_TagLo = arg1 & 0xFFFFFCF6;
+ }
+
+-void helper_mtc0_datalo (target_ulong arg1)
++void helper_mtc0_datalo(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_DataLo = arg1; /* XXX */
+ }
+
+-void helper_mtc0_taghi (target_ulong arg1)
++void helper_mtc0_taghi(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_TagHi = arg1; /* XXX */
+ }
+
+-void helper_mtc0_datahi (target_ulong arg1)
++void helper_mtc0_datahi(CPUMIPSState *env, target_ulong arg1)
+ {
+ env->CP0_DataHi = arg1; /* XXX */
+ }
+
+ /* MIPS MT functions */
+-target_ulong helper_mftgpr(uint32_t sel)
++target_ulong helper_mftgpr(CPUMIPSState *env, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.gpr[sel];
+@@ -1771,10 +1809,10 @@ target_ulong helper_mftgpr(uint32_t sel)
+ return other->tcs[other_tc].gpr[sel];
+ }
+
+-target_ulong helper_mftlo(uint32_t sel)
++target_ulong helper_mftlo(CPUMIPSState *env, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.LO[sel];
+@@ -1782,10 +1820,10 @@ target_ulong helper_mftlo(uint32_t sel)
+ return other->tcs[other_tc].LO[sel];
+ }
+
+-target_ulong helper_mfthi(uint32_t sel)
++target_ulong helper_mfthi(CPUMIPSState *env, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.HI[sel];
+@@ -1793,10 +1831,10 @@ target_ulong helper_mfthi(uint32_t sel)
+ return other->tcs[other_tc].HI[sel];
+ }
+
+-target_ulong helper_mftacx(uint32_t sel)
++target_ulong helper_mftacx(CPUMIPSState *env, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.ACX[sel];
+@@ -1804,10 +1842,10 @@ target_ulong helper_mftacx(uint32_t sel)
+ return other->tcs[other_tc].ACX[sel];
+ }
+
+-target_ulong helper_mftdsp(void)
++target_ulong helper_mftdsp(CPUMIPSState *env)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ return other->active_tc.DSPControl;
+@@ -1815,10 +1853,10 @@ target_ulong helper_mftdsp(void)
+ return other->tcs[other_tc].DSPControl;
+ }
+
+-void helper_mttgpr(target_ulong arg1, uint32_t sel)
++void helper_mttgpr(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.gpr[sel] = arg1;
+@@ -1826,10 +1864,10 @@ void helper_mttgpr(target_ulong arg1, uint32_t sel)
+ other->tcs[other_tc].gpr[sel] = arg1;
+ }
+
+-void helper_mttlo(target_ulong arg1, uint32_t sel)
++void helper_mttlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.LO[sel] = arg1;
+@@ -1837,10 +1875,10 @@ void helper_mttlo(target_ulong arg1, uint32_t sel)
+ other->tcs[other_tc].LO[sel] = arg1;
+ }
+
+-void helper_mtthi(target_ulong arg1, uint32_t sel)
++void helper_mtthi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.HI[sel] = arg1;
+@@ -1848,10 +1886,10 @@ void helper_mtthi(target_ulong arg1, uint32_t sel)
+ other->tcs[other_tc].HI[sel] = arg1;
+ }
+
+-void helper_mttacx(target_ulong arg1, uint32_t sel)
++void helper_mttacx(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.ACX[sel] = arg1;
+@@ -1859,10 +1897,10 @@ void helper_mttacx(target_ulong arg1, uint32_t sel)
+ other->tcs[other_tc].ACX[sel] = arg1;
+ }
+
+-void helper_mttdsp(target_ulong arg1)
++void helper_mttdsp(CPUMIPSState *env, target_ulong arg1)
+ {
+ int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
+- CPUMIPSState *other = mips_cpu_map_tc(&other_tc);
++ CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+
+ if (other_tc == other->current_tc)
+ other->active_tc.DSPControl = arg1;
+@@ -1883,7 +1921,7 @@ target_ulong helper_emt(void)
+ return 0;
+ }
+
+-target_ulong helper_dvpe(void)
++target_ulong helper_dvpe(CPUMIPSState *env)
+ {
+ CPUMIPSState *other_cpu = first_cpu;
+ target_ulong prev = env->mvp->CP0_MVPControl;
+@@ -1899,7 +1937,7 @@ target_ulong helper_dvpe(void)
+ return prev;
+ }
+
+-target_ulong helper_evpe(void)
++target_ulong helper_evpe(CPUMIPSState *env)
+ {
+ CPUMIPSState *other_cpu = first_cpu;
+ target_ulong prev = env->mvp->CP0_MVPControl;
+@@ -1925,7 +1963,7 @@ void helper_fork(target_ulong arg1, target_ulong arg2)
+ // TODO: store to TC register
+ }
+
+-target_ulong helper_yield(target_ulong arg)
++target_ulong helper_yield(CPUMIPSState *env, target_ulong arg)
+ {
+ target_long arg1 = arg;
+
+@@ -1936,13 +1974,13 @@ target_ulong helper_yield(target_ulong arg)
+ env->active_tc.CP0_TCStatus & (1 << CP0TCSt_DT)) {
+ env->CP0_VPEControl &= ~(0x7 << CP0VPECo_EXCPT);
+ env->CP0_VPEControl |= 4 << CP0VPECo_EXCPT;
+- helper_raise_exception(EXCP_THREAD);
++ helper_raise_exception(env, EXCP_THREAD);
+ }
+ }
+ } else if (arg1 == 0) {
+ if (0 /* TODO: TC underflow */) {
+ env->CP0_VPEControl &= ~(0x7 << CP0VPECo_EXCPT);
+- helper_raise_exception(EXCP_THREAD);
++ helper_raise_exception(env, EXCP_THREAD);
+ } else {
+ // TODO: Deallocate TC
+ }
+@@ -1950,7 +1988,7 @@ target_ulong helper_yield(target_ulong arg)
+ /* Yield qualifier inputs not implemented. */
+ env->CP0_VPEControl &= ~(0x7 << CP0VPECo_EXCPT);
+ env->CP0_VPEControl |= 2 << CP0VPECo_EXCPT;
+- helper_raise_exception(EXCP_THREAD);
++ helper_raise_exception(env, EXCP_THREAD);
+ }
+ return env->CP0_YQMask;
+ }
+@@ -1972,7 +2010,7 @@ static void r4k_mips_tlb_flush_extra (CPUMIPSState *env, int first)
+ }
+ }
+
+-static void r4k_fill_tlb (int idx)
++static void r4k_fill_tlb(CPUMIPSState *env, int idx)
+ {
+ r4k_tlb_t *tlb;
+
+@@ -1995,7 +2033,7 @@ static void r4k_fill_tlb (int idx)
+ tlb->PFN[1] = (env->CP0_EntryLo1 >> 6) << 12;
+ }
+
+-void r4k_helper_tlbwi (void)
++void r4k_helper_tlbwi(CPUMIPSState *env)
+ {
+ int idx;
+
+@@ -2007,18 +2045,18 @@ void r4k_helper_tlbwi (void)
+ r4k_mips_tlb_flush_extra (env, env->tlb->nb_tlb);
+
+ r4k_invalidate_tlb(env, idx, 0);
+- r4k_fill_tlb(idx);
++ r4k_fill_tlb(env, idx);
+ }
+
+-void r4k_helper_tlbwr (void)
++void r4k_helper_tlbwr(CPUMIPSState *env)
+ {
+ int r = cpu_mips_get_random(env);
+
+ r4k_invalidate_tlb(env, r, 1);
+- r4k_fill_tlb(r);
++ r4k_fill_tlb(env, r);
+ }
+
+-void r4k_helper_tlbp (void)
++void r4k_helper_tlbp(CPUMIPSState *env)
+ {
+ r4k_tlb_t *tlb;
+ target_ulong mask;
+@@ -2060,7 +2098,7 @@ void r4k_helper_tlbp (void)
+ }
+ }
+
+-void r4k_helper_tlbr (void)
++void r4k_helper_tlbr(CPUMIPSState *env)
+ {
+ r4k_tlb_t *tlb;
+ uint8_t ASID;
+@@ -2084,28 +2122,28 @@ void r4k_helper_tlbr (void)
+ (tlb->C1 << 3) | (tlb->PFN[1] >> 6);
+ }
+
+-void helper_tlbwi(void)
++void helper_tlbwi(CPUMIPSState *env)
+ {
+- env->tlb->helper_tlbwi();
++ env->tlb->helper_tlbwi(env);
+ }
+
+-void helper_tlbwr(void)
++void helper_tlbwr(CPUMIPSState *env)
+ {
+- env->tlb->helper_tlbwr();
++ env->tlb->helper_tlbwr(env);
+ }
+
+-void helper_tlbp(void)
++void helper_tlbp(CPUMIPSState *env)
+ {
+- env->tlb->helper_tlbp();
++ env->tlb->helper_tlbp(env);
+ }
+
+-void helper_tlbr(void)
++void helper_tlbr(CPUMIPSState *env)
+ {
+- env->tlb->helper_tlbr();
++ env->tlb->helper_tlbr(env);
+ }
+
+ /* Specials */
+-target_ulong helper_di (void)
++target_ulong helper_di(CPUMIPSState *env)
+ {
+ target_ulong t0 = env->CP0_Status;
+
+@@ -2113,7 +2151,7 @@ target_ulong helper_di (void)
+ return t0;
+ }
+
+-target_ulong helper_ei (void)
++target_ulong helper_ei(CPUMIPSState *env)
+ {
+ target_ulong t0 = env->CP0_Status;
+
+@@ -2121,7 +2159,7 @@ target_ulong helper_ei (void)
+ return t0;
+ }
+
+-static void debug_pre_eret (void)
++static void debug_pre_eret(CPUMIPSState *env)
+ {
+ if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+ qemu_log("ERET: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx,
+@@ -2134,7 +2172,7 @@ static void debug_pre_eret (void)
+ }
+ }
+
+-static void debug_post_eret (void)
++static void debug_post_eret(CPUMIPSState *env)
+ {
+ if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+ qemu_log(" => PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx,
+@@ -2152,7 +2190,7 @@ static void debug_post_eret (void)
+ }
+ }
+
+-static void set_pc (target_ulong error_pc)
++static void set_pc(CPUMIPSState *env, target_ulong error_pc)
+ {
+ env->active_tc.PC = error_pc & ~(target_ulong)1;
+ if (error_pc & 1) {
+@@ -2162,78 +2200,78 @@ static void set_pc (target_ulong error_pc)
+ }
+ }
+
+-void helper_eret (void)
++void helper_eret(CPUMIPSState *env)
+ {
+- debug_pre_eret();
++ debug_pre_eret(env);
+ if (env->CP0_Status & (1 << CP0St_ERL)) {
+- set_pc(env->CP0_ErrorEPC);
++ set_pc(env, env->CP0_ErrorEPC);
+ env->CP0_Status &= ~(1 << CP0St_ERL);
+ } else {
+- set_pc(env->CP0_EPC);
++ set_pc(env, env->CP0_EPC);
+ env->CP0_Status &= ~(1 << CP0St_EXL);
+ }
+ compute_hflags(env);
+- debug_post_eret();
++ debug_post_eret(env);
+ env->lladdr = 1;
+ }
+
+-void helper_deret (void)
++void helper_deret(CPUMIPSState *env)
+ {
+- debug_pre_eret();
+- set_pc(env->CP0_DEPC);
++ debug_pre_eret(env);
++ set_pc(env, env->CP0_DEPC);
+
+ env->hflags &= MIPS_HFLAG_DM;
+ compute_hflags(env);
+- debug_post_eret();
++ debug_post_eret(env);
+ env->lladdr = 1;
+ }
+ #endif /* !CONFIG_USER_ONLY */
+
+-target_ulong helper_rdhwr_cpunum(void)
++target_ulong helper_rdhwr_cpunum(CPUMIPSState *env)
+ {
+ if ((env->hflags & MIPS_HFLAG_CP0) ||
+ (env->CP0_HWREna & (1 << 0)))
+ return env->CP0_EBase & 0x3ff;
+ else
+- helper_raise_exception(EXCP_RI);
++ helper_raise_exception(env, EXCP_RI);
+
+ return 0;
+ }
+
+-target_ulong helper_rdhwr_synci_step(void)
++target_ulong helper_rdhwr_synci_step(CPUMIPSState *env)
+ {
+ if ((env->hflags & MIPS_HFLAG_CP0) ||
+ (env->CP0_HWREna & (1 << 1)))
+ return env->SYNCI_Step;
+ else
+- helper_raise_exception(EXCP_RI);
++ helper_raise_exception(env, EXCP_RI);
+
+ return 0;
+ }
+
+-target_ulong helper_rdhwr_cc(void)
++target_ulong helper_rdhwr_cc(CPUMIPSState *env)
+ {
+ if ((env->hflags & MIPS_HFLAG_CP0) ||
+ (env->CP0_HWREna & (1 << 2)))
+ return env->CP0_Count;
+ else
+- helper_raise_exception(EXCP_RI);
++ helper_raise_exception(env, EXCP_RI);
+
+ return 0;
+ }
+
+-target_ulong helper_rdhwr_ccres(void)
++target_ulong helper_rdhwr_ccres(CPUMIPSState *env)
+ {
+ if ((env->hflags & MIPS_HFLAG_CP0) ||
+ (env->CP0_HWREna & (1 << 3)))
+ return env->CCRes;
+ else
+- helper_raise_exception(EXCP_RI);
++ helper_raise_exception(env, EXCP_RI);
+
+ return 0;
+ }
+
+-void helper_pmon (int function)
++void helper_pmon(CPUMIPSState *env, int function)
+ {
+ function /= 2;
+ switch (function) {
+@@ -2259,16 +2297,17 @@ void helper_pmon (int function)
+ }
+ }
+
+-void helper_wait (void)
++void helper_wait(CPUMIPSState *env)
+ {
+ env->halted = 1;
+ cpu_reset_interrupt(env, CPU_INTERRUPT_WAKE);
+- helper_raise_exception(EXCP_HLT);
++ helper_raise_exception(env, EXCP_HLT);
+ }
+
+ #if !defined(CONFIG_USER_ONLY)
+
+-static void QEMU_NORETURN do_unaligned_access(target_ulong addr, int is_write,
++static void QEMU_NORETURN do_unaligned_access(CPUMIPSState *env,
++ target_ulong addr, int is_write,
+ int is_user, uintptr_t retaddr);
+
+ #define MMUSUFFIX _mmu
+@@ -2286,23 +2325,20 @@ static void QEMU_NORETURN do_unaligned_access(target_ulong addr, int is_write,
+ #define SHIFT 3
+ #include "softmmu_template.h"
+
+-static void do_unaligned_access(target_ulong addr, int is_write,
+- int is_user, uintptr_t retaddr)
++static void do_unaligned_access(CPUMIPSState *env, target_ulong addr,
++ int is_write, int is_user, uintptr_t retaddr)
+ {
+ env->CP0_BadVAddr = addr;
+- do_restore_state (retaddr);
+- helper_raise_exception ((is_write == 1) ? EXCP_AdES : EXCP_AdEL);
++ do_restore_state(env, retaddr);
++ helper_raise_exception(env, (is_write == 1) ? EXCP_AdES : EXCP_AdEL);
+ }
+
+-void tlb_fill(CPUMIPSState *env1, target_ulong addr, int is_write, int mmu_idx,
++void tlb_fill(CPUMIPSState *env, target_ulong addr, int is_write, int mmu_idx,
+ uintptr_t retaddr)
+ {
+ TranslationBlock *tb;
+- CPUMIPSState *saved_env;
+ int ret;
+
+- saved_env = env;
+- env = env1;
+ ret = cpu_mips_handle_mmu_fault(env, addr, is_write, mmu_idx);
+ if (ret) {
+ if (retaddr) {
+@@ -2314,20 +2350,17 @@ void tlb_fill(CPUMIPSState *env1, target_ulong addr, int is_write, int mmu_idx,
+ cpu_restore_state(tb, env, retaddr);
+ }
+ }
+- helper_raise_exception_err(env->exception_index, env->error_code);
++ helper_raise_exception_err(env, env->exception_index, env->error_code);
+ }
+- env = saved_env;
+ }
+
+-void cpu_unassigned_access(CPUMIPSState *env1, target_phys_addr_t addr,
++void cpu_unassigned_access(CPUMIPSState *env, target_phys_addr_t addr,
+ int is_write, int is_exec, int unused, int size)
+ {
+- env = env1;
+-
+ if (is_exec)
+- helper_raise_exception(EXCP_IBE);
++ helper_raise_exception(env, EXCP_IBE);
+ else
+- helper_raise_exception(EXCP_DBE);
++ helper_raise_exception(env, EXCP_DBE);
+ }
+ #endif /* !CONFIG_USER_ONLY */
+
+@@ -2356,7 +2389,7 @@ static unsigned int ieee_rm[] = {
+ #define RESTORE_FLUSH_MODE \
+ set_flush_to_zero((env->active_fpu.fcr31 & (1 << 24)) != 0, &env->active_fpu.fp_status);
+
+-target_ulong helper_cfc1 (uint32_t reg)
++target_ulong helper_cfc1(CPUMIPSState *env, uint32_t reg)
+ {
+ target_ulong arg1;
+
+@@ -2381,7 +2414,7 @@ target_ulong helper_cfc1 (uint32_t reg)
+ return arg1;
+ }
+
+-void helper_ctc1 (target_ulong arg1, uint32_t reg)
++void helper_ctc1(CPUMIPSState *env, target_ulong arg1, uint32_t reg)
+ {
+ switch(reg) {
+ case 25:
+@@ -2415,7 +2448,7 @@ void helper_ctc1 (target_ulong arg1, uint32_t reg)
+ RESTORE_FLUSH_MODE;
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ if ((GET_FP_ENABLE(env->active_fpu.fcr31) | 0x20) & GET_FP_CAUSE(env->active_fpu.fcr31))
+- helper_raise_exception(EXCP_FPE);
++ helper_raise_exception(env, EXCP_FPE);
+ }
+
+ static inline int ieee_ex_to_mips(int xcpt)
+@@ -2441,13 +2474,13 @@ static inline int ieee_ex_to_mips(int xcpt)
+ return ret;
+ }
+
+-static inline void update_fcr31(void)
++static inline void update_fcr31(CPUMIPSState *env)
+ {
+ int tmp = ieee_ex_to_mips(get_float_exception_flags(&env->active_fpu.fp_status));
+
+ SET_FP_CAUSE(env->active_fpu.fcr31, tmp);
+ if (GET_FP_ENABLE(env->active_fpu.fcr31) & tmp)
+- helper_raise_exception(EXCP_FPE);
++ helper_raise_exception(env, EXCP_FPE);
+ else
+ UPDATE_FP_FLAGS(env->active_fpu.fcr31, tmp);
+ }
+@@ -2458,71 +2491,71 @@ static inline void update_fcr31(void)
+ paired single lower "pl", paired single upper "pu". */
+
+ /* unary operations, modifying fp status */
+-uint64_t helper_float_sqrt_d(uint64_t fdt0)
++uint64_t helper_float_sqrt_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ return float64_sqrt(fdt0, &env->active_fpu.fp_status);
+ }
+
+-uint32_t helper_float_sqrt_s(uint32_t fst0)
++uint32_t helper_float_sqrt_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ return float32_sqrt(fst0, &env->active_fpu.fp_status);
+ }
+
+-uint64_t helper_float_cvtd_s(uint32_t fst0)
++uint64_t helper_float_cvtd_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float32_to_float64(fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint64_t helper_float_cvtd_w(uint32_t wt0)
++uint64_t helper_float_cvtd_w(CPUMIPSState *env, uint32_t wt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = int32_to_float64(wt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint64_t helper_float_cvtd_l(uint64_t dt0)
++uint64_t helper_float_cvtd_l(CPUMIPSState *env, uint64_t dt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = int64_to_float64(dt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint64_t helper_float_cvtl_d(uint64_t fdt0)
++uint64_t helper_float_cvtl_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t dt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ dt2 = float64_to_int64(fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_cvtl_s(uint32_t fst0)
++uint64_t helper_float_cvtl_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t dt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ dt2 = float32_to_int64(fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_cvtps_pw(uint64_t dt0)
++uint64_t helper_float_cvtps_pw(CPUMIPSState *env, uint64_t dt0)
+ {
+ uint32_t fst2;
+ uint32_t fsth2;
+@@ -2530,11 +2563,11 @@ uint64_t helper_float_cvtps_pw(uint64_t dt0)
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = int32_to_float32(dt0 & 0XFFFFFFFF, &env->active_fpu.fp_status);
+ fsth2 = int32_to_float32(dt0 >> 32, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-uint64_t helper_float_cvtpw_ps(uint64_t fdt0)
++uint64_t helper_float_cvtpw_ps(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+ uint32_t wth2;
+@@ -2542,7 +2575,7 @@ uint64_t helper_float_cvtpw_ps(uint64_t fdt0)
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32(fdt0 & 0XFFFFFFFF, &env->active_fpu.fp_status);
+ wth2 = float32_to_int32(fdt0 >> 32, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID)) {
+ wt2 = FLOAT_SNAN32;
+ wth2 = FLOAT_SNAN32;
+@@ -2550,81 +2583,81 @@ uint64_t helper_float_cvtpw_ps(uint64_t fdt0)
+ return ((uint64_t)wth2 << 32) | wt2;
+ }
+
+-uint32_t helper_float_cvts_d(uint64_t fdt0)
++uint32_t helper_float_cvts_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float64_to_float32(fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint32_t helper_float_cvts_w(uint32_t wt0)
++uint32_t helper_float_cvts_w(CPUMIPSState *env, uint32_t wt0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = int32_to_float32(wt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint32_t helper_float_cvts_l(uint64_t dt0)
++uint32_t helper_float_cvts_l(CPUMIPSState *env, uint64_t dt0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = int64_to_float32(dt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint32_t helper_float_cvts_pl(uint32_t wt0)
++uint32_t helper_float_cvts_pl(CPUMIPSState *env, uint32_t wt0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = wt0;
+- update_fcr31();
++ update_fcr31(env);
+ return wt2;
+ }
+
+-uint32_t helper_float_cvts_pu(uint32_t wth0)
++uint32_t helper_float_cvts_pu(CPUMIPSState *env, uint32_t wth0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = wth0;
+- update_fcr31();
++ update_fcr31(env);
+ return wt2;
+ }
+
+-uint32_t helper_float_cvtw_s(uint32_t fst0)
++uint32_t helper_float_cvtw_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint32_t helper_float_cvtw_d(uint64_t fdt0)
++uint32_t helper_float_cvtw_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = float64_to_int32(fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint64_t helper_float_roundl_d(uint64_t fdt0)
++uint64_t helper_float_roundl_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t dt2;
+
+@@ -2632,13 +2665,13 @@ uint64_t helper_float_roundl_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+ dt2 = float64_to_int64(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_roundl_s(uint32_t fst0)
++uint64_t helper_float_roundl_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t dt2;
+
+@@ -2646,13 +2679,13 @@ uint64_t helper_float_roundl_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+ dt2 = float32_to_int64(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint32_t helper_float_roundw_d(uint64_t fdt0)
++uint32_t helper_float_roundw_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+
+@@ -2660,13 +2693,13 @@ uint32_t helper_float_roundw_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+ wt2 = float64_to_int32(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint32_t helper_float_roundw_s(uint32_t fst0)
++uint32_t helper_float_roundw_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t wt2;
+
+@@ -2674,61 +2707,61 @@ uint32_t helper_float_roundw_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint64_t helper_float_truncl_d(uint64_t fdt0)
++uint64_t helper_float_truncl_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t dt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ dt2 = float64_to_int64_round_to_zero(fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_truncl_s(uint32_t fst0)
++uint64_t helper_float_truncl_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t dt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ dt2 = float32_to_int64_round_to_zero(fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint32_t helper_float_truncw_d(uint64_t fdt0)
++uint32_t helper_float_truncw_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = float64_to_int32_round_to_zero(fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint32_t helper_float_truncw_s(uint32_t fst0)
++uint32_t helper_float_truncw_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t wt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32_round_to_zero(fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint64_t helper_float_ceill_d(uint64_t fdt0)
++uint64_t helper_float_ceill_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t dt2;
+
+@@ -2736,13 +2769,13 @@ uint64_t helper_float_ceill_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_up, &env->active_fpu.fp_status);
+ dt2 = float64_to_int64(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_ceill_s(uint32_t fst0)
++uint64_t helper_float_ceill_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t dt2;
+
+@@ -2750,13 +2783,13 @@ uint64_t helper_float_ceill_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_up, &env->active_fpu.fp_status);
+ dt2 = float32_to_int64(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint32_t helper_float_ceilw_d(uint64_t fdt0)
++uint32_t helper_float_ceilw_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+
+@@ -2764,13 +2797,13 @@ uint32_t helper_float_ceilw_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_up, &env->active_fpu.fp_status);
+ wt2 = float64_to_int32(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint32_t helper_float_ceilw_s(uint32_t fst0)
++uint32_t helper_float_ceilw_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t wt2;
+
+@@ -2778,13 +2811,13 @@ uint32_t helper_float_ceilw_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_up, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint64_t helper_float_floorl_d(uint64_t fdt0)
++uint64_t helper_float_floorl_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t dt2;
+
+@@ -2792,13 +2825,13 @@ uint64_t helper_float_floorl_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_down, &env->active_fpu.fp_status);
+ dt2 = float64_to_int64(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint64_t helper_float_floorl_s(uint32_t fst0)
++uint64_t helper_float_floorl_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint64_t dt2;
+
+@@ -2806,13 +2839,13 @@ uint64_t helper_float_floorl_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_down, &env->active_fpu.fp_status);
+ dt2 = float32_to_int64(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ dt2 = FLOAT_SNAN64;
+ return dt2;
+ }
+
+-uint32_t helper_float_floorw_d(uint64_t fdt0)
++uint32_t helper_float_floorw_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t wt2;
+
+@@ -2820,13 +2853,13 @@ uint32_t helper_float_floorw_d(uint64_t fdt0)
+ set_float_rounding_mode(float_round_down, &env->active_fpu.fp_status);
+ wt2 = float64_to_int32(fdt0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+ }
+
+-uint32_t helper_float_floorw_s(uint32_t fst0)
++uint32_t helper_float_floorw_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t wt2;
+
+@@ -2834,7 +2867,7 @@ uint32_t helper_float_floorw_s(uint32_t fst0)
+ set_float_rounding_mode(float_round_down, &env->active_fpu.fp_status);
+ wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);
+ RESTORE_ROUNDING_MODE;
+- update_fcr31();
++ update_fcr31(env);
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & (FP_OVERFLOW | FP_INVALID))
+ wt2 = FLOAT_SNAN32;
+ return wt2;
+@@ -2864,69 +2897,69 @@ FLOAT_UNOP(chs)
+ #undef FLOAT_UNOP
+
+ /* MIPS specific unary operations */
+-uint64_t helper_float_recip_d(uint64_t fdt0)
++uint64_t helper_float_recip_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_div(FLOAT_ONE64, fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_recip_s(uint32_t fst0)
++uint32_t helper_float_recip_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_rsqrt_d(uint64_t fdt0)
++uint64_t helper_float_rsqrt_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_sqrt(fdt0, &env->active_fpu.fp_status);
+ fdt2 = float64_div(FLOAT_ONE64, fdt2, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_rsqrt_s(uint32_t fst0)
++uint32_t helper_float_rsqrt_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_sqrt(fst0, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fst2, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_recip1_d(uint64_t fdt0)
++uint64_t helper_float_recip1_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_div(FLOAT_ONE64, fdt0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_recip1_s(uint32_t fst0)
++uint32_t helper_float_recip1_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fst0, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_recip1_ps(uint64_t fdt0)
++uint64_t helper_float_recip1_ps(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t fst2;
+ uint32_t fsth2;
+@@ -2934,33 +2967,33 @@ uint64_t helper_float_recip1_ps(uint64_t fdt0)
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fdt0 & 0XFFFFFFFF, &env->active_fpu.fp_status);
+ fsth2 = float32_div(FLOAT_ONE32, fdt0 >> 32, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-uint64_t helper_float_rsqrt1_d(uint64_t fdt0)
++uint64_t helper_float_rsqrt1_d(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint64_t fdt2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_sqrt(fdt0, &env->active_fpu.fp_status);
+ fdt2 = float64_div(FLOAT_ONE64, fdt2, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_rsqrt1_s(uint32_t fst0)
++uint32_t helper_float_rsqrt1_s(CPUMIPSState *env, uint32_t fst0)
+ {
+ uint32_t fst2;
+
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_sqrt(fst0, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fst2, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_rsqrt1_ps(uint64_t fdt0)
++uint64_t helper_float_rsqrt1_ps(CPUMIPSState *env, uint64_t fdt0)
+ {
+ uint32_t fst2;
+ uint32_t fsth2;
+@@ -2970,39 +3003,43 @@ uint64_t helper_float_rsqrt1_ps(uint64_t fdt0)
+ fsth2 = float32_sqrt(fdt0 >> 32, &env->active_fpu.fp_status);
+ fst2 = float32_div(FLOAT_ONE32, fst2, &env->active_fpu.fp_status);
+ fsth2 = float32_div(FLOAT_ONE32, fsth2, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-#define FLOAT_OP(name, p) void helper_float_##name##_##p(void)
++#define FLOAT_OP(name, p) void helper_float_##name##_##p(CPUMIPSState *env)
+
+ /* binary operations */
+ #define FLOAT_BINOP(name) \
+-uint64_t helper_float_ ## name ## _d(uint64_t fdt0, uint64_t fdt1) \
++uint64_t helper_float_ ## name ## _d(CPUMIPSState *env, \
++ uint64_t fdt0, uint64_t fdt1) \
+ { \
+ uint64_t dt2; \
+ \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ dt2 = float64_ ## name (fdt0, fdt1, &env->active_fpu.fp_status); \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & FP_INVALID) \
+ dt2 = FLOAT_QNAN64; \
+ return dt2; \
+ } \
+ \
+-uint32_t helper_float_ ## name ## _s(uint32_t fst0, uint32_t fst1) \
++uint32_t helper_float_ ## name ## _s(CPUMIPSState *env, \
++ uint32_t fst0, uint32_t fst1) \
+ { \
+ uint32_t wt2; \
+ \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ wt2 = float32_ ## name (fst0, fst1, &env->active_fpu.fp_status); \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & FP_INVALID) \
+ wt2 = FLOAT_QNAN32; \
+ return wt2; \
+ } \
+ \
+-uint64_t helper_float_ ## name ## _ps(uint64_t fdt0, uint64_t fdt1) \
++uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env, \
++ uint64_t fdt0, \
++ uint64_t fdt1) \
+ { \
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF; \
+ uint32_t fsth0 = fdt0 >> 32; \
+@@ -3014,7 +3051,7 @@ uint64_t helper_float_ ## name ## _ps(uint64_t fdt0, uint64_t fdt1) \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ wt2 = float32_ ## name (fst0, fst1, &env->active_fpu.fp_status); \
+ wth2 = float32_ ## name (fsth0, fsth1, &env->active_fpu.fp_status); \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (GET_FP_CAUSE(env->active_fpu.fcr31) & FP_INVALID) { \
+ wt2 = FLOAT_QNAN32; \
+ wth2 = FLOAT_QNAN32; \
+@@ -3030,22 +3067,28 @@ FLOAT_BINOP(div)
+
+ /* ternary operations */
+ #define FLOAT_TERNOP(name1, name2) \
+-uint64_t helper_float_ ## name1 ## name2 ## _d(uint64_t fdt0, uint64_t fdt1, \
+- uint64_t fdt2) \
++uint64_t helper_float_ ## name1 ## name2 ## _d(CPUMIPSState *env, \
++ uint64_t fdt0, \
++ uint64_t fdt1, \
++ uint64_t fdt2) \
+ { \
+ fdt0 = float64_ ## name1 (fdt0, fdt1, &env->active_fpu.fp_status); \
+ return float64_ ## name2 (fdt0, fdt2, &env->active_fpu.fp_status); \
+ } \
+ \
+-uint32_t helper_float_ ## name1 ## name2 ## _s(uint32_t fst0, uint32_t fst1, \
+- uint32_t fst2) \
++uint32_t helper_float_ ## name1 ## name2 ## _s(CPUMIPSState *env, \
++ uint32_t fst0, \
++ uint32_t fst1, \
++ uint32_t fst2) \
+ { \
+ fst0 = float32_ ## name1 (fst0, fst1, &env->active_fpu.fp_status); \
+ return float32_ ## name2 (fst0, fst2, &env->active_fpu.fp_status); \
+ } \
+ \
+-uint64_t helper_float_ ## name1 ## name2 ## _ps(uint64_t fdt0, uint64_t fdt1, \
+- uint64_t fdt2) \
++uint64_t helper_float_ ## name1 ## name2 ## _ps(CPUMIPSState *env, \
++ uint64_t fdt0, \
++ uint64_t fdt1, \
++ uint64_t fdt2) \
+ { \
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF; \
+ uint32_t fsth0 = fdt0 >> 32; \
+@@ -3067,24 +3110,30 @@ FLOAT_TERNOP(mul, sub)
+
+ /* negated ternary operations */
+ #define FLOAT_NTERNOP(name1, name2) \
+-uint64_t helper_float_n ## name1 ## name2 ## _d(uint64_t fdt0, uint64_t fdt1, \
+- uint64_t fdt2) \
++uint64_t helper_float_n ## name1 ## name2 ## _d(CPUMIPSState *env, \
++ uint64_t fdt0, \
++ uint64_t fdt1, \
++ uint64_t fdt2) \
+ { \
+ fdt0 = float64_ ## name1 (fdt0, fdt1, &env->active_fpu.fp_status); \
+ fdt2 = float64_ ## name2 (fdt0, fdt2, &env->active_fpu.fp_status); \
+ return float64_chs(fdt2); \
+ } \
+ \
+-uint32_t helper_float_n ## name1 ## name2 ## _s(uint32_t fst0, uint32_t fst1, \
+- uint32_t fst2) \
++uint32_t helper_float_n ## name1 ## name2 ## _s(CPUMIPSState *env, \
++ uint32_t fst0, \
++ uint32_t fst1, \
++ uint32_t fst2) \
+ { \
+ fst0 = float32_ ## name1 (fst0, fst1, &env->active_fpu.fp_status); \
+ fst2 = float32_ ## name2 (fst0, fst2, &env->active_fpu.fp_status); \
+ return float32_chs(fst2); \
+ } \
+ \
+-uint64_t helper_float_n ## name1 ## name2 ## _ps(uint64_t fdt0, uint64_t fdt1,\
+- uint64_t fdt2) \
++uint64_t helper_float_n ## name1 ## name2 ## _ps(CPUMIPSState *env, \
++ uint64_t fdt0, \
++ uint64_t fdt1, \
++ uint64_t fdt2) \
+ { \
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF; \
+ uint32_t fsth0 = fdt0 >> 32; \
+@@ -3107,25 +3156,25 @@ FLOAT_NTERNOP(mul, sub)
+ #undef FLOAT_NTERNOP
+
+ /* MIPS specific binary operations */
+-uint64_t helper_float_recip2_d(uint64_t fdt0, uint64_t fdt2)
++uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
+ {
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_mul(fdt0, fdt2, &env->active_fpu.fp_status);
+ fdt2 = float64_chs(float64_sub(fdt2, FLOAT_ONE64, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_recip2_s(uint32_t fst0, uint32_t fst2)
++uint32_t helper_float_recip2_s(CPUMIPSState *env, uint32_t fst0, uint32_t fst2)
+ {
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_mul(fst0, fst2, &env->active_fpu.fp_status);
+ fst2 = float32_chs(float32_sub(fst2, FLOAT_ONE32, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_recip2_ps(uint64_t fdt0, uint64_t fdt2)
++uint64_t helper_float_recip2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
+ {
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF;
+ uint32_t fsth0 = fdt0 >> 32;
+@@ -3137,31 +3186,31 @@ uint64_t helper_float_recip2_ps(uint64_t fdt0, uint64_t fdt2)
+ fsth2 = float32_mul(fsth0, fsth2, &env->active_fpu.fp_status);
+ fst2 = float32_chs(float32_sub(fst2, FLOAT_ONE32, &env->active_fpu.fp_status));
+ fsth2 = float32_chs(float32_sub(fsth2, FLOAT_ONE32, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-uint64_t helper_float_rsqrt2_d(uint64_t fdt0, uint64_t fdt2)
++uint64_t helper_float_rsqrt2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
+ {
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fdt2 = float64_mul(fdt0, fdt2, &env->active_fpu.fp_status);
+ fdt2 = float64_sub(fdt2, FLOAT_ONE64, &env->active_fpu.fp_status);
+ fdt2 = float64_chs(float64_div(fdt2, FLOAT_TWO64, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return fdt2;
+ }
+
+-uint32_t helper_float_rsqrt2_s(uint32_t fst0, uint32_t fst2)
++uint32_t helper_float_rsqrt2_s(CPUMIPSState *env, uint32_t fst0, uint32_t fst2)
+ {
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_mul(fst0, fst2, &env->active_fpu.fp_status);
+ fst2 = float32_sub(fst2, FLOAT_ONE32, &env->active_fpu.fp_status);
+ fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return fst2;
+ }
+
+-uint64_t helper_float_rsqrt2_ps(uint64_t fdt0, uint64_t fdt2)
++uint64_t helper_float_rsqrt2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
+ {
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF;
+ uint32_t fsth0 = fdt0 >> 32;
+@@ -3175,11 +3224,11 @@ uint64_t helper_float_rsqrt2_ps(uint64_t fdt0, uint64_t fdt2)
+ fsth2 = float32_sub(fsth2, FLOAT_ONE32, &env->active_fpu.fp_status);
+ fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32, &env->active_fpu.fp_status));
+ fsth2 = float32_chs(float32_div(fsth2, FLOAT_TWO32, &env->active_fpu.fp_status));
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-uint64_t helper_float_addr_ps(uint64_t fdt0, uint64_t fdt1)
++uint64_t helper_float_addr_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt1)
+ {
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF;
+ uint32_t fsth0 = fdt0 >> 32;
+@@ -3191,11 +3240,11 @@ uint64_t helper_float_addr_ps(uint64_t fdt0, uint64_t fdt1)
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_add (fst0, fsth0, &env->active_fpu.fp_status);
+ fsth2 = float32_add (fst1, fsth1, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+-uint64_t helper_float_mulr_ps(uint64_t fdt0, uint64_t fdt1)
++uint64_t helper_float_mulr_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt1)
+ {
+ uint32_t fst0 = fdt0 & 0XFFFFFFFF;
+ uint32_t fsth0 = fdt0 >> 32;
+@@ -3207,31 +3256,33 @@ uint64_t helper_float_mulr_ps(uint64_t fdt0, uint64_t fdt1)
+ set_float_exception_flags(0, &env->active_fpu.fp_status);
+ fst2 = float32_mul (fst0, fsth0, &env->active_fpu.fp_status);
+ fsth2 = float32_mul (fst1, fsth1, &env->active_fpu.fp_status);
+- update_fcr31();
++ update_fcr31(env);
+ return ((uint64_t)fsth2 << 32) | fst2;
+ }
+
+ /* compare operations */
+ #define FOP_COND_D(op, cond) \
+-void helper_cmp_d_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
++void helper_cmp_d_ ## op(CPUMIPSState *env, uint64_t fdt0, \
++ uint64_t fdt1, int cc) \
+ { \
+ int c; \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ c = cond; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (c) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+ CLEAR_FP_COND(cc, env->active_fpu); \
+ } \
+-void helper_cmpabs_d_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
++void helper_cmpabs_d_ ## op(CPUMIPSState *env, uint64_t fdt0, \
++ uint64_t fdt1, int cc) \
+ { \
+ int c; \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ fdt0 = float64_abs(fdt0); \
+ fdt1 = float64_abs(fdt1); \
+ c = cond; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (c) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+@@ -3260,25 +3311,27 @@ FOP_COND_D(le, float64_le(fdt0, fdt1, &env->active_fpu.fp_status))
+ FOP_COND_D(ngt, float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status) || float64_le(fdt0, fdt1, &env->active_fpu.fp_status))
+
+ #define FOP_COND_S(op, cond) \
+-void helper_cmp_s_ ## op (uint32_t fst0, uint32_t fst1, int cc) \
++void helper_cmp_s_ ## op(CPUMIPSState *env, uint32_t fst0, \
++ uint32_t fst1, int cc) \
+ { \
+ int c; \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ c = cond; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (c) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+ CLEAR_FP_COND(cc, env->active_fpu); \
+ } \
+-void helper_cmpabs_s_ ## op (uint32_t fst0, uint32_t fst1, int cc) \
++void helper_cmpabs_s_ ## op(CPUMIPSState *env, uint32_t fst0, \
++ uint32_t fst1, int cc) \
+ { \
+ int c; \
+ set_float_exception_flags(0, &env->active_fpu.fp_status); \
+ fst0 = float32_abs(fst0); \
+ fst1 = float32_abs(fst1); \
+ c = cond; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (c) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+@@ -3307,7 +3360,8 @@ FOP_COND_S(le, float32_le(fst0, fst1, &env->active_fpu.fp_status))
+ FOP_COND_S(ngt, float32_unordered(fst1, fst0, &env->active_fpu.fp_status) || float32_le(fst0, fst1, &env->active_fpu.fp_status))
+
+ #define FOP_COND_PS(op, condl, condh) \
+-void helper_cmp_ps_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
++void helper_cmp_ps_ ## op(CPUMIPSState *env, uint64_t fdt0, \
++ uint64_t fdt1, int cc) \
+ { \
+ uint32_t fst0, fsth0, fst1, fsth1; \
+ int ch, cl; \
+@@ -3318,7 +3372,7 @@ void helper_cmp_ps_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
+ fsth1 = fdt1 >> 32; \
+ cl = condl; \
+ ch = condh; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (cl) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+@@ -3328,7 +3382,8 @@ void helper_cmp_ps_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
+ else \
+ CLEAR_FP_COND(cc + 1, env->active_fpu); \
+ } \
+-void helper_cmpabs_ps_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
++void helper_cmpabs_ps_ ## op(CPUMIPSState *env, uint64_t fdt0, \
++ uint64_t fdt1, int cc) \
+ { \
+ uint32_t fst0, fsth0, fst1, fsth1; \
+ int ch, cl; \
+@@ -3338,7 +3393,7 @@ void helper_cmpabs_ps_ ## op (uint64_t fdt0, uint64_t fdt1, int cc) \
+ fsth1 = float32_abs(fdt1 >> 32); \
+ cl = condl; \
+ ch = condh; \
+- update_fcr31(); \
++ update_fcr31(env); \
+ if (cl) \
+ SET_FP_COND(cc, env->active_fpu); \
+ else \
+diff --git a/target-mips/translate.c b/target-mips/translate.c
+index b293419..7ab769f 100644
+--- a/target-mips/translate.c
++++ b/target-mips/translate.c
+@@ -483,27 +483,45 @@ static uint32_t gen_opc_hflags[OPC_BUF_SIZE];
+
+ #include "gen-icount.h"
+
+-#define gen_helper_0i(name, arg) do { \
++#define gen_helper_0e0i(name, arg) do { \
+ TCGv_i32 helper_tmp = tcg_const_i32(arg); \
+- gen_helper_##name(helper_tmp); \
++ gen_helper_##name(cpu_env, helper_tmp); \
+ tcg_temp_free_i32(helper_tmp); \
+ } while(0)
+
+-#define gen_helper_1i(name, arg1, arg2) do { \
++#define gen_helper_0e1i(name, arg1, arg2) do { \
+ TCGv_i32 helper_tmp = tcg_const_i32(arg2); \
+- gen_helper_##name(arg1, helper_tmp); \
++ gen_helper_##name(cpu_env, arg1, helper_tmp); \
+ tcg_temp_free_i32(helper_tmp); \
+ } while(0)
+
+-#define gen_helper_2i(name, arg1, arg2, arg3) do { \
++#define gen_helper_1e0i(name, ret, arg1) do { \
++ TCGv_i32 helper_tmp = tcg_const_i32(arg1); \
++ gen_helper_##name(ret, cpu_env, helper_tmp); \
++ tcg_temp_free_i32(helper_tmp); \
++ } while(0)
++
++#define gen_helper_1e1i(name, ret, arg1, arg2) do { \
++ TCGv_i32 helper_tmp = tcg_const_i32(arg2); \
++ gen_helper_##name(ret, cpu_env, arg1, helper_tmp); \
++ tcg_temp_free_i32(helper_tmp); \
++ } while(0)
++
++#define gen_helper_0e2i(name, arg1, arg2, arg3) do { \
++ TCGv_i32 helper_tmp = tcg_const_i32(arg3); \
++ gen_helper_##name(cpu_env, arg1, arg2, helper_tmp); \
++ tcg_temp_free_i32(helper_tmp); \
++ } while(0)
++
++#define gen_helper_1e2i(name, ret, arg1, arg2, arg3) do { \
+ TCGv_i32 helper_tmp = tcg_const_i32(arg3); \
+- gen_helper_##name(arg1, arg2, helper_tmp); \
++ gen_helper_##name(ret, cpu_env, arg1, arg2, helper_tmp); \
+ tcg_temp_free_i32(helper_tmp); \
+ } while(0)
+
+-#define gen_helper_3i(name, arg1, arg2, arg3, arg4) do { \
++#define gen_helper_0e3i(name, arg1, arg2, arg3, arg4) do { \
+ TCGv_i32 helper_tmp = tcg_const_i32(arg4); \
+- gen_helper_##name(arg1, arg2, arg3, helper_tmp); \
++ gen_helper_##name(cpu_env, arg1, arg2, arg3, helper_tmp); \
+ tcg_temp_free_i32(helper_tmp); \
+ } while(0)
+
+@@ -748,7 +766,7 @@ generate_exception_err (DisasContext *ctx, int excp, int err)
+ TCGv_i32 texcp = tcg_const_i32(excp);
+ TCGv_i32 terr = tcg_const_i32(err);
+ save_cpu_state(ctx, 1);
+- gen_helper_raise_exception_err(texcp, terr);
++ gen_helper_raise_exception_err(cpu_env, texcp, terr);
+ tcg_temp_free_i32(terr);
+ tcg_temp_free_i32(texcp);
+ }
+@@ -757,7 +775,7 @@ static inline void
+ generate_exception (DisasContext *ctx, int excp)
+ {
+ save_cpu_state(ctx, 1);
+- gen_helper_0i(raise_exception, excp);
++ gen_helper_0e0i(raise_exception, excp);
+ }
+
+ /* Addresses computation */
+@@ -871,22 +889,22 @@ static inline void gen_cmp ## type ## _ ## fmt(DisasContext *ctx, int n, \
+ gen_ldcmp_fpr##bits (ctx, fp0, fs); \
+ gen_ldcmp_fpr##bits (ctx, fp1, ft); \
+ switch (n) { \
+- case 0: gen_helper_2i(cmp ## type ## _ ## fmt ## _f, fp0, fp1, cc); break;\
+- case 1: gen_helper_2i(cmp ## type ## _ ## fmt ## _un, fp0, fp1, cc); break;\
+- case 2: gen_helper_2i(cmp ## type ## _ ## fmt ## _eq, fp0, fp1, cc); break;\
+- case 3: gen_helper_2i(cmp ## type ## _ ## fmt ## _ueq, fp0, fp1, cc); break;\
+- case 4: gen_helper_2i(cmp ## type ## _ ## fmt ## _olt, fp0, fp1, cc); break;\
+- case 5: gen_helper_2i(cmp ## type ## _ ## fmt ## _ult, fp0, fp1, cc); break;\
+- case 6: gen_helper_2i(cmp ## type ## _ ## fmt ## _ole, fp0, fp1, cc); break;\
+- case 7: gen_helper_2i(cmp ## type ## _ ## fmt ## _ule, fp0, fp1, cc); break;\
+- case 8: gen_helper_2i(cmp ## type ## _ ## fmt ## _sf, fp0, fp1, cc); break;\
+- case 9: gen_helper_2i(cmp ## type ## _ ## fmt ## _ngle, fp0, fp1, cc); break;\
+- case 10: gen_helper_2i(cmp ## type ## _ ## fmt ## _seq, fp0, fp1, cc); break;\
+- case 11: gen_helper_2i(cmp ## type ## _ ## fmt ## _ngl, fp0, fp1, cc); break;\
+- case 12: gen_helper_2i(cmp ## type ## _ ## fmt ## _lt, fp0, fp1, cc); break;\
+- case 13: gen_helper_2i(cmp ## type ## _ ## fmt ## _nge, fp0, fp1, cc); break;\
+- case 14: gen_helper_2i(cmp ## type ## _ ## fmt ## _le, fp0, fp1, cc); break;\
+- case 15: gen_helper_2i(cmp ## type ## _ ## fmt ## _ngt, fp0, fp1, cc); break;\
++ case 0: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _f, fp0, fp1, cc); break;\
++ case 1: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _un, fp0, fp1, cc); break;\
++ case 2: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _eq, fp0, fp1, cc); break;\
++ case 3: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ueq, fp0, fp1, cc); break;\
++ case 4: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _olt, fp0, fp1, cc); break;\
++ case 5: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ult, fp0, fp1, cc); break;\
++ case 6: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ole, fp0, fp1, cc); break;\
++ case 7: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ule, fp0, fp1, cc); break;\
++ case 8: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _sf, fp0, fp1, cc); break;\
++ case 9: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ngle, fp0, fp1, cc); break;\
++ case 10: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _seq, fp0, fp1, cc); break;\
++ case 11: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ngl, fp0, fp1, cc); break;\
++ case 12: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _lt, fp0, fp1, cc); break;\
++ case 13: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _nge, fp0, fp1, cc); break;\
++ case 14: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _le, fp0, fp1, cc); break;\
++ case 15: gen_helper_0e2i(cmp ## type ## _ ## fmt ## _ngt, fp0, fp1, cc); break;\
+ default: abort(); \
+ } \
+ tcg_temp_free_i##bits (fp0); \
+@@ -948,7 +966,7 @@ static inline void op_ld_##insn(TCGv ret, TCGv arg1, DisasContext *ctx) \
+ #define OP_LD_ATOMIC(insn,fname) \
+ static inline void op_ld_##insn(TCGv ret, TCGv arg1, DisasContext *ctx) \
+ { \
+- gen_helper_2i(insn, ret, arg1, ctx->mem_idx); \
++ gen_helper_1e1i(insn, ret, arg1, ctx->mem_idx); \
+ }
+ #endif
+ OP_LD_ATOMIC(ll,ld32s);
+@@ -975,7 +993,7 @@ static inline void op_st_##insn(TCGv arg1, TCGv arg2, int rt, DisasContext *ctx)
+ tcg_gen_movi_tl(t0, rt | ((almask << 3) & 0x20)); \
+ tcg_gen_st_tl(t0, cpu_env, offsetof(CPUMIPSState, llreg)); \
+ tcg_gen_st_tl(arg1, cpu_env, offsetof(CPUMIPSState, llnewval)); \
+- gen_helper_0i(raise_exception, EXCP_SC); \
++ gen_helper_0e0i(raise_exception, EXCP_SC); \
+ gen_set_label(l2); \
+ tcg_gen_movi_tl(t0, 0); \
+ gen_store_gpr(t0, rt); \
+@@ -986,7 +1004,7 @@ static inline void op_st_##insn(TCGv arg1, TCGv arg2, int rt, DisasContext *ctx)
+ static inline void op_st_##insn(TCGv arg1, TCGv arg2, int rt, DisasContext *ctx) \
+ { \
+ TCGv t0 = tcg_temp_new(); \
+- gen_helper_3i(insn, t0, arg1, arg2, ctx->mem_idx); \
++ gen_helper_1e2i(insn, t0, arg1, arg2, ctx->mem_idx); \
+ gen_store_gpr(t0, rt); \
+ tcg_temp_free(t0); \
+ }
+@@ -1066,14 +1084,14 @@ static void gen_ld (CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
+ case OPC_LDL:
+ save_cpu_state(ctx, 1);
+ gen_load_gpr(t1, rt);
+- gen_helper_3i(ldl, t1, t1, t0, ctx->mem_idx);
++ gen_helper_1e2i(ldl, t1, t1, t0, ctx->mem_idx);
+ gen_store_gpr(t1, rt);
+ opn = "ldl";
+ break;
+ case OPC_LDR:
+ save_cpu_state(ctx, 1);
+ gen_load_gpr(t1, rt);
+- gen_helper_3i(ldr, t1, t1, t0, ctx->mem_idx);
++ gen_helper_1e2i(ldr, t1, t1, t0, ctx->mem_idx);
+ gen_store_gpr(t1, rt);
+ opn = "ldr";
+ break;
+@@ -1127,14 +1145,14 @@ static void gen_ld (CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
+ case OPC_LWL:
+ save_cpu_state(ctx, 1);
+ gen_load_gpr(t1, rt);
+- gen_helper_3i(lwl, t1, t1, t0, ctx->mem_idx);
++ gen_helper_1e2i(lwl, t1, t1, t0, ctx->mem_idx);
+ gen_store_gpr(t1, rt);
+ opn = "lwl";
+ break;
+ case OPC_LWR:
+ save_cpu_state(ctx, 1);
+ gen_load_gpr(t1, rt);
+- gen_helper_3i(lwr, t1, t1, t0, ctx->mem_idx);
++ gen_helper_1e2i(lwr, t1, t1, t0, ctx->mem_idx);
+ gen_store_gpr(t1, rt);
+ opn = "lwr";
+ break;
+@@ -1170,12 +1188,12 @@ static void gen_st (DisasContext *ctx, uint32_t opc, int rt,
+ break;
+ case OPC_SDL:
+ save_cpu_state(ctx, 1);
+- gen_helper_2i(sdl, t1, t0, ctx->mem_idx);
++ gen_helper_0e2i(sdl, t1, t0, ctx->mem_idx);
+ opn = "sdl";
+ break;
+ case OPC_SDR:
+ save_cpu_state(ctx, 1);
+- gen_helper_2i(sdr, t1, t0, ctx->mem_idx);
++ gen_helper_0e2i(sdr, t1, t0, ctx->mem_idx);
+ opn = "sdr";
+ break;
+ #endif
+@@ -1196,12 +1214,12 @@ static void gen_st (DisasContext *ctx, uint32_t opc, int rt,
+ break;
+ case OPC_SWL:
+ save_cpu_state(ctx, 1);
+- gen_helper_2i(swl, t1, t0, ctx->mem_idx);
++ gen_helper_0e2i(swl, t1, t0, ctx->mem_idx);
+ opn = "swl";
+ break;
+ case OPC_SWR:
+ save_cpu_state(ctx, 1);
+- gen_helper_2i(swr, t1, t0, ctx->mem_idx);
++ gen_helper_0e2i(swr, t1, t0, ctx->mem_idx);
+ opn = "swr";
+ break;
+ }
+@@ -2138,11 +2156,11 @@ static void gen_muldiv (DisasContext *ctx, uint32_t opc,
+ opn = "ddivu";
+ break;
+ case OPC_DMULT:
+- gen_helper_dmult(t0, t1);
++ gen_helper_dmult(cpu_env, t0, t1);
+ opn = "dmult";
+ break;
+ case OPC_DMULTU:
+- gen_helper_dmultu(t0, t1);
++ gen_helper_dmultu(cpu_env, t0, t1);
+ opn = "dmultu";
+ break;
+ #endif
+@@ -2254,59 +2272,59 @@ static void gen_mul_vr54xx (DisasContext *ctx, uint32_t opc,
+
+ switch (opc) {
+ case OPC_VR54XX_MULS:
+- gen_helper_muls(t0, t0, t1);
++ gen_helper_muls(t0, cpu_env, t0, t1);
+ opn = "muls";
+ break;
+ case OPC_VR54XX_MULSU:
+- gen_helper_mulsu(t0, t0, t1);
++ gen_helper_mulsu(t0, cpu_env, t0, t1);
+ opn = "mulsu";
+ break;
+ case OPC_VR54XX_MACC:
+- gen_helper_macc(t0, t0, t1);
++ gen_helper_macc(t0, cpu_env, t0, t1);
+ opn = "macc";
+ break;
+ case OPC_VR54XX_MACCU:
+- gen_helper_maccu(t0, t0, t1);
++ gen_helper_maccu(t0, cpu_env, t0, t1);
+ opn = "maccu";
+ break;
+ case OPC_VR54XX_MSAC:
+- gen_helper_msac(t0, t0, t1);
++ gen_helper_msac(t0, cpu_env, t0, t1);
+ opn = "msac";
+ break;
+ case OPC_VR54XX_MSACU:
+- gen_helper_msacu(t0, t0, t1);
++ gen_helper_msacu(t0, cpu_env, t0, t1);
+ opn = "msacu";
+ break;
+ case OPC_VR54XX_MULHI:
+- gen_helper_mulhi(t0, t0, t1);
++ gen_helper_mulhi(t0, cpu_env, t0, t1);
+ opn = "mulhi";
+ break;
+ case OPC_VR54XX_MULHIU:
+- gen_helper_mulhiu(t0, t0, t1);
++ gen_helper_mulhiu(t0, cpu_env, t0, t1);
+ opn = "mulhiu";
+ break;
+ case OPC_VR54XX_MULSHI:
+- gen_helper_mulshi(t0, t0, t1);
++ gen_helper_mulshi(t0, cpu_env, t0, t1);
+ opn = "mulshi";
+ break;
+ case OPC_VR54XX_MULSHIU:
+- gen_helper_mulshiu(t0, t0, t1);
++ gen_helper_mulshiu(t0, cpu_env, t0, t1);
+ opn = "mulshiu";
+ break;
+ case OPC_VR54XX_MACCHI:
+- gen_helper_macchi(t0, t0, t1);
++ gen_helper_macchi(t0, cpu_env, t0, t1);
+ opn = "macchi";
+ break;
+ case OPC_VR54XX_MACCHIU:
+- gen_helper_macchiu(t0, t0, t1);
++ gen_helper_macchiu(t0, cpu_env, t0, t1);
+ opn = "macchiu";
+ break;
+ case OPC_VR54XX_MSACHI:
+- gen_helper_msachi(t0, t0, t1);
++ gen_helper_msachi(t0, cpu_env, t0, t1);
+ opn = "msachi";
+ break;
+ case OPC_VR54XX_MSACHIU:
+- gen_helper_msachiu(t0, t0, t1);
++ gen_helper_msachiu(t0, cpu_env, t0, t1);
+ opn = "msachiu";
+ break;
+ default:
+@@ -2683,7 +2701,7 @@ static inline void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+ gen_save_pc(dest);
+ if (ctx->singlestep_enabled) {
+ save_cpu_state(ctx, 0);
+- gen_helper_0i(raise_exception, EXCP_DEBUG);
++ gen_helper_0e0i(raise_exception, EXCP_DEBUG);
+ }
+ tcg_gen_exit_tb(0);
+ }
+@@ -3187,17 +3205,17 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpcontrol(arg);
++ gen_helper_mfc0_mvpcontrol(arg, cpu_env);
+ rn = "MVPControl";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpconf0(arg);
++ gen_helper_mfc0_mvpconf0(arg, cpu_env);
+ rn = "MVPConf0";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpconf1(arg);
++ gen_helper_mfc0_mvpconf1(arg, cpu_env);
+ rn = "MVPConf1";
+ break;
+ default:
+@@ -3207,7 +3225,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 1:
+ switch (sel) {
+ case 0:
+- gen_helper_mfc0_random(arg);
++ gen_helper_mfc0_random(arg, cpu_env);
+ rn = "Random";
+ break;
+ case 1:
+@@ -3258,37 +3276,37 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcstatus(arg);
++ gen_helper_mfc0_tcstatus(arg, cpu_env);
+ rn = "TCStatus";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcbind(arg);
++ gen_helper_mfc0_tcbind(arg, cpu_env);
+ rn = "TCBind";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcrestart(arg);
++ gen_helper_mfc0_tcrestart(arg, cpu_env);
+ rn = "TCRestart";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tchalt(arg);
++ gen_helper_mfc0_tchalt(arg, cpu_env);
+ rn = "TCHalt";
+ break;
+ case 5:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tccontext(arg);
++ gen_helper_mfc0_tccontext(arg, cpu_env);
+ rn = "TCContext";
+ break;
+ case 6:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcschedule(arg);
++ gen_helper_mfc0_tcschedule(arg, cpu_env);
+ rn = "TCSchedule";
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcschefback(arg);
++ gen_helper_mfc0_tcschefback(arg, cpu_env);
+ rn = "TCScheFBack";
+ break;
+ default:
+@@ -3399,7 +3417,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ /* Mark as an IO operation because we read the time. */
+ if (use_icount)
+ gen_io_start();
+- gen_helper_mfc0_count(arg);
++ gen_helper_mfc0_count(arg, cpu_env);
+ if (use_icount) {
+ gen_io_end();
+ }
+@@ -3531,7 +3549,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 17:
+ switch (sel) {
+ case 0:
+- gen_helper_mfc0_lladdr(arg);
++ gen_helper_mfc0_lladdr(arg, cpu_env);
+ rn = "LLAddr";
+ break;
+ default:
+@@ -3541,7 +3559,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 18:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mfc0_watchlo, arg, sel);
++ gen_helper_1e0i(mfc0_watchlo, arg, sel);
+ rn = "WatchLo";
+ break;
+ default:
+@@ -3551,7 +3569,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 19:
+ switch (sel) {
+ case 0 ...7:
+- gen_helper_1i(mfc0_watchhi, arg, sel);
++ gen_helper_1e0i(mfc0_watchhi, arg, sel);
+ rn = "WatchHi";
+ break;
+ default:
+@@ -3590,7 +3608,7 @@ static void gen_mfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mfc0_debug(arg); /* EJTAG support */
++ gen_helper_mfc0_debug(arg, cpu_env); /* EJTAG support */
+ rn = "Debug";
+ break;
+ case 1:
+@@ -3765,12 +3783,12 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 0:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_index(arg);
++ gen_helper_mtc0_index(cpu_env, arg);
+ rn = "Index";
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_mvpcontrol(arg);
++ gen_helper_mtc0_mvpcontrol(cpu_env, arg);
+ rn = "MVPControl";
+ break;
+ case 2:
+@@ -3795,22 +3813,22 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpecontrol(arg);
++ gen_helper_mtc0_vpecontrol(cpu_env, arg);
+ rn = "VPEControl";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeconf0(arg);
++ gen_helper_mtc0_vpeconf0(cpu_env, arg);
+ rn = "VPEConf0";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeconf1(arg);
++ gen_helper_mtc0_vpeconf1(cpu_env, arg);
+ rn = "VPEConf1";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_yqmask(arg);
++ gen_helper_mtc0_yqmask(cpu_env, arg);
+ rn = "YQMask";
+ break;
+ case 5:
+@@ -3825,7 +3843,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeopt(arg);
++ gen_helper_mtc0_vpeopt(cpu_env, arg);
+ rn = "VPEOpt";
+ break;
+ default:
+@@ -3835,42 +3853,42 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 2:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entrylo0(arg);
++ gen_helper_mtc0_entrylo0(cpu_env, arg);
+ rn = "EntryLo0";
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcstatus(arg);
++ gen_helper_mtc0_tcstatus(cpu_env, arg);
+ rn = "TCStatus";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcbind(arg);
++ gen_helper_mtc0_tcbind(cpu_env, arg);
+ rn = "TCBind";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcrestart(arg);
++ gen_helper_mtc0_tcrestart(cpu_env, arg);
+ rn = "TCRestart";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tchalt(arg);
++ gen_helper_mtc0_tchalt(cpu_env, arg);
+ rn = "TCHalt";
+ break;
+ case 5:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tccontext(arg);
++ gen_helper_mtc0_tccontext(cpu_env, arg);
+ rn = "TCContext";
+ break;
+ case 6:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcschedule(arg);
++ gen_helper_mtc0_tcschedule(cpu_env, arg);
+ rn = "TCSchedule";
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcschefback(arg);
++ gen_helper_mtc0_tcschefback(cpu_env, arg);
+ rn = "TCScheFBack";
+ break;
+ default:
+@@ -3880,7 +3898,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 3:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entrylo1(arg);
++ gen_helper_mtc0_entrylo1(cpu_env, arg);
+ rn = "EntryLo1";
+ break;
+ default:
+@@ -3890,11 +3908,11 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 4:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_context(arg);
++ gen_helper_mtc0_context(cpu_env, arg);
+ rn = "Context";
+ break;
+ case 1:
+-// gen_helper_mtc0_contextconfig(arg); /* SmartMIPS ASE */
++// gen_helper_mtc0_contextconfig(cpu_env, arg); /* SmartMIPS ASE */
+ rn = "ContextConfig";
+ // break;
+ default:
+@@ -3904,12 +3922,12 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 5:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_pagemask(arg);
++ gen_helper_mtc0_pagemask(cpu_env, arg);
+ rn = "PageMask";
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_pagegrain(arg);
++ gen_helper_mtc0_pagegrain(cpu_env, arg);
+ rn = "PageGrain";
+ break;
+ default:
+@@ -3919,32 +3937,32 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 6:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_wired(arg);
++ gen_helper_mtc0_wired(cpu_env, arg);
+ rn = "Wired";
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf0(arg);
++ gen_helper_mtc0_srsconf0(cpu_env, arg);
+ rn = "SRSConf0";
+ break;
+ case 2:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf1(arg);
++ gen_helper_mtc0_srsconf1(cpu_env, arg);
+ rn = "SRSConf1";
+ break;
+ case 3:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf2(arg);
++ gen_helper_mtc0_srsconf2(cpu_env, arg);
+ rn = "SRSConf2";
+ break;
+ case 4:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf3(arg);
++ gen_helper_mtc0_srsconf3(cpu_env, arg);
+ rn = "SRSConf3";
+ break;
+ case 5:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf4(arg);
++ gen_helper_mtc0_srsconf4(cpu_env, arg);
+ rn = "SRSConf4";
+ break;
+ default:
+@@ -3955,7 +3973,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ switch (sel) {
+ case 0:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_hwrena(arg);
++ gen_helper_mtc0_hwrena(cpu_env, arg);
+ rn = "HWREna";
+ break;
+ default:
+@@ -3969,7 +3987,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 9:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_count(arg);
++ gen_helper_mtc0_count(cpu_env, arg);
+ rn = "Count";
+ break;
+ /* 6,7 are implementation dependent */
+@@ -3980,7 +3998,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 10:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entryhi(arg);
++ gen_helper_mtc0_entryhi(cpu_env, arg);
+ rn = "EntryHi";
+ break;
+ default:
+@@ -3990,7 +4008,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 11:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_compare(arg);
++ gen_helper_mtc0_compare(cpu_env, arg);
+ rn = "Compare";
+ break;
+ /* 6,7 are implementation dependent */
+@@ -4002,7 +4020,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ switch (sel) {
+ case 0:
+ save_cpu_state(ctx, 1);
+- gen_helper_mtc0_status(arg);
++ gen_helper_mtc0_status(cpu_env, arg);
+ /* BS_STOP isn't good enough here, hflags may have changed. */
+ gen_save_pc(ctx->pc + 4);
+ ctx->bstate = BS_EXCP;
+@@ -4010,14 +4028,14 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_intctl(arg);
++ gen_helper_mtc0_intctl(cpu_env, arg);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "IntCtl";
+ break;
+ case 2:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsctl(arg);
++ gen_helper_mtc0_srsctl(cpu_env, arg);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "SRSCtl";
+@@ -4037,7 +4055,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ switch (sel) {
+ case 0:
+ save_cpu_state(ctx, 1);
+- gen_helper_mtc0_cause(arg);
++ gen_helper_mtc0_cause(cpu_env, arg);
+ rn = "Cause";
+ break;
+ default:
+@@ -4062,7 +4080,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_ebase(arg);
++ gen_helper_mtc0_ebase(cpu_env, arg);
+ rn = "EBase";
+ break;
+ default:
+@@ -4072,7 +4090,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 16:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_config0(arg);
++ gen_helper_mtc0_config0(cpu_env, arg);
+ rn = "Config";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -4082,7 +4100,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ rn = "Config1";
+ break;
+ case 2:
+- gen_helper_mtc0_config2(arg);
++ gen_helper_mtc0_config2(cpu_env, arg);
+ rn = "Config2";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -4109,7 +4127,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 17:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_lladdr(arg);
++ gen_helper_mtc0_lladdr(cpu_env, arg);
+ rn = "LLAddr";
+ break;
+ default:
+@@ -4119,7 +4137,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 18:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mtc0_watchlo, arg, sel);
++ gen_helper_0e1i(mtc0_watchlo, arg, sel);
+ rn = "WatchLo";
+ break;
+ default:
+@@ -4129,7 +4147,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 19:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mtc0_watchhi, arg, sel);
++ gen_helper_0e1i(mtc0_watchhi, arg, sel);
+ rn = "WatchHi";
+ break;
+ default:
+@@ -4141,7 +4159,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 0:
+ #if defined(TARGET_MIPS64)
+ check_insn(env, ctx, ISA_MIPS3);
+- gen_helper_mtc0_xcontext(arg);
++ gen_helper_mtc0_xcontext(cpu_env, arg);
+ rn = "XContext";
+ break;
+ #endif
+@@ -4153,7 +4171,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ /* Officially reserved, but sel 0 is used for R1x000 framemask */
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_framemask(arg);
++ gen_helper_mtc0_framemask(cpu_env, arg);
+ rn = "Framemask";
+ break;
+ default:
+@@ -4167,20 +4185,20 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_debug(arg); /* EJTAG support */
++ gen_helper_mtc0_debug(cpu_env, arg); /* EJTAG support */
+ /* BS_STOP isn't good enough here, hflags may have changed. */
+ gen_save_pc(ctx->pc + 4);
+ ctx->bstate = BS_EXCP;
+ rn = "Debug";
+ break;
+ case 1:
+-// gen_helper_mtc0_tracecontrol(arg); /* PDtrace support */
++// gen_helper_mtc0_tracecontrol(cpu_env, arg); /* PDtrace support */
+ rn = "TraceControl";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ // break;
+ case 2:
+-// gen_helper_mtc0_tracecontrol2(arg); /* PDtrace support */
++// gen_helper_mtc0_tracecontrol2(cpu_env, arg); /* PDtrace support */
+ rn = "TraceControl2";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -4188,13 +4206,13 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 3:
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+-// gen_helper_mtc0_usertracedata(arg); /* PDtrace support */
++// gen_helper_mtc0_usertracedata(cpu_env, arg); /* PDtrace support */
+ rn = "UserTraceData";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ // break;
+ case 4:
+-// gen_helper_mtc0_tracebpc(arg); /* PDtrace support */
++// gen_helper_mtc0_tracebpc(cpu_env, arg); /* PDtrace support */
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "TraceBPC";
+@@ -4217,7 +4235,7 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 25:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_performance0(arg);
++ gen_helper_mtc0_performance0(cpu_env, arg);
+ rn = "Performance0";
+ break;
+ case 1:
+@@ -4272,14 +4290,14 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 2:
+ case 4:
+ case 6:
+- gen_helper_mtc0_taglo(arg);
++ gen_helper_mtc0_taglo(cpu_env, arg);
+ rn = "TagLo";
+ break;
+ case 1:
+ case 3:
+ case 5:
+ case 7:
+- gen_helper_mtc0_datalo(arg);
++ gen_helper_mtc0_datalo(cpu_env, arg);
+ rn = "DataLo";
+ break;
+ default:
+@@ -4292,14 +4310,14 @@ static void gen_mtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg, i
+ case 2:
+ case 4:
+ case 6:
+- gen_helper_mtc0_taghi(arg);
++ gen_helper_mtc0_taghi(cpu_env, arg);
+ rn = "TagHi";
+ break;
+ case 1:
+ case 3:
+ case 5:
+ case 7:
+- gen_helper_mtc0_datahi(arg);
++ gen_helper_mtc0_datahi(cpu_env, arg);
+ rn = "DataHi";
+ break;
+ default:
+@@ -4364,17 +4382,17 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpcontrol(arg);
++ gen_helper_mfc0_mvpcontrol(arg, cpu_env);
+ rn = "MVPControl";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpconf0(arg);
++ gen_helper_mfc0_mvpconf0(arg, cpu_env);
+ rn = "MVPConf0";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_mvpconf1(arg);
++ gen_helper_mfc0_mvpconf1(arg, cpu_env);
+ rn = "MVPConf1";
+ break;
+ default:
+@@ -4384,7 +4402,7 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 1:
+ switch (sel) {
+ case 0:
+- gen_helper_mfc0_random(arg);
++ gen_helper_mfc0_random(arg, cpu_env);
+ rn = "Random";
+ break;
+ case 1:
+@@ -4434,37 +4452,37 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcstatus(arg);
++ gen_helper_mfc0_tcstatus(arg, cpu_env);
+ rn = "TCStatus";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mfc0_tcbind(arg);
++ gen_helper_mfc0_tcbind(arg, cpu_env);
+ rn = "TCBind";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dmfc0_tcrestart(arg);
++ gen_helper_dmfc0_tcrestart(arg, cpu_env);
+ rn = "TCRestart";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dmfc0_tchalt(arg);
++ gen_helper_dmfc0_tchalt(arg, cpu_env);
+ rn = "TCHalt";
+ break;
+ case 5:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dmfc0_tccontext(arg);
++ gen_helper_dmfc0_tccontext(arg, cpu_env);
+ rn = "TCContext";
+ break;
+ case 6:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dmfc0_tcschedule(arg);
++ gen_helper_dmfc0_tcschedule(arg, cpu_env);
+ rn = "TCSchedule";
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dmfc0_tcschefback(arg);
++ gen_helper_dmfc0_tcschefback(arg, cpu_env);
+ rn = "TCScheFBack";
+ break;
+ default:
+@@ -4572,7 +4590,7 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ /* Mark as an IO operation because we read the time. */
+ if (use_icount)
+ gen_io_start();
+- gen_helper_mfc0_count(arg);
++ gen_helper_mfc0_count(arg, cpu_env);
+ if (use_icount) {
+ gen_io_end();
+ }
+@@ -4701,7 +4719,7 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 17:
+ switch (sel) {
+ case 0:
+- gen_helper_dmfc0_lladdr(arg);
++ gen_helper_dmfc0_lladdr(arg, cpu_env);
+ rn = "LLAddr";
+ break;
+ default:
+@@ -4711,7 +4729,7 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 18:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(dmfc0_watchlo, arg, sel);
++ gen_helper_1e0i(dmfc0_watchlo, arg, sel);
+ rn = "WatchLo";
+ break;
+ default:
+@@ -4721,7 +4739,7 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 19:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mfc0_watchhi, arg, sel);
++ gen_helper_1e0i(mfc0_watchhi, arg, sel);
+ rn = "WatchHi";
+ break;
+ default:
+@@ -4757,23 +4775,23 @@ static void gen_dmfc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mfc0_debug(arg); /* EJTAG support */
++ gen_helper_mfc0_debug(arg, cpu_env); /* EJTAG support */
+ rn = "Debug";
+ break;
+ case 1:
+-// gen_helper_dmfc0_tracecontrol(arg); /* PDtrace support */
++// gen_helper_dmfc0_tracecontrol(arg, cpu_env); /* PDtrace support */
+ rn = "TraceControl";
+ // break;
+ case 2:
+-// gen_helper_dmfc0_tracecontrol2(arg); /* PDtrace support */
++// gen_helper_dmfc0_tracecontrol2(arg, cpu_env); /* PDtrace support */
+ rn = "TraceControl2";
+ // break;
+ case 3:
+-// gen_helper_dmfc0_usertracedata(arg); /* PDtrace support */
++// gen_helper_dmfc0_usertracedata(arg, cpu_env); /* PDtrace support */
+ rn = "UserTraceData";
+ // break;
+ case 4:
+-// gen_helper_dmfc0_tracebpc(arg); /* PDtrace support */
++// gen_helper_dmfc0_tracebpc(arg, cpu_env); /* PDtrace support */
+ rn = "TraceBPC";
+ // break;
+ default:
+@@ -4931,12 +4949,12 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 0:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_index(arg);
++ gen_helper_mtc0_index(cpu_env, arg);
+ rn = "Index";
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_mvpcontrol(arg);
++ gen_helper_mtc0_mvpcontrol(cpu_env, arg);
+ rn = "MVPControl";
+ break;
+ case 2:
+@@ -4961,22 +4979,22 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpecontrol(arg);
++ gen_helper_mtc0_vpecontrol(cpu_env, arg);
+ rn = "VPEControl";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeconf0(arg);
++ gen_helper_mtc0_vpeconf0(cpu_env, arg);
+ rn = "VPEConf0";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeconf1(arg);
++ gen_helper_mtc0_vpeconf1(cpu_env, arg);
+ rn = "VPEConf1";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_yqmask(arg);
++ gen_helper_mtc0_yqmask(cpu_env, arg);
+ rn = "YQMask";
+ break;
+ case 5:
+@@ -4991,7 +5009,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_vpeopt(arg);
++ gen_helper_mtc0_vpeopt(cpu_env, arg);
+ rn = "VPEOpt";
+ break;
+ default:
+@@ -5001,42 +5019,42 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 2:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entrylo0(arg);
++ gen_helper_mtc0_entrylo0(cpu_env, arg);
+ rn = "EntryLo0";
+ break;
+ case 1:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcstatus(arg);
++ gen_helper_mtc0_tcstatus(cpu_env, arg);
+ rn = "TCStatus";
+ break;
+ case 2:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcbind(arg);
++ gen_helper_mtc0_tcbind(cpu_env, arg);
+ rn = "TCBind";
+ break;
+ case 3:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcrestart(arg);
++ gen_helper_mtc0_tcrestart(cpu_env, arg);
+ rn = "TCRestart";
+ break;
+ case 4:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tchalt(arg);
++ gen_helper_mtc0_tchalt(cpu_env, arg);
+ rn = "TCHalt";
+ break;
+ case 5:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tccontext(arg);
++ gen_helper_mtc0_tccontext(cpu_env, arg);
+ rn = "TCContext";
+ break;
+ case 6:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcschedule(arg);
++ gen_helper_mtc0_tcschedule(cpu_env, arg);
+ rn = "TCSchedule";
+ break;
+ case 7:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_mtc0_tcschefback(arg);
++ gen_helper_mtc0_tcschefback(cpu_env, arg);
+ rn = "TCScheFBack";
+ break;
+ default:
+@@ -5046,7 +5064,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 3:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entrylo1(arg);
++ gen_helper_mtc0_entrylo1(cpu_env, arg);
+ rn = "EntryLo1";
+ break;
+ default:
+@@ -5056,11 +5074,11 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 4:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_context(arg);
++ gen_helper_mtc0_context(cpu_env, arg);
+ rn = "Context";
+ break;
+ case 1:
+-// gen_helper_mtc0_contextconfig(arg); /* SmartMIPS ASE */
++// gen_helper_mtc0_contextconfig(cpu_env, arg); /* SmartMIPS ASE */
+ rn = "ContextConfig";
+ // break;
+ default:
+@@ -5070,12 +5088,12 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 5:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_pagemask(arg);
++ gen_helper_mtc0_pagemask(cpu_env, arg);
+ rn = "PageMask";
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_pagegrain(arg);
++ gen_helper_mtc0_pagegrain(cpu_env, arg);
+ rn = "PageGrain";
+ break;
+ default:
+@@ -5085,32 +5103,32 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 6:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_wired(arg);
++ gen_helper_mtc0_wired(cpu_env, arg);
+ rn = "Wired";
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf0(arg);
++ gen_helper_mtc0_srsconf0(cpu_env, arg);
+ rn = "SRSConf0";
+ break;
+ case 2:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf1(arg);
++ gen_helper_mtc0_srsconf1(cpu_env, arg);
+ rn = "SRSConf1";
+ break;
+ case 3:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf2(arg);
++ gen_helper_mtc0_srsconf2(cpu_env, arg);
+ rn = "SRSConf2";
+ break;
+ case 4:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf3(arg);
++ gen_helper_mtc0_srsconf3(cpu_env, arg);
+ rn = "SRSConf3";
+ break;
+ case 5:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsconf4(arg);
++ gen_helper_mtc0_srsconf4(cpu_env, arg);
+ rn = "SRSConf4";
+ break;
+ default:
+@@ -5121,7 +5139,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ switch (sel) {
+ case 0:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_hwrena(arg);
++ gen_helper_mtc0_hwrena(cpu_env, arg);
+ rn = "HWREna";
+ break;
+ default:
+@@ -5135,7 +5153,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 9:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_count(arg);
++ gen_helper_mtc0_count(cpu_env, arg);
+ rn = "Count";
+ break;
+ /* 6,7 are implementation dependent */
+@@ -5148,7 +5166,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 10:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_entryhi(arg);
++ gen_helper_mtc0_entryhi(cpu_env, arg);
+ rn = "EntryHi";
+ break;
+ default:
+@@ -5158,7 +5176,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 11:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_compare(arg);
++ gen_helper_mtc0_compare(cpu_env, arg);
+ rn = "Compare";
+ break;
+ /* 6,7 are implementation dependent */
+@@ -5172,7 +5190,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ switch (sel) {
+ case 0:
+ save_cpu_state(ctx, 1);
+- gen_helper_mtc0_status(arg);
++ gen_helper_mtc0_status(cpu_env, arg);
+ /* BS_STOP isn't good enough here, hflags may have changed. */
+ gen_save_pc(ctx->pc + 4);
+ ctx->bstate = BS_EXCP;
+@@ -5180,14 +5198,14 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_intctl(arg);
++ gen_helper_mtc0_intctl(cpu_env, arg);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "IntCtl";
+ break;
+ case 2:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_srsctl(arg);
++ gen_helper_mtc0_srsctl(cpu_env, arg);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "SRSCtl";
+@@ -5212,7 +5230,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ if (use_icount) {
+ gen_io_start();
+ }
+- gen_helper_mtc0_cause(arg);
++ gen_helper_mtc0_cause(cpu_env, arg);
+ if (use_icount) {
+ gen_io_end();
+ }
+@@ -5242,7 +5260,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ break;
+ case 1:
+ check_insn(env, ctx, ISA_MIPS32R2);
+- gen_helper_mtc0_ebase(arg);
++ gen_helper_mtc0_ebase(cpu_env, arg);
+ rn = "EBase";
+ break;
+ default:
+@@ -5252,7 +5270,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 16:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_config0(arg);
++ gen_helper_mtc0_config0(cpu_env, arg);
+ rn = "Config";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -5262,7 +5280,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ rn = "Config1";
+ break;
+ case 2:
+- gen_helper_mtc0_config2(arg);
++ gen_helper_mtc0_config2(cpu_env, arg);
+ rn = "Config2";
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -5280,7 +5298,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 17:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_lladdr(arg);
++ gen_helper_mtc0_lladdr(cpu_env, arg);
+ rn = "LLAddr";
+ break;
+ default:
+@@ -5290,7 +5308,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 18:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mtc0_watchlo, arg, sel);
++ gen_helper_0e1i(mtc0_watchlo, arg, sel);
+ rn = "WatchLo";
+ break;
+ default:
+@@ -5300,7 +5318,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 19:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_1i(mtc0_watchhi, arg, sel);
++ gen_helper_0e1i(mtc0_watchhi, arg, sel);
+ rn = "WatchHi";
+ break;
+ default:
+@@ -5311,7 +5329,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ switch (sel) {
+ case 0:
+ check_insn(env, ctx, ISA_MIPS3);
+- gen_helper_mtc0_xcontext(arg);
++ gen_helper_mtc0_xcontext(cpu_env, arg);
+ rn = "XContext";
+ break;
+ default:
+@@ -5322,7 +5340,7 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ /* Officially reserved, but sel 0 is used for R1x000 framemask */
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_framemask(arg);
++ gen_helper_mtc0_framemask(cpu_env, arg);
+ rn = "Framemask";
+ break;
+ default:
+@@ -5336,32 +5354,32 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_debug(arg); /* EJTAG support */
++ gen_helper_mtc0_debug(cpu_env, arg); /* EJTAG support */
+ /* BS_STOP isn't good enough here, hflags may have changed. */
+ gen_save_pc(ctx->pc + 4);
+ ctx->bstate = BS_EXCP;
+ rn = "Debug";
+ break;
+ case 1:
+-// gen_helper_mtc0_tracecontrol(arg); /* PDtrace support */
++// gen_helper_mtc0_tracecontrol(cpu_env, arg); /* PDtrace support */
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "TraceControl";
+ // break;
+ case 2:
+-// gen_helper_mtc0_tracecontrol2(arg); /* PDtrace support */
++// gen_helper_mtc0_tracecontrol2(cpu_env, arg); /* PDtrace support */
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "TraceControl2";
+ // break;
+ case 3:
+-// gen_helper_mtc0_usertracedata(arg); /* PDtrace support */
++// gen_helper_mtc0_usertracedata(cpu_env, arg); /* PDtrace support */
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "UserTraceData";
+ // break;
+ case 4:
+-// gen_helper_mtc0_tracebpc(arg); /* PDtrace support */
++// gen_helper_mtc0_tracebpc(cpu_env, arg); /* PDtrace support */
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+ rn = "TraceBPC";
+@@ -5384,35 +5402,35 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 25:
+ switch (sel) {
+ case 0:
+- gen_helper_mtc0_performance0(arg);
++ gen_helper_mtc0_performance0(cpu_env, arg);
+ rn = "Performance0";
+ break;
+ case 1:
+-// gen_helper_mtc0_performance1(arg);
++// gen_helper_mtc0_performance1(cpu_env, arg);
+ rn = "Performance1";
+ // break;
+ case 2:
+-// gen_helper_mtc0_performance2(arg);
++// gen_helper_mtc0_performance2(cpu_env, arg);
+ rn = "Performance2";
+ // break;
+ case 3:
+-// gen_helper_mtc0_performance3(arg);
++// gen_helper_mtc0_performance3(cpu_env, arg);
+ rn = "Performance3";
+ // break;
+ case 4:
+-// gen_helper_mtc0_performance4(arg);
++// gen_helper_mtc0_performance4(cpu_env, arg);
+ rn = "Performance4";
+ // break;
+ case 5:
+-// gen_helper_mtc0_performance5(arg);
++// gen_helper_mtc0_performance5(cpu_env, arg);
+ rn = "Performance5";
+ // break;
+ case 6:
+-// gen_helper_mtc0_performance6(arg);
++// gen_helper_mtc0_performance6(cpu_env, arg);
+ rn = "Performance6";
+ // break;
+ case 7:
+-// gen_helper_mtc0_performance7(arg);
++// gen_helper_mtc0_performance7(cpu_env, arg);
+ rn = "Performance7";
+ // break;
+ default:
+@@ -5439,14 +5457,14 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 2:
+ case 4:
+ case 6:
+- gen_helper_mtc0_taglo(arg);
++ gen_helper_mtc0_taglo(cpu_env, arg);
+ rn = "TagLo";
+ break;
+ case 1:
+ case 3:
+ case 5:
+ case 7:
+- gen_helper_mtc0_datalo(arg);
++ gen_helper_mtc0_datalo(cpu_env, arg);
+ rn = "DataLo";
+ break;
+ default:
+@@ -5459,14 +5477,14 @@ static void gen_dmtc0 (CPUMIPSState *env, DisasContext *ctx, TCGv arg, int reg,
+ case 2:
+ case 4:
+ case 6:
+- gen_helper_mtc0_taghi(arg);
++ gen_helper_mtc0_taghi(cpu_env, arg);
+ rn = "TagHi";
+ break;
+ case 1:
+ case 3:
+ case 5:
+ case 7:
+- gen_helper_mtc0_datahi(arg);
++ gen_helper_mtc0_datahi(cpu_env, arg);
+ rn = "DataHi";
+ break;
+ default:
+@@ -5533,10 +5551,10 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 1:
+ switch (sel) {
+ case 1:
+- gen_helper_mftc0_vpecontrol(t0);
++ gen_helper_mftc0_vpecontrol(t0, cpu_env);
+ break;
+ case 2:
+- gen_helper_mftc0_vpeconf0(t0);
++ gen_helper_mftc0_vpeconf0(t0, cpu_env);
+ break;
+ default:
+ goto die;
+@@ -5546,25 +5564,25 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 2:
+ switch (sel) {
+ case 1:
+- gen_helper_mftc0_tcstatus(t0);
++ gen_helper_mftc0_tcstatus(t0, cpu_env);
+ break;
+ case 2:
+- gen_helper_mftc0_tcbind(t0);
++ gen_helper_mftc0_tcbind(t0, cpu_env);
+ break;
+ case 3:
+- gen_helper_mftc0_tcrestart(t0);
++ gen_helper_mftc0_tcrestart(t0, cpu_env);
+ break;
+ case 4:
+- gen_helper_mftc0_tchalt(t0);
++ gen_helper_mftc0_tchalt(t0, cpu_env);
+ break;
+ case 5:
+- gen_helper_mftc0_tccontext(t0);
++ gen_helper_mftc0_tccontext(t0, cpu_env);
+ break;
+ case 6:
+- gen_helper_mftc0_tcschedule(t0);
++ gen_helper_mftc0_tcschedule(t0, cpu_env);
+ break;
+ case 7:
+- gen_helper_mftc0_tcschefback(t0);
++ gen_helper_mftc0_tcschefback(t0, cpu_env);
+ break;
+ default:
+ gen_mfc0(env, ctx, t0, rt, sel);
+@@ -5574,7 +5592,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 10:
+ switch (sel) {
+ case 0:
+- gen_helper_mftc0_entryhi(t0);
++ gen_helper_mftc0_entryhi(t0, cpu_env);
+ break;
+ default:
+ gen_mfc0(env, ctx, t0, rt, sel);
+@@ -5583,7 +5601,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 12:
+ switch (sel) {
+ case 0:
+- gen_helper_mftc0_status(t0);
++ gen_helper_mftc0_status(t0, cpu_env);
+ break;
+ default:
+ gen_mfc0(env, ctx, t0, rt, sel);
+@@ -5592,7 +5610,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 13:
+ switch (sel) {
+ case 0:
+- gen_helper_mftc0_cause(t0);
++ gen_helper_mftc0_cause(t0, cpu_env);
+ break;
+ default:
+ goto die;
+@@ -5602,7 +5620,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 14:
+ switch (sel) {
+ case 0:
+- gen_helper_mftc0_epc(t0);
++ gen_helper_mftc0_epc(t0, cpu_env);
+ break;
+ default:
+ goto die;
+@@ -5612,7 +5630,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 15:
+ switch (sel) {
+ case 1:
+- gen_helper_mftc0_ebase(t0);
++ gen_helper_mftc0_ebase(t0, cpu_env);
+ break;
+ default:
+ goto die;
+@@ -5622,7 +5640,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 16:
+ switch (sel) {
+ case 0 ... 7:
+- gen_helper_mftc0_configx(t0, tcg_const_tl(sel));
++ gen_helper_mftc0_configx(t0, cpu_env, tcg_const_tl(sel));
+ break;
+ default:
+ goto die;
+@@ -5632,7 +5650,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mftc0_debug(t0);
++ gen_helper_mftc0_debug(t0, cpu_env);
+ break;
+ default:
+ gen_mfc0(env, ctx, t0, rt, sel);
+@@ -5645,49 +5663,49 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ } else switch (sel) {
+ /* GPR registers. */
+ case 0:
+- gen_helper_1i(mftgpr, t0, rt);
++ gen_helper_1e0i(mftgpr, t0, rt);
+ break;
+ /* Auxiliary CPU registers */
+ case 1:
+ switch (rt) {
+ case 0:
+- gen_helper_1i(mftlo, t0, 0);
++ gen_helper_1e0i(mftlo, t0, 0);
+ break;
+ case 1:
+- gen_helper_1i(mfthi, t0, 0);
++ gen_helper_1e0i(mfthi, t0, 0);
+ break;
+ case 2:
+- gen_helper_1i(mftacx, t0, 0);
++ gen_helper_1e0i(mftacx, t0, 0);
+ break;
+ case 4:
+- gen_helper_1i(mftlo, t0, 1);
++ gen_helper_1e0i(mftlo, t0, 1);
+ break;
+ case 5:
+- gen_helper_1i(mfthi, t0, 1);
++ gen_helper_1e0i(mfthi, t0, 1);
+ break;
+ case 6:
+- gen_helper_1i(mftacx, t0, 1);
++ gen_helper_1e0i(mftacx, t0, 1);
+ break;
+ case 8:
+- gen_helper_1i(mftlo, t0, 2);
++ gen_helper_1e0i(mftlo, t0, 2);
+ break;
+ case 9:
+- gen_helper_1i(mfthi, t0, 2);
++ gen_helper_1e0i(mfthi, t0, 2);
+ break;
+ case 10:
+- gen_helper_1i(mftacx, t0, 2);
++ gen_helper_1e0i(mftacx, t0, 2);
+ break;
+ case 12:
+- gen_helper_1i(mftlo, t0, 3);
++ gen_helper_1e0i(mftlo, t0, 3);
+ break;
+ case 13:
+- gen_helper_1i(mfthi, t0, 3);
++ gen_helper_1e0i(mfthi, t0, 3);
+ break;
+ case 14:
+- gen_helper_1i(mftacx, t0, 3);
++ gen_helper_1e0i(mftacx, t0, 3);
+ break;
+ case 16:
+- gen_helper_mftdsp(t0);
++ gen_helper_mftdsp(t0, cpu_env);
+ break;
+ default:
+ goto die;
+@@ -5712,7 +5730,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
+ break;
+ case 3:
+ /* XXX: For now we support only a single FPU context. */
+- gen_helper_1i(cfc1, t0, rt);
++ gen_helper_1e0i(cfc1, t0, rt);
+ break;
+ /* COP2: Not implemented. */
+ case 4:
+@@ -5751,10 +5769,10 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 1:
+ switch (sel) {
+ case 1:
+- gen_helper_mttc0_vpecontrol(t0);
++ gen_helper_mttc0_vpecontrol(cpu_env, t0);
+ break;
+ case 2:
+- gen_helper_mttc0_vpeconf0(t0);
++ gen_helper_mttc0_vpeconf0(cpu_env, t0);
+ break;
+ default:
+ goto die;
+@@ -5764,25 +5782,25 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 2:
+ switch (sel) {
+ case 1:
+- gen_helper_mttc0_tcstatus(t0);
++ gen_helper_mttc0_tcstatus(cpu_env, t0);
+ break;
+ case 2:
+- gen_helper_mttc0_tcbind(t0);
++ gen_helper_mttc0_tcbind(cpu_env, t0);
+ break;
+ case 3:
+- gen_helper_mttc0_tcrestart(t0);
++ gen_helper_mttc0_tcrestart(cpu_env, t0);
+ break;
+ case 4:
+- gen_helper_mttc0_tchalt(t0);
++ gen_helper_mttc0_tchalt(cpu_env, t0);
+ break;
+ case 5:
+- gen_helper_mttc0_tccontext(t0);
++ gen_helper_mttc0_tccontext(cpu_env, t0);
+ break;
+ case 6:
+- gen_helper_mttc0_tcschedule(t0);
++ gen_helper_mttc0_tcschedule(cpu_env, t0);
+ break;
+ case 7:
+- gen_helper_mttc0_tcschefback(t0);
++ gen_helper_mttc0_tcschefback(cpu_env, t0);
+ break;
+ default:
+ gen_mtc0(env, ctx, t0, rd, sel);
+@@ -5792,7 +5810,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 10:
+ switch (sel) {
+ case 0:
+- gen_helper_mttc0_entryhi(t0);
++ gen_helper_mttc0_entryhi(cpu_env, t0);
+ break;
+ default:
+ gen_mtc0(env, ctx, t0, rd, sel);
+@@ -5801,7 +5819,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 12:
+ switch (sel) {
+ case 0:
+- gen_helper_mttc0_status(t0);
++ gen_helper_mttc0_status(cpu_env, t0);
+ break;
+ default:
+ gen_mtc0(env, ctx, t0, rd, sel);
+@@ -5810,7 +5828,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 13:
+ switch (sel) {
+ case 0:
+- gen_helper_mttc0_cause(t0);
++ gen_helper_mttc0_cause(cpu_env, t0);
+ break;
+ default:
+ goto die;
+@@ -5820,7 +5838,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 15:
+ switch (sel) {
+ case 1:
+- gen_helper_mttc0_ebase(t0);
++ gen_helper_mttc0_ebase(cpu_env, t0);
+ break;
+ default:
+ goto die;
+@@ -5830,7 +5848,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ case 23:
+ switch (sel) {
+ case 0:
+- gen_helper_mttc0_debug(t0);
++ gen_helper_mttc0_debug(cpu_env, t0);
+ break;
+ default:
+ gen_mtc0(env, ctx, t0, rd, sel);
+@@ -5843,49 +5861,49 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ } else switch (sel) {
+ /* GPR registers. */
+ case 0:
+- gen_helper_1i(mttgpr, t0, rd);
++ gen_helper_0e1i(mttgpr, t0, rd);
+ break;
+ /* Auxiliary CPU registers */
+ case 1:
+ switch (rd) {
+ case 0:
+- gen_helper_1i(mttlo, t0, 0);
++ gen_helper_0e1i(mttlo, t0, 0);
+ break;
+ case 1:
+- gen_helper_1i(mtthi, t0, 0);
++ gen_helper_0e1i(mtthi, t0, 0);
+ break;
+ case 2:
+- gen_helper_1i(mttacx, t0, 0);
++ gen_helper_0e1i(mttacx, t0, 0);
+ break;
+ case 4:
+- gen_helper_1i(mttlo, t0, 1);
++ gen_helper_0e1i(mttlo, t0, 1);
+ break;
+ case 5:
+- gen_helper_1i(mtthi, t0, 1);
++ gen_helper_0e1i(mtthi, t0, 1);
+ break;
+ case 6:
+- gen_helper_1i(mttacx, t0, 1);
++ gen_helper_0e1i(mttacx, t0, 1);
+ break;
+ case 8:
+- gen_helper_1i(mttlo, t0, 2);
++ gen_helper_0e1i(mttlo, t0, 2);
+ break;
+ case 9:
+- gen_helper_1i(mtthi, t0, 2);
++ gen_helper_0e1i(mtthi, t0, 2);
+ break;
+ case 10:
+- gen_helper_1i(mttacx, t0, 2);
++ gen_helper_0e1i(mttacx, t0, 2);
+ break;
+ case 12:
+- gen_helper_1i(mttlo, t0, 3);
++ gen_helper_0e1i(mttlo, t0, 3);
+ break;
+ case 13:
+- gen_helper_1i(mtthi, t0, 3);
++ gen_helper_0e1i(mtthi, t0, 3);
+ break;
+ case 14:
+- gen_helper_1i(mttacx, t0, 3);
++ gen_helper_0e1i(mttacx, t0, 3);
+ break;
+ case 16:
+- gen_helper_mttdsp(t0);
++ gen_helper_mttdsp(cpu_env, t0);
+ break;
+ default:
+ goto die;
+@@ -5910,7 +5928,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
+ break;
+ case 3:
+ /* XXX: For now we support only a single FPU context. */
+- gen_helper_1i(ctc1, t0, rd);
++ gen_helper_0e1i(ctc1, t0, rd);
+ break;
+ /* COP2: Not implemented. */
+ case 4:
+@@ -5995,30 +6013,30 @@ static void gen_cp0 (CPUMIPSState *env, DisasContext *ctx, uint32_t opc, int rt,
+ opn = "tlbwi";
+ if (!env->tlb->helper_tlbwi)
+ goto die;
+- gen_helper_tlbwi();
++ gen_helper_tlbwi(cpu_env);
+ break;
+ case OPC_TLBWR:
+ opn = "tlbwr";
+ if (!env->tlb->helper_tlbwr)
+ goto die;
+- gen_helper_tlbwr();
++ gen_helper_tlbwr(cpu_env);
+ break;
+ case OPC_TLBP:
+ opn = "tlbp";
+ if (!env->tlb->helper_tlbp)
+ goto die;
+- gen_helper_tlbp();
++ gen_helper_tlbp(cpu_env);
+ break;
+ case OPC_TLBR:
+ opn = "tlbr";
+ if (!env->tlb->helper_tlbr)
+ goto die;
+- gen_helper_tlbr();
++ gen_helper_tlbr(cpu_env);
+ break;
+ case OPC_ERET:
+ opn = "eret";
+ check_insn(env, ctx, ISA_MIPS2);
+- gen_helper_eret();
++ gen_helper_eret(cpu_env);
+ ctx->bstate = BS_EXCP;
+ break;
+ case OPC_DERET:
+@@ -6028,7 +6046,7 @@ static void gen_cp0 (CPUMIPSState *env, DisasContext *ctx, uint32_t opc, int rt,
+ MIPS_INVAL(opn);
+ generate_exception(ctx, EXCP_RI);
+ } else {
+- gen_helper_deret();
++ gen_helper_deret(cpu_env);
+ ctx->bstate = BS_EXCP;
+ }
+ break;
+@@ -6039,7 +6057,7 @@ static void gen_cp0 (CPUMIPSState *env, DisasContext *ctx, uint32_t opc, int rt,
+ ctx->pc += 4;
+ save_cpu_state(ctx, 1);
+ ctx->pc -= 4;
+- gen_helper_wait();
++ gen_helper_wait(cpu_env);
+ ctx->bstate = BS_EXCP;
+ break;
+ default:
+@@ -6340,13 +6358,13 @@ static void gen_cp1 (DisasContext *ctx, uint32_t opc, int rt, int fs)
+ opn = "mtc1";
+ break;
+ case OPC_CFC1:
+- gen_helper_1i(cfc1, t0, fs);
++ gen_helper_1e0i(cfc1, t0, fs);
+ gen_store_gpr(t0, rt);
+ opn = "cfc1";
+ break;
+ case OPC_CTC1:
+ gen_load_gpr(t0, rt);
+- gen_helper_1i(ctc1, t0, fs);
++ gen_helper_0e1i(ctc1, t0, fs);
+ opn = "ctc1";
+ break;
+ #if defined(TARGET_MIPS64)
+@@ -6543,7 +6561,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_add_s(fp0, fp0, fp1);
++ gen_helper_float_add_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6558,7 +6576,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_sub_s(fp0, fp0, fp1);
++ gen_helper_float_sub_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6573,7 +6591,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_mul_s(fp0, fp0, fp1);
++ gen_helper_float_mul_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6588,7 +6606,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_div_s(fp0, fp0, fp1);
++ gen_helper_float_div_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6601,7 +6619,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_sqrt_s(fp0, fp0);
++ gen_helper_float_sqrt_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6646,7 +6664,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_roundl_s(fp64, fp32);
++ gen_helper_float_roundl_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6660,7 +6678,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_truncl_s(fp64, fp32);
++ gen_helper_float_truncl_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6674,7 +6692,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_ceill_s(fp64, fp32);
++ gen_helper_float_ceill_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6688,7 +6706,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_floorl_s(fp64, fp32);
++ gen_helper_float_floorl_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6700,7 +6718,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_roundw_s(fp0, fp0);
++ gen_helper_float_roundw_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6711,7 +6729,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_truncw_s(fp0, fp0);
++ gen_helper_float_truncw_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6722,7 +6740,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_ceilw_s(fp0, fp0);
++ gen_helper_float_ceilw_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6733,7 +6751,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_floorw_s(fp0, fp0);
++ gen_helper_float_floorw_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6781,7 +6799,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_recip_s(fp0, fp0);
++ gen_helper_float_recip_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6793,7 +6811,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_rsqrt_s(fp0, fp0);
++ gen_helper_float_rsqrt_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6807,7 +6825,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_recip2_s(fp0, fp0, fp1);
++ gen_helper_float_recip2_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6820,7 +6838,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_recip1_s(fp0, fp0);
++ gen_helper_float_recip1_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6832,7 +6850,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_rsqrt1_s(fp0, fp0);
++ gen_helper_float_rsqrt1_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6846,7 +6864,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+- gen_helper_float_rsqrt2_s(fp0, fp0, fp1);
++ gen_helper_float_rsqrt2_s(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+@@ -6860,7 +6878,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_cvtd_s(fp64, fp32);
++ gen_helper_float_cvtd_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6872,7 +6890,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_cvtw_s(fp0, fp0);
++ gen_helper_float_cvtw_s(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -6885,7 +6903,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_cvtl_s(fp64, fp32);
++ gen_helper_float_cvtl_s(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -6941,7 +6959,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_add_d(fp0, fp0, fp1);
++ gen_helper_float_add_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -6957,7 +6975,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_sub_d(fp0, fp0, fp1);
++ gen_helper_float_sub_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -6973,7 +6991,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_mul_d(fp0, fp0, fp1);
++ gen_helper_float_mul_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -6989,7 +7007,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_div_d(fp0, fp0, fp1);
++ gen_helper_float_div_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7003,7 +7021,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_sqrt_d(fp0, fp0);
++ gen_helper_float_sqrt_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7050,7 +7068,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_roundl_d(fp0, fp0);
++ gen_helper_float_roundl_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7062,7 +7080,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_truncl_d(fp0, fp0);
++ gen_helper_float_truncl_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7074,7 +7092,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_ceill_d(fp0, fp0);
++ gen_helper_float_ceill_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7086,7 +7104,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_floorl_d(fp0, fp0);
++ gen_helper_float_floorl_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7099,7 +7117,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_roundw_d(fp32, fp64);
++ gen_helper_float_roundw_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7113,7 +7131,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_truncw_d(fp32, fp64);
++ gen_helper_float_truncw_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7127,7 +7145,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_ceilw_d(fp32, fp64);
++ gen_helper_float_ceilw_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7141,7 +7159,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_floorw_d(fp32, fp64);
++ gen_helper_float_floorw_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7190,7 +7208,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_recip_d(fp0, fp0);
++ gen_helper_float_recip_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7202,7 +7220,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_rsqrt_d(fp0, fp0);
++ gen_helper_float_rsqrt_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7216,7 +7234,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_recip2_d(fp0, fp0, fp1);
++ gen_helper_float_recip2_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7229,7 +7247,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_recip1_d(fp0, fp0);
++ gen_helper_float_recip1_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7241,7 +7259,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_rsqrt1_d(fp0, fp0);
++ gen_helper_float_rsqrt1_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7255,7 +7273,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_rsqrt2_d(fp0, fp0, fp1);
++ gen_helper_float_rsqrt2_d(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7293,7 +7311,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_cvts_d(fp32, fp64);
++ gen_helper_float_cvts_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7307,7 +7325,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_cvtw_d(fp32, fp64);
++ gen_helper_float_cvtw_d(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7320,7 +7338,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_cvtl_d(fp0, fp0);
++ gen_helper_float_cvtl_d(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7331,7 +7349,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_cvts_w(fp0, fp0);
++ gen_helper_float_cvts_w(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -7344,7 +7362,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr32(fp32, fs);
+- gen_helper_float_cvtd_w(fp64, fp32);
++ gen_helper_float_cvtd_w(fp64, cpu_env, fp32);
+ tcg_temp_free_i32(fp32);
+ gen_store_fpr64(ctx, fp64, fd);
+ tcg_temp_free_i64(fp64);
+@@ -7358,7 +7376,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp64 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp64, fs);
+- gen_helper_float_cvts_l(fp32, fp64);
++ gen_helper_float_cvts_l(fp32, cpu_env, fp64);
+ tcg_temp_free_i64(fp64);
+ gen_store_fpr32(fp32, fd);
+ tcg_temp_free_i32(fp32);
+@@ -7371,7 +7389,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_cvtd_l(fp0, fp0);
++ gen_helper_float_cvtd_l(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7383,7 +7401,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_cvtps_pw(fp0, fp0);
++ gen_helper_float_cvtps_pw(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7397,7 +7415,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_add_ps(fp0, fp0, fp1);
++ gen_helper_float_add_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7412,7 +7430,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_sub_ps(fp0, fp0, fp1);
++ gen_helper_float_sub_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7427,7 +7445,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_mul_ps(fp0, fp0, fp1);
++ gen_helper_float_mul_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7515,7 +7533,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, ft);
+ gen_load_fpr64(ctx, fp1, fs);
+- gen_helper_float_addr_ps(fp0, fp0, fp1);
++ gen_helper_float_addr_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7530,7 +7548,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, ft);
+ gen_load_fpr64(ctx, fp1, fs);
+- gen_helper_float_mulr_ps(fp0, fp0, fp1);
++ gen_helper_float_mulr_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7545,7 +7563,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_recip2_ps(fp0, fp0, fp1);
++ gen_helper_float_recip2_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7558,7 +7576,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_recip1_ps(fp0, fp0);
++ gen_helper_float_recip1_ps(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7570,7 +7588,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_rsqrt1_ps(fp0, fp0);
++ gen_helper_float_rsqrt1_ps(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7584,7 +7602,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+- gen_helper_float_rsqrt2_ps(fp0, fp0, fp1);
++ gen_helper_float_rsqrt2_ps(fp0, cpu_env, fp0, fp1);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+@@ -7597,7 +7615,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32h(fp0, fs);
+- gen_helper_float_cvts_pu(fp0, fp0);
++ gen_helper_float_cvts_pu(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -7609,7 +7627,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i64 fp0 = tcg_temp_new_i64();
+
+ gen_load_fpr64(ctx, fp0, fs);
+- gen_helper_float_cvtpw_ps(fp0, fp0);
++ gen_helper_float_cvtpw_ps(fp0, cpu_env, fp0);
+ gen_store_fpr64(ctx, fp0, fd);
+ tcg_temp_free_i64(fp0);
+ }
+@@ -7621,7 +7639,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
+ TCGv_i32 fp0 = tcg_temp_new_i32();
+
+ gen_load_fpr32(fp0, fs);
+- gen_helper_float_cvts_pl(fp0, fp0);
++ gen_helper_float_cvts_pl(fp0, cpu_env, fp0);
+ gen_store_fpr32(fp0, fd);
+ tcg_temp_free_i32(fp0);
+ }
+@@ -7887,7 +7905,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+ gen_load_fpr32(fp2, fr);
+- gen_helper_float_muladd_s(fp2, fp0, fp1, fp2);
++ gen_helper_float_muladd_s(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i32(fp0);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp2, fd);
+@@ -7906,7 +7924,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_muladd_d(fp2, fp0, fp1, fp2);
++ gen_helper_float_muladd_d(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -7924,7 +7942,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_muladd_ps(fp2, fp0, fp1, fp2);
++ gen_helper_float_muladd_ps(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -7942,7 +7960,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+ gen_load_fpr32(fp2, fr);
+- gen_helper_float_mulsub_s(fp2, fp0, fp1, fp2);
++ gen_helper_float_mulsub_s(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i32(fp0);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp2, fd);
+@@ -7961,7 +7979,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_mulsub_d(fp2, fp0, fp1, fp2);
++ gen_helper_float_mulsub_d(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -7979,7 +7997,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_mulsub_ps(fp2, fp0, fp1, fp2);
++ gen_helper_float_mulsub_ps(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -7997,7 +8015,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+ gen_load_fpr32(fp2, fr);
+- gen_helper_float_nmuladd_s(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmuladd_s(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i32(fp0);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp2, fd);
+@@ -8016,7 +8034,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_nmuladd_d(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmuladd_d(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -8034,7 +8052,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_nmuladd_ps(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmuladd_ps(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -8052,7 +8070,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr32(fp0, fs);
+ gen_load_fpr32(fp1, ft);
+ gen_load_fpr32(fp2, fr);
+- gen_helper_float_nmulsub_s(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmulsub_s(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i32(fp0);
+ tcg_temp_free_i32(fp1);
+ gen_store_fpr32(fp2, fd);
+@@ -8071,7 +8089,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_nmulsub_d(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmulsub_d(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -8089,7 +8107,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
+ gen_load_fpr64(ctx, fp0, fs);
+ gen_load_fpr64(ctx, fp1, ft);
+ gen_load_fpr64(ctx, fp2, fr);
+- gen_helper_float_nmulsub_ps(fp2, fp0, fp1, fp2);
++ gen_helper_float_nmulsub_ps(fp2, cpu_env, fp0, fp1, fp2);
+ tcg_temp_free_i64(fp0);
+ tcg_temp_free_i64(fp1);
+ gen_store_fpr64(ctx, fp2, fd);
+@@ -8122,22 +8140,22 @@ gen_rdhwr (CPUMIPSState *env, DisasContext *ctx, int rt, int rd)
+ switch (rd) {
+ case 0:
+ save_cpu_state(ctx, 1);
+- gen_helper_rdhwr_cpunum(t0);
++ gen_helper_rdhwr_cpunum(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case 1:
+ save_cpu_state(ctx, 1);
+- gen_helper_rdhwr_synci_step(t0);
++ gen_helper_rdhwr_synci_step(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case 2:
+ save_cpu_state(ctx, 1);
+- gen_helper_rdhwr_cc(t0);
++ gen_helper_rdhwr_cc(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case 3:
+ save_cpu_state(ctx, 1);
+- gen_helper_rdhwr_ccres(t0);
++ gen_helper_rdhwr_ccres(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case 29:
+@@ -8214,7 +8232,7 @@ static void handle_delay_slot (CPUMIPSState *env, DisasContext *ctx,
+ }
+ if (ctx->singlestep_enabled) {
+ save_cpu_state(ctx, 0);
+- gen_helper_0i(raise_exception, EXCP_DEBUG);
++ gen_helper_0e0i(raise_exception, EXCP_DEBUG);
+ }
+ tcg_gen_exit_tb(0);
+ break;
+@@ -8678,7 +8696,7 @@ static void decode_i64_mips16 (CPUMIPSState *env, DisasContext *ctx,
+ static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ int *is_branch)
+ {
+- int extend = lduw_code(ctx->pc + 2);
++ int extend = cpu_lduw_code(env, ctx->pc + 2);
+ int op, rx, ry, funct, sa;
+ int16_t imm, offset;
+
+@@ -8904,7 +8922,7 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ /* No delay slot, so just process as a normal instruction */
+ break;
+ case M16_OPC_JAL:
+- offset = lduw_code(ctx->pc + 2);
++ offset = cpu_lduw_code(env, ctx->pc + 2);
+ offset = (((ctx->opcode & 0x1f) << 21)
+ | ((ctx->opcode >> 5) & 0x1f) << 16
+ | offset) << 2;
+@@ -9855,17 +9873,17 @@ static void gen_ldst_multiple (DisasContext *ctx, uint32_t opc, int reglist,
+ save_cpu_state(ctx, 1);
+ switch (opc) {
+ case LWM32:
+- gen_helper_lwm(t0, t1, t2);
++ gen_helper_lwm(cpu_env, t0, t1, t2);
+ break;
+ case SWM32:
+- gen_helper_swm(t0, t1, t2);
++ gen_helper_swm(cpu_env, t0, t1, t2);
+ break;
+ #ifdef TARGET_MIPS64
+ case LDM:
+- gen_helper_ldm(t0, t1, t2);
++ gen_helper_ldm(cpu_env, t0, t1, t2);
+ break;
+ case SDM:
+- gen_helper_sdm(t0, t1, t2);
++ gen_helper_sdm(cpu_env, t0, t1, t2);
+ break;
+ #endif
+ }
+@@ -10287,7 +10305,7 @@ static void gen_pool32axf (CPUMIPSState *env, DisasContext *ctx, int rt, int rs,
+ TCGv t0 = tcg_temp_new();
+
+ save_cpu_state(ctx, 1);
+- gen_helper_di(t0);
++ gen_helper_di(t0, cpu_env);
+ gen_store_gpr(t0, rs);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -10300,7 +10318,7 @@ static void gen_pool32axf (CPUMIPSState *env, DisasContext *ctx, int rt, int rs,
+ TCGv t0 = tcg_temp_new();
+
+ save_cpu_state(ctx, 1);
+- gen_helper_ei(t0);
++ gen_helper_ei(t0, cpu_env);
+ gen_store_gpr(t0, rs);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -10635,7 +10653,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ uint32_t op, minor, mips32_op;
+ uint32_t cond, fmt, cc;
+
+- insn = lduw_code(ctx->pc + 2);
++ insn = cpu_lduw_code(env, ctx->pc + 2);
+ ctx->opcode = (ctx->opcode << 16) | insn;
+
+ rt = (ctx->opcode >> 21) & 0x1f;
+@@ -11827,7 +11845,7 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ MIPS_INVAL("PMON / selsl");
+ generate_exception(ctx, EXCP_RI);
+ #else
+- gen_helper_0i(pmon, sa);
++ gen_helper_0e0i(pmon, sa);
+ #endif
+ break;
+ case OPC_SYSCALL:
+@@ -12045,7 +12063,7 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+
+ save_cpu_state(ctx, 1);
+ gen_load_gpr(t0, rs);
+- gen_helper_yield(t0, t0);
++ gen_helper_yield(t0, cpu_env, t0);
+ gen_store_gpr(t0, rd);
+ tcg_temp_free(t0);
+ }
+@@ -12144,18 +12162,18 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ break;
+ case OPC_DVPE:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_dvpe(t0);
++ gen_helper_dvpe(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case OPC_EVPE:
+ check_insn(env, ctx, ASE_MT);
+- gen_helper_evpe(t0);
++ gen_helper_evpe(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ break;
+ case OPC_DI:
+ check_insn(env, ctx, ISA_MIPS32R2);
+ save_cpu_state(ctx, 1);
+- gen_helper_di(t0);
++ gen_helper_di(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -12163,7 +12181,7 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ case OPC_EI:
+ check_insn(env, ctx, ISA_MIPS32R2);
+ save_cpu_state(ctx, 1);
+- gen_helper_ei(t0);
++ gen_helper_ei(t0, cpu_env);
+ gen_store_gpr(t0, rt);
+ /* Stop translation as we may have switched the execution mode */
+ ctx->bstate = BS_STOP;
+@@ -12432,7 +12450,7 @@ gen_intermediate_code_internal (CPUMIPSState *env, TranslationBlock *tb,
+ if (bp->pc == ctx.pc) {
+ save_cpu_state(&ctx, 1);
+ ctx.bstate = BS_BRANCH;
+- gen_helper_0i(raise_exception, EXCP_DEBUG);
++ gen_helper_0e0i(raise_exception, EXCP_DEBUG);
+ /* Include the breakpoint location or the tb won't
+ * be flushed when it must be. */
+ ctx.pc += 4;
+@@ -12458,14 +12476,14 @@ gen_intermediate_code_internal (CPUMIPSState *env, TranslationBlock *tb,
+
+ is_branch = 0;
+ if (!(ctx.hflags & MIPS_HFLAG_M16)) {
+- ctx.opcode = ldl_code(ctx.pc);
++ ctx.opcode = cpu_ldl_code(env, ctx.pc);
+ insn_bytes = 4;
+ decode_opc(env, &ctx, &is_branch);
+ } else if (env->insn_flags & ASE_MICROMIPS) {
+- ctx.opcode = lduw_code(ctx.pc);
++ ctx.opcode = cpu_lduw_code(env, ctx.pc);
+ insn_bytes = decode_micromips_opc(env, &ctx, &is_branch);
+ } else if (env->insn_flags & ASE_MIPS16) {
+- ctx.opcode = lduw_code(ctx.pc);
++ ctx.opcode = cpu_lduw_code(env, ctx.pc);
+ insn_bytes = decode_mips16_opc(env, &ctx, &is_branch);
+ } else {
+ generate_exception(&ctx, EXCP_RI);
+@@ -12502,7 +12520,7 @@ gen_intermediate_code_internal (CPUMIPSState *env, TranslationBlock *tb,
+ gen_io_end();
+ if (env->singlestep_enabled && ctx.bstate != BS_BRANCH) {
+ save_cpu_state(&ctx, ctx.bstate == BS_NONE);
+- gen_helper_0i(raise_exception, EXCP_DEBUG);
++ gen_helper_0e0i(raise_exception, EXCP_DEBUG);
+ } else {
+ switch (ctx.bstate) {
+ case BS_STOP:
+--
+1.7.12.1
+
--- /dev/null
+From 3ec8ca067ea6617b5bd4423d0b40c894b39a4924 Mon Sep 17 00:00:00 2001
+From: Blue Swirl <blauwirbel@gmail.com>
+Date: Sun, 2 Sep 2012 15:28:56 +0000
+Subject: [PATCH] Remove unused CONFIG_TCG_PASS_AREG0 and dead code
+
+Now that CONFIG_TCG_PASS_AREG0 is enabled for all targets,
+remove dead code and support for !CONFIG_TCG_PASS_AREG0 case.
+
+Remove dyngen-exec.h and all references to it. Although included by
+hw/spapr_hcall.c, it does not seem to use it.
+
+Remove unused HELPER_CFLAGS.
+
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ Makefile.target | 8 ------
+ configure | 11 -------
+ cpu-all.h | 11 -------
+ cputlb.c | 5 ----
+ dyngen-exec.h | 70 --------------------------------------------
+ exec-all.h | 4 ---
+ hw/spapr_hcall.c | 1 -
+ softmmu_defs.h | 21 --------------
+ softmmu_header.h | 63 +++++++++++++---------------------------
+ softmmu_template.h | 72 +++++++++++++++++-----------------------------
+ target-m68k/op_helper.c | 3 --
+ target-sparc/Makefile.objs | 2 --
+ tcg/arm/tcg-target.c | 31 ++------------------
+ tcg/arm/tcg-target.h | 1 -
+ tcg/hppa/tcg-target.c | 24 ----------------
+ tcg/hppa/tcg-target.h | 1 -
+ tcg/i386/tcg-target.c | 30 -------------------
+ tcg/i386/tcg-target.h | 1 -
+ tcg/ia64/tcg-target.c | 34 ----------------------
+ tcg/ia64/tcg-target.h | 1 -
+ tcg/mips/tcg-target.c | 31 ++------------------
+ tcg/mips/tcg-target.h | 1 -
+ tcg/ppc/tcg-target.c | 38 ------------------------
+ tcg/ppc64/tcg-target.c | 28 ------------------
+ tcg/s390/tcg-target.c | 24 ----------------
+ tcg/s390/tcg-target.h | 1 -
+ tcg/sparc/tcg-target.c | 30 -------------------
+ tcg/sparc/tcg-target.h | 1 -
+ tcg/tci/tcg-target.c | 4 ---
+ tci.c | 12 --------
+ user-exec.c | 14 ---------
+ 31 files changed, 53 insertions(+), 525 deletions(-)
+ delete mode 100644 dyngen-exec.h
+
+diff --git a/Makefile.target b/Makefile.target
+index 7892a8d..d9d54b8 100644
+--- a/Makefile.target
++++ b/Makefile.target
+@@ -80,14 +80,6 @@ obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o
+
+ tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci
+
+-# HELPER_CFLAGS is used for all the legacy code compiled with static register
+-# variables
+-user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+-
+-# Note: this is a workaround. The real fix is to avoid compiling
+-# cpu_signal_handler() in user-exec.c.
+-%/signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+-
+ #########################################################
+ # Linux user emulator target
+
+diff --git a/configure b/configure
+index 83b068d..816f0f9 100755
+--- a/configure
++++ b/configure
+@@ -118,7 +118,6 @@ audio_card_list="ac97 es1370 sb16 hda"
+ audio_possible_cards="ac97 es1370 sb16 cs4231a adlib gus hda"
+ block_drv_whitelist=""
+ host_cc="gcc"
+-helper_cflags=""
+ libs_softmmu=""
+ libs_tools=""
+ audio_pt_int=""
+@@ -904,7 +903,6 @@ case "$cpu" in
+ QEMU_CFLAGS="-m32 -ffixed-g2 -ffixed-g3 $QEMU_CFLAGS"
+ if test "$solaris" = "no" ; then
+ QEMU_CFLAGS="-ffixed-g1 -ffixed-g6 $QEMU_CFLAGS"
+- helper_cflags="-ffixed-i0"
+ fi
+ ;;
+ sparc64)
+@@ -929,7 +927,6 @@ case "$cpu" in
+ QEMU_CFLAGS="-m32 $QEMU_CFLAGS"
+ LDFLAGS="-m32 $LDFLAGS"
+ cc_i386='$(CC) -m32'
+- helper_cflags="-fomit-frame-pointer"
+ host_guest_base="yes"
+ ;;
+ x86_64)
+@@ -3582,7 +3579,6 @@ if test "$sparse" = "yes" ; then
+ echo "HOST_CC := REAL_CC=\"\$(HOST_CC)\" cgcc" >> $config_host_mak
+ echo "QEMU_CFLAGS += -Wbitwise -Wno-transparent-union -Wno-old-initializer -Wno-non-pointer-null" >> $config_host_mak
+ fi
+-echo "HELPER_CFLAGS=$helper_cflags" >> $config_host_mak
+ echo "LDFLAGS=$LDFLAGS" >> $config_host_mak
+ echo "ARLIBS_BEGIN=$arlibs_begin" >> $config_host_mak
+ echo "ARLIBS_END=$arlibs_end" >> $config_host_mak
+@@ -3837,13 +3833,6 @@ fi
+
+ symlink "$source_path/Makefile.target" "$target_dir/Makefile"
+
+-
+-case "$target_arch2" in
+- alpha | arm* | cris | i386 | lm32 | m68k | microblaze* | mips* | or32 | s390x | sh4* | sparc* | unicore32 | x86_64 | xtensa* | ppc*)
+- echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
+- ;;
+-esac
+-
+ upper() {
+ echo "$@"| LC_ALL=C tr '[a-z]' '[A-Z]'
+ }
+diff --git a/cpu-all.h b/cpu-all.h
+index 5e07d28..74d3681 100644
+--- a/cpu-all.h
++++ b/cpu-all.h
+@@ -260,14 +260,6 @@ extern unsigned long reserved_va;
+ #define stfl(p, v) stfl_raw(p, v)
+ #define stfq(p, v) stfq_raw(p, v)
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+-#define ldub_code(p) ldub_raw(p)
+-#define ldsb_code(p) ldsb_raw(p)
+-#define lduw_code(p) lduw_raw(p)
+-#define ldsw_code(p) ldsw_raw(p)
+-#define ldl_code(p) ldl_raw(p)
+-#define ldq_code(p) ldq_raw(p)
+-#else
+ #define cpu_ldub_code(env1, p) ldub_raw(p)
+ #define cpu_ldsb_code(env1, p) ldsb_raw(p)
+ #define cpu_lduw_code(env1, p) lduw_raw(p)
+@@ -296,7 +288,6 @@ extern unsigned long reserved_va;
+ #define cpu_stw_kernel(env, addr, data) stw_raw(addr, data)
+ #define cpu_stl_kernel(env, addr, data) stl_raw(addr, data)
+ #define cpu_stq_kernel(env, addr, data) stq_raw(addr, data)
+-#endif
+
+ #define ldub_kernel(p) ldub_raw(p)
+ #define ldsb_kernel(p) ldsb_raw(p)
+@@ -313,7 +304,6 @@ extern unsigned long reserved_va;
+ #define stfl_kernel(p, v) stfl_raw(p, v)
+ #define stfq_kernel(p, vt) stfq_raw(p, v)
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ #define cpu_ldub_data(env, addr) ldub_raw(addr)
+ #define cpu_lduw_data(env, addr) lduw_raw(addr)
+ #define cpu_ldl_data(env, addr) ldl_raw(addr)
+@@ -321,7 +311,6 @@ extern unsigned long reserved_va;
+ #define cpu_stb_data(env, addr, data) stb_raw(addr, data)
+ #define cpu_stw_data(env, addr, data) stw_raw(addr, data)
+ #define cpu_stl_data(env, addr, data) stl_raw(addr, data)
+-#endif
+ #endif /* defined(CONFIG_USER_ONLY) */
+
+ /* page related stuff */
+diff --git a/cputlb.c b/cputlb.c
+index d3e7b25..51b5897 100644
+--- a/cputlb.c
++++ b/cputlb.c
+@@ -325,11 +325,7 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
+ mmu_idx = cpu_mmu_index(env1);
+ if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
+ (addr & TARGET_PAGE_MASK))) {
+-#ifdef CONFIG_TCG_PASS_AREG0
+ cpu_ldub_code(env1, addr);
+-#else
+- ldub_code(addr);
+-#endif
+ }
+ pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
+ mr = iotlb_to_region(pd);
+@@ -348,7 +344,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
+ #define MMUSUFFIX _cmmu
+ #undef GETPC
+ #define GETPC() ((uintptr_t)0)
+-#define env cpu_single_env
+ #define SOFTMMU_CODE_ACCESS
+
+ #define SHIFT 0
+diff --git a/dyngen-exec.h b/dyngen-exec.h
+deleted file mode 100644
+index 083e20b..0000000
+--- a/dyngen-exec.h
++++ /dev/null
+@@ -1,70 +0,0 @@
+-/*
+- * dyngen defines for micro operation code
+- *
+- * Copyright (c) 2003 Fabrice Bellard
+- *
+- * This library is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU Lesser General Public
+- * License as published by the Free Software Foundation; either
+- * version 2 of the License, or (at your option) any later version.
+- *
+- * This library is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * Lesser General Public License for more details.
+- *
+- * You should have received a copy of the GNU Lesser General Public
+- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+- */
+-#if !defined(__DYNGEN_EXEC_H__)
+-#define __DYNGEN_EXEC_H__
+-
+-#if defined(CONFIG_TCG_INTERPRETER)
+-/* The TCG interpreter does not need a special register AREG0,
+- * but it is possible to use one by defining AREG0.
+- * On i386, register edi seems to work. */
+-/* Run without special register AREG0 or use a value defined elsewhere. */
+-#elif defined(__i386__)
+-#define AREG0 "ebp"
+-#elif defined(__x86_64__)
+-#define AREG0 "r14"
+-#elif defined(_ARCH_PPC)
+-#define AREG0 "r27"
+-#elif defined(__arm__)
+-#define AREG0 "r6"
+-#elif defined(__hppa__)
+-#define AREG0 "r17"
+-#elif defined(__mips__)
+-#define AREG0 "s0"
+-#elif defined(__sparc__)
+-#ifdef CONFIG_SOLARIS
+-#define AREG0 "g2"
+-#else
+-#ifdef __sparc_v9__
+-#define AREG0 "g5"
+-#else
+-#define AREG0 "g6"
+-#endif
+-#endif
+-#elif defined(__s390__)
+-#define AREG0 "r10"
+-#elif defined(__alpha__)
+-/* Note $15 is the frame pointer, so anything in op-i386.c that would
+- require a frame pointer, like alloca, would probably loose. */
+-#define AREG0 "$15"
+-#elif defined(__mc68000)
+-#define AREG0 "%a5"
+-#elif defined(__ia64__)
+-#define AREG0 "r7"
+-#else
+-#error unsupported CPU
+-#endif
+-
+-#if defined(AREG0)
+-register CPUArchState *env asm(AREG0);
+-#else
+-/* TODO: Try env = cpu_single_env. */
+-extern CPUArchState *env;
+-#endif
+-
+-#endif /* !defined(__DYNGEN_EXEC_H__) */
+diff --git a/exec-all.h b/exec-all.h
+index c5ec8e1..c5d3a13 100644
+--- a/exec-all.h
++++ b/exec-all.h
+@@ -323,9 +323,6 @@ void tlb_fill(CPUArchState *env1, target_ulong addr, int is_write, int mmu_idx,
+
+ #define ACCESS_TYPE (NB_MMU_MODES + 1)
+ #define MEMSUFFIX _code
+-#ifndef CONFIG_TCG_PASS_AREG0
+-#define env cpu_single_env
+-#endif
+
+ #define DATA_SIZE 1
+ #include "softmmu_header.h"
+@@ -341,7 +338,6 @@ void tlb_fill(CPUArchState *env1, target_ulong addr, int is_write, int mmu_idx,
+
+ #undef ACCESS_TYPE
+ #undef MEMSUFFIX
+-#undef env
+
+ #endif
+
+diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
+index a5990a9..abd847f 100644
+--- a/hw/spapr_hcall.c
++++ b/hw/spapr_hcall.c
+@@ -1,6 +1,5 @@
+ #include "sysemu.h"
+ #include "cpu.h"
+-#include "dyngen-exec.h"
+ #include "qemu-char.h"
+ #include "sysemu.h"
+ #include "qemu-char.h"
+diff --git a/softmmu_defs.h b/softmmu_defs.h
+index 8d59f9d..1f25e33 100644
+--- a/softmmu_defs.h
++++ b/softmmu_defs.h
+@@ -9,25 +9,6 @@
+ #ifndef SOFTMMU_DEFS_H
+ #define SOFTMMU_DEFS_H
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+-uint8_t __ldb_mmu(target_ulong addr, int mmu_idx);
+-void __stb_mmu(target_ulong addr, uint8_t val, int mmu_idx);
+-uint16_t __ldw_mmu(target_ulong addr, int mmu_idx);
+-void __stw_mmu(target_ulong addr, uint16_t val, int mmu_idx);
+-uint32_t __ldl_mmu(target_ulong addr, int mmu_idx);
+-void __stl_mmu(target_ulong addr, uint32_t val, int mmu_idx);
+-uint64_t __ldq_mmu(target_ulong addr, int mmu_idx);
+-void __stq_mmu(target_ulong addr, uint64_t val, int mmu_idx);
+-
+-uint8_t __ldb_cmmu(target_ulong addr, int mmu_idx);
+-void __stb_cmmu(target_ulong addr, uint8_t val, int mmu_idx);
+-uint16_t __ldw_cmmu(target_ulong addr, int mmu_idx);
+-void __stw_cmmu(target_ulong addr, uint16_t val, int mmu_idx);
+-uint32_t __ldl_cmmu(target_ulong addr, int mmu_idx);
+-void __stl_cmmu(target_ulong addr, uint32_t val, int mmu_idx);
+-uint64_t __ldq_cmmu(target_ulong addr, int mmu_idx);
+-void __stq_cmmu(target_ulong addr, uint64_t val, int mmu_idx);
+-#else
+ uint8_t helper_ldb_mmu(CPUArchState *env, target_ulong addr, int mmu_idx);
+ void helper_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
+ int mmu_idx);
+@@ -54,5 +35,3 @@ uint64_t helper_ldq_cmmu(CPUArchState *env, target_ulong addr, int mmu_idx);
+ void helper_stq_cmmu(CPUArchState *env, target_ulong addr, uint64_t val,
+ int mmu_idx);
+ #endif
+-
+-#endif
+diff --git a/softmmu_header.h b/softmmu_header.h
+index cf1aa38..d8d9c81 100644
+--- a/softmmu_header.h
++++ b/softmmu_header.h
+@@ -78,23 +78,10 @@
+ #define ADDR_READ addr_read
+ #endif
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+-#define ENV_PARAM
+-#define ENV_VAR
+-#define CPU_PREFIX
+-#define HELPER_PREFIX __
+-#else
+-#define ENV_PARAM CPUArchState *env,
+-#define ENV_VAR env,
+-#define CPU_PREFIX cpu_
+-#define HELPER_PREFIX helper_
+-#endif
+-
+ /* generic load/store macros */
+
+ static inline RES_TYPE
+-glue(glue(glue(CPU_PREFIX, ld), USUFFIX), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr)
++glue(glue(cpu_ld, USUFFIX), MEMSUFFIX)(CPUArchState *env, target_ulong ptr)
+ {
+ int page_index;
+ RES_TYPE res;
+@@ -106,9 +93,7 @@ glue(glue(glue(CPU_PREFIX, ld), USUFFIX), MEMSUFFIX)(ENV_PARAM
+ mmu_idx = CPU_MMU_INDEX;
+ if (unlikely(env->tlb_table[mmu_idx][page_index].ADDR_READ !=
+ (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+- res = glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_VAR
+- addr,
+- mmu_idx);
++ res = glue(glue(helper_ld, SUFFIX), MMUSUFFIX)(env, addr, mmu_idx);
+ } else {
+ uintptr_t hostaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
+ res = glue(glue(ld, USUFFIX), _raw)(hostaddr);
+@@ -118,8 +103,7 @@ glue(glue(glue(CPU_PREFIX, ld), USUFFIX), MEMSUFFIX)(ENV_PARAM
+
+ #if DATA_SIZE <= 2
+ static inline int
+-glue(glue(glue(CPU_PREFIX, lds), SUFFIX), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr)
++glue(glue(cpu_lds, SUFFIX), MEMSUFFIX)(CPUArchState *env, target_ulong ptr)
+ {
+ int res, page_index;
+ target_ulong addr;
+@@ -130,8 +114,8 @@ glue(glue(glue(CPU_PREFIX, lds), SUFFIX), MEMSUFFIX)(ENV_PARAM
+ mmu_idx = CPU_MMU_INDEX;
+ if (unlikely(env->tlb_table[mmu_idx][page_index].ADDR_READ !=
+ (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+- res = (DATA_STYPE)glue(glue(glue(HELPER_PREFIX, ld), SUFFIX),
+- MMUSUFFIX)(ENV_VAR addr, mmu_idx);
++ res = (DATA_STYPE)glue(glue(helper_ld, SUFFIX),
++ MMUSUFFIX)(env, addr, mmu_idx);
+ } else {
+ uintptr_t hostaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
+ res = glue(glue(lds, SUFFIX), _raw)(hostaddr);
+@@ -145,8 +129,8 @@ glue(glue(glue(CPU_PREFIX, lds), SUFFIX), MEMSUFFIX)(ENV_PARAM
+ /* generic store macro */
+
+ static inline void
+-glue(glue(glue(CPU_PREFIX, st), SUFFIX), MEMSUFFIX)(ENV_PARAM target_ulong ptr,
+- RES_TYPE v)
++glue(glue(cpu_st, SUFFIX), MEMSUFFIX)(CPUArchState *env, target_ulong ptr,
++ RES_TYPE v)
+ {
+ int page_index;
+ target_ulong addr;
+@@ -157,8 +141,7 @@ glue(glue(glue(CPU_PREFIX, st), SUFFIX), MEMSUFFIX)(ENV_PARAM target_ulong ptr,
+ mmu_idx = CPU_MMU_INDEX;
+ if (unlikely(env->tlb_table[mmu_idx][page_index].addr_write !=
+ (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+- glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_VAR addr, v,
+- mmu_idx);
++ glue(glue(helper_st, SUFFIX), MMUSUFFIX)(env, addr, v, mmu_idx);
+ } else {
+ uintptr_t hostaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
+ glue(glue(st, SUFFIX), _raw)(hostaddr, v);
+@@ -170,52 +153,50 @@ glue(glue(glue(CPU_PREFIX, st), SUFFIX), MEMSUFFIX)(ENV_PARAM target_ulong ptr,
+ #if ACCESS_TYPE != (NB_MMU_MODES + 1)
+
+ #if DATA_SIZE == 8
+-static inline float64 glue(glue(CPU_PREFIX, ldfq), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr)
++static inline float64 glue(cpu_ldfq, MEMSUFFIX)(CPUArchState *env,
++ target_ulong ptr)
+ {
+ union {
+ float64 d;
+ uint64_t i;
+ } u;
+- u.i = glue(glue(CPU_PREFIX, ldq), MEMSUFFIX)(ENV_VAR ptr);
++ u.i = glue(cpu_ldq, MEMSUFFIX)(env, ptr);
+ return u.d;
+ }
+
+-static inline void glue(glue(CPU_PREFIX, stfq), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr,
+- float64 v)
++static inline void glue(cpu_stfq, MEMSUFFIX)(CPUArchState *env,
++ target_ulong ptr, float64 v)
+ {
+ union {
+ float64 d;
+ uint64_t i;
+ } u;
+ u.d = v;
+- glue(glue(CPU_PREFIX, stq), MEMSUFFIX)(ENV_VAR ptr, u.i);
++ glue(cpu_stq, MEMSUFFIX)(env, ptr, u.i);
+ }
+ #endif /* DATA_SIZE == 8 */
+
+ #if DATA_SIZE == 4
+-static inline float32 glue(glue(CPU_PREFIX, ldfl), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr)
++static inline float32 glue(cpu_ldfl, MEMSUFFIX)(CPUArchState *env,
++ target_ulong ptr)
+ {
+ union {
+ float32 f;
+ uint32_t i;
+ } u;
+- u.i = glue(glue(CPU_PREFIX, ldl), MEMSUFFIX)(ENV_VAR ptr);
++ u.i = glue(cpu_ldl, MEMSUFFIX)(env, ptr);
+ return u.f;
+ }
+
+-static inline void glue(glue(CPU_PREFIX, stfl), MEMSUFFIX)(ENV_PARAM
+- target_ulong ptr,
+- float32 v)
++static inline void glue(cpu_stfl, MEMSUFFIX)(CPUArchState *env,
++ target_ulong ptr, float32 v)
+ {
+ union {
+ float32 f;
+ uint32_t i;
+ } u;
+ u.f = v;
+- glue(glue(CPU_PREFIX, stl), MEMSUFFIX)(ENV_VAR ptr, u.i);
++ glue(cpu_stl, MEMSUFFIX)(env, ptr, u.i);
+ }
+ #endif /* DATA_SIZE == 4 */
+
+@@ -230,7 +211,3 @@ static inline void glue(glue(CPU_PREFIX, stfl), MEMSUFFIX)(ENV_PARAM
+ #undef CPU_MMU_INDEX
+ #undef MMUSUFFIX
+ #undef ADDR_READ
+-#undef ENV_PARAM
+-#undef ENV_VAR
+-#undef CPU_PREFIX
+-#undef HELPER_PREFIX
+diff --git a/softmmu_template.h b/softmmu_template.h
+index b8bd700..e2490f0 100644
+--- a/softmmu_template.h
++++ b/softmmu_template.h
+@@ -54,23 +54,11 @@
+ #define ADDR_READ addr_read
+ #endif
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+-#define ENV_PARAM
+-#define ENV_VAR
+-#define CPU_PREFIX
+-#define HELPER_PREFIX __
+-#else
+-#define ENV_PARAM CPUArchState *env,
+-#define ENV_VAR env,
+-#define CPU_PREFIX cpu_
+-#define HELPER_PREFIX helper_
+-#endif
+-
+-static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_PARAM
++static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(CPUArchState *env,
+ target_ulong addr,
+ int mmu_idx,
+ uintptr_t retaddr);
+-static inline DATA_TYPE glue(io_read, SUFFIX)(ENV_PARAM
++static inline DATA_TYPE glue(io_read, SUFFIX)(CPUArchState *env,
+ target_phys_addr_t physaddr,
+ target_ulong addr,
+ uintptr_t retaddr)
+@@ -104,9 +92,8 @@ static inline DATA_TYPE glue(io_read, SUFFIX)(ENV_PARAM
+
+ /* handle all cases except unaligned access which span two pages */
+ DATA_TYPE
+-glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_PARAM
+- target_ulong addr,
+- int mmu_idx)
++glue(glue(helper_ld, SUFFIX), MMUSUFFIX)(CPUArchState *env, target_ulong addr,
++ int mmu_idx)
+ {
+ DATA_TYPE res;
+ int index;
+@@ -126,15 +113,15 @@ glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ goto do_unaligned_access;
+ retaddr = GETPC();
+ ioaddr = env->iotlb[mmu_idx][index];
+- res = glue(io_read, SUFFIX)(ENV_VAR ioaddr, addr, retaddr);
++ res = glue(io_read, SUFFIX)(env, ioaddr, addr, retaddr);
+ } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+ /* slow unaligned access (it spans two pages or IO) */
+ do_unaligned_access:
+ retaddr = GETPC();
+ #ifdef ALIGNED_ONLY
+- do_unaligned_access(ENV_VAR addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
+ #endif
+- res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_VAR addr,
++ res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(env, addr,
+ mmu_idx, retaddr);
+ } else {
+ /* unaligned/aligned access in the same page */
+@@ -142,7 +129,7 @@ glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ #ifdef ALIGNED_ONLY
+ if ((addr & (DATA_SIZE - 1)) != 0) {
+ retaddr = GETPC();
+- do_unaligned_access(ENV_VAR addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
+ }
+ #endif
+ addend = env->tlb_table[mmu_idx][index].addend;
+@@ -154,7 +141,7 @@ glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ retaddr = GETPC();
+ #ifdef ALIGNED_ONLY
+ if ((addr & (DATA_SIZE - 1)) != 0)
+- do_unaligned_access(ENV_VAR addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
+ #endif
+ tlb_fill(env, addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
+ goto redo;
+@@ -164,7 +151,7 @@ glue(glue(glue(HELPER_PREFIX, ld), SUFFIX), MMUSUFFIX)(ENV_PARAM
+
+ /* handle all unaligned cases */
+ static DATA_TYPE
+-glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_PARAM
++glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(CPUArchState *env,
+ target_ulong addr,
+ int mmu_idx,
+ uintptr_t retaddr)
+@@ -183,15 +170,15 @@ glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_PARAM
+ if ((addr & (DATA_SIZE - 1)) != 0)
+ goto do_unaligned_access;
+ ioaddr = env->iotlb[mmu_idx][index];
+- res = glue(io_read, SUFFIX)(ENV_VAR ioaddr, addr, retaddr);
++ res = glue(io_read, SUFFIX)(env, ioaddr, addr, retaddr);
+ } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+ do_unaligned_access:
+ /* slow unaligned access (it spans two pages) */
+ addr1 = addr & ~(DATA_SIZE - 1);
+ addr2 = addr1 + DATA_SIZE;
+- res1 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_VAR addr1,
++ res1 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(env, addr1,
+ mmu_idx, retaddr);
+- res2 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_VAR addr2,
++ res2 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(env, addr2,
+ mmu_idx, retaddr);
+ shift = (addr & (DATA_SIZE - 1)) * 8;
+ #ifdef TARGET_WORDS_BIGENDIAN
+@@ -216,13 +203,13 @@ glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(ENV_PARAM
+
+ #ifndef SOFTMMU_CODE_ACCESS
+
+-static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_PARAM
++static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(CPUArchState *env,
+ target_ulong addr,
+ DATA_TYPE val,
+ int mmu_idx,
+ uintptr_t retaddr);
+
+-static inline void glue(io_write, SUFFIX)(ENV_PARAM
++static inline void glue(io_write, SUFFIX)(CPUArchState *env,
+ target_phys_addr_t physaddr,
+ DATA_TYPE val,
+ target_ulong addr,
+@@ -253,10 +240,9 @@ static inline void glue(io_write, SUFFIX)(ENV_PARAM
+ #endif /* SHIFT > 2 */
+ }
+
+-void glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_PARAM
+- target_ulong addr,
+- DATA_TYPE val,
+- int mmu_idx)
++void glue(glue(helper_st, SUFFIX), MMUSUFFIX)(CPUArchState *env,
++ target_ulong addr, DATA_TYPE val,
++ int mmu_idx)
+ {
+ target_phys_addr_t ioaddr;
+ target_ulong tlb_addr;
+@@ -273,14 +259,14 @@ void glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ goto do_unaligned_access;
+ retaddr = GETPC();
+ ioaddr = env->iotlb[mmu_idx][index];
+- glue(io_write, SUFFIX)(ENV_VAR ioaddr, val, addr, retaddr);
++ glue(io_write, SUFFIX)(env, ioaddr, val, addr, retaddr);
+ } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+ do_unaligned_access:
+ retaddr = GETPC();
+ #ifdef ALIGNED_ONLY
+- do_unaligned_access(ENV_VAR addr, 1, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, 1, mmu_idx, retaddr);
+ #endif
+- glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_VAR addr, val,
++ glue(glue(slow_st, SUFFIX), MMUSUFFIX)(env, addr, val,
+ mmu_idx, retaddr);
+ } else {
+ /* aligned/unaligned access in the same page */
+@@ -288,7 +274,7 @@ void glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ #ifdef ALIGNED_ONLY
+ if ((addr & (DATA_SIZE - 1)) != 0) {
+ retaddr = GETPC();
+- do_unaligned_access(ENV_VAR addr, 1, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, 1, mmu_idx, retaddr);
+ }
+ #endif
+ addend = env->tlb_table[mmu_idx][index].addend;
+@@ -300,7 +286,7 @@ void glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ retaddr = GETPC();
+ #ifdef ALIGNED_ONLY
+ if ((addr & (DATA_SIZE - 1)) != 0)
+- do_unaligned_access(ENV_VAR addr, 1, mmu_idx, retaddr);
++ do_unaligned_access(env, addr, 1, mmu_idx, retaddr);
+ #endif
+ tlb_fill(env, addr, 1, mmu_idx, retaddr);
+ goto redo;
+@@ -308,7 +294,7 @@ void glue(glue(glue(HELPER_PREFIX, st), SUFFIX), MMUSUFFIX)(ENV_PARAM
+ }
+
+ /* handles all unaligned cases */
+-static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_PARAM
++static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(CPUArchState *env,
+ target_ulong addr,
+ DATA_TYPE val,
+ int mmu_idx,
+@@ -327,7 +313,7 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_PARAM
+ if ((addr & (DATA_SIZE - 1)) != 0)
+ goto do_unaligned_access;
+ ioaddr = env->iotlb[mmu_idx][index];
+- glue(io_write, SUFFIX)(ENV_VAR ioaddr, val, addr, retaddr);
++ glue(io_write, SUFFIX)(env, ioaddr, val, addr, retaddr);
+ } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+ do_unaligned_access:
+ /* XXX: not efficient, but simple */
+@@ -335,11 +321,11 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_PARAM
+ * previous page from the TLB cache. */
+ for(i = DATA_SIZE - 1; i >= 0; i--) {
+ #ifdef TARGET_WORDS_BIGENDIAN
+- glue(slow_stb, MMUSUFFIX)(ENV_VAR addr + i,
++ glue(slow_stb, MMUSUFFIX)(env, addr + i,
+ val >> (((DATA_SIZE - 1) * 8) - (i * 8)),
+ mmu_idx, retaddr);
+ #else
+- glue(slow_stb, MMUSUFFIX)(ENV_VAR addr + i,
++ glue(slow_stb, MMUSUFFIX)(env, addr + i,
+ val >> (i * 8),
+ mmu_idx, retaddr);
+ #endif
+@@ -366,7 +352,3 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(ENV_PARAM
+ #undef USUFFIX
+ #undef DATA_SIZE
+ #undef ADDR_READ
+-#undef ENV_PARAM
+-#undef ENV_VAR
+-#undef CPU_PREFIX
+-#undef HELPER_PREFIX
+diff --git a/target-m68k/op_helper.c b/target-m68k/op_helper.c
+index 3116287..aa00504 100644
+--- a/target-m68k/op_helper.c
++++ b/target-m68k/op_helper.c
+@@ -192,9 +192,6 @@ void HELPER(divu)(CPUM68KState *env, uint32_t word)
+ quot = num / den;
+ rem = num % den;
+ flags = 0;
+- /* Avoid using a PARAM1 of zero. This breaks dyngen because it uses
+- the address of a symbol, and gcc knows symbols can't have address
+- zero. */
+ if (word && quot > 0xffff)
+ flags |= CCF_V;
+ if (quot == 0)
+diff --git a/target-sparc/Makefile.objs b/target-sparc/Makefile.objs
+index a93e07d..9fc42ea 100644
+--- a/target-sparc/Makefile.objs
++++ b/target-sparc/Makefile.objs
+@@ -4,5 +4,3 @@ obj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
+ obj-$(TARGET_SPARC) += int32_helper.o
+ obj-$(TARGET_SPARC64) += int64_helper.o
+ obj-$(TARGET_SPARC64) += vis_helper.o
+-
+-$(obj)/op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
+index cf0ca3d..aed3b53 100644
+--- a/tcg/arm/tcg-target.c
++++ b/tcg/arm/tcg-target.c
+@@ -176,7 +176,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ so don't use these. */
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+-#if defined(CONFIG_TCG_PASS_AREG0) && (TARGET_LONG_BITS == 64)
++#if TARGET_LONG_BITS == 64
+ /* If we're passing env to the helper as r0 and need a regpair
+ * for the address then r2 will be overwritten as we're setting
+ * up the args to the helper.
+@@ -204,8 +204,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ use these. */
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+-#if defined(CONFIG_SOFTMMU) && \
+- defined(CONFIG_TCG_PASS_AREG0) && (TARGET_LONG_BITS == 64)
++#if defined(CONFIG_SOFTMMU) && (TARGET_LONG_BITS == 64)
+ /* Avoid clashes with registers being used for helper args */
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+@@ -223,7 +222,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ #ifdef CONFIG_SOFTMMU
+ /* r2 is still needed to load data_reg, so don't use it. */
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+-#if defined(CONFIG_TCG_PASS_AREG0) && (TARGET_LONG_BITS == 64)
++#if TARGET_LONG_BITS == 64
+ /* Avoid clashes with registers being used for helper args */
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+ #endif
+@@ -954,7 +953,6 @@ static inline void tcg_out_goto_label(TCGContext *s, int cond, int label_index)
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -972,25 +970,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+
+ /* Helper routines for marshalling helper function arguments into
+ * the correct registers and stack.
+@@ -1203,9 +1182,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ * trash by moving the earlier arguments into them.
+ */
+ argreg = TCG_REG_R0;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
+-#endif
+ #if TARGET_LONG_BITS == 64
+ argreg = tcg_out_arg_reg64(s, argreg, addr_reg, addr_reg2);
+ #else
+@@ -1421,9 +1398,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ * trash by moving the earlier arguments into them.
+ */
+ argreg = TCG_REG_R0;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
+-#endif
+ #if TARGET_LONG_BITS == 64
+ argreg = tcg_out_arg_reg64(s, argreg, addr_reg, addr_reg2);
+ #else
+diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+index f90b834..c0b8f72 100644
+--- a/tcg/arm/tcg-target.h
++++ b/tcg/arm/tcg-target.h
+@@ -77,7 +77,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_GUEST_BASE
+
+ enum {
+- /* Note: must be synced with dyngen-exec.h */
+ TCG_AREG0 = TCG_REG_R6,
+ };
+
+diff --git a/tcg/hppa/tcg-target.c b/tcg/hppa/tcg-target.c
+index 2885212..8b81b70 100644
+--- a/tcg/hppa/tcg-target.c
++++ b/tcg/hppa/tcg-target.c
+@@ -882,7 +882,6 @@ static void tcg_out_setcond2(TCGContext *s, int cond, TCGArg ret,
+ #if defined(CONFIG_SOFTMMU)
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -900,25 +899,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+
+ /* Load and compare a TLB entry, and branch if TLB miss. OFFSET is set to
+ the offset of the first ADDR_READ or ADDR_WRITE member of the appropriate
+@@ -1085,7 +1065,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ }
+ tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[2],
+ tcg_target_call_iarg_regs[1]);
+@@ -1093,7 +1072,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+ tcg_out_call(s, qemu_ld_helpers[opc & 3]);
+
+ switch (opc) {
+@@ -1245,7 +1223,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ tcg_abort();
+ }
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -1255,7 +1232,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+ tcg_out_call(s, qemu_st_helpers[opc]);
+
+ /* label2: */
+diff --git a/tcg/hppa/tcg-target.h b/tcg/hppa/tcg-target.h
+index d4bf6fe..01ef960 100644
+--- a/tcg/hppa/tcg-target.h
++++ b/tcg/hppa/tcg-target.h
+@@ -104,7 +104,6 @@ typedef enum {
+
+ #define TCG_TARGET_HAS_GUEST_BASE
+
+-/* Note: must be synced with dyngen-exec.h */
+ #define TCG_AREG0 TCG_REG_R17
+
+
+diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
+index da17bba..34c2df8 100644
+--- a/tcg/i386/tcg-target.c
++++ b/tcg/i386/tcg-target.c
+@@ -183,9 +183,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_set32(ct->u.regs, 0, 0xffff);
+ tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
+ tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
+-#endif
+ } else {
+ tcg_regset_set32(ct->u.regs, 0, 0xff);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_EAX);
+@@ -965,7 +963,6 @@ static void tcg_out_jmp(TCGContext *s, tcg_target_long dest)
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void *qemu_ld_helpers[4] = {
+@@ -983,25 +980,6 @@ static const void *qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+
+ /* Perform the TLB load and compare.
+
+@@ -1220,16 +1198,13 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ }
+ tcg_out_push(s, args[addrlo_idx]);
+ stack_adjust += 4;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_push(s, TCG_AREG0);
+ stack_adjust += 4;
+-#endif
+ #else
+ /* The first argument is already loaded with addrlo. */
+ arg_idx = 1;
+ tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[arg_idx],
+ mem_index);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -1240,7 +1215,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+ #endif
+-#endif
+
+ tcg_out_calli(s, (tcg_target_long)qemu_ld_helpers[s_bits]);
+
+@@ -1436,16 +1410,13 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ }
+ tcg_out_push(s, args[addrlo_idx]);
+ stack_adjust += 4;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_push(s, TCG_AREG0);
+ stack_adjust += 4;
+-#endif
+ #else
+ tcg_out_mov(s, (opc == 3 ? TCG_TYPE_I64 : TCG_TYPE_I32),
+ tcg_target_call_iarg_regs[1], data_reg);
+ tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[2], mem_index);
+ stack_adjust = 0;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -1456,7 +1427,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+ #endif
+-#endif
+
+ tcg_out_calli(s, (tcg_target_long)qemu_st_helpers[s_bits]);
+
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index c3cfe05..8be42f3 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -116,7 +116,6 @@ typedef enum {
+
+ #define TCG_TARGET_HAS_GUEST_BASE
+
+-/* Note: must be synced with dyngen-exec.h */
+ #if TCG_TARGET_REG_BITS == 64
+ # define TCG_AREG0 TCG_REG_R14
+ #else
+diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
+index dc588db..1745038 100644
+--- a/tcg/ia64/tcg-target.c
++++ b/tcg/ia64/tcg-target.c
+@@ -1452,7 +1452,6 @@ static inline void tcg_out_qemu_tlb(TCGContext *s, TCGArg addr_reg,
+ TCG_REG_P7, TCG_REG_R3, TCG_REG_R57));
+ }
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -1461,16 +1460,6 @@ static const void * const qemu_ld_helpers[4] = {
+ helper_ldl_mmu,
+ helper_ldq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-#endif
+
+ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ {
+@@ -1530,7 +1519,6 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1, TCG_REG_R1, TCG_REG_R2),
+ tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+ }
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_bundle(s, mII,
+ tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
+@@ -1539,7 +1527,6 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ TCG_REG_R57, 0, TCG_REG_R56),
+ tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4,
+ TCG_REG_R56, 0, TCG_AREG0));
+-#endif
+ if (!bswap || s_bits == 0) {
+ tcg_out_bundle(s, miB,
+ tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+@@ -1570,7 +1557,6 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ }
+ }
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_st_mmu(CPUState *env, target_ulong addr,
+ uintxx_t val, int mmu_idx) */
+ static const void * const qemu_st_helpers[4] = {
+@@ -1579,16 +1565,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+
+ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ {
+@@ -1658,7 +1634,6 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ data_reg = TCG_REG_R2;
+ }
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_bundle(s, mII,
+ tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R59,
+@@ -1674,15 +1649,6 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ TCG_REG_R56, 0, TCG_AREG0),
+ tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
+ TCG_REG_B0, TCG_REG_B6));
+-#else
+- tcg_out_bundle(s, miB,
+- tcg_opc_m4 (TCG_REG_P6, opc_st_m4[opc],
+- data_reg, TCG_REG_R3),
+- tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
+- mem_index, TCG_REG_R0),
+- tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
+- TCG_REG_B0, TCG_REG_B6));
+-#endif
+ }
+
+ #else /* !CONFIG_SOFTMMU */
+diff --git a/tcg/ia64/tcg-target.h b/tcg/ia64/tcg-target.h
+index 0631b9f..c22962a 100644
+--- a/tcg/ia64/tcg-target.h
++++ b/tcg/ia64/tcg-target.h
+@@ -140,7 +140,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_not_i32 0 /* xor r1, -1, r3 */
+ #define TCG_TARGET_HAS_not_i64 0 /* xor r1, -1, r3 */
+
+-/* Note: must be synced with dyngen-exec.h */
+ #define TCG_AREG0 TCG_REG_R7
+
+ /* Guest base is supported */
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 1006e28..74db83d 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -217,7 +217,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_set(ct->u.regs, 0xffffffff);
+ #if defined(CONFIG_SOFTMMU)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+-# if defined(CONFIG_TCG_PASS_AREG0) && (TARGET_LONG_BITS == 64)
++# if (TARGET_LONG_BITS == 64)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+ # endif
+ #endif
+@@ -227,12 +227,11 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_set(ct->u.regs, 0xffffffff);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+ #if defined(CONFIG_SOFTMMU)
+-# if (defined(CONFIG_TCG_PASS_AREG0) && TARGET_LONG_BITS == 32) || \
+- (!defined(CONFIG_TCG_PASS_AREG0) && TARGET_LONG_BITS == 64)
++# if (TARGET_LONG_BITS == 32)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
+ # endif
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+-# if defined(CONFIG_TCG_PASS_AREG0) && TARGET_LONG_BITS == 64
++# if TARGET_LONG_BITS == 64
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+ # endif
+ #endif
+@@ -821,7 +820,6 @@ static void tcg_out_setcond2(TCGContext *s, TCGCond cond, int ret,
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -839,25 +837,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+ #endif
+
+ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+@@ -942,9 +921,7 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+
+ /* slow path */
+ arg_num = 0;
+-# ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_call_iarg_reg32(s, &arg_num, TCG_AREG0);
+-# endif
+ # if TARGET_LONG_BITS == 64
+ tcg_out_call_iarg_reg64(s, &arg_num, addr_regl, addr_regh);
+ # else
+@@ -1127,9 +1104,7 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+
+ /* slow path */
+ arg_num = 0;
+-# ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_call_iarg_reg32(s, &arg_num, TCG_AREG0);
+-# endif
+ # if TARGET_LONG_BITS == 64
+ tcg_out_call_iarg_reg64(s, &arg_num, addr_regl, addr_regh);
+ # else
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index d3c804d..1c61931 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -96,7 +96,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_ext8u_i32 0 /* andi rt, rs, 0xff */
+ #define TCG_TARGET_HAS_ext16u_i32 0 /* andi rt, rs, 0xffff */
+
+-/* Note: must be synced with dyngen-exec.h */
+ #define TCG_AREG0 TCG_REG_S0
+
+ /* guest base is supported */
+diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
+index 0cff181..26c4b33 100644
+--- a/tcg/ppc/tcg-target.c
++++ b/tcg/ppc/tcg-target.c
+@@ -248,7 +248,6 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+ #if TARGET_LONG_BITS == 64
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+@@ -256,11 +255,6 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R7);
+ #endif
+ #endif
+-#else /* !AREG0 */
+-#if TARGET_LONG_BITS == 64
+- tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+-#endif
+-#endif
+ break;
+ case 'K': /* qemu_st[8..32] constraint */
+ ct->ct |= TCG_CT_REG;
+@@ -268,7 +262,6 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+ #if TARGET_LONG_BITS == 64
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R7);
+@@ -276,11 +269,6 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R8);
+ #endif
+ #endif
+-#else /* !AREG0 */
+-#if TARGET_LONG_BITS == 64
+- tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+-#endif
+-#endif
+ break;
+ case 'M': /* qemu_st64 constraint */
+ ct->ct |= TCG_CT_REG;
+@@ -290,12 +278,10 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R7);
+-#if defined(CONFIG_TCG_PASS_AREG0)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R8);
+ #ifdef TCG_TARGET_CALL_ALIGN_ARGS
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_R9);
+ #endif
+-#endif
+ break;
+ #else
+ case 'L':
+@@ -541,7 +527,6 @@ static void tcg_out_call (TCGContext *s, tcg_target_long arg, int const_arg)
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -559,25 +544,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+ #endif
+
+ static void tcg_out_qemu_ld (TCGContext *s, const TCGArg *args, int opc)
+@@ -647,9 +613,7 @@ static void tcg_out_qemu_ld (TCGContext *s, const TCGArg *args, int opc)
+
+ /* slow path */
+ ir = 3;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_mov (s, TCG_TYPE_I32, ir++, TCG_AREG0);
+-#endif
+ #if TARGET_LONG_BITS == 32
+ tcg_out_mov (s, TCG_TYPE_I32, ir++, addr_reg);
+ #else
+@@ -849,9 +813,7 @@ static void tcg_out_qemu_st (TCGContext *s, const TCGArg *args, int opc)
+
+ /* slow path */
+ ir = 3;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_mov (s, TCG_TYPE_I32, ir++, TCG_AREG0);
+-#endif
+ #if TARGET_LONG_BITS == 32
+ tcg_out_mov (s, TCG_TYPE_I32, ir++, addr_reg);
+ #else
+diff --git a/tcg/ppc64/tcg-target.c b/tcg/ppc64/tcg-target.c
+index 27a0ae8..337cd41 100644
+--- a/tcg/ppc64/tcg-target.c
++++ b/tcg/ppc64/tcg-target.c
+@@ -235,10 +235,8 @@ static int target_parse_constraint (TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R3);
+ #ifdef CONFIG_SOFTMMU
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R4);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R5);
+ #endif
+-#endif
+ break;
+ case 'S': /* qemu_st constraint */
+ ct->ct |= TCG_CT_REG;
+@@ -247,10 +245,8 @@ static int target_parse_constraint (TCGArgConstraint *ct, const char **pct_str)
+ #ifdef CONFIG_SOFTMMU
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R4);
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R5);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg (ct->u.regs, TCG_REG_R6);
+ #endif
+-#endif
+ break;
+ case 'Z':
+ ct->ct |= TCG_CT_CONST_U32;
+@@ -558,7 +554,6 @@ static void tcg_out_ldsta (TCGContext *s, int ret, int addr,
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -576,25 +571,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+
+ static void tcg_out_tlb_read (TCGContext *s, int r0, int r1, int r2,
+ int addr_reg, int s_bits, int offset)
+@@ -676,9 +652,7 @@ static void tcg_out_qemu_ld (TCGContext *s, const TCGArg *args, int opc)
+
+ /* slow path */
+ ir = 3;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_mov (s, TCG_TYPE_I64, ir++, TCG_AREG0);
+-#endif
+ tcg_out_mov (s, TCG_TYPE_I64, ir++, addr_reg);
+ tcg_out_movi (s, TCG_TYPE_I64, ir++, mem_index);
+
+@@ -827,9 +801,7 @@ static void tcg_out_qemu_st (TCGContext *s, const TCGArg *args, int opc)
+
+ /* slow path */
+ ir = 3;
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_mov (s, TCG_TYPE_I64, ir++, TCG_AREG0);
+-#endif
+ tcg_out_mov (s, TCG_TYPE_I64, ir++, addr_reg);
+ tcg_out_rld (s, RLDICL, ir++, data_reg, 0, 64 - (1 << (3 + opc)));
+ tcg_out_movi (s, TCG_TYPE_I64, ir++, mem_index);
+diff --git a/tcg/s390/tcg-target.c b/tcg/s390/tcg-target.c
+index 99b5339..aac11d9 100644
+--- a/tcg/s390/tcg-target.c
++++ b/tcg/s390/tcg-target.c
+@@ -301,7 +301,6 @@ static const uint8_t tcg_cond_to_ltr_cond[10] = {
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -319,25 +318,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static void *qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static void *qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+ #endif
+
+ static uint8_t *tb_ret_addr;
+@@ -1507,7 +1487,6 @@ static void tcg_prepare_qemu_ldst(TCGContext* s, TCGReg data_reg,
+ tcg_abort();
+ }
+ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R4, mem_index);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -1517,11 +1496,9 @@ static void tcg_prepare_qemu_ldst(TCGContext* s, TCGReg data_reg,
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+ tgen_calli(s, (tcg_target_ulong)qemu_st_helpers[s_bits]);
+ } else {
+ tcg_out_movi(s, TCG_TYPE_I32, arg1, mem_index);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+ tcg_target_call_iarg_regs[1]);
+@@ -1529,7 +1506,6 @@ static void tcg_prepare_qemu_ldst(TCGContext* s, TCGReg data_reg,
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+ tgen_calli(s, (tcg_target_ulong)qemu_ld_helpers[s_bits]);
+
+ /* sign extension */
+diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
+index d12f90b..4f7dfab 100644
+--- a/tcg/s390/tcg-target.h
++++ b/tcg/s390/tcg-target.h
+@@ -96,7 +96,6 @@ typedef enum TCGReg {
+ #define TCG_TARGET_EXTEND_ARGS 1
+
+ enum {
+- /* Note: must be synced with dyngen-exec.h */
+ TCG_AREG0 = TCG_REG_R10,
+ };
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 247a278..baed3b4 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -59,11 +59,7 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+ };
+ #endif
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ #define ARG_OFFSET 1
+-#else
+-#define ARG_OFFSET 0
+-#endif
+
+ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_L0,
+@@ -161,9 +157,7 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O3);
+-#endif
+ break;
+ case 'I':
+ ct->ct |= TCG_CT_CONST_S11;
+@@ -715,7 +709,6 @@ static void tcg_target_qemu_prologue(TCGContext *s)
+
+ #include "../../softmmu_defs.h"
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+ int mmu_idx) */
+ static const void * const qemu_ld_helpers[4] = {
+@@ -733,25 +726,6 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#else
+-/* legacy helper signature: __ld_mmu(target_ulong addr, int
+- mmu_idx) */
+-static const void * const qemu_ld_helpers[4] = {
+- __ldb_mmu,
+- __ldw_mmu,
+- __ldl_mmu,
+- __ldq_mmu,
+-};
+-
+-/* legacy helper signature: __st_mmu(target_ulong addr, uintxx_t val,
+- int mmu_idx) */
+-static const void * const qemu_st_helpers[4] = {
+- __stb_mmu,
+- __stw_mmu,
+- __stl_mmu,
+- __stq_mmu,
+-};
+-#endif
+ #endif
+
+ #if TARGET_LONG_BITS == 32
+@@ -834,7 +808,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+
+ /* mov */
+ tcg_out_movi(s, TCG_TYPE_I32, arg1, mem_index);
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -844,7 +817,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+
+ /* XXX: move that code at the end of the TB */
+ /* qemu_ld_helper[s_bits](arg0, arg1) */
+@@ -1061,7 +1033,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ /* mov */
+ tcg_out_movi(s, TCG_TYPE_I32, arg2, mem_index);
+
+-#ifdef CONFIG_TCG_PASS_AREG0
+ /* XXX/FIXME: suboptimal */
+ tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+ tcg_target_call_iarg_regs[2]);
+@@ -1071,7 +1042,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ tcg_target_call_iarg_regs[0]);
+ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+ TCG_AREG0);
+-#endif
+ /* XXX: move that code at the end of the TB */
+ /* qemu_st_helper[s_bits](arg0, arg1, arg2) */
+ tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_st_helpers[s_bits]
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index ee2274d..0ea87be 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -125,7 +125,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_deposit_i64 0
+ #endif
+
+-/* Note: must be synced with dyngen-exec.h */
+ #ifdef CONFIG_SOLARIS
+ #define TCG_AREG0 TCG_REG_G2
+ #elif defined(__sparc_v9__)
+diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c
+index ef8580f..003244c 100644
+--- a/tcg/tci/tcg-target.c
++++ b/tcg/tci/tcg-target.c
+@@ -798,9 +798,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ case INDEX_op_qemu_st8:
+ case INDEX_op_qemu_st16:
+ case INDEX_op_qemu_st32:
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_r(s, TCG_AREG0);
+-#endif
+ tcg_out_r(s, *args++);
+ tcg_out_r(s, *args++);
+ #if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
+@@ -811,9 +809,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ #endif
+ break;
+ case INDEX_op_qemu_st64:
+-#ifdef CONFIG_TCG_PASS_AREG0
+ tcg_out_r(s, TCG_AREG0);
+-#endif
+ tcg_out_r(s, *args++);
+ #if TCG_TARGET_REG_BITS == 32
+ tcg_out_r(s, *args++);
+diff --git a/tci.c b/tci.c
+index c79350d..ce8a988 100644
+--- a/tci.c
++++ b/tci.c
+@@ -25,7 +25,6 @@
+ #endif
+
+ #include "qemu-common.h"
+-#include "dyngen-exec.h" /* env */
+ #include "exec-all.h" /* MAX_OPC_PARAM_IARGS */
+ #include "tcg-op.h"
+
+@@ -63,17 +62,6 @@ uintptr_t tci_tb_ptr;
+
+ static tcg_target_ulong tci_reg[TCG_TARGET_NB_REGS];
+
+-#if !defined(CONFIG_TCG_PASS_AREG0)
+-# define helper_ldb_mmu(env, addr, mmu_idx) __ldb_mmu(addr, mmu_idx)
+-# define helper_ldw_mmu(env, addr, mmu_idx) __ldw_mmu(addr, mmu_idx)
+-# define helper_ldl_mmu(env, addr, mmu_idx) __ldl_mmu(addr, mmu_idx)
+-# define helper_ldq_mmu(env, addr, mmu_idx) __ldq_mmu(addr, mmu_idx)
+-# define helper_stb_mmu(env, addr, val, mmu_idx) __stb_mmu(addr, val, mmu_idx)
+-# define helper_stw_mmu(env, addr, val, mmu_idx) __stw_mmu(addr, val, mmu_idx)
+-# define helper_stl_mmu(env, addr, val, mmu_idx) __stl_mmu(addr, val, mmu_idx)
+-# define helper_stq_mmu(env, addr, val, mmu_idx) __stq_mmu(addr, val, mmu_idx)
+-#endif /* !CONFIG_TCG_PASS_AREG0 */
+-
+ static tcg_target_ulong tci_read_reg(TCGReg index)
+ {
+ assert(index < ARRAY_SIZE(tci_reg));
+diff --git a/user-exec.c b/user-exec.c
+index b9ea9dd..ef9b172 100644
+--- a/user-exec.c
++++ b/user-exec.c
+@@ -18,9 +18,6 @@
+ */
+ #include "config.h"
+ #include "cpu.h"
+-#ifndef CONFIG_TCG_PASS_AREG0
+-#include "dyngen-exec.h"
+-#endif
+ #include "disas.h"
+ #include "tcg.h"
+
+@@ -60,12 +57,6 @@ void cpu_resume_from_signal(CPUArchState *env1, void *puc)
+ struct sigcontext *uc = puc;
+ #endif
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+- env = env1;
+-
+- /* XXX: restore cpu registers saved in host registers */
+-#endif
+-
+ if (puc) {
+ /* XXX: use siglongjmp ? */
+ #ifdef __linux__
+@@ -93,11 +84,6 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
+ TranslationBlock *tb;
+ int ret;
+
+-#ifndef CONFIG_TCG_PASS_AREG0
+- if (cpu_single_env) {
+- env = cpu_single_env; /* XXX: find a correct solution for multithread */
+- }
+-#endif
+ #if defined(DEBUG_SIGNAL)
+ qemu_printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
+ pc, address, is_write, *(unsigned long *)old_set);
+--
+1.7.12.1
+
--- /dev/null
+From 83b25655bcd988054a2bb2a0a38dc662d4901b08 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Mon, 10 Sep 2012 13:56:24 +0200
+Subject: [PATCH] tcg/i386: allow constants in load/store ops
+
+On x86, it is possible to move a constant value to memory. Add code to
+handle a constant argument to load/store ops.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/i386/tcg-target.c | 50 +++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
+index 34c2df8..3017858 100644
+--- a/tcg/i386/tcg-target.c
++++ b/tcg/i386/tcg-target.c
+@@ -263,6 +263,7 @@ static inline int tcg_target_const_match(tcg_target_long val,
+ #define OPC_MOVB_EvGv (0x88) /* stores, more or less */
+ #define OPC_MOVL_EvGv (0x89) /* stores, more or less */
+ #define OPC_MOVL_GvEv (0x8b) /* loads, more or less */
++#define OPC_MOVB_EvIz (0xc6)
+ #define OPC_MOVL_EvIz (0xc7)
+ #define OPC_MOVL_Iv (0xb8)
+ #define OPC_MOVSBL (0xbe | P_EXT)
+@@ -1543,18 +1544,35 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ break;
+
+ OP_32_64(st8):
+- tcg_out_modrm_offset(s, OPC_MOVB_EvGv | P_REXB_R,
+- args[0], args[1], args[2]);
++ if (const_args[0]) {
++ tcg_out_modrm_offset(s, OPC_MOVB_EvIz,
++ 0, args[1], args[2]);
++ tcg_out8(s, args[0]);
++ } else {
++ tcg_out_modrm_offset(s, OPC_MOVB_EvGv | P_REXB_R,
++ args[0], args[1], args[2]);
++ }
+ break;
+ OP_32_64(st16):
+- tcg_out_modrm_offset(s, OPC_MOVL_EvGv | P_DATA16,
+- args[0], args[1], args[2]);
++ if (const_args[0]) {
++ tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_DATA16,
++ 0, args[1], args[2]);
++ tcg_out16(s, args[0]);
++ } else {
++ tcg_out_modrm_offset(s, OPC_MOVL_EvGv | P_DATA16,
++ args[0], args[1], args[2]);
++ }
+ break;
+ #if TCG_TARGET_REG_BITS == 64
+ case INDEX_op_st32_i64:
+ #endif
+ case INDEX_op_st_i32:
+- tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
++ if (const_args[0]) {
++ tcg_out_modrm_offset(s, OPC_MOVL_EvIz, 0, args[1], args[2]);
++ tcg_out32(s, args[0]);
++ } else {
++ tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
++ }
+ break;
+
+ OP_32_64(add):
+@@ -1758,7 +1776,13 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_ld(s, TCG_TYPE_I64, args[0], args[1], args[2]);
+ break;
+ case INDEX_op_st_i64:
+- tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
++ if (const_args[0]) {
++ tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_REXW,
++ 0, args[1], args[2]);
++ tcg_out32(s, args[0]);
++ } else {
++ tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
++ }
+ break;
+ case INDEX_op_qemu_ld32s:
+ tcg_out_qemu_ld(s, args, 2 | 4);
+@@ -1820,9 +1844,9 @@ static const TCGTargetOpDef x86_op_defs[] = {
+ { INDEX_op_ld16u_i32, { "r", "r" } },
+ { INDEX_op_ld16s_i32, { "r", "r" } },
+ { INDEX_op_ld_i32, { "r", "r" } },
+- { INDEX_op_st8_i32, { "q", "r" } },
+- { INDEX_op_st16_i32, { "r", "r" } },
+- { INDEX_op_st_i32, { "r", "r" } },
++ { INDEX_op_st8_i32, { "qi", "r" } },
++ { INDEX_op_st16_i32, { "ri", "r" } },
++ { INDEX_op_st_i32, { "ri", "r" } },
+
+ { INDEX_op_add_i32, { "r", "r", "ri" } },
+ { INDEX_op_sub_i32, { "r", "0", "ri" } },
+@@ -1873,10 +1897,10 @@ static const TCGTargetOpDef x86_op_defs[] = {
+ { INDEX_op_ld32u_i64, { "r", "r" } },
+ { INDEX_op_ld32s_i64, { "r", "r" } },
+ { INDEX_op_ld_i64, { "r", "r" } },
+- { INDEX_op_st8_i64, { "r", "r" } },
+- { INDEX_op_st16_i64, { "r", "r" } },
+- { INDEX_op_st32_i64, { "r", "r" } },
+- { INDEX_op_st_i64, { "r", "r" } },
++ { INDEX_op_st8_i64, { "ri", "r" } },
++ { INDEX_op_st16_i64, { "ri", "r" } },
++ { INDEX_op_st32_i64, { "ri", "r" } },
++ { INDEX_op_st_i64, { "re", "r" } },
+
+ { INDEX_op_add_i64, { "r", "0", "re" } },
+ { INDEX_op_mul_i64, { "r", "0", "re" } },
+--
+1.7.12.1
+
--- /dev/null
+From 1610a0e56c0be3e4bfd3034e5323188b1d05badd Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Mon, 10 Sep 2012 14:23:49 +0200
+Subject: [PATCH] tcg: mark set_label with TCG_OPF_BB_END flag
+
+set_label is effectively the end of a basic block, as no optimization
+can be made accross it. It was treated as such in the liveness analysis
+code, but as a special case.
+
+Mark it with TCG_OPF_BB_END flag so that this information can be used
+by other parts of the TCG code, and remove the special case in the liveness
+analysis code.
+
+Cc: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/tcg-opc.h | 2 +-
+ tcg/tcg.c | 5 -----
+ 2 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
+index 8e06d03..d12e8d0 100644
+--- a/tcg/tcg-opc.h
++++ b/tcg/tcg-opc.h
+@@ -36,7 +36,7 @@ DEF(nopn, 0, 0, 1, 0) /* variable number of parameters */
+
+ DEF(discard, 1, 0, 0, 0)
+
+-DEF(set_label, 0, 0, 1, 0)
++DEF(set_label, 0, 0, 1, TCG_OPF_BB_END)
+ DEF(call, 0, 1, 2, TCG_OPF_SIDE_EFFECTS) /* variable number of parameters */
+ DEF(jmp, 0, 1, 0, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+ DEF(br, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index 8386b70..c002a88 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -1297,11 +1297,6 @@ static void tcg_liveness_analysis(TCGContext *s)
+ args--;
+ }
+ break;
+- case INDEX_op_set_label:
+- args--;
+- /* mark end of basic block */
+- tcg_la_bb_end(s, dead_temps);
+- break;
+ case INDEX_op_debug_insn_start:
+ args -= def->nb_args;
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From 2b8d0049e88c17749ccb978509d3f8fda180d35f Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Mon, 10 Sep 2012 13:14:12 +0200
+Subject: [PATCH] revert "TCG: fix copy propagation"
+
+Given the copy propagation breakage on 32-bit hosts has been fixed
+commit e31b0a7c050711884ad570fe73df806520953618 can be reverted.
+
+Cc: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 15 ++++++---------
+ tcg/tcg.h | 5 -----
+ 2 files changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index fba0ed9..10d9773 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -107,15 +107,12 @@ static TCGOpcode op_to_movi(TCGOpcode op)
+ }
+ }
+
+-static void tcg_opt_gen_mov(TCGContext *s, TCGArg *gen_args, TCGArg dst,
+- TCGArg src, int nb_temps, int nb_globals)
++static void tcg_opt_gen_mov(TCGArg *gen_args, TCGArg dst, TCGArg src,
++ int nb_temps, int nb_globals)
+ {
+ reset_temp(dst, nb_temps, nb_globals);
+ assert(temps[src].state != TCG_TEMP_COPY);
+- /* Don't try to copy if one of temps is a global or either one
+- is local and another is register */
+- if (src >= nb_globals && dst >= nb_globals &&
+- tcg_arg_is_local(s, src) == tcg_arg_is_local(s, dst)) {
++ if (src >= nb_globals) {
+ assert(temps[src].state != TCG_TEMP_CONST);
+ if (temps[src].state != TCG_TEMP_HAS_COPY) {
+ temps[src].state = TCG_TEMP_HAS_COPY;
+@@ -444,7 +441,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+- tcg_opt_gen_mov(s, gen_args, args[0], args[1],
++ tcg_opt_gen_mov(gen_args, args[0], args[1],
+ nb_temps, nb_globals);
+ gen_args += 2;
+ }
+@@ -482,7 +479,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+- tcg_opt_gen_mov(s, gen_args, args[0], args[1], nb_temps,
++ tcg_opt_gen_mov(gen_args, args[0], args[1], nb_temps,
+ nb_globals);
+ gen_args += 2;
+ }
+@@ -507,7 +504,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ break;
+ }
+ if (temps[args[1]].state != TCG_TEMP_CONST) {
+- tcg_opt_gen_mov(s, gen_args, args[0], args[1],
++ tcg_opt_gen_mov(gen_args, args[0], args[1],
+ nb_temps, nb_globals);
+ gen_args += 2;
+ args += 2;
+diff --git a/tcg/tcg.h b/tcg/tcg.h
+index d710694..8fbbc81 100644
+--- a/tcg/tcg.h
++++ b/tcg/tcg.h
+@@ -458,11 +458,6 @@ static inline TCGv_i64 tcg_temp_local_new_i64(void)
+ void tcg_temp_free_i64(TCGv_i64 arg);
+ char *tcg_get_arg_str_i64(TCGContext *s, char *buf, int buf_size, TCGv_i64 arg);
+
+-static inline bool tcg_arg_is_local(TCGContext *s, TCGArg arg)
+-{
+- return s->temps[arg].temp_local;
+-}
+-
+ #if defined(CONFIG_DEBUG_TCG)
+ /* If you call tcg_clear_temp_count() at the start of a section of
+ * code which is not supposed to leak any TCG temporaries, then
+--
+1.7.12.1
+
--- /dev/null
+From 3380afc68a701604e51fa22637ef48d93514d678 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Tue, 18 Sep 2012 21:55:32 -0700
+Subject: [PATCH] target-mips: Set opn in gen_ldst_multiple.
+
+Used by MIPS_DEBUG, when enabled.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Acked-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-mips/translate.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/target-mips/translate.c b/target-mips/translate.c
+index 7ab769f..c31f91c 100644
+--- a/target-mips/translate.c
++++ b/target-mips/translate.c
+@@ -9855,6 +9855,7 @@ static void gen_andi16 (CPUMIPSState *env, DisasContext *ctx)
+ static void gen_ldst_multiple (DisasContext *ctx, uint32_t opc, int reglist,
+ int base, int16_t offset)
+ {
++ const char *opn = "ldst_multiple";
+ TCGv t0, t1;
+ TCGv_i32 t2;
+
+@@ -9874,19 +9875,24 @@ static void gen_ldst_multiple (DisasContext *ctx, uint32_t opc, int reglist,
+ switch (opc) {
+ case LWM32:
+ gen_helper_lwm(cpu_env, t0, t1, t2);
++ opn = "lwm";
+ break;
+ case SWM32:
+ gen_helper_swm(cpu_env, t0, t1, t2);
++ opn = "swm";
+ break;
+ #ifdef TARGET_MIPS64
+ case LDM:
+ gen_helper_ldm(cpu_env, t0, t1, t2);
++ opn = "ldm";
+ break;
+ case SDM:
+ gen_helper_sdm(cpu_env, t0, t1, t2);
++ opn = "sdm";
+ break;
+ #endif
+ }
++ (void)opn;
+ MIPS_DEBUG("%s, %x, %d(%s)", opn, reglist, offset, regnames[base]);
+ tcg_temp_free(t0);
+ tcg_temp_free(t1);
+--
+1.7.12.1
+
--- /dev/null
+From 5dd8e9207a39d8fe41eaa110edfdba5e37064562 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Tue, 18 Sep 2012 21:55:33 -0700
+Subject: [PATCH] target-mips: Fix MIPS_DEBUG.
+
+The macro uses the DisasContext. Pass it around as needed.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Acked-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-mips/translate.c | 74 +++++++++++++++++++++++++------------------------
+ 1 file changed, 38 insertions(+), 36 deletions(-)
+
+diff --git a/target-mips/translate.c b/target-mips/translate.c
+index c31f91c..4937f6b 100644
+--- a/target-mips/translate.c
++++ b/target-mips/translate.c
+@@ -1431,7 +1431,8 @@ static void gen_arith_imm (CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
+ }
+
+ /* Logic with immediate operand */
+-static void gen_logic_imm (CPUMIPSState *env, uint32_t opc, int rt, int rs, int16_t imm)
++static void gen_logic_imm(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
++ int rt, int rs, int16_t imm)
+ {
+ target_ulong uimm;
+ const char *opn = "imm logic";
+@@ -1474,7 +1475,8 @@ static void gen_logic_imm (CPUMIPSState *env, uint32_t opc, int rt, int rs, int1
+ }
+
+ /* Set on less than with immediate operand */
+-static void gen_slt_imm (CPUMIPSState *env, uint32_t opc, int rt, int rs, int16_t imm)
++static void gen_slt_imm(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
++ int rt, int rs, int16_t imm)
+ {
+ target_ulong uimm = (target_long)imm; /* Sign extend to 32/64 bits */
+ const char *opn = "imm arith";
+@@ -1775,7 +1777,8 @@ static void gen_arith (CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
+ }
+
+ /* Conditional move */
+-static void gen_cond_move (CPUMIPSState *env, uint32_t opc, int rd, int rs, int rt)
++static void gen_cond_move(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
++ int rd, int rs, int rt)
+ {
+ const char *opn = "cond move";
+ int l1;
+@@ -1813,7 +1816,8 @@ static void gen_cond_move (CPUMIPSState *env, uint32_t opc, int rd, int rs, int
+ }
+
+ /* Logic */
+-static void gen_logic (CPUMIPSState *env, uint32_t opc, int rd, int rs, int rt)
++static void gen_logic(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
++ int rd, int rs, int rt)
+ {
+ const char *opn = "logic";
+
+@@ -1874,7 +1878,8 @@ static void gen_logic (CPUMIPSState *env, uint32_t opc, int rd, int rs, int rt)
+ }
+
+ /* Set on lower than */
+-static void gen_slt (CPUMIPSState *env, uint32_t opc, int rd, int rs, int rt)
++static void gen_slt(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
++ int rd, int rs, int rt)
+ {
+ const char *opn = "slt";
+ TCGv t0, t1;
+@@ -8778,10 +8783,10 @@ static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ gen_arith_imm(env, ctx, OPC_ADDIU, rx, rx, imm);
+ break;
+ case M16_OPC_SLTI:
+- gen_slt_imm(env, OPC_SLTI, 24, rx, imm);
++ gen_slt_imm(env, ctx, OPC_SLTI, 24, rx, imm);
+ break;
+ case M16_OPC_SLTIU:
+- gen_slt_imm(env, OPC_SLTIU, 24, rx, imm);
++ gen_slt_imm(env, ctx, OPC_SLTIU, 24, rx, imm);
+ break;
+ case M16_OPC_I8:
+ switch (funct) {
+@@ -8992,15 +8997,13 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ case M16_OPC_SLTI:
+ {
+ int16_t imm = (uint8_t) ctx->opcode;
+-
+- gen_slt_imm(env, OPC_SLTI, 24, rx, imm);
++ gen_slt_imm(env, ctx, OPC_SLTI, 24, rx, imm);
+ }
+ break;
+ case M16_OPC_SLTIU:
+ {
+ int16_t imm = (uint8_t) ctx->opcode;
+-
+- gen_slt_imm(env, OPC_SLTIU, 24, rx, imm);
++ gen_slt_imm(env, ctx, OPC_SLTIU, 24, rx, imm);
+ }
+ break;
+ case M16_OPC_I8:
+@@ -9075,8 +9078,7 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ case M16_OPC_CMPI:
+ {
+ int16_t imm = (uint8_t) ctx->opcode;
+-
+- gen_logic_imm(env, OPC_XORI, 24, rx, imm);
++ gen_logic_imm(env, ctx, OPC_XORI, 24, rx, imm);
+ }
+ break;
+ #if defined(TARGET_MIPS64)
+@@ -9188,10 +9190,10 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ }
+ break;
+ case RR_SLT:
+- gen_slt(env, OPC_SLT, 24, rx, ry);
++ gen_slt(env, ctx, OPC_SLT, 24, rx, ry);
+ break;
+ case RR_SLTU:
+- gen_slt(env, OPC_SLTU, 24, rx, ry);
++ gen_slt(env, ctx, OPC_SLTU, 24, rx, ry);
+ break;
+ case RR_BREAK:
+ generate_exception(ctx, EXCP_BREAK);
+@@ -9212,22 +9214,22 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
+ break;
+ #endif
+ case RR_CMP:
+- gen_logic(env, OPC_XOR, 24, rx, ry);
++ gen_logic(env, ctx, OPC_XOR, 24, rx, ry);
+ break;
+ case RR_NEG:
+ gen_arith(env, ctx, OPC_SUBU, rx, 0, ry);
+ break;
+ case RR_AND:
+- gen_logic(env, OPC_AND, rx, rx, ry);
++ gen_logic(env, ctx, OPC_AND, rx, rx, ry);
+ break;
+ case RR_OR:
+- gen_logic(env, OPC_OR, rx, rx, ry);
++ gen_logic(env, ctx, OPC_OR, rx, rx, ry);
+ break;
+ case RR_XOR:
+- gen_logic(env, OPC_XOR, rx, rx, ry);
++ gen_logic(env, ctx, OPC_XOR, rx, rx, ry);
+ break;
+ case RR_NOT:
+- gen_logic(env, OPC_NOR, rx, ry, 0);
++ gen_logic(env, ctx, OPC_NOR, rx, ry, 0);
+ break;
+ case RR_MFHI:
+ gen_HILO(ctx, OPC_MFHI, rx);
+@@ -9849,7 +9851,7 @@ static void gen_andi16 (CPUMIPSState *env, DisasContext *ctx)
+ int rs = mmreg(uMIPS_RS(ctx->opcode));
+ int encoded = ZIMM(ctx->opcode, 0, 4);
+
+- gen_logic_imm(env, OPC_ANDI, rd, rs, decoded_imm[encoded]);
++ gen_logic_imm(env, ctx, OPC_ANDI, rd, rs, decoded_imm[encoded]);
+ }
+
+ static void gen_ldst_multiple (DisasContext *ctx, uint32_t opc, int reglist,
+@@ -9911,25 +9913,25 @@ static void gen_pool16c_insn (CPUMIPSState *env, DisasContext *ctx, int *is_bran
+ case NOT16 + 1:
+ case NOT16 + 2:
+ case NOT16 + 3:
+- gen_logic(env, OPC_NOR, rd, rs, 0);
++ gen_logic(env, ctx, OPC_NOR, rd, rs, 0);
+ break;
+ case XOR16 + 0:
+ case XOR16 + 1:
+ case XOR16 + 2:
+ case XOR16 + 3:
+- gen_logic(env, OPC_XOR, rd, rd, rs);
++ gen_logic(env, ctx, OPC_XOR, rd, rd, rs);
+ break;
+ case AND16 + 0:
+ case AND16 + 1:
+ case AND16 + 2:
+ case AND16 + 3:
+- gen_logic(env, OPC_AND, rd, rd, rs);
++ gen_logic(env, ctx, OPC_AND, rd, rd, rs);
+ break;
+ case OR16 + 0:
+ case OR16 + 1:
+ case OR16 + 2:
+ case OR16 + 3:
+- gen_logic(env, OPC_OR, rd, rd, rs);
++ gen_logic(env, ctx, OPC_OR, rd, rd, rs);
+ break;
+ case LWM16 + 0:
+ case LWM16 + 1:
+@@ -10743,7 +10745,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ case XOR32:
+ mips32_op = OPC_XOR;
+ do_logic:
+- gen_logic(env, mips32_op, rd, rs, rt);
++ gen_logic(env, ctx, mips32_op, rd, rs, rt);
+ break;
+ /* Set less than */
+ case SLT:
+@@ -10752,7 +10754,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ case SLTU:
+ mips32_op = OPC_SLTU;
+ do_slt:
+- gen_slt(env, mips32_op, rd, rs, rt);
++ gen_slt(env, ctx, mips32_op, rd, rs, rt);
+ break;
+ default:
+ goto pool32a_invalid;
+@@ -10768,7 +10770,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ case MOVZ:
+ mips32_op = OPC_MOVZ;
+ do_cmov:
+- gen_cond_move(env, mips32_op, rd, rs, rt);
++ gen_cond_move(env, ctx, mips32_op, rd, rs, rt);
+ break;
+ case LWXS:
+ gen_ldxs(ctx, rs, rt, rd);
+@@ -11181,7 +11183,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ target. */
+ break;
+ case LUI:
+- gen_logic_imm(env, OPC_LUI, rs, -1, imm);
++ gen_logic_imm(env, ctx, OPC_LUI, rs, -1, imm);
+ break;
+ case SYNCI:
+ break;
+@@ -11300,7 +11302,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ case ANDI32:
+ mips32_op = OPC_ANDI;
+ do_logici:
+- gen_logic_imm(env, mips32_op, rt, rs, imm);
++ gen_logic_imm(env, ctx, mips32_op, rt, rs, imm);
+ break;
+
+ /* Set less than immediate */
+@@ -11310,7 +11312,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
+ case SLTIU32:
+ mips32_op = OPC_SLTIU;
+ do_slti:
+- gen_slt_imm(env, mips32_op, rt, rs, imm);
++ gen_slt_imm(env, ctx, mips32_op, rt, rs, imm);
+ break;
+ case JALX32:
+ offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 2;
+@@ -11787,7 +11789,7 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ case OPC_MOVZ:
+ check_insn(env, ctx, ISA_MIPS4 | ISA_MIPS32 |
+ INSN_LOONGSON2E | INSN_LOONGSON2F);
+- gen_cond_move(env, op1, rd, rs, rt);
++ gen_cond_move(env, ctx, op1, rd, rs, rt);
+ break;
+ case OPC_ADD ... OPC_SUBU:
+ gen_arith(env, ctx, op1, rd, rs, rt);
+@@ -11814,13 +11816,13 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ break;
+ case OPC_SLT: /* Set on less than */
+ case OPC_SLTU:
+- gen_slt(env, op1, rd, rs, rt);
++ gen_slt(env, ctx, op1, rd, rs, rt);
+ break;
+ case OPC_AND: /* Logic*/
+ case OPC_OR:
+ case OPC_NOR:
+ case OPC_XOR:
+- gen_logic(env, op1, rd, rs, rt);
++ gen_logic(env, ctx, op1, rd, rs, rt);
+ break;
+ case OPC_MULT ... OPC_DIVU:
+ if (sa) {
+@@ -12221,13 +12223,13 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+ break;
+ case OPC_SLTI: /* Set on less than with immediate opcode */
+ case OPC_SLTIU:
+- gen_slt_imm(env, op, rt, rs, imm);
++ gen_slt_imm(env, ctx, op, rt, rs, imm);
+ break;
+ case OPC_ANDI: /* Arithmetic with immediate opcode */
+ case OPC_LUI:
+ case OPC_ORI:
+ case OPC_XORI:
+- gen_logic_imm(env, op, rt, rs, imm);
++ gen_logic_imm(env, ctx, op, rt, rs, imm);
+ break;
+ case OPC_J ... OPC_JAL: /* Jump */
+ offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 2;
+--
+1.7.12.1
+
--- /dev/null
+From e6f923b4e3e71661343f6d2eecd7f102022e5635 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Tue, 18 Sep 2012 21:55:34 -0700
+Subject: [PATCH] target-mips: Always evaluate debugging macro arguments
+
+this will prevent some of the compilation errors with debugging
+enabled from creeping back in.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-mips/translate.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+diff --git a/target-mips/translate.c b/target-mips/translate.c
+index 4937f6b..aba7935 100644
+--- a/target-mips/translate.c
++++ b/target-mips/translate.c
+@@ -28,7 +28,7 @@
+ #define GEN_HELPER 1
+ #include "helper.h"
+
+-//#define MIPS_DEBUG_DISAS
++#define MIPS_DEBUG_DISAS 0
+ //#define MIPS_DEBUG_SIGN_EXTENSIONS
+
+ /* MIPS major opcodes */
+@@ -566,22 +566,25 @@ static const char *fregnames[] =
+ "f16", "f17", "f18", "f19", "f20", "f21", "f22", "f23",
+ "f24", "f25", "f26", "f27", "f28", "f29", "f30", "f31", };
+
+-#ifdef MIPS_DEBUG_DISAS
+-#define MIPS_DEBUG(fmt, ...) \
+- qemu_log_mask(CPU_LOG_TB_IN_ASM, \
+- TARGET_FMT_lx ": %08x " fmt "\n", \
+- ctx->pc, ctx->opcode , ## __VA_ARGS__)
+-#define LOG_DISAS(...) qemu_log_mask(CPU_LOG_TB_IN_ASM, ## __VA_ARGS__)
+-#else
+-#define MIPS_DEBUG(fmt, ...) do { } while(0)
+-#define LOG_DISAS(...) do { } while (0)
+-#endif
++#define MIPS_DEBUG(fmt, ...) \
++ do { \
++ if (MIPS_DEBUG_DISAS) { \
++ qemu_log_mask(CPU_LOG_TB_IN_ASM, \
++ TARGET_FMT_lx ": %08x " fmt "\n", \
++ ctx->pc, ctx->opcode , ## __VA_ARGS__); \
++ } \
++ } while (0)
++
++#define LOG_DISAS(...) \
++ do { \
++ if (MIPS_DEBUG_DISAS) { \
++ qemu_log_mask(CPU_LOG_TB_IN_ASM, ## __VA_ARGS__); \
++ } \
++ } while (0)
+
+ #define MIPS_INVAL(op) \
+-do { \
+ MIPS_DEBUG("Invalid %s %03x %03x %03x", op, ctx->opcode >> 26, \
+- ctx->opcode & 0x3F, ((ctx->opcode >> 16) & 0x1F)); \
+-} while (0)
++ ctx->opcode & 0x3F, ((ctx->opcode >> 16) & 0x1F))
+
+ /* General purpose registers moves. */
+ static inline void gen_load_gpr (TCGv t, int reg)
+--
+1.7.12.1
+
--- /dev/null
+From 4ce7a1e0aaecb220016af9b4f390b76f7fffcce8 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Wed, 19 Sep 2012 21:40:30 +0200
+Subject: [PATCH] tcg/optimize: fix end of basic block detection
+
+Commit e31b0a7c050711884ad570fe73df806520953618 fixed copy propagation on
+32-bit host by restricting the copy between different types. This was the
+wrong fix.
+
+The real problem is that the all temps states should be reset at the end
+of a basic block. This was done by adding such operations in the switch,
+but brcond2 was forgotten (that's why the crash was only observed on 32-bit
+hosts).
+
+Fix that by looking at the TCG_OPF_BB_END instead. We need to keep the case
+for op_set_label as temps might be modified through another path.
+
+Cc: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 10d9773..9da333c 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -632,21 +632,17 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ i--;
+ }
+ break;
+- case INDEX_op_set_label:
+- case INDEX_op_jmp:
+- case INDEX_op_br:
+- memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+- for (i = 0; i < def->nb_args; i++) {
+- *gen_args = *args;
+- args++;
+- gen_args++;
+- }
+- break;
+ default:
+ /* Default case: we do know nothing about operation so no
+- propagation is done. We only trash output args. */
+- for (i = 0; i < def->nb_oargs; i++) {
+- reset_temp(args[i], nb_temps, nb_globals);
++ propagation is done. We trash everything if the operation
++ is the end of a basic block, otherwise we only trash the
++ output args. */
++ if (def->flags & TCG_OPF_BB_END) {
++ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
++ } else {
++ for (i = 0; i < def->nb_oargs; i++) {
++ reset_temp(args[i], nb_temps, nb_globals);
++ }
+ }
+ for (i = 0; i < def->nb_args; i++) {
+ gen_args[i] = args[i];
+--
+1.7.12.1
+
--- /dev/null
+From 1c596a9498830485a1b2f4a4445643a149179b99 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 21 Sep 2012 02:59:49 +0400
+Subject: [PATCH] target-xtensa: fix extui shift amount
+
+extui opcode only uses lowermost op1 bit for sa4.
+
+Reported-by: malc <av1474@comtv.ru>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Signed-off-by: malc <av1474@comtv.ru>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-xtensa/translate.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
+index 1900bd5..7a1c528 100644
+--- a/target-xtensa/translate.c
++++ b/target-xtensa/translate.c
+@@ -1778,12 +1778,30 @@ static void disas_xtensa_insn(DisasContext *dc)
+ case 5:
+ gen_window_check2(dc, RRR_R, RRR_T);
+ {
+- int shiftimm = RRR_S | (OP1 << 4);
++ int shiftimm = RRR_S | ((OP1 & 1) << 4);
+ int maskimm = (1 << (OP2 + 1)) - 1;
+
+ TCGv_i32 tmp = tcg_temp_new_i32();
+- tcg_gen_shri_i32(tmp, cpu_R[RRR_T], shiftimm);
+- tcg_gen_andi_i32(cpu_R[RRR_R], tmp, maskimm);
++
++ if (shiftimm) {
++ tcg_gen_shri_i32(tmp, cpu_R[RRR_T], shiftimm);
++ } else {
++ tcg_gen_mov_i32(tmp, cpu_R[RRR_T]);
++ }
++
++ switch (maskimm) {
++ case 0xff:
++ tcg_gen_ext8u_i32(cpu_R[RRR_R], tmp);
++ break;
++
++ case 0xffff:
++ tcg_gen_ext16u_i32(cpu_R[RRR_R], tmp);
++ break;
++
++ default:
++ tcg_gen_andi_i32(cpu_R[RRR_R], tmp, maskimm);
++ break;
++ }
+ tcg_temp_free(tmp);
+ }
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From ba9c2acb955f0453ae80077a791a4d1c27b5d6e6 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 21 Sep 2012 02:59:50 +0400
+Subject: [PATCH] target-xtensa: don't emit extra tcg_gen_goto_tb
+
+Unconditional gen_check_loop_end at the end of disas_xtensa_insn
+can emit tcg_gen_goto_tb with slot id already used in the TB (e.g. when
+TB ends at LEND with a branch).
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Signed-off-by: malc <av1474@comtv.ru>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-xtensa/translate.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
+index 7a1c528..b6643eb 100644
+--- a/target-xtensa/translate.c
++++ b/target-xtensa/translate.c
+@@ -2520,7 +2520,9 @@ static void disas_xtensa_insn(DisasContext *dc)
+ break;
+ }
+
+- gen_check_loop_end(dc, 0);
++ if (dc->is_jmp == DISAS_NEXT) {
++ gen_check_loop_end(dc, 0);
++ }
+ dc->pc = dc->next_pc;
+
+ return;
+--
+1.7.12.1
+
--- /dev/null
+From a977d2c7f02eb2ed7fc879979d6f5525c017a881 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:13:34 -0700
+Subject: [PATCH] tcg: Introduce movcond
+
+Implemented with setcond if the target does not provide
+the optional opcode.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/README | 6 ++++++
+ tcg/arm/tcg-target.h | 1 +
+ tcg/hppa/tcg-target.h | 1 +
+ tcg/i386/tcg-target.h | 2 ++
+ tcg/ia64/tcg-target.h | 2 ++
+ tcg/mips/tcg-target.h | 1 +
+ tcg/ppc/tcg-target.h | 1 +
+ tcg/ppc64/tcg-target.h | 2 ++
+ tcg/s390/tcg-target.h | 2 ++
+ tcg/sparc/tcg-target.h | 2 ++
+ tcg/tcg-op.h | 40 ++++++++++++++++++++++++++++++++++++++++
+ tcg/tcg-opc.h | 2 ++
+ tcg/tcg.c | 11 +++++------
+ tcg/tcg.h | 1 +
+ tcg/tci/tcg-target.h | 2 ++
+ 15 files changed, 70 insertions(+), 6 deletions(-)
+
+diff --git a/tcg/README b/tcg/README
+index cfdfd96..d03ae05 100644
+--- a/tcg/README
++++ b/tcg/README
+@@ -307,6 +307,12 @@ dest = (t1 cond t2)
+
+ Set DEST to 1 if (T1 cond T2) is true, otherwise set to 0.
+
++* movcond_i32/i64 cond, dest, c1, c2, v1, v2
++
++dest = (c1 cond c2 ? v1 : v2)
++
++Set DEST to V1 if (C1 cond C2) is true, otherwise set to V2.
++
+ ********* Type conversions
+
+ * ext_i32_i64 t0, t1
+diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+index c0b8f72..e2299ca 100644
+--- a/tcg/arm/tcg-target.h
++++ b/tcg/arm/tcg-target.h
+@@ -73,6 +73,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 0
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #define TCG_TARGET_HAS_GUEST_BASE
+
+diff --git a/tcg/hppa/tcg-target.h b/tcg/hppa/tcg-target.h
+index 01ef960..4defd28 100644
+--- a/tcg/hppa/tcg-target.h
++++ b/tcg/hppa/tcg-target.h
+@@ -96,6 +96,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 1
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ /* optional instructions automatically implemented */
+ #define TCG_TARGET_HAS_neg_i32 0 /* sub rd, 0, rs */
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index 8be42f3..504f953 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -86,6 +86,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 1
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_div2_i64 1
+@@ -107,6 +108,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 1
++#define TCG_TARGET_HAS_movcond_i64 0
+ #endif
+
+ #define TCG_TARGET_deposit_i32_valid(ofs, len) \
+diff --git a/tcg/ia64/tcg-target.h b/tcg/ia64/tcg-target.h
+index c22962a..368aee4 100644
+--- a/tcg/ia64/tcg-target.h
++++ b/tcg/ia64/tcg-target.h
+@@ -133,6 +133,8 @@ typedef enum {
+ #define TCG_TARGET_HAS_rot_i64 1
+ #define TCG_TARGET_HAS_deposit_i32 0
+ #define TCG_TARGET_HAS_deposit_i64 0
++#define TCG_TARGET_HAS_movcond_i32 0
++#define TCG_TARGET_HAS_movcond_i64 0
+
+ /* optional instructions automatically implemented */
+ #define TCG_TARGET_HAS_neg_i32 0 /* sub r1, r0, r3 */
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index 1c61931..9c68a32 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -90,6 +90,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_eqv_i32 0
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 0
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ /* optional instructions automatically implemented */
+ #define TCG_TARGET_HAS_neg_i32 0 /* sub rd, zero, rt */
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
+index 2f37fd2..177eea1 100644
+--- a/tcg/ppc/tcg-target.h
++++ b/tcg/ppc/tcg-target.h
+@@ -92,6 +92,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 1
+ #define TCG_TARGET_HAS_nor_i32 1
+ #define TCG_TARGET_HAS_deposit_i32 1
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #define TCG_AREG0 TCG_REG_R27
+
+diff --git a/tcg/ppc64/tcg-target.h b/tcg/ppc64/tcg-target.h
+index 97eec08..57569e8 100644
+--- a/tcg/ppc64/tcg-target.h
++++ b/tcg/ppc64/tcg-target.h
+@@ -83,6 +83,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 0
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #define TCG_TARGET_HAS_div_i64 1
+ #define TCG_TARGET_HAS_rot_i64 0
+@@ -103,6 +104,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 0
++#define TCG_TARGET_HAS_movcond_i64 0
+
+ #define TCG_AREG0 TCG_REG_R27
+
+diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
+index 4f7dfab..ed55c33 100644
+--- a/tcg/s390/tcg-target.h
++++ b/tcg/s390/tcg-target.h
+@@ -63,6 +63,7 @@ typedef enum TCGReg {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 0
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_div2_i64 1
+@@ -84,6 +85,7 @@ typedef enum TCGReg {
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 0
++#define TCG_TARGET_HAS_movcond_i64 0
+ #endif
+
+ #define TCG_TARGET_HAS_GUEST_BASE
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index 0ea87be..d762574 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -102,6 +102,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 0
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_div_i64 1
+@@ -123,6 +124,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 0
++#define TCG_TARGET_HAS_movcond_i64 0
+ #endif
+
+ #ifdef CONFIG_SOLARIS
+diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
+index 169d3b2..6d28f82 100644
+--- a/tcg/tcg-op.h
++++ b/tcg/tcg-op.h
+@@ -2118,6 +2118,44 @@ static inline void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1,
+ tcg_temp_free_i64(t1);
+ }
+
++static inline void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret,
++ TCGv_i32 c1, TCGv_i32 c2,
++ TCGv_i32 v1, TCGv_i32 v2)
++{
++ if (TCG_TARGET_HAS_movcond_i32) {
++ tcg_gen_op6i_i32(INDEX_op_movcond_i32, ret, c1, c2, v1, v2, cond);
++ } else {
++ TCGv_i32 t0 = tcg_temp_new_i32();
++ TCGv_i32 t1 = tcg_temp_new_i32();
++ tcg_gen_setcond_i32(cond, t0, c1, c2);
++ tcg_gen_neg_i32(t0, t0);
++ tcg_gen_and_i32(t1, v1, t0);
++ tcg_gen_andc_i32(ret, v2, t0);
++ tcg_gen_or_i32(ret, ret, t1);
++ tcg_temp_free_i32(t0);
++ tcg_temp_free_i32(t1);
++ }
++}
++
++static inline void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret,
++ TCGv_i64 c1, TCGv_i64 c2,
++ TCGv_i64 v1, TCGv_i64 v2)
++{
++ if (TCG_TARGET_HAS_movcond_i64) {
++ tcg_gen_op6i_i64(INDEX_op_movcond_i64, ret, c1, c2, v1, v2, cond);
++ } else {
++ TCGv_i64 t0 = tcg_temp_new_i64();
++ TCGv_i64 t1 = tcg_temp_new_i64();
++ tcg_gen_setcond_i64(cond, t0, c1, c2);
++ tcg_gen_neg_i64(t0, t0);
++ tcg_gen_and_i64(t1, v1, t0);
++ tcg_gen_andc_i64(ret, v2, t0);
++ tcg_gen_or_i64(ret, ret, t1);
++ tcg_temp_free_i64(t0);
++ tcg_temp_free_i64(t1);
++ }
++}
++
+ /***************************************/
+ /* QEMU specific operations. Their type depend on the QEMU CPU
+ type. */
+@@ -2434,6 +2472,7 @@ static inline void tcg_gen_qemu_st64(TCGv_i64 arg, TCGv addr, int mem_index)
+ #define tcg_gen_deposit_tl tcg_gen_deposit_i64
+ #define tcg_const_tl tcg_const_i64
+ #define tcg_const_local_tl tcg_const_local_i64
++#define tcg_gen_movcond_tl tcg_gen_movcond_i64
+ #else
+ #define tcg_gen_movi_tl tcg_gen_movi_i32
+ #define tcg_gen_mov_tl tcg_gen_mov_i32
+@@ -2505,6 +2544,7 @@ static inline void tcg_gen_qemu_st64(TCGv_i64 arg, TCGv addr, int mem_index)
+ #define tcg_gen_deposit_tl tcg_gen_deposit_i32
+ #define tcg_const_tl tcg_const_i32
+ #define tcg_const_local_tl tcg_const_local_i32
++#define tcg_gen_movcond_tl tcg_gen_movcond_i32
+ #endif
+
+ #if TCG_TARGET_REG_BITS == 32
+diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
+index d12e8d0..dbb0e39 100644
+--- a/tcg/tcg-opc.h
++++ b/tcg/tcg-opc.h
+@@ -51,6 +51,7 @@ DEF(br, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+ DEF(mov_i32, 1, 1, 0, 0)
+ DEF(movi_i32, 1, 0, 1, 0)
+ DEF(setcond_i32, 1, 2, 1, 0)
++DEF(movcond_i32, 1, 4, 1, IMPL(TCG_TARGET_HAS_movcond_i32))
+ /* load/store */
+ DEF(ld8u_i32, 1, 1, 1, 0)
+ DEF(ld8s_i32, 1, 1, 1, 0)
+@@ -107,6 +108,7 @@ DEF(nor_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_nor_i32))
+ DEF(mov_i64, 1, 1, 0, IMPL64)
+ DEF(movi_i64, 1, 0, 1, IMPL64)
+ DEF(setcond_i64, 1, 2, 1, IMPL64)
++DEF(movcond_i64, 1, 4, 1, IMPL64 | IMPL(TCG_TARGET_HAS_movcond_i64))
+ /* load/store */
+ DEF(ld8u_i64, 1, 1, 1, IMPL64)
+ DEF(ld8s_i64, 1, 1, 1, IMPL64)
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index c002a88..24ce830 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -991,16 +991,15 @@ void tcg_dump_ops(TCGContext *s)
+ }
+ switch (c) {
+ case INDEX_op_brcond_i32:
+-#if TCG_TARGET_REG_BITS == 32
+- case INDEX_op_brcond2_i32:
+-#elif TCG_TARGET_REG_BITS == 64
+- case INDEX_op_brcond_i64:
+-#endif
+ case INDEX_op_setcond_i32:
++ case INDEX_op_movcond_i32:
+ #if TCG_TARGET_REG_BITS == 32
++ case INDEX_op_brcond2_i32:
+ case INDEX_op_setcond2_i32:
+-#elif TCG_TARGET_REG_BITS == 64
++#else
++ case INDEX_op_brcond_i64:
+ case INDEX_op_setcond_i64:
++ case INDEX_op_movcond_i64:
+ #endif
+ if (args[k] < ARRAY_SIZE(cond_name) && cond_name[args[k]]) {
+ qemu_log(",%s", cond_name[args[k++]]);
+diff --git a/tcg/tcg.h b/tcg/tcg.h
+index 8fbbc81..f454107 100644
+--- a/tcg/tcg.h
++++ b/tcg/tcg.h
+@@ -79,6 +79,7 @@ typedef uint64_t TCGRegSet;
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 0
++#define TCG_TARGET_HAS_movcond_i64 0
+ #endif
+
+ #ifndef TCG_TARGET_deposit_i32_valid
+diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+index 30a0f21..6d89495 100644
+--- a/tcg/tci/tcg-target.h
++++ b/tcg/tci/tcg-target.h
+@@ -75,6 +75,7 @@
+ #define TCG_TARGET_HAS_not_i32 1
+ #define TCG_TARGET_HAS_orc_i32 0
+ #define TCG_TARGET_HAS_rot_i32 1
++#define TCG_TARGET_HAS_movcond_i32 0
+
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_bswap16_i64 1
+@@ -98,6 +99,7 @@
+ #define TCG_TARGET_HAS_not_i64 1
+ #define TCG_TARGET_HAS_orc_i64 0
+ #define TCG_TARGET_HAS_rot_i64 1
++#define TCG_TARGET_HAS_movcond_i64 0
+ #endif /* TCG_TARGET_REG_BITS == 64 */
+
+ /* Offset to user memory in user mode. */
+--
+1.7.12.1
+
--- /dev/null
+From 4bf321d3f494134fe2e03c9cbc042e28ec3a1045 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:13:35 -0700
+Subject: [PATCH] target-alpha: Use movcond
+
+For proper cmov insns, as well as the non-goto-tb case
+of conditional branch.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-alpha/translate.c | 102 ++++++++++++++++++++++-------------------------
+ 1 file changed, 48 insertions(+), 54 deletions(-)
+
+diff --git a/target-alpha/translate.c b/target-alpha/translate.c
+index 12de6a3..4a9011a 100644
+--- a/target-alpha/translate.c
++++ b/target-alpha/translate.c
+@@ -426,27 +426,15 @@ static ExitStatus gen_bcond_internal(DisasContext *ctx, TCGCond cond,
+
+ return EXIT_GOTO_TB;
+ } else {
+- int lab_over = gen_new_label();
+-
+- /* ??? Consider using either
+- movi pc, next
+- addi tmp, pc, disp
+- movcond pc, cond, 0, tmp, pc
+- or
+- setcond tmp, cond, 0
+- movi pc, next
+- neg tmp, tmp
+- andi tmp, tmp, disp
+- add pc, pc, tmp
+- The current diamond subgraph surely isn't efficient. */
++ TCGv_i64 z = tcg_const_i64(0);
++ TCGv_i64 d = tcg_const_i64(dest);
++ TCGv_i64 p = tcg_const_i64(ctx->pc);
+
+- tcg_gen_brcondi_i64(cond, cmp, 0, lab_true);
+- tcg_gen_movi_i64(cpu_pc, ctx->pc);
+- tcg_gen_br(lab_over);
+- gen_set_label(lab_true);
+- tcg_gen_movi_i64(cpu_pc, dest);
+- gen_set_label(lab_over);
++ tcg_gen_movcond_i64(cond, cpu_pc, cmp, z, d, p);
+
++ tcg_temp_free_i64(z);
++ tcg_temp_free_i64(d);
++ tcg_temp_free_i64(p);
+ return EXIT_PC_UPDATED;
+ }
+ }
+@@ -521,61 +509,67 @@ static ExitStatus gen_fbcond(DisasContext *ctx, TCGCond cond, int ra,
+ static void gen_cmov(TCGCond cond, int ra, int rb, int rc,
+ int islit, uint8_t lit, int mask)
+ {
+- TCGCond inv_cond = tcg_invert_cond(cond);
+- int l1;
++ TCGv_i64 c1, z, v1;
+
+- if (unlikely(rc == 31))
++ if (unlikely(rc == 31)) {
+ return;
++ }
+
+- l1 = gen_new_label();
+-
+- if (ra != 31) {
+- if (mask) {
+- TCGv tmp = tcg_temp_new();
+- tcg_gen_andi_i64(tmp, cpu_ir[ra], 1);
+- tcg_gen_brcondi_i64(inv_cond, tmp, 0, l1);
+- tcg_temp_free(tmp);
+- } else
+- tcg_gen_brcondi_i64(inv_cond, cpu_ir[ra], 0, l1);
+- } else {
++ if (ra == 31) {
+ /* Very uncommon case - Do not bother to optimize. */
+- TCGv tmp = tcg_const_i64(0);
+- tcg_gen_brcondi_i64(inv_cond, tmp, 0, l1);
+- tcg_temp_free(tmp);
++ c1 = tcg_const_i64(0);
++ } else if (mask) {
++ c1 = tcg_const_i64(1);
++ tcg_gen_and_i64(c1, c1, cpu_ir[ra]);
++ } else {
++ c1 = cpu_ir[ra];
+ }
++ if (islit) {
++ v1 = tcg_const_i64(lit);
++ } else {
++ v1 = cpu_ir[rb];
++ }
++ z = tcg_const_i64(0);
+
+- if (islit)
+- tcg_gen_movi_i64(cpu_ir[rc], lit);
+- else
+- tcg_gen_mov_i64(cpu_ir[rc], cpu_ir[rb]);
+- gen_set_label(l1);
++ tcg_gen_movcond_i64(cond, cpu_ir[rc], c1, z, v1, cpu_ir[rc]);
++
++ tcg_temp_free_i64(z);
++ if (ra == 31 || mask) {
++ tcg_temp_free_i64(c1);
++ }
++ if (islit) {
++ tcg_temp_free_i64(v1);
++ }
+ }
+
+ static void gen_fcmov(TCGCond cond, int ra, int rb, int rc)
+ {
+- TCGv cmp_tmp;
+- int l1;
++ TCGv_i64 c1, z, v1;
+
+ if (unlikely(rc == 31)) {
+ return;
+ }
+
+- cmp_tmp = tcg_temp_new();
++ c1 = tcg_temp_new_i64();
+ if (unlikely(ra == 31)) {
+- tcg_gen_movi_i64(cmp_tmp, 0);
++ tcg_gen_movi_i64(c1, 0);
++ } else {
++ gen_fold_mzero(cond, c1, cpu_fir[ra]);
++ }
++ if (rb == 31) {
++ v1 = tcg_const_i64(0);
+ } else {
+- gen_fold_mzero(cond, cmp_tmp, cpu_fir[ra]);
++ v1 = cpu_fir[rb];
+ }
++ z = tcg_const_i64(0);
+
+- l1 = gen_new_label();
+- tcg_gen_brcondi_i64(tcg_invert_cond(cond), cmp_tmp, 0, l1);
+- tcg_temp_free(cmp_tmp);
++ tcg_gen_movcond_i64(cond, cpu_fir[rc], c1, z, v1, cpu_fir[rc]);
+
+- if (rb != 31)
+- tcg_gen_mov_i64(cpu_fir[rc], cpu_fir[rb]);
+- else
+- tcg_gen_movi_i64(cpu_fir[rc], 0);
+- gen_set_label(l1);
++ tcg_temp_free_i64(z);
++ tcg_temp_free_i64(c1);
++ if (rb == 31) {
++ tcg_temp_free_i64(v1);
++ }
+ }
+
+ #define QUAL_RM_N 0x080 /* Round mode nearest even */
+--
+1.7.12.1
+
--- /dev/null
+From 7a6273e2995b6c439441316467ab19bd6a48f03f Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:13:36 -0700
+Subject: [PATCH] tcg-i386: Implement movcond
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/i386/tcg-target.c | 29 +++++++++++++++++++++++++++++
+ tcg/i386/tcg-target.h | 7 ++++++-
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
+index 3017858..aa1fa9f 100644
+--- a/tcg/i386/tcg-target.c
++++ b/tcg/i386/tcg-target.c
+@@ -249,6 +249,7 @@ static inline int tcg_target_const_match(tcg_target_long val,
+ #define OPC_ADD_GvEv (OPC_ARITH_GvEv | (ARITH_ADD << 3))
+ #define OPC_BSWAP (0xc8 | P_EXT)
+ #define OPC_CALL_Jz (0xe8)
++#define OPC_CMOVCC (0x40 | P_EXT) /* ... plus condition code */
+ #define OPC_CMP_GvEv (OPC_ARITH_GvEv | (ARITH_CMP << 3))
+ #define OPC_DEC_r32 (0x48)
+ #define OPC_IMUL_GvEv (0xaf | P_EXT)
+@@ -936,6 +937,24 @@ static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
+ }
+ #endif
+
++static void tcg_out_movcond32(TCGContext *s, TCGCond cond, TCGArg dest,
++ TCGArg c1, TCGArg c2, int const_c2,
++ TCGArg v1)
++{
++ tcg_out_cmp(s, c1, c2, const_c2, 0);
++ tcg_out_modrm(s, OPC_CMOVCC | tcg_cond_to_jcc[cond], dest, v1);
++}
++
++#if TCG_TARGET_REG_BITS == 64
++static void tcg_out_movcond64(TCGContext *s, TCGCond cond, TCGArg dest,
++ TCGArg c1, TCGArg c2, int const_c2,
++ TCGArg v1)
++{
++ tcg_out_cmp(s, c1, c2, const_c2, P_REXW);
++ tcg_out_modrm(s, OPC_CMOVCC | tcg_cond_to_jcc[cond] | P_REXW, dest, v1);
++}
++#endif
++
+ static void tcg_out_branch(TCGContext *s, int call, tcg_target_long dest)
+ {
+ tcg_target_long disp = dest - (tcg_target_long)s->code_ptr - 5;
+@@ -1668,6 +1687,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_setcond32(s, args[3], args[0], args[1],
+ args[2], const_args[2]);
+ break;
++ case INDEX_op_movcond_i32:
++ tcg_out_movcond32(s, args[5], args[0], args[1],
++ args[2], const_args[2], args[3]);
++ break;
+
+ OP_32_64(bswap16):
+ tcg_out_rolw_8(s, args[0]);
+@@ -1796,6 +1819,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_setcond64(s, args[3], args[0], args[1],
+ args[2], const_args[2]);
+ break;
++ case INDEX_op_movcond_i64:
++ tcg_out_movcond64(s, args[5], args[0], args[1],
++ args[2], const_args[2], args[3]);
++ break;
+
+ case INDEX_op_bswap64_i64:
+ tcg_out_bswap64(s, args[0]);
+@@ -1880,6 +1907,7 @@ static const TCGTargetOpDef x86_op_defs[] = {
+ { INDEX_op_setcond_i32, { "q", "r", "ri" } },
+
+ { INDEX_op_deposit_i32, { "Q", "0", "Q" } },
++ { INDEX_op_movcond_i32, { "r", "r", "ri", "r", "0" } },
+
+ #if TCG_TARGET_REG_BITS == 32
+ { INDEX_op_mulu2_i32, { "a", "d", "a", "r" } },
+@@ -1934,6 +1962,7 @@ static const TCGTargetOpDef x86_op_defs[] = {
+ { INDEX_op_ext32u_i64, { "r", "r" } },
+
+ { INDEX_op_deposit_i64, { "Q", "0", "Q" } },
++ { INDEX_op_movcond_i64, { "r", "r", "re", "r", "0" } },
+ #endif
+
+ #if TCG_TARGET_REG_BITS == 64
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index 504f953..b356d76 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -86,7 +86,12 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+ #define TCG_TARGET_HAS_nor_i32 0
+ #define TCG_TARGET_HAS_deposit_i32 1
++#if defined(__x86_64__) || defined(__i686__)
++/* Use cmov only if the compiler is already doing so. */
++#define TCG_TARGET_HAS_movcond_i32 1
++#else
+ #define TCG_TARGET_HAS_movcond_i32 0
++#endif
+
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_div2_i64 1
+@@ -108,7 +113,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i64 0
+ #define TCG_TARGET_HAS_nor_i64 0
+ #define TCG_TARGET_HAS_deposit_i64 1
+-#define TCG_TARGET_HAS_movcond_i64 0
++#define TCG_TARGET_HAS_movcond_i64 1
+ #endif
+
+ #define TCG_TARGET_deposit_i32_valid(ofs, len) \
+--
+1.7.12.1
+
--- /dev/null
+From c489b380d3f827be91b5f8b80b88585fb4014fbb Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:13:37 -0700
+Subject: [PATCH] tcg: Optimize movcond for constant comparisons
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 9da333c..26038a6 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -394,6 +394,14 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args[3] = tcg_swap_cond(args[3]);
+ }
+ break;
++ CASE_OP_32_64(movcond):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[2]].state != TCG_TEMP_CONST) {
++ tmp = args[1];
++ args[1] = args[2];
++ args[2] = tmp;
++ args[5] = tcg_swap_cond(args[5]);
++ }
+ default:
+ break;
+ }
+@@ -614,6 +622,38 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ }
+ args += 4;
+ break;
++ CASE_OP_32_64(movcond):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[2]].state == TCG_TEMP_CONST) {
++ tmp = do_constant_folding_cond(op, temps[args[1]].val,
++ temps[args[2]].val, args[5]);
++ if (args[0] == args[4-tmp]
++ || (temps[args[4-tmp]].state == TCG_TEMP_COPY
++ && temps[args[4-tmp]].val == args[0])) {
++ gen_opc_buf[op_index] = INDEX_op_nop;
++ } else if (temps[args[4-tmp]].state == TCG_TEMP_CONST) {
++ gen_opc_buf[op_index] = op_to_movi(op);
++ tcg_opt_gen_movi(gen_args, args[0], temps[args[4-tmp]].val,
++ nb_temps, nb_globals);
++ gen_args += 2;
++ } else {
++ gen_opc_buf[op_index] = op_to_mov(op);
++ tcg_opt_gen_mov(gen_args, args[0], args[4-tmp],
++ nb_temps, nb_globals);
++ gen_args += 2;
++ }
++ } else {
++ reset_temp(args[0], nb_temps, nb_globals);
++ gen_args[0] = args[0];
++ gen_args[1] = args[1];
++ gen_args[2] = args[2];
++ gen_args[3] = args[3];
++ gen_args[4] = args[4];
++ gen_args[5] = args[5];
++ gen_args += 6;
++ }
++ args += 6;
++ break;
+ case INDEX_op_call:
+ nb_call_args = (args[0] >> 16) + (args[0] & 0xffff);
+ if (!(args[nb_call_args + 1] & (TCG_CALL_CONST | TCG_CALL_PURE))) {
+--
+1.7.12.1
+
--- /dev/null
+From af2bf6bcc6614622c87d28e9d763b57408c17500 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:13:38 -0700
+Subject: [PATCH] tcg: Optimize two-address commutative operations
+
+While swapping constants to the second operand, swap
+sources matching destinations to the first operand.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 26038a6..1be7631 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -334,6 +334,8 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ const TCGOpDef *def;
+ TCGArg *gen_args;
+ TCGArg tmp;
++ TCGCond cond;
++
+ /* Array VALS has an element for each temp.
+ If this temp holds a constant then its value is kept in VALS' element.
+ If this temp is a copy of other ones then this equivalence class'
+@@ -395,13 +397,24 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ }
+ break;
+ CASE_OP_32_64(movcond):
++ cond = args[5];
+ if (temps[args[1]].state == TCG_TEMP_CONST
+ && temps[args[2]].state != TCG_TEMP_CONST) {
+ tmp = args[1];
+ args[1] = args[2];
+ args[2] = tmp;
+- args[5] = tcg_swap_cond(args[5]);
++ cond = tcg_swap_cond(cond);
++ }
++ /* For movcond, we canonicalize the "false" input reg to match
++ the destination reg so that the tcg backend can implement
++ a "move if true" operation. */
++ if (args[0] == args[3]) {
++ tmp = args[3];
++ args[3] = args[4];
++ args[4] = tmp;
++ cond = tcg_invert_cond(cond);
+ }
++ args[5] = cond;
+ default:
+ break;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From b6407e30c30268cdeddec6e2b115f419647cc07f Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Sun, 16 Sep 2012 13:12:21 +0200
+Subject: [PATCH] gdbstub/sh4: fix build with USE_SOFTFLOAT_STRUCT_TYPES
+
+We have to use different type to access float values when
+USE_SOFTFLOAT_STRUCT_TYPES is defined.
+
+Rework SH4 version of cpu_gdb_{read,write}_register() using
+a single case, and fixing the coding style. Use ldll_p() and
+stfl_p() to access float values.
+
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ gdbstub.c | 144 +++++++++++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 90 insertions(+), 54 deletions(-)
+
+diff --git a/gdbstub.c b/gdbstub.c
+index 5d37dd9..a91709f 100644
+--- a/gdbstub.c
++++ b/gdbstub.c
+@@ -1226,33 +1226,48 @@ static int cpu_gdb_write_register(CPUOpenRISCState *env,
+
+ static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+ {
+- if (n < 8) {
++ switch (n) {
++ case 0 ... 7:
+ if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
+ GET_REGL(env->gregs[n + 16]);
+ } else {
+ GET_REGL(env->gregs[n]);
+ }
+- } else if (n < 16) {
++ case 8 ... 15:
+ GET_REGL(env->gregs[n]);
+- } else if (n >= 25 && n < 41) {
+- GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
+- } else if (n >= 43 && n < 51) {
+- GET_REGL(env->gregs[n - 43]);
+- } else if (n >= 51 && n < 59) {
+- GET_REGL(env->gregs[n - (51 - 16)]);
+- }
+- switch (n) {
+- case 16: GET_REGL(env->pc);
+- case 17: GET_REGL(env->pr);
+- case 18: GET_REGL(env->gbr);
+- case 19: GET_REGL(env->vbr);
+- case 20: GET_REGL(env->mach);
+- case 21: GET_REGL(env->macl);
+- case 22: GET_REGL(env->sr);
+- case 23: GET_REGL(env->fpul);
+- case 24: GET_REGL(env->fpscr);
+- case 41: GET_REGL(env->ssr);
+- case 42: GET_REGL(env->spc);
++ case 16:
++ GET_REGL(env->pc);
++ case 17:
++ GET_REGL(env->pr);
++ case 18:
++ GET_REGL(env->gbr);
++ case 19:
++ GET_REGL(env->vbr);
++ case 20:
++ GET_REGL(env->mach);
++ case 21:
++ GET_REGL(env->macl);
++ case 22:
++ GET_REGL(env->sr);
++ case 23:
++ GET_REGL(env->fpul);
++ case 24:
++ GET_REGL(env->fpscr);
++ case 25 ... 40:
++ if (env->fpscr & FPSCR_FR) {
++ stfl_p(mem_buf, env->fregs[n - 9]);
++ } else {
++ stfl_p(mem_buf, env->fregs[n - 25]);
++ }
++ return 4;
++ case 41:
++ GET_REGL(env->ssr);
++ case 42:
++ GET_REGL(env->spc);
++ case 43 ... 50:
++ GET_REGL(env->gregs[n - 43]);
++ case 51 ... 58:
++ GET_REGL(env->gregs[n - (51 - 16)]);
+ }
+
+ return 0;
+@@ -1260,42 +1275,63 @@ static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+
+ static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+ {
+- uint32_t tmp;
+-
+- tmp = ldl_p(mem_buf);
+-
+- if (n < 8) {
++ switch (n) {
++ case 0 ... 7:
+ if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
+- env->gregs[n + 16] = tmp;
++ env->gregs[n + 16] = ldl_p(mem_buf);
+ } else {
+- env->gregs[n] = tmp;
++ env->gregs[n] = ldl_p(mem_buf);
+ }
+- return 4;
+- } else if (n < 16) {
+- env->gregs[n] = tmp;
+- return 4;
+- } else if (n >= 25 && n < 41) {
+- env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
+- return 4;
+- } else if (n >= 43 && n < 51) {
+- env->gregs[n - 43] = tmp;
+- return 4;
+- } else if (n >= 51 && n < 59) {
+- env->gregs[n - (51 - 16)] = tmp;
+- return 4;
+- }
+- switch (n) {
+- case 16: env->pc = tmp; break;
+- case 17: env->pr = tmp; break;
+- case 18: env->gbr = tmp; break;
+- case 19: env->vbr = tmp; break;
+- case 20: env->mach = tmp; break;
+- case 21: env->macl = tmp; break;
+- case 22: env->sr = tmp; break;
+- case 23: env->fpul = tmp; break;
+- case 24: env->fpscr = tmp; break;
+- case 41: env->ssr = tmp; break;
+- case 42: env->spc = tmp; break;
++ break;
++ case 8 ... 15:
++ env->gregs[n] = ldl_p(mem_buf);
++ break;
++ case 16:
++ env->pc = ldl_p(mem_buf);
++ break;
++ case 17:
++ env->pr = ldl_p(mem_buf);
++ break;
++ case 18:
++ env->gbr = ldl_p(mem_buf);
++ break;
++ case 19:
++ env->vbr = ldl_p(mem_buf);
++ break;
++ case 20:
++ env->mach = ldl_p(mem_buf);
++ break;
++ case 21:
++ env->macl = ldl_p(mem_buf);
++ break;
++ case 22:
++ env->sr = ldl_p(mem_buf);
++ break;
++ case 23:
++ env->fpul = ldl_p(mem_buf);
++ break;
++ case 24:
++ env->fpscr = ldl_p(mem_buf);
++ break;
++ case 25 ... 40:
++ if (env->fpscr & FPSCR_FR) {
++ env->fregs[n - 9] = ldfl_p(mem_buf);
++ } else {
++ env->fregs[n - 25] = ldfl_p(mem_buf);
++ }
++ break;
++ case 41:
++ env->ssr = ldl_p(mem_buf);
++ break;
++ case 42:
++ env->spc = ldl_p(mem_buf);
++ break;
++ case 43 ... 50:
++ env->gregs[n - 43] = ldl_p(mem_buf);
++ break;
++ case 51 ... 58:
++ env->gregs[n - (51 - 16)] = ldl_p(mem_buf);
++ break;
+ default: return 0;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 03ddebf0c48dc78070c846b7cfdc2665fe7df854 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Mon, 17 Sep 2012 08:28:52 -0700
+Subject: [PATCH] tcg: Fix !USE_DIRECT_JUMP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 6375e09e changed the type of TranslationBlock.tb_next,
+but failed to change the type of TCGContext.tb_next.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Reviewed-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/tcg.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tcg/tcg.h b/tcg/tcg.h
+index f454107..609ed86 100644
+--- a/tcg/tcg.h
++++ b/tcg/tcg.h
+@@ -344,7 +344,7 @@ struct TCGContext {
+
+ /* goto_tb support */
+ uint8_t *code_buf;
+- unsigned long *tb_next;
++ uintptr_t *tb_next;
+ uint16_t *tb_next_offset;
+ uint16_t *tb_jmp_offset; /* != NULL if USE_DIRECT_JUMP */
+
+--
+1.7.12.1
+
--- /dev/null
+From 3616400bc0065f7114172ad7801d9d88332ef981 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Tue, 18 Sep 2012 19:59:47 -0700
+Subject: [PATCH] tcg-hppa: Fix brcond2 and setcond2
+
+Neither of these functions were performing double-word
+compares properly.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/hppa/tcg-target.c | 51 ++++++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 42 insertions(+), 9 deletions(-)
+
+diff --git a/tcg/hppa/tcg-target.c b/tcg/hppa/tcg-target.c
+index 8b81b70..a76569d 100644
+--- a/tcg/hppa/tcg-target.c
++++ b/tcg/hppa/tcg-target.c
+@@ -820,19 +820,34 @@ static void tcg_out_comclr(TCGContext *s, int cond, TCGArg ret,
+ tcg_out32(s, op);
+ }
+
++static TCGCond const tcg_high_cond[] = {
++ [TCG_COND_EQ] = TCG_COND_EQ,
++ [TCG_COND_NE] = TCG_COND_NE,
++ [TCG_COND_LT] = TCG_COND_LT,
++ [TCG_COND_LE] = TCG_COND_LT,
++ [TCG_COND_GT] = TCG_COND_GT,
++ [TCG_COND_GE] = TCG_COND_GT,
++ [TCG_COND_LTU] = TCG_COND_LTU,
++ [TCG_COND_LEU] = TCG_COND_LTU,
++ [TCG_COND_GTU] = TCG_COND_GTU,
++ [TCG_COND_GEU] = TCG_COND_GTU
++};
++
+ static void tcg_out_brcond2(TCGContext *s, int cond, TCGArg al, TCGArg ah,
+ TCGArg bl, int blconst, TCGArg bh, int bhconst,
+ int label_index)
+ {
+ switch (cond) {
+ case TCG_COND_EQ:
++ tcg_out_comclr(s, TCG_COND_NE, TCG_REG_R0, al, bl, blconst);
++ tcg_out_brcond(s, TCG_COND_EQ, ah, bh, bhconst, label_index);
++ break;
+ case TCG_COND_NE:
+- tcg_out_comclr(s, tcg_invert_cond(cond), TCG_REG_R0, al, bl, blconst);
+- tcg_out_brcond(s, cond, ah, bh, bhconst, label_index);
++ tcg_out_brcond(s, TCG_COND_NE, al, bl, bhconst, label_index);
++ tcg_out_brcond(s, TCG_COND_NE, ah, bh, bhconst, label_index);
+ break;
+-
+ default:
+- tcg_out_brcond(s, cond, ah, bh, bhconst, label_index);
++ tcg_out_brcond(s, tcg_high_cond[cond], ah, bh, bhconst, label_index);
+ tcg_out_comclr(s, TCG_COND_NE, TCG_REG_R0, ah, bh, bhconst);
+ tcg_out_brcond(s, tcg_unsigned_cond(cond),
+ al, bl, blconst, label_index);
+@@ -853,9 +868,8 @@ static void tcg_out_setcond2(TCGContext *s, int cond, TCGArg ret,
+ {
+ int scratch = TCG_REG_R20;
+
+- if (ret != al && ret != ah
+- && (blconst || ret != bl)
+- && (bhconst || ret != bh)) {
++ /* Note that the low parts are fully consumed before scratch is set. */
++ if (ret != ah && (bhconst || ret != bh)) {
+ scratch = ret;
+ }
+
+@@ -867,13 +881,32 @@ static void tcg_out_setcond2(TCGContext *s, int cond, TCGArg ret,
+ tcg_out_movi(s, TCG_TYPE_I32, scratch, cond == TCG_COND_NE);
+ break;
+
+- default:
++ case TCG_COND_GE:
++ case TCG_COND_GEU:
++ case TCG_COND_LT:
++ case TCG_COND_LTU:
++ /* Optimize compares with low part zero. */
++ if (bl == 0) {
++ tcg_out_setcond(s, cond, ret, ah, bh, bhconst);
++ return;
++ }
++ /* FALLTHRU */
++
++ case TCG_COND_LE:
++ case TCG_COND_LEU:
++ case TCG_COND_GT:
++ case TCG_COND_GTU:
++ /* <= : ah < bh | (ah == bh && al <= bl) */
+ tcg_out_setcond(s, tcg_unsigned_cond(cond), scratch, al, bl, blconst);
+ tcg_out_comclr(s, TCG_COND_EQ, TCG_REG_R0, ah, bh, bhconst);
+ tcg_out_movi(s, TCG_TYPE_I32, scratch, 0);
+- tcg_out_comclr(s, cond, TCG_REG_R0, ah, bh, bhconst);
++ tcg_out_comclr(s, tcg_invert_cond(tcg_high_cond[cond]),
++ TCG_REG_R0, ah, bh, bhconst);
+ tcg_out_movi(s, TCG_TYPE_I32, scratch, 1);
+ break;
++
++ default:
++ tcg_abort();
+ }
+
+ tcg_out_mov(s, TCG_TYPE_I32, ret, scratch);
+--
+1.7.12.1
+
--- /dev/null
+From c13ecfea174994d3f7f7d392f0faaed6d40efd9e Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Tue, 18 Sep 2012 19:59:48 -0700
+Subject: [PATCH] tcg-hppa: Fix broken load/store helpers
+
+The CONFIG_TCG_PASS_AREG0 code for calling ld/st helpers
+was not respecting the ABI requirement for 64-bit values
+being aligned in registers.
+
+Mirror the ARM port in use of helper functions to marshal
+arguments into the correct registers.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/hppa/tcg-target.c | 136 +++++++++++++++++++++++++++-----------------------
+ 1 file changed, 74 insertions(+), 62 deletions(-)
+
+diff --git a/tcg/hppa/tcg-target.c b/tcg/hppa/tcg-target.c
+index a76569d..5385d45 100644
+--- a/tcg/hppa/tcg-target.c
++++ b/tcg/hppa/tcg-target.c
+@@ -976,10 +976,11 @@ static int tcg_out_tlb_read(TCGContext *s, int r0, int r1, int addrlo,
+ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R20, r1, offset);
+ }
+
+- /* Compute the value that ought to appear in the TLB for a hit, namely, the page
+- of the address. We include the low N bits of the address to catch unaligned
+- accesses and force them onto the slow path. Do this computation after having
+- issued the load from the TLB slot to give the load time to complete. */
++ /* Compute the value that ought to appear in the TLB for a hit, namely,
++ the page of the address. We include the low N bits of the address
++ to catch unaligned accesses and force them onto the slow path. Do
++ this computation after having issued the load from the TLB slot to
++ give the load time to complete. */
+ tcg_out_andi(s, r0, addrlo, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
+
+ /* If not equal, jump to lab_miss. */
+@@ -992,6 +993,36 @@ static int tcg_out_tlb_read(TCGContext *s, int r0, int r1, int addrlo,
+
+ return ret;
+ }
++
++static int tcg_out_arg_reg32(TCGContext *s, int argno, TCGArg v, bool vconst)
++{
++ if (argno < 4) {
++ if (vconst) {
++ tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[argno], v);
++ } else {
++ tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[argno], v);
++ }
++ } else {
++ if (vconst && v != 0) {
++ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R20, v);
++ v = TCG_REG_R20;
++ }
++ tcg_out_st(s, TCG_TYPE_I32, v, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - ((argno - 3) * 4));
++ }
++ return argno + 1;
++}
++
++static int tcg_out_arg_reg64(TCGContext *s, int argno, TCGArg vl, TCGArg vh)
++{
++ /* 64-bit arguments must go in even reg pairs and stack slots. */
++ if (argno & 1) {
++ argno++;
++ }
++ argno = tcg_out_arg_reg32(s, argno, vl, false);
++ argno = tcg_out_arg_reg32(s, argno, vh, false);
++ return argno;
++}
+ #endif
+
+ static void tcg_out_qemu_ld_direct(TCGContext *s, int datalo_reg, int datahi_reg,
+@@ -1072,39 +1103,36 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ /* Note that addrhi_reg is only used for 64-bit guests. */
+ int addrhi_reg = (TARGET_LONG_BITS == 64 ? *args++ : TCG_REG_R0);
+ int mem_index = *args;
+- int lab1, lab2, argreg, offset;
++ int lab1, lab2, argno, offset;
+
+ lab1 = gen_new_label();
+ lab2 = gen_new_label();
+
+ offset = offsetof(CPUArchState, tlb_table[mem_index][0].addr_read);
+- offset = tcg_out_tlb_read(s, TCG_REG_R26, TCG_REG_R25, addrlo_reg, addrhi_reg,
+- opc & 3, lab1, offset);
++ offset = tcg_out_tlb_read(s, TCG_REG_R26, TCG_REG_R25, addrlo_reg,
++ addrhi_reg, opc & 3, lab1, offset);
+
+ /* TLB Hit. */
+- tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R20, (offset ? TCG_REG_R1 : TCG_REG_R25),
++ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R20,
++ (offset ? TCG_REG_R1 : TCG_REG_R25),
+ offsetof(CPUArchState, tlb_table[mem_index][0].addend) - offset);
+- tcg_out_qemu_ld_direct(s, datalo_reg, datahi_reg, addrlo_reg, TCG_REG_R20, opc);
++ tcg_out_qemu_ld_direct(s, datalo_reg, datahi_reg, addrlo_reg,
++ TCG_REG_R20, opc);
+ tcg_out_branch(s, lab2, 1);
+
+ /* TLB Miss. */
+ /* label1: */
+ tcg_out_label(s, lab1, s->code_ptr);
+
+- argreg = TCG_REG_R26;
+- tcg_out_mov(s, TCG_TYPE_I32, argreg--, addrlo_reg);
++ argno = 0;
++ argno = tcg_out_arg_reg32(s, argno, TCG_AREG0, false);
+ if (TARGET_LONG_BITS == 64) {
+- tcg_out_mov(s, TCG_TYPE_I32, argreg--, addrhi_reg);
++ argno = tcg_out_arg_reg64(s, argno, addrlo_reg, addrhi_reg);
++ } else {
++ argno = tcg_out_arg_reg32(s, argno, addrlo_reg, false);
+ }
+- tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
+-
+- /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[2],
+- tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
+- tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+- TCG_AREG0);
++ argno = tcg_out_arg_reg32(s, argno, mem_index, true);
++
+ tcg_out_call(s, qemu_ld_helpers[opc & 3]);
+
+ switch (opc) {
+@@ -1140,8 +1168,8 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+ #endif
+ }
+
+-static void tcg_out_qemu_st_direct(TCGContext *s, int datalo_reg, int datahi_reg,
+- int addr_reg, int opc)
++static void tcg_out_qemu_st_direct(TCGContext *s, int datalo_reg,
++ int datahi_reg, int addr_reg, int opc)
+ {
+ #ifdef TARGET_WORDS_BIGENDIAN
+ const int bswap = 0;
+@@ -1194,17 +1222,18 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ /* Note that addrhi_reg is only used for 64-bit guests. */
+ int addrhi_reg = (TARGET_LONG_BITS == 64 ? *args++ : TCG_REG_R0);
+ int mem_index = *args;
+- int lab1, lab2, argreg, offset;
++ int lab1, lab2, argno, next, offset;
+
+ lab1 = gen_new_label();
+ lab2 = gen_new_label();
+
+ offset = offsetof(CPUArchState, tlb_table[mem_index][0].addr_write);
+- offset = tcg_out_tlb_read(s, TCG_REG_R26, TCG_REG_R25, addrlo_reg, addrhi_reg,
+- opc, lab1, offset);
++ offset = tcg_out_tlb_read(s, TCG_REG_R26, TCG_REG_R25, addrlo_reg,
++ addrhi_reg, opc, lab1, offset);
+
+ /* TLB Hit. */
+- tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R20, (offset ? TCG_REG_R1 : TCG_REG_R25),
++ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R20,
++ (offset ? TCG_REG_R1 : TCG_REG_R25),
+ offsetof(CPUArchState, tlb_table[mem_index][0].addend) - offset);
+
+ /* There are no indexed stores, so we must do this addition explitly.
+@@ -1217,63 +1246,46 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+ /* label1: */
+ tcg_out_label(s, lab1, s->code_ptr);
+
+- argreg = TCG_REG_R26;
+- tcg_out_mov(s, TCG_TYPE_I32, argreg--, addrlo_reg);
++ argno = 0;
++ argno = tcg_out_arg_reg32(s, argno, TCG_AREG0, false);
+ if (TARGET_LONG_BITS == 64) {
+- tcg_out_mov(s, TCG_TYPE_I32, argreg--, addrhi_reg);
++ argno = tcg_out_arg_reg64(s, argno, addrlo_reg, addrhi_reg);
++ } else {
++ argno = tcg_out_arg_reg32(s, argno, addrlo_reg, false);
+ }
+
++ next = (argno < 4 ? tcg_target_call_iarg_regs[argno] : TCG_REG_R20);
+ switch(opc) {
+ case 0:
+- tcg_out_andi(s, argreg--, datalo_reg, 0xff);
+- tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
++ tcg_out_andi(s, next, datalo_reg, 0xff);
++ argno = tcg_out_arg_reg32(s, argno, next, false);
+ break;
+ case 1:
+- tcg_out_andi(s, argreg--, datalo_reg, 0xffff);
+- tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
++ tcg_out_andi(s, next, datalo_reg, 0xffff);
++ argno = tcg_out_arg_reg32(s, argno, next, false);
+ break;
+ case 2:
+- tcg_out_mov(s, TCG_TYPE_I32, argreg--, datalo_reg);
+- tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
++ argno = tcg_out_arg_reg32(s, argno, datalo_reg, false);
+ break;
+ case 3:
+- /* Because of the alignment required by the 64-bit data argument,
+- we will always use R23/R24. Also, we will always run out of
+- argument registers for storing mem_index, so that will have
+- to go on the stack. */
+- if (mem_index == 0) {
+- argreg = TCG_REG_R0;
+- } else {
+- argreg = TCG_REG_R20;
+- tcg_out_movi(s, TCG_TYPE_I32, argreg, mem_index);
+- }
+- tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R23, datahi_reg);
+- tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R24, datalo_reg);
+- tcg_out_st(s, TCG_TYPE_I32, argreg, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - 4);
++ argno = tcg_out_arg_reg64(s, argno, datalo_reg, datahi_reg);
+ break;
+ default:
+ tcg_abort();
+ }
++ argno = tcg_out_arg_reg32(s, argno, mem_index, true);
+
+- /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+- tcg_target_call_iarg_regs[2]);
+- tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+- tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
+- tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+- TCG_AREG0);
+ tcg_out_call(s, qemu_st_helpers[opc]);
+
+ /* label2: */
+ tcg_out_label(s, lab2, s->code_ptr);
+ #else
+- /* There are no indexed stores, so if GUEST_BASE is set we must do the add
+- explicitly. Careful to avoid R20, which is used for the bswaps to follow. */
++ /* There are no indexed stores, so if GUEST_BASE is set we must do
++ the add explicitly. Careful to avoid R20, which is used for the
++ bswaps to follow. */
+ if (GUEST_BASE != 0) {
+- tcg_out_arith(s, TCG_REG_R31, addrlo_reg, TCG_GUEST_BASE_REG, INSN_ADDL);
++ tcg_out_arith(s, TCG_REG_R31, addrlo_reg,
++ TCG_GUEST_BASE_REG, INSN_ADDL);
+ addrlo_reg = TCG_REG_R31;
+ }
+ tcg_out_qemu_st_direct(s, datalo_reg, datahi_reg, addrlo_reg, opc);
+--
+1.7.12.1
+
--- /dev/null
+From 061d22ad76512e8ec10af89eda1dcc7c185360d2 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:25 +0200
+Subject: [PATCH] tcg-mips: fix wrong usage of 'Z' constraint
+
+The 'Z' constraint has been introduced to map the zero register. However
+when the op also accept a constant, there is no point to accept the zero
+register in addition.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 74db83d..9293745 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -1453,24 +1453,24 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_st16_i32, { "rZ", "r" } },
+ { INDEX_op_st_i32, { "rZ", "r" } },
+
+- { INDEX_op_add_i32, { "r", "rZ", "rJZ" } },
++ { INDEX_op_add_i32, { "r", "rZ", "rJ" } },
+ { INDEX_op_mul_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_mulu2_i32, { "r", "r", "rZ", "rZ" } },
+ { INDEX_op_div_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_divu_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_rem_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_remu_i32, { "r", "rZ", "rZ" } },
+- { INDEX_op_sub_i32, { "r", "rZ", "rJZ" } },
++ { INDEX_op_sub_i32, { "r", "rZ", "rJ" } },
+
+- { INDEX_op_and_i32, { "r", "rZ", "rIZ" } },
++ { INDEX_op_and_i32, { "r", "rZ", "rI" } },
+ { INDEX_op_nor_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_not_i32, { "r", "rZ" } },
+ { INDEX_op_or_i32, { "r", "rZ", "rIZ" } },
+ { INDEX_op_xor_i32, { "r", "rZ", "rIZ" } },
+
+- { INDEX_op_shl_i32, { "r", "rZ", "riZ" } },
+- { INDEX_op_shr_i32, { "r", "rZ", "riZ" } },
+- { INDEX_op_sar_i32, { "r", "rZ", "riZ" } },
++ { INDEX_op_shl_i32, { "r", "rZ", "ri" } },
++ { INDEX_op_shr_i32, { "r", "rZ", "ri" } },
++ { INDEX_op_sar_i32, { "r", "rZ", "ri" } },
+
+ { INDEX_op_ext8s_i32, { "r", "rZ" } },
+ { INDEX_op_ext16s_i32, { "r", "rZ" } },
+@@ -1479,8 +1479,8 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_setcond_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_setcond2_i32, { "r", "rZ", "rZ", "rZ", "rZ" } },
+
+- { INDEX_op_add2_i32, { "r", "r", "rZ", "rZ", "rJZ", "rJZ" } },
+- { INDEX_op_sub2_i32, { "r", "r", "rZ", "rZ", "rJZ", "rJZ" } },
++ { INDEX_op_add2_i32, { "r", "r", "rZ", "rZ", "rJ", "rJ" } },
++ { INDEX_op_sub2_i32, { "r", "r", "rZ", "rZ", "rJ", "rJ" } },
+ { INDEX_op_brcond2_i32, { "rZ", "rZ", "rZ", "rZ" } },
+
+ #if TARGET_LONG_BITS == 32
+--
+1.7.12.1
+
--- /dev/null
+From e63a3c6c70c9933320c6d8b23c3ea4cf4724d316 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:25 +0200
+Subject: [PATCH] tcg/mips: kill warnings in user mode
+
+Recent versions of GCC emit warnings when compiling user mode targets.
+Kill them by reordering a bit the #ifdef.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 84 ++++++++++++++++++++++++++-------------------------
+ 1 file changed, 43 insertions(+), 41 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 9293745..a09c0d6 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -842,18 +842,16 @@ static const void * const qemu_st_helpers[4] = {
+ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ int opc)
+ {
+- int addr_regl, addr_meml;
+- int data_regl, data_regh, data_reg1, data_reg2;
+- int mem_index, s_bits;
++ int addr_regl, data_regl, data_regh, data_reg1, data_reg2;
+ #if defined(CONFIG_SOFTMMU)
+ void *label1_ptr, *label2_ptr;
+ int arg_num;
+-#endif
+-#if TARGET_LONG_BITS == 64
+-# if defined(CONFIG_SOFTMMU)
++ int mem_index, s_bits;
++ int addr_meml;
++# if TARGET_LONG_BITS == 64
+ uint8_t *label3_ptr;
+-# endif
+ int addr_regh, addr_memh;
++# endif
+ #endif
+ data_regl = *args++;
+ if (opc == 3)
+@@ -861,11 +859,22 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ else
+ data_regh = 0;
+ addr_regl = *args++;
+-#if TARGET_LONG_BITS == 64
++#if defined(CONFIG_SOFTMMU)
++# if TARGET_LONG_BITS == 64
+ addr_regh = *args++;
+-#endif
++# if defined(TCG_TARGET_WORDS_BIGENDIAN)
++ addr_memh = 0;
++ addr_meml = 4;
++# else
++ addr_memh = 4;
++ addr_meml = 0;
++# endif
++# else
++ addr_meml = 0;
++# endif
+ mem_index = *args;
+ s_bits = opc & 3;
++#endif
+
+ if (opc == 3) {
+ #if defined(TCG_TARGET_WORDS_BIGENDIAN)
+@@ -879,18 +888,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ data_reg1 = data_regl;
+ data_reg2 = 0;
+ }
+-#if TARGET_LONG_BITS == 64
+-# if defined(TCG_TARGET_WORDS_BIGENDIAN)
+- addr_memh = 0;
+- addr_meml = 4;
+-# else
+- addr_memh = 4;
+- addr_meml = 0;
+-# endif
+-#else
+- addr_meml = 0;
+-#endif
+-
+ #if defined(CONFIG_SOFTMMU)
+ tcg_out_opc_sa(s, OPC_SRL, TCG_REG_A0, addr_regl, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
+ tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_A0, TCG_REG_A0, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+@@ -1029,50 +1026,55 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ int opc)
+ {
+- int addr_regl, addr_meml;
+- int data_regl, data_regh, data_reg1, data_reg2;
+- int mem_index, s_bits;
++ int addr_regl, data_regl, data_regh, data_reg1, data_reg2;
+ #if defined(CONFIG_SOFTMMU)
+ uint8_t *label1_ptr, *label2_ptr;
+ int arg_num;
++ int mem_index, s_bits;
++ int addr_meml;
+ #endif
+ #if TARGET_LONG_BITS == 64
+ # if defined(CONFIG_SOFTMMU)
+ uint8_t *label3_ptr;
+-# endif
+ int addr_regh, addr_memh;
++# endif
+ #endif
+-
+ data_regl = *args++;
+ if (opc == 3) {
+ data_regh = *args++;
+-#if defined(TCG_TARGET_WORDS_BIGENDIAN)
+- data_reg1 = data_regh;
+- data_reg2 = data_regl;
+-#else
+- data_reg1 = data_regl;
+- data_reg2 = data_regh;
+-#endif
+ } else {
+- data_reg1 = data_regl;
+- data_reg2 = 0;
+ data_regh = 0;
+ }
+ addr_regl = *args++;
+-#if TARGET_LONG_BITS == 64
++#if defined(CONFIG_SOFTMMU)
++# if TARGET_LONG_BITS == 64
+ addr_regh = *args++;
+-# if defined(TCG_TARGET_WORDS_BIGENDIAN)
++# if defined(TCG_TARGET_WORDS_BIGENDIAN)
+ addr_memh = 0;
+ addr_meml = 4;
+-# else
++# else
+ addr_memh = 4;
+ addr_meml = 0;
+-# endif
+-#else
++# endif
++# else
+ addr_meml = 0;
+-#endif
++# endif
+ mem_index = *args;
+ s_bits = opc;
++#endif
++
++ if (opc == 3) {
++#if defined(TCG_TARGET_WORDS_BIGENDIAN)
++ data_reg1 = data_regh;
++ data_reg2 = data_regl;
++#else
++ data_reg1 = data_regl;
++ data_reg2 = data_regh;
++#endif
++ } else {
++ data_reg1 = data_regl;
++ data_reg2 = 0;
++ }
+
+ #if defined(CONFIG_SOFTMMU)
+ tcg_out_opc_sa(s, OPC_SRL, TCG_REG_A0, addr_regl, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
+--
+1.7.12.1
+
--- /dev/null
+From 7b817977fbb87ee2e34018d92b64907197974a75 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: use TCGArg or TCGReg instead of int
+
+Instead of int, use the correct TCGArg and TCGReg type: TCGReg when
+representing a TCG target register, TCGArg when representing the latter
+or a constant.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 63 ++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 35 insertions(+), 28 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index a09c0d6..8b38f98 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -68,7 +68,7 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+ #endif
+
+ /* check if we really need so many registers :P */
+-static const int tcg_target_reg_alloc_order[] = {
++static const TCGReg tcg_target_reg_alloc_order[] = {
+ TCG_REG_S0,
+ TCG_REG_S1,
+ TCG_REG_S2,
+@@ -94,14 +94,14 @@ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_V1
+ };
+
+-static const int tcg_target_call_iarg_regs[4] = {
++static const TCGReg tcg_target_call_iarg_regs[4] = {
+ TCG_REG_A0,
+ TCG_REG_A1,
+ TCG_REG_A2,
+ TCG_REG_A3
+ };
+
+-static const int tcg_target_call_oarg_regs[2] = {
++static const TCGReg tcg_target_call_oarg_regs[2] = {
+ TCG_REG_V0,
+ TCG_REG_V1
+ };
+@@ -327,7 +327,8 @@ enum {
+ /*
+ * Type reg
+ */
+-static inline void tcg_out_opc_reg(TCGContext *s, int opc, int rd, int rs, int rt)
++static inline void tcg_out_opc_reg(TCGContext *s, int opc,
++ TCGReg rd, TCGReg rs, TCGReg rt)
+ {
+ int32_t inst;
+
+@@ -341,7 +342,8 @@ static inline void tcg_out_opc_reg(TCGContext *s, int opc, int rd, int rs, int r
+ /*
+ * Type immediate
+ */
+-static inline void tcg_out_opc_imm(TCGContext *s, int opc, int rt, int rs, int imm)
++static inline void tcg_out_opc_imm(TCGContext *s, int opc,
++ TCGReg rt, TCGReg rs, TCGArg imm)
+ {
+ int32_t inst;
+
+@@ -355,7 +357,8 @@ static inline void tcg_out_opc_imm(TCGContext *s, int opc, int rt, int rs, int i
+ /*
+ * Type branch
+ */
+-static inline void tcg_out_opc_br(TCGContext *s, int opc, int rt, int rs)
++static inline void tcg_out_opc_br(TCGContext *s, int opc,
++ TCGReg rt, TCGReg rs)
+ {
+ /* We pay attention here to not modify the branch target by reading
+ the existing value and using it again. This ensure that caches and
+@@ -368,7 +371,8 @@ static inline void tcg_out_opc_br(TCGContext *s, int opc, int rt, int rs)
+ /*
+ * Type sa
+ */
+-static inline void tcg_out_opc_sa(TCGContext *s, int opc, int rd, int rt, int sa)
++static inline void tcg_out_opc_sa(TCGContext *s, int opc,
++ TCGReg rd, TCGReg rt, TCGArg sa)
+ {
+ int32_t inst;
+
+@@ -407,7 +411,7 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
+ }
+ }
+
+-static inline void tcg_out_bswap16(TCGContext *s, int ret, int arg)
++static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+ /* ret and arg can't be register at */
+ if (ret == TCG_REG_AT || arg == TCG_REG_AT) {
+@@ -422,7 +426,7 @@ static inline void tcg_out_bswap16(TCGContext *s, int ret, int arg)
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
+ }
+
+-static inline void tcg_out_bswap16s(TCGContext *s, int ret, int arg)
++static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+ /* ret and arg can't be register at */
+ if (ret == TCG_REG_AT || arg == TCG_REG_AT) {
+@@ -437,7 +441,7 @@ static inline void tcg_out_bswap16s(TCGContext *s, int ret, int arg)
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
+ }
+
+-static inline void tcg_out_bswap32(TCGContext *s, int ret, int arg)
++static inline void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+ /* ret and arg must be different and can't be register at */
+ if (ret == arg || ret == TCG_REG_AT || arg == TCG_REG_AT) {
+@@ -458,7 +462,7 @@ static inline void tcg_out_bswap32(TCGContext *s, int ret, int arg)
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
+ }
+
+-static inline void tcg_out_ext8s(TCGContext *s, int ret, int arg)
++static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+ #ifdef _MIPS_ARCH_MIPS32R2
+ tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
+@@ -468,7 +472,7 @@ static inline void tcg_out_ext8s(TCGContext *s, int ret, int arg)
+ #endif
+ }
+
+-static inline void tcg_out_ext16s(TCGContext *s, int ret, int arg)
++static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+ #ifdef _MIPS_ARCH_MIPS32R2
+ tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
+@@ -478,8 +482,8 @@ static inline void tcg_out_ext16s(TCGContext *s, int ret, int arg)
+ #endif
+ }
+
+-static inline void tcg_out_ldst(TCGContext *s, int opc, int arg,
+- int arg1, tcg_target_long arg2)
++static inline void tcg_out_ldst(TCGContext *s, int opc, TCGArg arg,
++ TCGReg arg1, TCGArg arg2)
+ {
+ if (arg2 == (int16_t) arg2) {
+ tcg_out_opc_imm(s, opc, arg, arg1, arg2);
+@@ -502,7 +506,7 @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+ tcg_out_ldst(s, OPC_SW, arg, arg1, arg2);
+ }
+
+-static inline void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
++static inline void tcg_out_addi(TCGContext *s, TCGReg reg, TCGArg val)
+ {
+ if (val == (int16_t)val) {
+ tcg_out_opc_imm(s, OPC_ADDIU, reg, reg, val);
+@@ -543,7 +547,7 @@ DEFINE_TCG_OUT_CALL_IARG(tcg_out_call_iarg_reg16, TCGReg arg)
+ #undef DEFINE_TCG_OUT_CALL_IARG_GET_ARG
+ #define DEFINE_TCG_OUT_CALL_IARG_GET_ARG(A) \
+ tcg_out_movi(s, TCG_TYPE_I32, A, arg);
+-DEFINE_TCG_OUT_CALL_IARG(tcg_out_call_iarg_imm32, uint32_t arg)
++DEFINE_TCG_OUT_CALL_IARG(tcg_out_call_iarg_imm32, TCGArg arg)
+ #undef DEFINE_TCG_OUT_CALL_IARG_GET_ARG
+
+ /* We don't use the macro for this one to avoid an unnecessary reg-reg
+@@ -573,8 +577,8 @@ static inline void tcg_out_call_iarg_reg64(TCGContext *s, int *arg_num,
+ #endif
+ }
+
+-static void tcg_out_brcond(TCGContext *s, TCGCond cond, int arg1,
+- int arg2, int label_index)
++static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
++ TCGArg arg2, int label_index)
+ {
+ TCGLabel *l = &s->labels[label_index];
+
+@@ -631,8 +635,9 @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, int arg1,
+
+ /* XXX: we implement it at the target level to avoid having to
+ handle cross basic blocks temporaries */
+-static void tcg_out_brcond2(TCGContext *s, TCGCond cond, int arg1,
+- int arg2, int arg3, int arg4, int label_index)
++static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGArg arg1,
++ TCGArg arg2, TCGArg arg3, TCGArg arg4,
++ int label_index)
+ {
+ void *label_ptr;
+
+@@ -694,8 +699,8 @@ static void tcg_out_brcond2(TCGContext *s, TCGCond cond, int arg1,
+ reloc_pc16(label_ptr, (tcg_target_long) s->code_ptr);
+ }
+
+-static void tcg_out_setcond(TCGContext *s, TCGCond cond, int ret,
+- int arg1, int arg2)
++static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
++ TCGArg arg1, TCGArg arg2)
+ {
+ switch (cond) {
+ case TCG_COND_EQ:
+@@ -754,8 +759,8 @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, int ret,
+
+ /* XXX: we implement it at the target level to avoid having to
+ handle cross basic blocks temporaries */
+-static void tcg_out_setcond2(TCGContext *s, TCGCond cond, int ret,
+- int arg1, int arg2, int arg3, int arg4)
++static void tcg_out_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
++ TCGArg arg1, TCGArg arg2, TCGArg arg3, TCGArg arg4)
+ {
+ switch (cond) {
+ case TCG_COND_EQ:
+@@ -842,7 +847,7 @@ static const void * const qemu_st_helpers[4] = {
+ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ int opc)
+ {
+- int addr_regl, data_regl, data_regh, data_reg1, data_reg2;
++ TCGReg addr_regl, data_regl, data_regh, data_reg1, data_reg2;
+ #if defined(CONFIG_SOFTMMU)
+ void *label1_ptr, *label2_ptr;
+ int arg_num;
+@@ -850,7 +855,8 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ int addr_meml;
+ # if TARGET_LONG_BITS == 64
+ uint8_t *label3_ptr;
+- int addr_regh, addr_memh;
++ TCGReg addr_regh;
++ int addr_memh;
+ # endif
+ #endif
+ data_regl = *args++;
+@@ -1026,7 +1032,7 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ int opc)
+ {
+- int addr_regl, data_regl, data_regh, data_reg1, data_reg2;
++ TCGReg addr_regl, data_regl, data_regh, data_reg1, data_reg2;
+ #if defined(CONFIG_SOFTMMU)
+ uint8_t *label1_ptr, *label2_ptr;
+ int arg_num;
+@@ -1036,7 +1042,8 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ #if TARGET_LONG_BITS == 64
+ # if defined(CONFIG_SOFTMMU)
+ uint8_t *label3_ptr;
+- int addr_regh, addr_memh;
++ TCGReg addr_regh;
++ int addr_memh;
+ # endif
+ #endif
+ data_regl = *args++;
+--
+1.7.12.1
+
--- /dev/null
+From 9a4f545e4526f946613548a427fcab4c2a089ac0 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: don't use global pointer
+
+Don't use the global pointer in TCG, in case helpers try access global
+variables.
+
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 8b38f98..0ea6a76 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -1529,7 +1529,6 @@ static int tcg_target_callee_save_regs[] = {
+ TCG_REG_S5,
+ TCG_REG_S6,
+ TCG_REG_S7,
+- TCG_REG_GP,
+ TCG_REG_FP,
+ TCG_REG_RA, /* should be last for ABI compliance */
+ };
+@@ -1595,6 +1594,7 @@ static void tcg_target_init(TCGContext *s)
+ tcg_regset_set_reg(s->reserved_regs, TCG_REG_T0); /* internal use */
+ tcg_regset_set_reg(s->reserved_regs, TCG_REG_RA); /* return address */
+ tcg_regset_set_reg(s->reserved_regs, TCG_REG_SP); /* stack pointer */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP); /* global pointer */
+
+ tcg_add_target_add_op_defs(mips_op_defs);
+ tcg_set_frame(s, TCG_AREG0, offsetof(CPUArchState, temp_buf),
+--
+1.7.12.1
+
--- /dev/null
+From c914ae50df4dc2f2ab589c87c0cd2ce2f14d9639 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: use stack for TCG temps
+
+Use stack instead of temp_buf array in CPUState for TCG
+temps.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 0ea6a76..c05169f 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -1538,11 +1538,15 @@ static void tcg_target_qemu_prologue(TCGContext *s)
+ {
+ int i, frame_size;
+
+- /* reserve some stack space */
++ /* reserve some stack space, also for TCG temps. */
+ frame_size = ARRAY_SIZE(tcg_target_callee_save_regs) * 4
+- + TCG_STATIC_CALL_ARGS_SIZE;
++ + TCG_STATIC_CALL_ARGS_SIZE
++ + CPU_TEMP_BUF_NLONGS * sizeof(long);
+ frame_size = (frame_size + TCG_TARGET_STACK_ALIGN - 1) &
+ ~(TCG_TARGET_STACK_ALIGN - 1);
++ tcg_set_frame(s, TCG_REG_SP, ARRAY_SIZE(tcg_target_callee_save_regs) * 4
++ + TCG_STATIC_CALL_ARGS_SIZE,
++ CPU_TEMP_BUF_NLONGS * sizeof(long));
+
+ /* TB prologue */
+ tcg_out_addi(s, TCG_REG_SP, -frame_size);
+@@ -1597,6 +1601,4 @@ static void tcg_target_init(TCGContext *s)
+ tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP); /* global pointer */
+
+ tcg_add_target_add_op_defs(mips_op_defs);
+- tcg_set_frame(s, TCG_AREG0, offsetof(CPUArchState, temp_buf),
+- CPU_TEMP_BUF_NLONGS * sizeof(long));
+ }
+--
+1.7.12.1
+
--- /dev/null
+From e30cf829e9d8200364b53b9189c76d2155a32876 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: optimize brcond arg, 0
+
+MIPS has some conditional branch instructions when comparing with zero.
+Use them.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 38 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index c05169f..6aa4527 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -278,6 +278,8 @@ static inline int tcg_target_const_match(tcg_target_long val,
+ enum {
+ OPC_BEQ = 0x04 << 26,
+ OPC_BNE = 0x05 << 26,
++ OPC_BLEZ = 0x06 << 26,
++ OPC_BGTZ = 0x07 << 26,
+ OPC_ADDIU = 0x09 << 26,
+ OPC_SLTI = 0x0A << 26,
+ OPC_SLTIU = 0x0B << 26,
+@@ -319,6 +321,10 @@ enum {
+ OPC_SLT = OPC_SPECIAL | 0x2A,
+ OPC_SLTU = OPC_SPECIAL | 0x2B,
+
++ OPC_REGIMM = 0x01 << 26,
++ OPC_BLTZ = OPC_REGIMM | (0x00 << 16),
++ OPC_BGEZ = OPC_REGIMM | (0x01 << 16),
++
+ OPC_SPECIAL3 = 0x1f << 26,
+ OPC_SEB = OPC_SPECIAL3 | 0x420,
+ OPC_SEH = OPC_SPECIAL3 | 0x620,
+@@ -590,32 +596,48 @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
+ tcg_out_opc_br(s, OPC_BNE, arg1, arg2);
+ break;
+ case TCG_COND_LT:
+- tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg1, arg2);
+- tcg_out_opc_br(s, OPC_BNE, TCG_REG_AT, TCG_REG_ZERO);
++ if (arg2 == 0) {
++ tcg_out_opc_br(s, OPC_BLTZ, 0, arg1);
++ } else {
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg1, arg2);
++ tcg_out_opc_br(s, OPC_BNE, TCG_REG_AT, TCG_REG_ZERO);
++ }
+ break;
+ case TCG_COND_LTU:
+ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, arg1, arg2);
+ tcg_out_opc_br(s, OPC_BNE, TCG_REG_AT, TCG_REG_ZERO);
+ break;
+ case TCG_COND_GE:
+- tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg1, arg2);
+- tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
++ if (arg2 == 0) {
++ tcg_out_opc_br(s, OPC_BGEZ, 0, arg1);
++ } else {
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg1, arg2);
++ tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
++ }
+ break;
+ case TCG_COND_GEU:
+ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, arg1, arg2);
+ tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
+ break;
+ case TCG_COND_LE:
+- tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg2, arg1);
+- tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
++ if (arg2 == 0) {
++ tcg_out_opc_br(s, OPC_BLEZ, 0, arg1);
++ } else {
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg2, arg1);
++ tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
++ }
+ break;
+ case TCG_COND_LEU:
+ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, arg2, arg1);
+ tcg_out_opc_br(s, OPC_BEQ, TCG_REG_AT, TCG_REG_ZERO);
+ break;
+ case TCG_COND_GT:
+- tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg2, arg1);
+- tcg_out_opc_br(s, OPC_BNE, TCG_REG_AT, TCG_REG_ZERO);
++ if (arg2 == 0) {
++ tcg_out_opc_br(s, OPC_BGTZ, 0, arg1);
++ } else {
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, arg2, arg1);
++ tcg_out_opc_br(s, OPC_BNE, TCG_REG_AT, TCG_REG_ZERO);
++ }
+ break;
+ case TCG_COND_GTU:
+ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, arg2, arg1);
+--
+1.7.12.1
+
--- /dev/null
+From 879794c3d3974b1206bbc52011c8f2525709f396 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: optimize bswap{16,16s,32} on MIPS32R2
+
+bswap operations can be optimized on MIPS32 Release 2 using the ROTR,
+WSBH and SEH instructions. We can't use the non-R2 code to implement the
+ops due to registers constraints, so don't define the corresponding
+TCG_TARGET_HAS_bswap* values.
+
+Also bswap16* operations are supposed to be called with the 16 high bits
+zeroed. This is the case everywhere (including for TCG by definition)
+except when called from the store helper. Remove the AND instructions from
+bswap16* and move it there.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 34 +++++++++++++++++++++++++++++-----
+ tcg/mips/tcg-target.h | 11 +++++++++--
+ 2 files changed, 38 insertions(+), 7 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 6aa4527..8b2f9fc 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -326,6 +326,7 @@ enum {
+ OPC_BGEZ = OPC_REGIMM | (0x01 << 16),
+
+ OPC_SPECIAL3 = 0x1f << 26,
++ OPC_WSBH = OPC_SPECIAL3 | 0x0a0,
+ OPC_SEB = OPC_SPECIAL3 | 0x420,
+ OPC_SEH = OPC_SPECIAL3 | 0x620,
+ };
+@@ -419,36 +420,45 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
+
+ static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
++#ifdef _MIPS_ARCH_MIPS32R2
++ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
++#else
+ /* ret and arg can't be register at */
+ if (ret == TCG_REG_AT || arg == TCG_REG_AT) {
+ tcg_abort();
+ }
+
+ tcg_out_opc_sa(s, OPC_SRL, TCG_REG_AT, arg, 8);
+- tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_AT, TCG_REG_AT, 0x00ff);
+-
+ tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);
+ tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
++#endif
+ }
+
+ static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
++#ifdef _MIPS_ARCH_MIPS32R2
++ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
++ tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);
++#else
+ /* ret and arg can't be register at */
+ if (ret == TCG_REG_AT || arg == TCG_REG_AT) {
+ tcg_abort();
+ }
+
+ tcg_out_opc_sa(s, OPC_SRL, TCG_REG_AT, arg, 8);
+- tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_AT, TCG_REG_AT, 0xff);
+-
+ tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
+ tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
++#endif
+ }
+
+ static inline void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
++#ifdef _MIPS_ARCH_MIPS32R2
++ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
++ tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
++#else
+ /* ret and arg must be different and can't be register at */
+ if (ret == arg || ret == TCG_REG_AT || arg == TCG_REG_AT) {
+ tcg_abort();
+@@ -466,6 +476,7 @@ static inline void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+ tcg_out_opc_sa(s, OPC_SRL, TCG_REG_AT, arg, 8);
+ tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_AT, TCG_REG_AT, 0xff00);
+ tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_REG_AT);
++#endif
+ }
+
+ static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+@@ -1188,7 +1199,8 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+ break;
+ case 1:
+ if (TCG_NEED_BSWAP) {
+- tcg_out_bswap16(s, TCG_REG_T0, data_reg1);
++ tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_T0, data_reg1, 0xffff);
++ tcg_out_bswap16(s, TCG_REG_T0, TCG_REG_T0);
+ tcg_out_opc_imm(s, OPC_SH, TCG_REG_T0, TCG_REG_A0, 0);
+ } else {
+ tcg_out_opc_imm(s, OPC_SH, data_reg1, TCG_REG_A0, 0);
+@@ -1409,6 +1421,15 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ }
+ break;
+
++ /* The bswap routines do not work on non-R2 CPU. In that case
++ we let TCG generating the corresponding code. */
++ case INDEX_op_bswap16_i32:
++ tcg_out_bswap16(s, args[0], args[1]);
++ break;
++ case INDEX_op_bswap32_i32:
++ tcg_out_bswap32(s, args[0], args[1]);
++ break;
++
+ case INDEX_op_ext8s_i32:
+ tcg_out_ext8s(s, args[0], args[1]);
+ break;
+@@ -1503,6 +1524,9 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_shr_i32, { "r", "rZ", "ri" } },
+ { INDEX_op_sar_i32, { "r", "rZ", "ri" } },
+
++ { INDEX_op_bswap16_i32, { "r", "r" } },
++ { INDEX_op_bswap32_i32, { "r", "r" } },
++
+ { INDEX_op_ext8s_i32, { "r", "rZ" } },
+ { INDEX_op_ext16s_i32, { "r", "rZ" } },
+
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index 9c68a32..c5c13f7 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -83,8 +83,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_rot_i32 0
+ #define TCG_TARGET_HAS_ext8s_i32 1
+ #define TCG_TARGET_HAS_ext16s_i32 1
+-#define TCG_TARGET_HAS_bswap32_i32 0
+-#define TCG_TARGET_HAS_bswap16_i32 0
+ #define TCG_TARGET_HAS_andc_i32 0
+ #define TCG_TARGET_HAS_orc_i32 0
+ #define TCG_TARGET_HAS_eqv_i32 0
+@@ -92,6 +90,15 @@ typedef enum {
+ #define TCG_TARGET_HAS_deposit_i32 0
+ #define TCG_TARGET_HAS_movcond_i32 0
+
++/* optional instructions only implemented on MIPS32R2 */
++#ifdef _MIPS_ARCH_MIPS32R2
++#define TCG_TARGET_HAS_bswap16_i32 1
++#define TCG_TARGET_HAS_bswap32_i32 1
++#else
++#define TCG_TARGET_HAS_bswap16_i32 0
++#define TCG_TARGET_HAS_bswap32_i32 0
++#endif
++
+ /* optional instructions automatically implemented */
+ #define TCG_TARGET_HAS_neg_i32 0 /* sub rd, zero, rt */
+ #define TCG_TARGET_HAS_ext8u_i32 0 /* andi rt, rs, 0xff */
+--
+1.7.12.1
+
--- /dev/null
+From d19858a5515cd15dabf88b8f180754c1c3f3eb76 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: implement rotl/rotr ops on MIPS32R2
+
+rotr operations can be optimized on MIPS32 Release 2 using the ROTR and
+ROTRV instructions. Also implemented rotl operations by subtracting the
+shift from 32.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 20 ++++++++++++++++++++
+ tcg/mips/tcg-target.h | 3 ++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 8b2f9fc..592e42a 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -300,9 +300,11 @@ enum {
+ OPC_SPECIAL = 0x00 << 26,
+ OPC_SLL = OPC_SPECIAL | 0x00,
+ OPC_SRL = OPC_SPECIAL | 0x02,
++ OPC_ROTR = OPC_SPECIAL | (0x01 << 21) | 0x02,
+ OPC_SRA = OPC_SPECIAL | 0x03,
+ OPC_SLLV = OPC_SPECIAL | 0x04,
+ OPC_SRLV = OPC_SPECIAL | 0x06,
++ OPC_ROTRV = OPC_SPECIAL | (0x01 << 6) | 0x06,
+ OPC_SRAV = OPC_SPECIAL | 0x07,
+ OPC_JR = OPC_SPECIAL | 0x08,
+ OPC_JALR = OPC_SPECIAL | 0x09,
+@@ -1420,6 +1422,22 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_opc_reg(s, OPC_SRLV, args[0], args[2], args[1]);
+ }
+ break;
++ case INDEX_op_rotl_i32:
++ if (const_args[2]) {
++ tcg_out_opc_sa(s, OPC_ROTR, args[0], args[1], 0x20 - args[2]);
++ } else {
++ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_AT, 32);
++ tcg_out_opc_reg(s, OPC_SUBU, TCG_REG_AT, TCG_REG_AT, args[2]);
++ tcg_out_opc_reg(s, OPC_ROTRV, args[0], TCG_REG_AT, args[1]);
++ }
++ break;
++ case INDEX_op_rotr_i32:
++ if (const_args[2]) {
++ tcg_out_opc_sa(s, OPC_ROTR, args[0], args[1], args[2]);
++ } else {
++ tcg_out_opc_reg(s, OPC_ROTRV, args[0], args[2], args[1]);
++ }
++ break;
+
+ /* The bswap routines do not work on non-R2 CPU. In that case
+ we let TCG generating the corresponding code. */
+@@ -1523,6 +1541,8 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_shl_i32, { "r", "rZ", "ri" } },
+ { INDEX_op_shr_i32, { "r", "rZ", "ri" } },
+ { INDEX_op_sar_i32, { "r", "rZ", "ri" } },
++ { INDEX_op_rotr_i32, { "r", "rZ", "ri" } },
++ { INDEX_op_rotl_i32, { "r", "rZ", "ri" } },
+
+ { INDEX_op_bswap16_i32, { "r", "r" } },
+ { INDEX_op_bswap32_i32, { "r", "r" } },
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index c5c13f7..470314c 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -80,7 +80,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_div_i32 1
+ #define TCG_TARGET_HAS_not_i32 1
+ #define TCG_TARGET_HAS_nor_i32 1
+-#define TCG_TARGET_HAS_rot_i32 0
+ #define TCG_TARGET_HAS_ext8s_i32 1
+ #define TCG_TARGET_HAS_ext16s_i32 1
+ #define TCG_TARGET_HAS_andc_i32 0
+@@ -94,9 +93,11 @@ typedef enum {
+ #ifdef _MIPS_ARCH_MIPS32R2
+ #define TCG_TARGET_HAS_bswap16_i32 1
+ #define TCG_TARGET_HAS_bswap32_i32 1
++#define TCG_TARGET_HAS_rot_i32 1
+ #else
+ #define TCG_TARGET_HAS_bswap16_i32 0
+ #define TCG_TARGET_HAS_bswap32_i32 0
++#define TCG_TARGET_HAS_rot_i32 0
+ #endif
+
+ /* optional instructions automatically implemented */
+--
+1.7.12.1
+
--- /dev/null
+From 7c3e573b364a65d4abce5266c376f4e77624b039 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: implement deposit op on MIPS32R2
+
+deposit operations can be optimized on MIPS32 Release 2 using the INS
+instruction.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 8 ++++++++
+ tcg/mips/tcg-target.h | 3 ++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index 592e42a..b2e1056 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -328,6 +328,7 @@ enum {
+ OPC_BGEZ = OPC_REGIMM | (0x01 << 16),
+
+ OPC_SPECIAL3 = 0x1f << 26,
++ OPC_INS = OPC_SPECIAL3 | 0x004,
+ OPC_WSBH = OPC_SPECIAL3 | 0x0a0,
+ OPC_SEB = OPC_SPECIAL3 | 0x420,
+ OPC_SEH = OPC_SPECIAL3 | 0x620,
+@@ -1455,6 +1456,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_ext16s(s, args[0], args[1]);
+ break;
+
++ case INDEX_op_deposit_i32:
++ tcg_out_opc_imm(s, OPC_INS, args[0], args[2],
++ ((args[3] + args[4] - 1) << 11) | (args[3] << 6));
++ break;
++
+ case INDEX_op_brcond_i32:
+ tcg_out_brcond(s, args[2], args[0], args[1], args[3]);
+ break;
+@@ -1550,6 +1556,8 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_ext8s_i32, { "r", "rZ" } },
+ { INDEX_op_ext16s_i32, { "r", "rZ" } },
+
++ { INDEX_op_deposit_i32, { "r", "0", "rZ" } },
++
+ { INDEX_op_brcond_i32, { "rZ", "rZ" } },
+ { INDEX_op_setcond_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_setcond2_i32, { "r", "rZ", "rZ", "rZ", "rZ" } },
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index 470314c..897a737 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -86,7 +86,6 @@ typedef enum {
+ #define TCG_TARGET_HAS_orc_i32 0
+ #define TCG_TARGET_HAS_eqv_i32 0
+ #define TCG_TARGET_HAS_nand_i32 0
+-#define TCG_TARGET_HAS_deposit_i32 0
+ #define TCG_TARGET_HAS_movcond_i32 0
+
+ /* optional instructions only implemented on MIPS32R2 */
+@@ -94,10 +93,12 @@ typedef enum {
+ #define TCG_TARGET_HAS_bswap16_i32 1
+ #define TCG_TARGET_HAS_bswap32_i32 1
+ #define TCG_TARGET_HAS_rot_i32 1
++#define TCG_TARGET_HAS_deposit_i32 1
+ #else
+ #define TCG_TARGET_HAS_bswap16_i32 0
+ #define TCG_TARGET_HAS_bswap32_i32 0
+ #define TCG_TARGET_HAS_rot_i32 0
++#define TCG_TARGET_HAS_deposit_i32 0
+ #endif
+
+ /* optional instructions automatically implemented */
+--
+1.7.12.1
+
--- /dev/null
+From 552720cea4c1ca99dd1919cb8a80b6b8f3b13cda Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 18:20:26 +0200
+Subject: [PATCH] tcg/mips: implement movcond op on MIPS32R2
+
+movcond operation can be implemented on MIPS32 Release 2 using the MOVN,
+MOVZ, SLT and SLTU instructions.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ tcg/mips/tcg-target.h | 8 ++++++
+ 2 files changed, 77 insertions(+)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index b2e1056..c272b38 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -308,6 +308,8 @@ enum {
+ OPC_SRAV = OPC_SPECIAL | 0x07,
+ OPC_JR = OPC_SPECIAL | 0x08,
+ OPC_JALR = OPC_SPECIAL | 0x09,
++ OPC_MOVZ = OPC_SPECIAL | 0x0A,
++ OPC_MOVN = OPC_SPECIAL | 0x0B,
+ OPC_MFHI = OPC_SPECIAL | 0x10,
+ OPC_MFLO = OPC_SPECIAL | 0x12,
+ OPC_MULT = OPC_SPECIAL | 0x18,
+@@ -735,6 +737,68 @@ static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGArg arg1,
+ reloc_pc16(label_ptr, (tcg_target_long) s->code_ptr);
+ }
+
++static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
++ TCGArg c1, TCGArg c2, TCGArg v)
++{
++ switch (cond) {
++ case TCG_COND_EQ:
++ if (c1 == 0) {
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, c2);
++ } else if (c2 == 0) {
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, c1);
++ } else {
++ tcg_out_opc_reg(s, OPC_XOR, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, TCG_REG_AT);
++ }
++ break;
++ case TCG_COND_NE:
++ if (c1 == 0) {
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, c2);
++ } else if (c2 == 0) {
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, c1);
++ } else {
++ tcg_out_opc_reg(s, OPC_XOR, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, TCG_REG_AT);
++ }
++ break;
++ case TCG_COND_LT:
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_LTU:
++ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_GE:
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_GEU:
++ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, c1, c2);
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_LE:
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, c2, c1);
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_LEU:
++ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, c2, c1);
++ tcg_out_opc_reg(s, OPC_MOVZ, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_GT:
++ tcg_out_opc_reg(s, OPC_SLT, TCG_REG_AT, c2, c1);
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, TCG_REG_AT);
++ break;
++ case TCG_COND_GTU:
++ tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_AT, c2, c1);
++ tcg_out_opc_reg(s, OPC_MOVN, ret, v, TCG_REG_AT);
++ break;
++ default:
++ tcg_abort();
++ break;
++ }
++}
++
+ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
+ TCGArg arg1, TCGArg arg2)
+ {
+@@ -1468,6 +1532,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ tcg_out_brcond2(s, args[4], args[0], args[1], args[2], args[3], args[5]);
+ break;
+
++ case INDEX_op_movcond_i32:
++ tcg_out_movcond(s, args[5], args[0], args[1], args[2], args[3]);
++ break;
++
+ case INDEX_op_setcond_i32:
+ tcg_out_setcond(s, args[3], args[0], args[1], args[2]);
+ break;
+@@ -1559,6 +1627,7 @@ static const TCGTargetOpDef mips_op_defs[] = {
+ { INDEX_op_deposit_i32, { "r", "0", "rZ" } },
+
+ { INDEX_op_brcond_i32, { "rZ", "rZ" } },
++ { INDEX_op_movcond_i32, { "r", "rZ", "rZ", "rZ", "0" } },
+ { INDEX_op_setcond_i32, { "r", "rZ", "rZ" } },
+ { INDEX_op_setcond2_i32, { "r", "rZ", "rZ", "rZ", "rZ" } },
+
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index 897a737..d147e70 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -86,7 +86,15 @@ typedef enum {
+ #define TCG_TARGET_HAS_orc_i32 0
+ #define TCG_TARGET_HAS_eqv_i32 0
+ #define TCG_TARGET_HAS_nand_i32 0
++
++/* optional instructions only implemented on MIPS4, MIPS32 and Loongson 2 */
++#if defined(_MIPS_ARCH_MIPS4) || defined(_MIPS_ARCH_MIPS32) || \
++ defined(_MIPS_ARCH_MIPS32R2) || defined(_MIPS_ARCH_LOONGSON2E) || \
++ defined(_MIPS_ARCH_LOONGSON2F)
++#define TCG_TARGET_HAS_movcond_i32 1
++#else
+ #define TCG_TARGET_HAS_movcond_i32 0
++#endif
+
+ /* optional instructions only implemented on MIPS32R2 */
+ #ifdef _MIPS_ARCH_MIPS32R2
+--
+1.7.12.1
+
--- /dev/null
+From 848750a4acf9ea5c473be596d41720e702d770f0 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Mon, 10 Sep 2012 23:51:42 +0200
+Subject: [PATCH] tcg/optimize: remove TCG_TEMP_ANY
+
+TCG_TEMP_ANY has no different meaning than TCG_TEMP_UNDEF, so use
+the later instead.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 1be7631..308b7f9 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -39,8 +39,7 @@ typedef enum {
+ TCG_TEMP_UNDEF = 0,
+ TCG_TEMP_CONST,
+ TCG_TEMP_COPY,
+- TCG_TEMP_HAS_COPY,
+- TCG_TEMP_ANY
++ TCG_TEMP_HAS_COPY
+ } tcg_temp_state;
+
+ struct tcg_temp_info {
+@@ -52,7 +51,7 @@ struct tcg_temp_info {
+
+ static struct tcg_temp_info temps[TCG_MAX_TEMPS];
+
+-/* Reset TEMP's state to TCG_TEMP_ANY. If TEMP was a representative of some
++/* Reset TEMP's state to TCG_TEMP_UNDEF. If TEMP was a representative of some
+ class of equivalent temp's, a new representative should be chosen in this
+ class. */
+ static void reset_temp(TCGArg temp, int nb_temps, int nb_globals)
+@@ -69,7 +68,7 @@ static void reset_temp(TCGArg temp, int nb_temps, int nb_globals)
+ }
+ for (i = temps[temp].next_copy; i != temp; i = temps[i].next_copy) {
+ if (new_base == (TCGArg)-1) {
+- temps[i].state = TCG_TEMP_ANY;
++ temps[i].state = TCG_TEMP_UNDEF;
+ } else {
+ temps[i].val = new_base;
+ }
+@@ -81,9 +80,9 @@ static void reset_temp(TCGArg temp, int nb_temps, int nb_globals)
+ temps[temps[temp].prev_copy].next_copy = temps[temp].next_copy;
+ new_base = temps[temp].val;
+ }
+- temps[temp].state = TCG_TEMP_ANY;
++ temps[temp].state = TCG_TEMP_UNDEF;
+ if (new_base != (TCGArg)-1 && temps[new_base].next_copy == new_base) {
+- temps[new_base].state = TCG_TEMP_ANY;
++ temps[new_base].state = TCG_TEMP_UNDEF;
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 71f0bcf065ddd00d5659e846ddfdffb9a06ee896 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 11 Sep 2012 12:26:23 +0200
+Subject: [PATCH] tcg/optimize: check types in copy propagation
+
+The copy propagation doesn't check the types of the temps during copy
+propagation. However TCG is using the mov_i32 for the i64 to i32
+conversion and thus the two are not equivalent.
+
+With this patch tcg_opt_gen_mov() doesn't consider two temps of
+different type as copies anymore.
+
+So far it seems the optimization was not aggressive enough to trigger
+this bug, but it will be triggered later in this series once the copy
+propagation is improved.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 308b7f9..da8dffe 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -106,12 +106,13 @@ static TCGOpcode op_to_movi(TCGOpcode op)
+ }
+ }
+
+-static void tcg_opt_gen_mov(TCGArg *gen_args, TCGArg dst, TCGArg src,
+- int nb_temps, int nb_globals)
++static void tcg_opt_gen_mov(TCGContext *s, TCGArg *gen_args,
++ TCGArg dst, TCGArg src)
+ {
+- reset_temp(dst, nb_temps, nb_globals);
++ reset_temp(dst, s->nb_temps, s->nb_globals);
+ assert(temps[src].state != TCG_TEMP_COPY);
+- if (src >= nb_globals) {
++ /* Only consider temps with the same type (width) as copies. */
++ if (src >= s->nb_globals && s->temps[dst].type == s->temps[src].type) {
+ assert(temps[src].state != TCG_TEMP_CONST);
+ if (temps[src].state != TCG_TEMP_HAS_COPY) {
+ temps[src].state = TCG_TEMP_HAS_COPY;
+@@ -461,8 +462,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+- tcg_opt_gen_mov(gen_args, args[0], args[1],
+- nb_temps, nb_globals);
++ tcg_opt_gen_mov(s, gen_args, args[0], args[1]);
+ gen_args += 2;
+ }
+ args += 3;
+@@ -499,8 +499,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+- tcg_opt_gen_mov(gen_args, args[0], args[1], nb_temps,
+- nb_globals);
++ tcg_opt_gen_mov(s, gen_args, args[0], args[1]);
+ gen_args += 2;
+ }
+ args += 3;
+@@ -524,8 +523,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ break;
+ }
+ if (temps[args[1]].state != TCG_TEMP_CONST) {
+- tcg_opt_gen_mov(gen_args, args[0], args[1],
+- nb_temps, nb_globals);
++ tcg_opt_gen_mov(s, gen_args, args[0], args[1]);
+ gen_args += 2;
+ args += 2;
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From bf408071104de13f79a0c3c8cac892f440462e7c Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 11 Sep 2012 12:31:21 +0200
+Subject: [PATCH] tcg/optimize: rework copy progagation
+
+The copy propagation pass tries to keep track what is a copy of what
+and what has copy of what, and in addition it keep a circular list of
+of all the copies. Unfortunately this doesn't fully work: a mov from
+a temp which has a state "COPY" changed it into a state "HAS_COPY".
+Later when this temp is used again, it is considered has not having
+copy and thus no propagation is done.
+
+This patch fixes that by removing the hiearchy between copies, and thus
+only keeping a "COPY" state both meaning "is a copy" and "has a copy".
+The decision of which copy to use is deferred to the actual temp
+replacement. At this stage there is not one best choice to do, but only
+better choices than others. For doing the best choice the operation
+would have to be parsed in reversed to know if a temp is going to be
+used later or not. That what is done by the liveness analysis. At this
+stage it is known that globals will be always live, that local temps
+will be dead at the end of the translation block, and that the temps
+will be dead at the end of the basic block. This means that this stage
+should try to replace temps by local temps or globals and local temps
+by globals.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 167 +++++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 92 insertions(+), 75 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index da8dffe..1904b39 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -39,7 +39,6 @@ typedef enum {
+ TCG_TEMP_UNDEF = 0,
+ TCG_TEMP_CONST,
+ TCG_TEMP_COPY,
+- TCG_TEMP_HAS_COPY
+ } tcg_temp_state;
+
+ struct tcg_temp_info {
+@@ -51,39 +50,19 @@ struct tcg_temp_info {
+
+ static struct tcg_temp_info temps[TCG_MAX_TEMPS];
+
+-/* Reset TEMP's state to TCG_TEMP_UNDEF. If TEMP was a representative of some
+- class of equivalent temp's, a new representative should be chosen in this
+- class. */
+-static void reset_temp(TCGArg temp, int nb_temps, int nb_globals)
++/* Reset TEMP's state to TCG_TEMP_UNDEF. If TEMP only had one copy, remove
++ the copy flag from the left temp. */
++static void reset_temp(TCGArg temp)
+ {
+- int i;
+- TCGArg new_base = (TCGArg)-1;
+- if (temps[temp].state == TCG_TEMP_HAS_COPY) {
+- for (i = temps[temp].next_copy; i != temp; i = temps[i].next_copy) {
+- if (i >= nb_globals) {
+- temps[i].state = TCG_TEMP_HAS_COPY;
+- new_base = i;
+- break;
+- }
+- }
+- for (i = temps[temp].next_copy; i != temp; i = temps[i].next_copy) {
+- if (new_base == (TCGArg)-1) {
+- temps[i].state = TCG_TEMP_UNDEF;
+- } else {
+- temps[i].val = new_base;
+- }
++ if (temps[temp].state == TCG_TEMP_COPY) {
++ if (temps[temp].prev_copy == temps[temp].next_copy) {
++ temps[temps[temp].next_copy].state = TCG_TEMP_UNDEF;
++ } else {
++ temps[temps[temp].next_copy].prev_copy = temps[temp].prev_copy;
++ temps[temps[temp].prev_copy].next_copy = temps[temp].next_copy;
+ }
+- temps[temps[temp].next_copy].prev_copy = temps[temp].prev_copy;
+- temps[temps[temp].prev_copy].next_copy = temps[temp].next_copy;
+- } else if (temps[temp].state == TCG_TEMP_COPY) {
+- temps[temps[temp].next_copy].prev_copy = temps[temp].prev_copy;
+- temps[temps[temp].prev_copy].next_copy = temps[temp].next_copy;
+- new_base = temps[temp].val;
+ }
+ temps[temp].state = TCG_TEMP_UNDEF;
+- if (new_base != (TCGArg)-1 && temps[new_base].next_copy == new_base) {
+- temps[new_base].state = TCG_TEMP_UNDEF;
+- }
+ }
+
+ static int op_bits(TCGOpcode op)
+@@ -106,34 +85,83 @@ static TCGOpcode op_to_movi(TCGOpcode op)
+ }
+ }
+
++static TCGArg find_better_copy(TCGContext *s, TCGArg temp)
++{
++ TCGArg i;
++
++ /* If this is already a global, we can't do better. */
++ if (temp < s->nb_globals) {
++ return temp;
++ }
++
++ /* Search for a global first. */
++ for (i = temps[temp].next_copy ; i != temp ; i = temps[i].next_copy) {
++ if (i < s->nb_globals) {
++ return i;
++ }
++ }
++
++ /* If it is a temp, search for a temp local. */
++ if (!s->temps[temp].temp_local) {
++ for (i = temps[temp].next_copy ; i != temp ; i = temps[i].next_copy) {
++ if (s->temps[i].temp_local) {
++ return i;
++ }
++ }
++ }
++
++ /* Failure to find a better representation, return the same temp. */
++ return temp;
++}
++
++static bool temps_are_copies(TCGArg arg1, TCGArg arg2)
++{
++ TCGArg i;
++
++ if (arg1 == arg2) {
++ return true;
++ }
++
++ if (temps[arg1].state != TCG_TEMP_COPY
++ || temps[arg2].state != TCG_TEMP_COPY) {
++ return false;
++ }
++
++ for (i = temps[arg1].next_copy ; i != arg1 ; i = temps[i].next_copy) {
++ if (i == arg2) {
++ return true;
++ }
++ }
++
++ return false;
++}
++
+ static void tcg_opt_gen_mov(TCGContext *s, TCGArg *gen_args,
+ TCGArg dst, TCGArg src)
+ {
+- reset_temp(dst, s->nb_temps, s->nb_globals);
+- assert(temps[src].state != TCG_TEMP_COPY);
+- /* Only consider temps with the same type (width) as copies. */
+- if (src >= s->nb_globals && s->temps[dst].type == s->temps[src].type) {
+- assert(temps[src].state != TCG_TEMP_CONST);
+- if (temps[src].state != TCG_TEMP_HAS_COPY) {
+- temps[src].state = TCG_TEMP_HAS_COPY;
++ reset_temp(dst);
++ assert(temps[src].state != TCG_TEMP_CONST);
++
++ if (s->temps[src].type == s->temps[dst].type) {
++ if (temps[src].state != TCG_TEMP_COPY) {
++ temps[src].state = TCG_TEMP_COPY;
+ temps[src].next_copy = src;
+ temps[src].prev_copy = src;
+ }
+ temps[dst].state = TCG_TEMP_COPY;
+- temps[dst].val = src;
+ temps[dst].next_copy = temps[src].next_copy;
+ temps[dst].prev_copy = src;
+ temps[temps[dst].next_copy].prev_copy = dst;
+ temps[src].next_copy = dst;
+ }
++
+ gen_args[0] = dst;
+ gen_args[1] = src;
+ }
+
+-static void tcg_opt_gen_movi(TCGArg *gen_args, TCGArg dst, TCGArg val,
+- int nb_temps, int nb_globals)
++static void tcg_opt_gen_movi(TCGArg *gen_args, TCGArg dst, TCGArg val)
+ {
+- reset_temp(dst, nb_temps, nb_globals);
++ reset_temp(dst);
+ temps[dst].state = TCG_TEMP_CONST;
+ temps[dst].val = val;
+ gen_args[0] = dst;
+@@ -324,7 +352,6 @@ static TCGArg do_constant_folding_cond(TCGOpcode op, TCGArg x,
+ tcg_abort();
+ }
+
+-
+ /* Propagate constants and copies, fold constant expressions. */
+ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ TCGArg *args, TCGOpDef *tcg_op_defs)
+@@ -338,10 +365,8 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+
+ /* Array VALS has an element for each temp.
+ If this temp holds a constant then its value is kept in VALS' element.
+- If this temp is a copy of other ones then this equivalence class'
+- representative is kept in VALS' element.
+- If this temp is neither copy nor constant then corresponding VALS'
+- element is unused. */
++ If this temp is a copy of other ones then the other copies are
++ available through the doubly linked circular list. */
+
+ nb_temps = s->nb_temps;
+ nb_globals = s->nb_globals;
+@@ -357,7 +382,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ assert(op != INDEX_op_call);
+ for (i = def->nb_oargs; i < def->nb_oargs + def->nb_iargs; i++) {
+ if (temps[args[i]].state == TCG_TEMP_COPY) {
+- args[i] = temps[args[i]].val;
++ args[i] = find_better_copy(s, args[i]);
+ }
+ }
+ }
+@@ -429,7 +454,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ if (temps[args[1]].state == TCG_TEMP_CONST
+ && temps[args[1]].val == 0) {
+ gen_opc_buf[op_index] = op_to_movi(op);
+- tcg_opt_gen_movi(gen_args, args[0], 0, nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], 0);
+ args += 3;
+ gen_args += 2;
+ continue;
+@@ -456,9 +481,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ }
+ if (temps[args[2]].state == TCG_TEMP_CONST
+ && temps[args[2]].val == 0) {
+- if ((temps[args[0]].state == TCG_TEMP_COPY
+- && temps[args[0]].val == args[1])
+- || args[0] == args[1]) {
++ if (temps_are_copies(args[0], args[1])) {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+@@ -480,7 +503,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ if ((temps[args[2]].state == TCG_TEMP_CONST
+ && temps[args[2]].val == 0)) {
+ gen_opc_buf[op_index] = op_to_movi(op);
+- tcg_opt_gen_movi(gen_args, args[0], 0, nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], 0);
+ args += 3;
+ gen_args += 2;
+ continue;
+@@ -495,7 +518,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ CASE_OP_32_64(or):
+ CASE_OP_32_64(and):
+ if (args[1] == args[2]) {
+- if (args[1] == args[0]) {
++ if (temps_are_copies(args[0], args[1])) {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+@@ -515,9 +538,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ allocator where needed and possible. Also detect copies. */
+ switch (op) {
+ CASE_OP_32_64(mov):
+- if ((temps[args[1]].state == TCG_TEMP_COPY
+- && temps[args[1]].val == args[0])
+- || args[0] == args[1]) {
++ if (temps_are_copies(args[0], args[1])) {
+ args += 2;
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ break;
+@@ -535,7 +556,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args[1] = temps[args[1]].val;
+ /* fallthrough */
+ CASE_OP_32_64(movi):
+- tcg_opt_gen_movi(gen_args, args[0], args[1], nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], args[1]);
+ gen_args += 2;
+ args += 2;
+ break;
+@@ -550,9 +571,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ if (temps[args[1]].state == TCG_TEMP_CONST) {
+ gen_opc_buf[op_index] = op_to_movi(op);
+ tmp = do_constant_folding(op, temps[args[1]].val, 0);
+- tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], tmp);
+ } else {
+- reset_temp(args[0], nb_temps, nb_globals);
++ reset_temp(args[0]);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ }
+@@ -580,10 +601,10 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = op_to_movi(op);
+ tmp = do_constant_folding(op, temps[args[1]].val,
+ temps[args[2]].val);
+- tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], tmp);
+ gen_args += 2;
+ } else {
+- reset_temp(args[0], nb_temps, nb_globals);
++ reset_temp(args[0]);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ gen_args[2] = args[2];
+@@ -597,10 +618,10 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ gen_opc_buf[op_index] = op_to_movi(op);
+ tmp = do_constant_folding_cond(op, temps[args[1]].val,
+ temps[args[2]].val, args[3]);
+- tcg_opt_gen_movi(gen_args, args[0], tmp, nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], tmp);
+ gen_args += 2;
+ } else {
+- reset_temp(args[0], nb_temps, nb_globals);
++ reset_temp(args[0]);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ gen_args[2] = args[2];
+@@ -623,7 +644,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ }
+ } else {
+ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+- reset_temp(args[0], nb_temps, nb_globals);
++ reset_temp(args[0]);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ gen_args[2] = args[2];
+@@ -637,23 +658,19 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ && temps[args[2]].state == TCG_TEMP_CONST) {
+ tmp = do_constant_folding_cond(op, temps[args[1]].val,
+ temps[args[2]].val, args[5]);
+- if (args[0] == args[4-tmp]
+- || (temps[args[4-tmp]].state == TCG_TEMP_COPY
+- && temps[args[4-tmp]].val == args[0])) {
++ if (temps_are_copies(args[0], args[4-tmp])) {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else if (temps[args[4-tmp]].state == TCG_TEMP_CONST) {
+ gen_opc_buf[op_index] = op_to_movi(op);
+- tcg_opt_gen_movi(gen_args, args[0], temps[args[4-tmp]].val,
+- nb_temps, nb_globals);
++ tcg_opt_gen_movi(gen_args, args[0], temps[args[4-tmp]].val);
+ gen_args += 2;
+ } else {
+ gen_opc_buf[op_index] = op_to_mov(op);
+- tcg_opt_gen_mov(gen_args, args[0], args[4-tmp],
+- nb_temps, nb_globals);
++ tcg_opt_gen_mov(s, gen_args, args[0], args[4-tmp]);
+ gen_args += 2;
+ }
+ } else {
+- reset_temp(args[0], nb_temps, nb_globals);
++ reset_temp(args[0]);
+ gen_args[0] = args[0];
+ gen_args[1] = args[1];
+ gen_args[2] = args[2];
+@@ -668,11 +685,11 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ nb_call_args = (args[0] >> 16) + (args[0] & 0xffff);
+ if (!(args[nb_call_args + 1] & (TCG_CALL_CONST | TCG_CALL_PURE))) {
+ for (i = 0; i < nb_globals; i++) {
+- reset_temp(i, nb_temps, nb_globals);
++ reset_temp(i);
+ }
+ }
+ for (i = 0; i < (args[0] >> 16); i++) {
+- reset_temp(args[i + 1], nb_temps, nb_globals);
++ reset_temp(args[i + 1]);
+ }
+ i = nb_call_args + 3;
+ while (i) {
+@@ -691,7 +708,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+ } else {
+ for (i = 0; i < def->nb_oargs; i++) {
+- reset_temp(args[i], nb_temps, nb_globals);
++ reset_temp(args[i]);
+ }
+ }
+ for (i = 0; i < def->nb_args; i++) {
+--
+1.7.12.1
+
--- /dev/null
+From 7c1a67bb734f364ea0643b549e030f04d4eed798 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 11 Sep 2012 16:18:49 +0200
+Subject: [PATCH] tcg/optimize: do copy propagation for all operations
+
+It is possible to due copy propagation for all operations, even the one
+that have side effects or clobber arguments (it only concerns input
+arguments). That said, the call operation should be handled differently
+due to the variable number of arguments.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index 1904b39..aeb2225 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -378,8 +378,15 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ op = gen_opc_buf[op_index];
+ def = &tcg_op_defs[op];
+ /* Do copy propagation */
+- if (!(def->flags & (TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS))) {
+- assert(op != INDEX_op_call);
++ if (op == INDEX_op_call) {
++ int nb_oargs = args[0] >> 16;
++ int nb_iargs = args[0] & 0xffff;
++ for (i = nb_oargs + 1; i < nb_oargs + nb_iargs + 1; i++) {
++ if (temps[args[i]].state == TCG_TEMP_COPY) {
++ args[i] = find_better_copy(s, args[i]);
++ }
++ }
++ } else {
+ for (i = def->nb_oargs; i < def->nb_oargs + def->nb_iargs; i++) {
+ if (temps[args[i]].state == TCG_TEMP_COPY) {
+ args[i] = find_better_copy(s, args[i]);
+--
+1.7.12.1
+
--- /dev/null
+From e38329760e40a354e37d11c7f5d8c86cdb90736c Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 18 Sep 2012 19:11:32 +0200
+Subject: [PATCH] tcg/optimize: optimize "op r, a, a => mov r, a"
+
+Now that we can easily detect all copies, we can optimize the
+"op r, a, a => mov r, a" case a bit more.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index aeb2225..b9a7da9 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -524,7 +524,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ switch (op) {
+ CASE_OP_32_64(or):
+ CASE_OP_32_64(and):
+- if (args[1] == args[2]) {
++ if (temps_are_copies(args[1], args[2])) {
+ if (temps_are_copies(args[0], args[1])) {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else {
+--
+1.7.12.1
+
--- /dev/null
+From 363479b4d4f729959eafb1209d48ad75e928c00a Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 18 Sep 2012 19:12:36 +0200
+Subject: [PATCH] tcg/optimize: optimize "op r, a, a => movi r, 0"
+
+Now that it's possible to detect copies, we can optimize the case
+the "op r, a, a => movi r, 0". This helps in the computation of
+overflow flags when one of the two args is 0.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index b9a7da9..ceea644 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -540,6 +540,22 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ break;
+ }
+
++ /* Simplify expression for "op r, a, a => movi r, 0" cases */
++ switch (op) {
++ CASE_OP_32_64(sub):
++ CASE_OP_32_64(xor):
++ if (temps_are_copies(args[1], args[2])) {
++ gen_opc_buf[op_index] = op_to_movi(op);
++ tcg_opt_gen_movi(gen_args, args[0], 0);
++ gen_args += 2;
++ args += 3;
++ continue;
++ }
++ break;
++ default:
++ break;
++ }
++
+ /* Propagate constants through copy operations and do constant
+ folding. Constants will be substituted to arguments by register
+ allocator where needed and possible. Also detect copies. */
+--
+1.7.12.1
+
--- /dev/null
+From 8d5f3ca9ccace2374fd73d46fad56decc02e0a44 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 18 Sep 2012 19:37:00 +0200
+Subject: [PATCH] tcg/optimize: further optimize brcond/movcond/setcond
+
+When both argument of brcond/movcond/setcond are the same or when one
+of the two values is a constant equal to zero, it's possible to do
+further optimizations.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 127 ++++++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 76 insertions(+), 51 deletions(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index ceea644..abe016a 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -292,58 +292,88 @@ static TCGArg do_constant_folding(TCGOpcode op, TCGArg x, TCGArg y)
+ return res;
+ }
+
++/* Return 2 if the condition can't be simplified, and the result
++ of the condition (0 or 1) if it can */
+ static TCGArg do_constant_folding_cond(TCGOpcode op, TCGArg x,
+ TCGArg y, TCGCond c)
+ {
+- switch (op_bits(op)) {
+- case 32:
++ if (temps[x].state == TCG_TEMP_CONST && temps[y].state == TCG_TEMP_CONST) {
++ switch (op_bits(op)) {
++ case 32:
++ switch (c) {
++ case TCG_COND_EQ:
++ return (uint32_t)temps[x].val == (uint32_t)temps[y].val;
++ case TCG_COND_NE:
++ return (uint32_t)temps[x].val != (uint32_t)temps[y].val;
++ case TCG_COND_LT:
++ return (int32_t)temps[x].val < (int32_t)temps[y].val;
++ case TCG_COND_GE:
++ return (int32_t)temps[x].val >= (int32_t)temps[y].val;
++ case TCG_COND_LE:
++ return (int32_t)temps[x].val <= (int32_t)temps[y].val;
++ case TCG_COND_GT:
++ return (int32_t)temps[x].val > (int32_t)temps[y].val;
++ case TCG_COND_LTU:
++ return (uint32_t)temps[x].val < (uint32_t)temps[y].val;
++ case TCG_COND_GEU:
++ return (uint32_t)temps[x].val >= (uint32_t)temps[y].val;
++ case TCG_COND_LEU:
++ return (uint32_t)temps[x].val <= (uint32_t)temps[y].val;
++ case TCG_COND_GTU:
++ return (uint32_t)temps[x].val > (uint32_t)temps[y].val;
++ }
++ break;
++ case 64:
++ switch (c) {
++ case TCG_COND_EQ:
++ return (uint64_t)temps[x].val == (uint64_t)temps[y].val;
++ case TCG_COND_NE:
++ return (uint64_t)temps[x].val != (uint64_t)temps[y].val;
++ case TCG_COND_LT:
++ return (int64_t)temps[x].val < (int64_t)temps[y].val;
++ case TCG_COND_GE:
++ return (int64_t)temps[x].val >= (int64_t)temps[y].val;
++ case TCG_COND_LE:
++ return (int64_t)temps[x].val <= (int64_t)temps[y].val;
++ case TCG_COND_GT:
++ return (int64_t)temps[x].val > (int64_t)temps[y].val;
++ case TCG_COND_LTU:
++ return (uint64_t)temps[x].val < (uint64_t)temps[y].val;
++ case TCG_COND_GEU:
++ return (uint64_t)temps[x].val >= (uint64_t)temps[y].val;
++ case TCG_COND_LEU:
++ return (uint64_t)temps[x].val <= (uint64_t)temps[y].val;
++ case TCG_COND_GTU:
++ return (uint64_t)temps[x].val > (uint64_t)temps[y].val;
++ }
++ break;
++ }
++ } else if (temps_are_copies(x, y)) {
+ switch (c) {
+- case TCG_COND_EQ:
+- return (uint32_t)x == (uint32_t)y;
+- case TCG_COND_NE:
+- return (uint32_t)x != (uint32_t)y;
+- case TCG_COND_LT:
+- return (int32_t)x < (int32_t)y;
+- case TCG_COND_GE:
+- return (int32_t)x >= (int32_t)y;
+- case TCG_COND_LE:
+- return (int32_t)x <= (int32_t)y;
+ case TCG_COND_GT:
+- return (int32_t)x > (int32_t)y;
+ case TCG_COND_LTU:
+- return (uint32_t)x < (uint32_t)y;
+- case TCG_COND_GEU:
+- return (uint32_t)x >= (uint32_t)y;
+- case TCG_COND_LEU:
+- return (uint32_t)x <= (uint32_t)y;
++ case TCG_COND_LT:
+ case TCG_COND_GTU:
+- return (uint32_t)x > (uint32_t)y;
+- }
+- break;
+- case 64:
+- switch (c) {
+- case TCG_COND_EQ:
+- return (uint64_t)x == (uint64_t)y;
+ case TCG_COND_NE:
+- return (uint64_t)x != (uint64_t)y;
+- case TCG_COND_LT:
+- return (int64_t)x < (int64_t)y;
++ return 0;
+ case TCG_COND_GE:
+- return (int64_t)x >= (int64_t)y;
++ case TCG_COND_GEU:
+ case TCG_COND_LE:
+- return (int64_t)x <= (int64_t)y;
+- case TCG_COND_GT:
+- return (int64_t)x > (int64_t)y;
++ case TCG_COND_LEU:
++ case TCG_COND_EQ:
++ return 1;
++ }
++ } else if (temps[y].state == TCG_TEMP_CONST && temps[y].val == 0) {
++ switch (c) {
+ case TCG_COND_LTU:
+- return (uint64_t)x < (uint64_t)y;
++ return 0;
+ case TCG_COND_GEU:
+- return (uint64_t)x >= (uint64_t)y;
+- case TCG_COND_LEU:
+- return (uint64_t)x <= (uint64_t)y;
+- case TCG_COND_GTU:
+- return (uint64_t)x > (uint64_t)y;
++ return 1;
++ default:
++ return 2;
+ }
+- break;
++ } else {
++ return 2;
+ }
+
+ fprintf(stderr,
+@@ -636,11 +666,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args += 3;
+ break;
+ CASE_OP_32_64(setcond):
+- if (temps[args[1]].state == TCG_TEMP_CONST
+- && temps[args[2]].state == TCG_TEMP_CONST) {
++ tmp = do_constant_folding_cond(op, args[1], args[2], args[3]);
++ if (tmp != 2) {
+ gen_opc_buf[op_index] = op_to_movi(op);
+- tmp = do_constant_folding_cond(op, temps[args[1]].val,
+- temps[args[2]].val, args[3]);
+ tcg_opt_gen_movi(gen_args, args[0], tmp);
+ gen_args += 2;
+ } else {
+@@ -654,10 +682,9 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args += 4;
+ break;
+ CASE_OP_32_64(brcond):
+- if (temps[args[0]].state == TCG_TEMP_CONST
+- && temps[args[1]].state == TCG_TEMP_CONST) {
+- if (do_constant_folding_cond(op, temps[args[0]].val,
+- temps[args[1]].val, args[2])) {
++ tmp = do_constant_folding_cond(op, args[0], args[1], args[2]);
++ if (tmp != 2) {
++ if (tmp) {
+ memset(temps, 0, nb_temps * sizeof(struct tcg_temp_info));
+ gen_opc_buf[op_index] = INDEX_op_br;
+ gen_args[0] = args[3];
+@@ -677,10 +704,8 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ args += 4;
+ break;
+ CASE_OP_32_64(movcond):
+- if (temps[args[1]].state == TCG_TEMP_CONST
+- && temps[args[2]].state == TCG_TEMP_CONST) {
+- tmp = do_constant_folding_cond(op, temps[args[1]].val,
+- temps[args[2]].val, args[5]);
++ tmp = do_constant_folding_cond(op, args[1], args[2], args[5]);
++ if (tmp != 2) {
+ if (temps_are_copies(args[0], args[4-tmp])) {
+ gen_opc_buf[op_index] = INDEX_op_nop;
+ } else if (temps[args[4-tmp]].state == TCG_TEMP_CONST) {
+--
+1.7.12.1
+
--- /dev/null
+From a0b71ad6a3f8aeb8b5ea6d112a7afeadc7c004a4 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Wed, 19 Sep 2012 22:00:22 +0200
+Subject: [PATCH] tcg/optimize: prefer the "op a, a, b" form for commutative
+ ops
+
+The "op a, a, b" form is better handled on non-RISC host than the "op
+a, b, a" form, so swap the arguments to this form when possible, and
+when b is not a constant.
+
+This reduces the number of generated instructions by a tiny bit.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index abe016a..c8ae50b 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -434,7 +434,10 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ CASE_OP_32_64(eqv):
+ CASE_OP_32_64(nand):
+ CASE_OP_32_64(nor):
+- if (temps[args[1]].state == TCG_TEMP_CONST) {
++ /* Prefer the constant in second argument, and then the form
++ op a, a, b, which is better handled on non-RISC hosts. */
++ if (temps[args[1]].state == TCG_TEMP_CONST || (args[0] == args[2]
++ && temps[args[2]].state != TCG_TEMP_CONST)) {
+ tmp = args[1];
+ args[1] = args[2];
+ args[2] = tmp;
+--
+1.7.12.1
+
--- /dev/null
+From 3942910a66f682b98ac53ac2d2fba65b9c75eefd Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 10:02:45 +0200
+Subject: [PATCH] tcg: remove #ifdef #endif around TCGOpcode tests
+
+Commit 25c4d9cc changed all TCGOpcode enums to be available, so we don't
+need to #ifdef #endif the one that are available only on some targets.
+This makes the code easier to read.
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/tcg.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index 24ce830..93421cd 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -937,11 +937,7 @@ void tcg_dump_ops(TCGContext *s)
+ args[nb_oargs + i]));
+ }
+ }
+- } else if (c == INDEX_op_movi_i32
+-#if TCG_TARGET_REG_BITS == 64
+- || c == INDEX_op_movi_i64
+-#endif
+- ) {
++ } else if (c == INDEX_op_movi_i32 || c == INDEX_op_movi_i64) {
+ tcg_target_ulong val;
+ TCGHelperInfo *th;
+
+@@ -993,14 +989,11 @@ void tcg_dump_ops(TCGContext *s)
+ case INDEX_op_brcond_i32:
+ case INDEX_op_setcond_i32:
+ case INDEX_op_movcond_i32:
+-#if TCG_TARGET_REG_BITS == 32
+ case INDEX_op_brcond2_i32:
+ case INDEX_op_setcond2_i32:
+-#else
+ case INDEX_op_brcond_i64:
+ case INDEX_op_setcond_i64:
+ case INDEX_op_movcond_i64:
+-#endif
+ if (args[k] < ARRAY_SIZE(cond_name) && cond_name[args[k]]) {
+ qemu_log(",%s", cond_name[args[k++]]);
+ } else {
+@@ -2095,16 +2088,12 @@ static inline int tcg_gen_code_common(TCGContext *s, uint8_t *gen_code_buf,
+ #endif
+ switch(opc) {
+ case INDEX_op_mov_i32:
+-#if TCG_TARGET_REG_BITS == 64
+ case INDEX_op_mov_i64:
+-#endif
+ dead_args = s->op_dead_args[op_index];
+ tcg_reg_alloc_mov(s, def, args, dead_args);
+ break;
+ case INDEX_op_movi_i32:
+-#if TCG_TARGET_REG_BITS == 64
+ case INDEX_op_movi_i64:
+-#endif
+ tcg_reg_alloc_movi(s, args);
+ break;
+ case INDEX_op_debug_insn_start:
+--
+1.7.12.1
+
--- /dev/null
+From 04edfbcf025b5588e0f3b86c74356a4339745f35 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Fri, 21 Sep 2012 11:07:29 +0200
+Subject: [PATCH] tcg/optimize: add constant folding for deposit
+
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/optimize.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index c8ae50b..35532a1 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -668,6 +668,26 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
+ }
+ args += 3;
+ break;
++ CASE_OP_32_64(deposit):
++ if (temps[args[1]].state == TCG_TEMP_CONST
++ && temps[args[2]].state == TCG_TEMP_CONST) {
++ gen_opc_buf[op_index] = op_to_movi(op);
++ tmp = ((1ull << args[4]) - 1);
++ tmp = (temps[args[1]].val & ~(tmp << args[3]))
++ | ((temps[args[2]].val & tmp) << args[3]);
++ tcg_opt_gen_movi(gen_args, args[0], tmp);
++ gen_args += 2;
++ } else {
++ reset_temp(args[0]);
++ gen_args[0] = args[0];
++ gen_args[1] = args[1];
++ gen_args[2] = args[2];
++ gen_args[3] = args[3];
++ gen_args[4] = args[4];
++ gen_args += 5;
++ }
++ args += 5;
++ break;
+ CASE_OP_32_64(setcond):
+ tmp = do_constant_folding_cond(op, args[1], args[2], args[3]);
+ if (tmp != 2) {
+--
+1.7.12.1
+
--- /dev/null
+From 08de143bdd34e906c3e89443cb6b24665f7c088d Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 21 Sep 2012 04:18:07 +0400
+Subject: [PATCH] tcg/README: document tcg_gen_goto_tb restrictions
+
+See
+http://lists.nongnu.org/archive/html/qemu-devel/2012-09/msg03196.html
+for the whole story.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/README | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/README b/tcg/README
+index d03ae05..33783ee 100644
+--- a/tcg/README
++++ b/tcg/README
+@@ -392,7 +392,8 @@ Exit the current TB and return the value t0 (word type).
+
+ Exit the current TB and jump to the TB index 'index' (constant) if the
+ current TB was linked to this TB. Otherwise execute the next
+-instructions.
++instructions. Only indices 0 and 1 are valid and tcg_gen_goto_tb may be issued
++at most once with each slot index per TB.
+
+ * qemu_ld8u t0, t1, flags
+ qemu_ld8s t0, t1, flags
+--
+1.7.12.1
+
--- /dev/null
+From e35e8b9bb446ff2693962151b8c80c5c88294959 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Thu, 13 Sep 2012 19:37:43 +0200
+Subject: [PATCH] w64: Fix TCG helper functions with 5 arguments
+
+TCG uses 6 registers for function arguments on 64 bit Linux hosts,
+but only 4 registers on W64 hosts.
+
+Commit 2999a0b20074a7e4a58f56572bb1436749368f59 increased the number
+of arguments for some important helper functions from 4 to 5
+which triggered a bug for W64 hosts: QEMU aborts when executing
+helper_lcall_real in the guest's BIOS because function
+tcg_target_get_call_iarg_regs_count always returned 6.
+
+As W64 has only 4 registers for arguments, the 5th argument must be
+passed on the stack using a correct stack offset.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/i386/tcg-target.c | 2 +-
+ tcg/i386/tcg-target.h | 4 ++++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
+index aa1fa9f..85c6b81 100644
+--- a/tcg/i386/tcg-target.c
++++ b/tcg/i386/tcg-target.c
+@@ -118,7 +118,7 @@ static void patch_reloc(uint8_t *code_ptr, int type,
+ static inline int tcg_target_get_call_iarg_regs_count(int flags)
+ {
+ if (TCG_TARGET_REG_BITS == 64) {
+- return 6;
++ return ARRAY_SIZE(tcg_target_call_iarg_regs);
+ }
+
+ return 0;
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index b356d76..ace63ba 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -67,7 +67,11 @@ typedef enum {
+ /* used for function call generation */
+ #define TCG_REG_CALL_STACK TCG_REG_ESP
+ #define TCG_TARGET_STACK_ALIGN 16
++#if defined(_WIN64)
++#define TCG_TARGET_CALL_STACK_OFFSET 32
++#else
+ #define TCG_TARGET_CALL_STACK_OFFSET 0
++#endif
+
+ /* optional instructions */
+ #define TCG_TARGET_HAS_div2_i32 1
+--
+1.7.12.1
+
--- /dev/null
+From d65d20819ac52207befffa9a7aa858cc7de9cbaf Mon Sep 17 00:00:00 2001
+From: malc <av1474@comtv.ru>
+Date: Sat, 22 Sep 2012 19:14:33 +0400
+Subject: [PATCH] tcg/ppc32: Implement movcond32
+
+Thanks to Richard Henderson
+
+Signed-off-by: malc <av1474@comtv.ru>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/ppc/tcg-target.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ tcg/ppc/tcg-target.h | 2 +-
+ 2 files changed, 76 insertions(+), 1 deletion(-)
+
+diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
+index 26c4b33..8f8b193 100644
+--- a/tcg/ppc/tcg-target.c
++++ b/tcg/ppc/tcg-target.c
+@@ -390,6 +390,7 @@ static int tcg_target_const_match(tcg_target_long val,
+ #define ORC XO31(412)
+ #define EQV XO31(284)
+ #define NAND XO31(476)
++#define ISEL XO31( 15)
+
+ #define LBZX XO31( 87)
+ #define LHZX XO31(279)
+@@ -1269,6 +1270,72 @@ static void tcg_out_setcond2 (TCGContext *s, const TCGArg *args,
+ );
+ }
+
++static void tcg_out_movcond (TCGContext *s, TCGCond cond,
++ TCGArg dest,
++ TCGArg c1, TCGArg c2,
++ TCGArg v1, TCGArg v2,
++ int const_c2)
++{
++ tcg_out_cmp (s, cond, c1, c2, const_c2, 7);
++
++ if (1) {
++ /* At least here on 7747A bit twiddling hacks are outperformed
++ by jumpy code (the testing was not scientific) */
++ if (dest == v2) {
++ cond = tcg_invert_cond (cond);
++ v2 = v1;
++ }
++ else {
++ if (dest != v1) {
++ tcg_out_mov (s, TCG_TYPE_I32, dest, v1);
++ }
++ }
++ /* Branch forward over one insn */
++ tcg_out32 (s, tcg_to_bc[cond] | 8);
++ tcg_out_mov (s, TCG_TYPE_I32, dest, v2);
++ }
++ else {
++ /* isel version, "if (1)" above should be replaced once a way
++ to figure out availability of isel on the underlying
++ hardware is found */
++ int tab, bc;
++
++ switch (cond) {
++ case TCG_COND_EQ:
++ tab = TAB (dest, v1, v2);
++ bc = CR_EQ;
++ break;
++ case TCG_COND_NE:
++ tab = TAB (dest, v2, v1);
++ bc = CR_EQ;
++ break;
++ case TCG_COND_LTU:
++ case TCG_COND_LT:
++ tab = TAB (dest, v1, v2);
++ bc = CR_LT;
++ break;
++ case TCG_COND_GEU:
++ case TCG_COND_GE:
++ tab = TAB (dest, v2, v1);
++ bc = CR_LT;
++ break;
++ case TCG_COND_LEU:
++ case TCG_COND_LE:
++ tab = TAB (dest, v2, v1);
++ bc = CR_GT;
++ break;
++ case TCG_COND_GTU:
++ case TCG_COND_GT:
++ tab = TAB (dest, v1, v2);
++ bc = CR_GT;
++ break;
++ default:
++ tcg_abort ();
++ }
++ tcg_out32 (s, ISEL | tab | ((bc + 28) << 6));
++ }
++}
++
+ static void tcg_out_brcond (TCGContext *s, TCGCond cond,
+ TCGArg arg1, TCGArg arg2, int const_arg2,
+ int label_index)
+@@ -1826,6 +1893,13 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ );
+ break;
+
++ case INDEX_op_movcond_i32:
++ tcg_out_movcond (s, args[5], args[0],
++ args[1], args[2],
++ args[3], args[4],
++ const_args[2]);
++ break;
++
+ default:
+ tcg_dump_ops (s);
+ tcg_abort ();
+@@ -1922,6 +1996,7 @@ static const TCGTargetOpDef ppc_op_defs[] = {
+ { INDEX_op_ext16u_i32, { "r", "r" } },
+
+ { INDEX_op_deposit_i32, { "r", "0", "r" } },
++ { INDEX_op_movcond_i32, { "r", "r", "ri", "r", "r" } },
+
+ { -1 },
+ };
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
+index 177eea1..3259d89 100644
+--- a/tcg/ppc/tcg-target.h
++++ b/tcg/ppc/tcg-target.h
+@@ -92,7 +92,7 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 1
+ #define TCG_TARGET_HAS_nor_i32 1
+ #define TCG_TARGET_HAS_deposit_i32 1
+-#define TCG_TARGET_HAS_movcond_i32 0
++#define TCG_TARGET_HAS_movcond_i32 1
+
+ #define TCG_AREG0 TCG_REG_R27
+
+--
+1.7.12.1
+
--- /dev/null
+From da65fa6c51ef1c999ffc75a162e95285d4cb915b Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sat, 24 Mar 2012 21:30:20 +0100
+Subject: [PATCH] tcg-sparc: Hack in qemu_ld/st64 for 32-bit.
+
+Not actually implemented, but at least we avoid the tcg assert at startup.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index baed3b4..608fc46 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -1556,6 +1556,9 @@ static const TCGTargetOpDef sparc_op_defs[] = {
+
+ { INDEX_op_brcond_i64, { "r", "rJ" } },
+ { INDEX_op_setcond_i64, { "r", "r", "rJ" } },
++#else
++ { INDEX_op_qemu_ld64, { "L", "L", "L" } },
++ { INDEX_op_qemu_st64, { "L", "L", "L" } },
+ #endif
+ { -1 },
+ };
+--
+1.7.12.1
+
--- /dev/null
+From b92aceeb9604c74e4a66db8ea5dd399d892e94bc Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 23 Mar 2012 23:57:12 +0100
+Subject: [PATCH] tcg-sparc: Fix ADDX opcode.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 608fc46..0a19313 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -236,7 +236,7 @@ static inline int tcg_target_const_match(tcg_target_long val,
+ #define ARITH_XOR (INSN_OP(2) | INSN_OP3(0x03))
+ #define ARITH_SUB (INSN_OP(2) | INSN_OP3(0x04))
+ #define ARITH_SUBCC (INSN_OP(2) | INSN_OP3(0x14))
+-#define ARITH_ADDX (INSN_OP(2) | INSN_OP3(0x10))
++#define ARITH_ADDX (INSN_OP(2) | INSN_OP3(0x08))
+ #define ARITH_SUBX (INSN_OP(2) | INSN_OP3(0x0c))
+ #define ARITH_UMUL (INSN_OP(2) | INSN_OP3(0x0a))
+ #define ARITH_UDIV (INSN_OP(2) | INSN_OP3(0x0e))
+--
+1.7.12.1
+
--- /dev/null
+From 59aadb4f5b15eff968ed00ad29816ac19bef507d Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:40:48 -0700
+Subject: [PATCH] tcg-sparc: Don't MAP_FIXED on top of the program
+
+The address we pick in sparc64.ld is also 0x60000000, so doing a fixed map
+on top of that is guaranteed to blow up. Choosing 0x40000000 is exactly
+right for the max of code_gen_buffer_size set below.
+
+No need to ever use MAP_FIXED. While getting our desired address helps
+optimize the generated code, we won't fail if we don't get it.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ exec.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/exec.c b/exec.c
+index 5834766..871a68a 100644
+--- a/exec.c
++++ b/exec.c
+@@ -543,8 +543,7 @@ static void code_gen_alloc(unsigned long tb_size)
+ code_gen_buffer_size = (800 * 1024 * 1024);
+ #elif defined(__sparc_v9__)
+ // Map the buffer below 2G, so we can use direct calls and branches
+- flags |= MAP_FIXED;
+- start = (void *) 0x60000000UL;
++ start = (void *) 0x40000000UL;
+ if (code_gen_buffer_size > (512 * 1024 * 1024))
+ code_gen_buffer_size = (512 * 1024 * 1024);
+ #elif defined(__arm__)
+@@ -584,8 +583,7 @@ static void code_gen_alloc(unsigned long tb_size)
+ code_gen_buffer_size = (800 * 1024 * 1024);
+ #elif defined(__sparc_v9__)
+ // Map the buffer below 2G, so we can use direct calls and branches
+- flags |= MAP_FIXED;
+- addr = (void *) 0x60000000UL;
++ addr = (void *) 0x40000000UL;
+ if (code_gen_buffer_size > (512 * 1024 * 1024)) {
+ code_gen_buffer_size = (512 * 1024 * 1024);
+ }
+--
+1.7.12.1
+
--- /dev/null
+From cf873edf4227be439a9ffa5abb3da61ff1fd6527 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:34:21 -0700
+Subject: [PATCH] tcg-sparc: Assume v9 cpu always, i.e. force v8plus in 32-bit
+ mode.
+
+Current code doesn't actually work in 32-bit mode at all. Since
+no one really noticed, drop the complication of v7 and v8 cpus.
+Eliminate the --sparc_cpu configure option and standardize macro
+testing on TCG_TARGET_REG_BITS / HOST_LONG_BITS
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 40 ++++------------------------------------
+ disas.c | 2 --
+ exec.c | 6 +++---
+ qemu-timer.h | 8 +++++---
+ tcg/sparc/tcg-target.c | 20 +++++---------------
+ tcg/sparc/tcg-target.h | 7 ++++---
+ tcg/tcg.c | 3 ++-
+ 7 files changed, 23 insertions(+), 63 deletions(-)
+
+diff --git a/configure b/configure
+index 816f0f9..0590f16 100755
+--- a/configure
++++ b/configure
+@@ -111,7 +111,6 @@ source_path=`dirname "$0"`
+ cpu=""
+ interp_prefix="/usr/gnemul/qemu-%M"
+ static="no"
+-sparc_cpu=""
+ cross_prefix=""
+ audio_drv_list=""
+ audio_card_list="ac97 es1370 sb16 hda"
+@@ -249,21 +248,6 @@ for opt do
+ ;;
+ --disable-debug-info) debug_info="no"
+ ;;
+- --sparc_cpu=*)
+- sparc_cpu="$optarg"
+- case $sparc_cpu in
+- v7|v8|v8plus|v8plusa)
+- cpu="sparc"
+- ;;
+- v9)
+- cpu="sparc64"
+- ;;
+- *)
+- echo "undefined SPARC architecture. Exiting";
+- exit 1
+- ;;
+- esac
+- ;;
+ esac
+ done
+ # OS specific
+@@ -351,8 +335,6 @@ elif check_define __i386__ ; then
+ elif check_define __x86_64__ ; then
+ cpu="x86_64"
+ elif check_define __sparc__ ; then
+- # We can't check for 64 bit (when gcc is biarch) or V8PLUSA
+- # They must be specified using --sparc_cpu
+ if check_define __arch64__ ; then
+ cpu="sparc64"
+ else
+@@ -798,8 +780,6 @@ for opt do
+ ;;
+ --enable-uname-release=*) uname_release="$optarg"
+ ;;
+- --sparc_cpu=*)
+- ;;
+ --enable-werror) werror="yes"
+ ;;
+ --disable-werror) werror="no"
+@@ -883,31 +863,19 @@ for opt do
+ esac
+ done
+
+-#
+-# If cpu ~= sparc and sparc_cpu hasn't been defined, plug in the right
+-# QEMU_CFLAGS/LDFLAGS (assume sparc_v8plus for 32-bit and sparc_v9 for 64-bit)
+-#
+ host_guest_base="no"
+ case "$cpu" in
+- sparc) case $sparc_cpu in
+- v7|v8)
+- QEMU_CFLAGS="-mcpu=${sparc_cpu} -D__sparc_${sparc_cpu}__ $QEMU_CFLAGS"
+- ;;
+- v8plus|v8plusa)
+- QEMU_CFLAGS="-mcpu=ultrasparc -D__sparc_${sparc_cpu}__ $QEMU_CFLAGS"
+- ;;
+- *) # sparc_cpu not defined in the command line
+- QEMU_CFLAGS="-mcpu=ultrasparc -D__sparc_v8plus__ $QEMU_CFLAGS"
+- esac
++ sparc)
+ LDFLAGS="-m32 $LDFLAGS"
+- QEMU_CFLAGS="-m32 -ffixed-g2 -ffixed-g3 $QEMU_CFLAGS"
++ QEMU_CFLAGS="-m32 -mcpu=ultrasparc $QEMU_CFLAGS"
++ QEMU_CFLAGS="-ffixed-g2 -ffixed-g3 $QEMU_CFLAGS"
+ if test "$solaris" = "no" ; then
+ QEMU_CFLAGS="-ffixed-g1 -ffixed-g6 $QEMU_CFLAGS"
+ fi
+ ;;
+ sparc64)
+- QEMU_CFLAGS="-m64 -mcpu=ultrasparc -D__sparc_v9__ $QEMU_CFLAGS"
+ LDFLAGS="-m64 $LDFLAGS"
++ QEMU_CFLAGS="-m64 -mcpu=ultrasparc $QEMU_CFLAGS"
+ QEMU_CFLAGS="-ffixed-g5 -ffixed-g6 -ffixed-g7 $QEMU_CFLAGS"
+ if test "$solaris" != "no" ; then
+ QEMU_CFLAGS="-ffixed-g1 $QEMU_CFLAGS"
+diff --git a/disas.c b/disas.c
+index 7b2acc9..b801c8f 100644
+--- a/disas.c
++++ b/disas.c
+@@ -316,9 +316,7 @@ void disas(FILE *out, void *code, unsigned long size)
+ print_insn = print_insn_alpha;
+ #elif defined(__sparc__)
+ print_insn = print_insn_sparc;
+-#if defined(__sparc_v8plus__) || defined(__sparc_v8plusa__) || defined(__sparc_v9__)
+ disasm_info.mach = bfd_mach_sparc_v9b;
+-#endif
+ #elif defined(__arm__)
+ print_insn = print_insn_arm;
+ #elif defined(__MIPSEB__)
+diff --git a/exec.c b/exec.c
+index 871a68a..ad175db 100644
+--- a/exec.c
++++ b/exec.c
+@@ -86,7 +86,7 @@ static int nb_tbs;
+ /* any access to the tbs or the page table must use this lock */
+ spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
+
+-#if defined(__arm__) || defined(__sparc_v9__)
++#if defined(__arm__) || defined(__sparc__)
+ /* The prologue must be reachable with a direct jump. ARM and Sparc64
+ have limited branch ranges (possibly also PPC) so place it in a
+ section close to code segment. */
+@@ -541,7 +541,7 @@ static void code_gen_alloc(unsigned long tb_size)
+ /* Cannot map more than that */
+ if (code_gen_buffer_size > (800 * 1024 * 1024))
+ code_gen_buffer_size = (800 * 1024 * 1024);
+-#elif defined(__sparc_v9__)
++#elif defined(__sparc__) && HOST_LONG_BITS == 64
+ // Map the buffer below 2G, so we can use direct calls and branches
+ start = (void *) 0x40000000UL;
+ if (code_gen_buffer_size > (512 * 1024 * 1024))
+@@ -581,7 +581,7 @@ static void code_gen_alloc(unsigned long tb_size)
+ /* Cannot map more than that */
+ if (code_gen_buffer_size > (800 * 1024 * 1024))
+ code_gen_buffer_size = (800 * 1024 * 1024);
+-#elif defined(__sparc_v9__)
++#elif defined(__sparc__) && HOST_LONG_BITS == 64
+ // Map the buffer below 2G, so we can use direct calls and branches
+ addr = (void *) 0x40000000UL;
+ if (code_gen_buffer_size > (512 * 1024 * 1024)) {
+diff --git a/qemu-timer.h b/qemu-timer.h
+index f8af595..da7e97c 100644
+--- a/qemu-timer.h
++++ b/qemu-timer.h
+@@ -218,7 +218,7 @@ static inline int64_t cpu_get_real_ticks(void)
+ return val;
+ }
+
+-#elif defined(__sparc_v8plus__) || defined(__sparc_v8plusa__) || defined(__sparc_v9__)
++#elif defined(__sparc__)
+
+ static inline int64_t cpu_get_real_ticks (void)
+ {
+@@ -227,6 +227,8 @@ static inline int64_t cpu_get_real_ticks (void)
+ asm volatile("rd %%tick,%0" : "=r"(rval));
+ return rval;
+ #else
++ /* We need an %o or %g register for this. For recent enough gcc
++ there is an "h" constraint for that. Don't bother with that. */
+ union {
+ uint64_t i64;
+ struct {
+@@ -234,8 +236,8 @@ static inline int64_t cpu_get_real_ticks (void)
+ uint32_t low;
+ } i32;
+ } rval;
+- asm volatile("rd %%tick,%1; srlx %1,32,%0"
+- : "=r"(rval.i32.high), "=r"(rval.i32.low));
++ asm volatile("rd %%tick,%%g1; srlx %%g1,32,%0; mov %%g1,%1"
++ : "=r"(rval.i32.high), "=r"(rval.i32.low) : : "g1");
+ return rval.i64;
+ #endif
+ }
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 0a19313..23c2fda 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -621,18 +621,10 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGArg ret,
+
+ default:
+ tcg_out_cmp(s, c1, c2, c2const);
+-#if defined(__sparc_v9__) || defined(__sparc_v8plus__)
+ tcg_out_movi_imm13(s, ret, 0);
+- tcg_out32 (s, ARITH_MOVCC | INSN_RD(ret)
+- | INSN_RS1(tcg_cond_to_bcond[cond])
+- | MOVCC_ICC | INSN_IMM11(1));
+-#else
+- t = gen_new_label();
+- tcg_out_branch_i32(s, INSN_COND(tcg_cond_to_bcond[cond], 1), t);
+- tcg_out_movi_imm13(s, ret, 1);
+- tcg_out_movi_imm13(s, ret, 0);
+- tcg_out_label(s, t, s->code_ptr);
+-#endif
++ tcg_out32(s, ARITH_MOVCC | INSN_RD(ret)
++ | INSN_RS1(tcg_cond_to_bcond[cond])
++ | MOVCC_ICC | INSN_IMM11(1));
+ return;
+ }
+
+@@ -742,7 +734,7 @@ static const void * const qemu_st_helpers[4] = {
+ #endif
+ #endif
+
+-#ifdef __arch64__
++#if TCG_TARGET_REG_BITS == 64
+ #define HOST_LD_OP LDX
+ #define HOST_ST_OP STX
+ #define HOST_SLL_OP SHIFT_SLLX
+@@ -1600,11 +1592,9 @@ static void tcg_target_init(TCGContext *s)
+
+ #if TCG_TARGET_REG_BITS == 64
+ # define ELF_HOST_MACHINE EM_SPARCV9
+-#elif defined(__sparc_v8plus__)
++#else
+ # define ELF_HOST_MACHINE EM_SPARC32PLUS
+ # define ELF_HOST_FLAGS EF_SPARC_32PLUS
+-#else
+-# define ELF_HOST_MACHINE EM_SPARC
+ #endif
+
+ typedef struct {
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index d762574..adca1d2 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -67,7 +67,8 @@ typedef enum {
+
+ /* used for function call generation */
+ #define TCG_REG_CALL_STACK TCG_REG_I6
+-#ifdef __arch64__
++
++#if TCG_TARGET_REG_BITS == 64
+ // Reserve space for AREG0
+ #define TCG_TARGET_STACK_MINFRAME (176 + 4 * (int)sizeof(long) + \
+ TCG_STATIC_CALL_ARGS_SIZE)
+@@ -81,7 +82,7 @@ typedef enum {
+ #define TCG_TARGET_STACK_ALIGN 8
+ #endif
+
+-#ifdef __arch64__
++#if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_EXTEND_ARGS 1
+ #endif
+
+@@ -129,7 +130,7 @@ typedef enum {
+
+ #ifdef CONFIG_SOLARIS
+ #define TCG_AREG0 TCG_REG_G2
+-#elif defined(__sparc_v9__)
++#elif HOST_LONG_BITS == 64
+ #define TCG_AREG0 TCG_REG_G5
+ #else
+ #define TCG_AREG0 TCG_REG_G6
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index 93421cd..16c4e1d 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -1450,7 +1450,8 @@ static void temp_allocate_frame(TCGContext *s, int temp)
+ {
+ TCGTemp *ts;
+ ts = &s->temps[temp];
+-#ifndef __sparc_v9__ /* Sparc64 stack is accessed with offset of 2047 */
++#if !(defined(__sparc__) && TCG_TARGET_REG_BITS == 64)
++ /* Sparc64 stack is accessed with offset of 2047 */
+ s->current_frame_offset = (s->current_frame_offset +
+ (tcg_target_long)sizeof(tcg_target_long) - 1) &
+ ~(sizeof(tcg_target_long) - 1);
+--
+1.7.12.1
+
--- /dev/null
+From 138dfa905538bf918af390ff365a27de49364578 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 23 Mar 2012 23:27:39 +0100
+Subject: [PATCH] tcg-sparc: Fix qemu_ld/st to handle 32-bit host.
+
+At the same time, split out the tlb load logic to a new function.
+Fixes the cases of two data registers and two address registers.
+Fixes the signature of, and adds missing, qemu_ld/st opcodes.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 777 ++++++++++++++++++++++---------------------------
+ 1 file changed, 348 insertions(+), 429 deletions(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 23c2fda..d89c19b 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -59,8 +59,6 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+ };
+ #endif
+
+-#define ARG_OFFSET 1
+-
+ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_L0,
+ TCG_REG_L1,
+@@ -288,6 +286,16 @@ static inline int tcg_target_const_match(tcg_target_long val,
+ #define ASI_PRIMARY_LITTLE 0x88
+ #endif
+
++#define LDUH_LE (LDUHA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define LDSH_LE (LDSHA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define LDUW_LE (LDUWA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define LDSW_LE (LDSWA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define LDX_LE (LDXA | INSN_ASI(ASI_PRIMARY_LITTLE))
++
++#define STH_LE (STHA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define STW_LE (STWA | INSN_ASI(ASI_PRIMARY_LITTLE))
++#define STX_LE (STXA | INSN_ASI(ASI_PRIMARY_LITTLE))
++
+ static inline void tcg_out_arith(TCGContext *s, int rd, int rs1, int rs2,
+ int op)
+ {
+@@ -360,64 +368,43 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
+ }
+ }
+
+-static inline void tcg_out_ld_raw(TCGContext *s, int ret,
+- tcg_target_long arg)
+-{
+- tcg_out_sethi(s, ret, arg);
+- tcg_out32(s, LDUW | INSN_RD(ret) | INSN_RS1(ret) |
+- INSN_IMM13(arg & 0x3ff));
+-}
+-
+-static inline void tcg_out_ld_ptr(TCGContext *s, int ret,
+- tcg_target_long arg)
++static inline void tcg_out_ldst_rr(TCGContext *s, int data, int a1,
++ int a2, int op)
+ {
+- if (!check_fit_tl(arg, 10))
+- tcg_out_movi(s, TCG_TYPE_PTR, ret, arg & ~0x3ffULL);
+- if (TCG_TARGET_REG_BITS == 64) {
+- tcg_out32(s, LDX | INSN_RD(ret) | INSN_RS1(ret) |
+- INSN_IMM13(arg & 0x3ff));
+- } else {
+- tcg_out32(s, LDUW | INSN_RD(ret) | INSN_RS1(ret) |
+- INSN_IMM13(arg & 0x3ff));
+- }
++ tcg_out32(s, op | INSN_RD(data) | INSN_RS1(a1) | INSN_RS2(a2));
+ }
+
+-static inline void tcg_out_ldst(TCGContext *s, int ret, int addr, int offset, int op)
++static inline void tcg_out_ldst(TCGContext *s, int ret, int addr,
++ int offset, int op)
+ {
+- if (check_fit_tl(offset, 13))
++ if (check_fit_tl(offset, 13)) {
+ tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(addr) |
+ INSN_IMM13(offset));
+- else {
++ } else {
+ tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, offset);
+- tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(TCG_REG_I5) |
+- INSN_RS2(addr));
++ tcg_out_ldst_rr(s, ret, addr, TCG_REG_I5, op);
+ }
+ }
+
+-static inline void tcg_out_ldst_asi(TCGContext *s, int ret, int addr,
+- int offset, int op, int asi)
+-{
+- tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, offset);
+- tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(TCG_REG_I5) |
+- INSN_ASI(asi) | INSN_RS2(addr));
+-}
+-
+ static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret,
+ TCGReg arg1, tcg_target_long arg2)
+ {
+- if (type == TCG_TYPE_I32)
+- tcg_out_ldst(s, ret, arg1, arg2, LDUW);
+- else
+- tcg_out_ldst(s, ret, arg1, arg2, LDX);
++ tcg_out_ldst(s, ret, arg1, arg2, (type == TCG_TYPE_I32 ? LDUW : LDX));
+ }
+
+ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+ TCGReg arg1, tcg_target_long arg2)
+ {
+- if (type == TCG_TYPE_I32)
+- tcg_out_ldst(s, arg, arg1, arg2, STW);
+- else
+- tcg_out_ldst(s, arg, arg1, arg2, STX);
++ tcg_out_ldst(s, arg, arg1, arg2, (type == TCG_TYPE_I32 ? STW : STX));
++}
++
++static inline void tcg_out_ld_ptr(TCGContext *s, int ret,
++ tcg_target_long arg)
++{
++ if (!check_fit_tl(arg, 10)) {
++ tcg_out_movi(s, TCG_TYPE_PTR, ret, arg & ~0x3ff);
++ }
++ tcg_out_ld(s, TCG_TYPE_PTR, ret, ret, arg & 0x3ff);
+ }
+
+ static inline void tcg_out_sety(TCGContext *s, int rs)
+@@ -442,14 +429,15 @@ static inline void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+ }
+ }
+
+-static inline void tcg_out_andi(TCGContext *s, int reg, tcg_target_long val)
++static inline void tcg_out_andi(TCGContext *s, int rd, int rs,
++ tcg_target_long val)
+ {
+ if (val != 0) {
+ if (check_fit_tl(val, 13))
+- tcg_out_arithi(s, reg, reg, val, ARITH_AND);
++ tcg_out_arithi(s, rd, rs, val, ARITH_AND);
+ else {
+ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, val);
+- tcg_out_arith(s, reg, reg, TCG_REG_I5, ARITH_AND);
++ tcg_out_arith(s, rd, rs, TCG_REG_I5, ARITH_AND);
+ }
+ }
+ }
+@@ -718,418 +706,328 @@ static const void * const qemu_st_helpers[4] = {
+ helper_stl_mmu,
+ helper_stq_mmu,
+ };
+-#endif
+
+-#if TARGET_LONG_BITS == 32
+-#define TARGET_LD_OP LDUW
+-#else
+-#define TARGET_LD_OP LDX
+-#endif
++/* Perform the TLB load and compare.
+
+-#if defined(CONFIG_SOFTMMU)
+-#if HOST_LONG_BITS == 32
+-#define TARGET_ADDEND_LD_OP LDUW
++ Inputs:
++ ADDRLO_IDX contains the index into ARGS of the low part of the
++ address; the high part of the address is at ADDR_LOW_IDX+1.
++
++ MEM_INDEX and S_BITS are the memory context and log2 size of the load.
++
++ WHICH is the offset into the CPUTLBEntry structure of the slot to read.
++ This should be offsetof addr_read or addr_write.
++
++ The result of the TLB comparison is in %[ix]cc. The sanitized address
++ is in the returned register, maybe %o0. The TLB addend is in %o1. */
++
++static int tcg_out_tlb_load(TCGContext *s, int addrlo_idx, int mem_index,
++ int s_bits, const TCGArg *args, int which)
++{
++ const int addrlo = args[addrlo_idx];
++ const int r0 = TCG_REG_O0;
++ const int r1 = TCG_REG_O1;
++ const int r2 = TCG_REG_O2;
++ int addr = addrlo;
++ int tlb_ofs;
++
++ if (TCG_TARGET_REG_BITS == 32 && TARGET_LONG_BITS == 64) {
++ /* Assemble the 64-bit address in R0. */
++ tcg_out_arithi(s, r0, addrlo, 0, SHIFT_SRL);
++ tcg_out_arithi(s, r1, args[addrlo_idx + 1], 32, SHIFT_SLLX);
++ tcg_out_arith(s, r0, r0, r1, ARITH_OR);
++ }
++
++ /* Shift the page number down to tlb-entry. */
++ tcg_out_arithi(s, r1, addrlo,
++ TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS, SHIFT_SRL);
++
++ /* Mask out the page offset, except for the required alignment. */
++ tcg_out_andi(s, r0, addr, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
++
++ /* Compute tlb index, modulo tlb size. */
++ tcg_out_andi(s, r1, r1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
++
++ /* Relative to the current ENV. */
++ tcg_out_arith(s, r1, TCG_AREG0, r1, ARITH_ADD);
++
++ /* Find a base address that can load both tlb comparator and addend. */
++ tlb_ofs = offsetof(CPUArchState, tlb_table[mem_index][0]);
++ if (!check_fit_tl(tlb_ofs + sizeof(CPUTLBEntry), 13)) {
++ tcg_out_addi(s, r1, tlb_ofs);
++ tlb_ofs = 0;
++ }
++
++ /* Load the tlb comparator and the addend. */
++ tcg_out_ld(s, TCG_TYPE_TL, r2, r1, tlb_ofs + which);
++ tcg_out_ld(s, TCG_TYPE_PTR, r1, r1, tlb_ofs+offsetof(CPUTLBEntry, addend));
++
++ /* subcc arg0, arg2, %g0 */
++ tcg_out_cmp(s, r0, r2, 0);
++
++ /* If the guest address must be zero-extended, do so now. */
++ if (TCG_TARGET_REG_BITS == 64 && TARGET_LONG_BITS == 32) {
++ tcg_out_arithi(s, r0, addrlo, 0, SHIFT_SRL);
++ return r0;
++ }
++ return addrlo;
++}
++#endif /* CONFIG_SOFTMMU */
++
++static const int qemu_ld_opc[8] = {
++#ifdef TARGET_WORDS_BIGENDIAN
++ LDUB, LDUH, LDUW, LDX, LDSB, LDSH, LDSW, LDX
+ #else
+-#define TARGET_ADDEND_LD_OP LDX
+-#endif
++ LDUB, LDUH_LE, LDUW_LE, LDX_LE, LDSB, LDSH_LE, LDSW_LE, LDX_LE
+ #endif
++};
+
+-#if TCG_TARGET_REG_BITS == 64
+-#define HOST_LD_OP LDX
+-#define HOST_ST_OP STX
+-#define HOST_SLL_OP SHIFT_SLLX
+-#define HOST_SRA_OP SHIFT_SRAX
++static const int qemu_st_opc[4] = {
++#ifdef TARGET_WORDS_BIGENDIAN
++ STB, STH, STW, STX
+ #else
+-#define HOST_LD_OP LDUW
+-#define HOST_ST_OP STW
+-#define HOST_SLL_OP SHIFT_SLL
+-#define HOST_SRA_OP SHIFT_SRA
++ STB, STH_LE, STW_LE, STX_LE
+ #endif
++};
+
+-static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+- int opc)
++static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
+ {
+- int addr_reg, data_reg, arg0, arg1, arg2, mem_index, s_bits;
++ int addrlo_idx = 1, datalo, datahi, addr_reg;
+ #if defined(CONFIG_SOFTMMU)
+- uint32_t *label1_ptr, *label2_ptr;
++ int memi_idx, memi, s_bits, n;
++ uint32_t *label_ptr[2];
+ #endif
+
+- data_reg = *args++;
+- addr_reg = *args++;
+- mem_index = *args;
+- s_bits = opc & 3;
+-
+- arg0 = TCG_REG_O0;
+- arg1 = TCG_REG_O1;
+- arg2 = TCG_REG_O2;
++ datahi = datalo = args[0];
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ datahi = args[1];
++ addrlo_idx = 2;
++ }
+
+ #if defined(CONFIG_SOFTMMU)
+- /* srl addr_reg, x, arg1 */
+- tcg_out_arithi(s, arg1, addr_reg, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS,
+- SHIFT_SRL);
+- /* and addr_reg, x, arg0 */
+- tcg_out_arithi(s, arg0, addr_reg, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+- ARITH_AND);
++ memi_idx = addrlo_idx + 1 + (TARGET_LONG_BITS > TCG_TARGET_REG_BITS);
++ memi = args[memi_idx];
++ s_bits = sizeop & 3;
++
++ addr_reg = tcg_out_tlb_load(s, addrlo_idx, memi, s_bits, args,
++ offsetof(CPUTLBEntry, addr_read));
++
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ int reg64;
++
++ /* bne,pn %[xi]cc, label0 */
++ label_ptr[0] = (uint32_t *)s->code_ptr;
++ tcg_out32(s, (INSN_OP(0) | INSN_COND(COND_NE, 0) | INSN_OP2(0x1)
++ | ((TARGET_LONG_BITS == 64) << 21)));
++
++ /* TLB Hit. */
++ /* Load all 64-bits into an O/G register. */
++ reg64 = (datalo < 16 ? datalo : TCG_REG_O0);
++ tcg_out_ldst_rr(s, reg64, addr_reg, TCG_REG_O1, qemu_ld_opc[sizeop]);
++
++ /* Move the two 32-bit pieces into the destination registers. */
++ tcg_out_arithi(s, datahi, reg64, 32, SHIFT_SRLX);
++ if (reg64 != datalo) {
++ tcg_out_mov(s, TCG_TYPE_I32, datalo, reg64);
++ }
+
+- /* and arg1, x, arg1 */
+- tcg_out_andi(s, arg1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
++ /* b,a,pt label1 */
++ label_ptr[1] = (uint32_t *)s->code_ptr;
++ tcg_out32(s, (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x1)
++ | (1 << 29) | (1 << 19)));
++ } else {
++ /* The fast path is exactly one insn. Thus we can perform the
++ entire TLB Hit in the (annulled) delay slot of the branch
++ over the TLB Miss case. */
++
++ /* beq,a,pt %[xi]cc, label0 */
++ label_ptr[0] = NULL;
++ label_ptr[1] = (uint32_t *)s->code_ptr;
++ tcg_out32(s, (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x1)
++ | ((TARGET_LONG_BITS == 64) << 21)
++ | (1 << 29) | (1 << 19)));
++ /* delay slot */
++ tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_O1, qemu_ld_opc[sizeop]);
++ }
+
+- /* add arg1, x, arg1 */
+- tcg_out_addi(s, arg1, offsetof(CPUArchState,
+- tlb_table[mem_index][0].addr_read));
++ /* TLB Miss. */
+
+- /* add env, arg1, arg1 */
+- tcg_out_arith(s, arg1, TCG_AREG0, arg1, ARITH_ADD);
++ if (label_ptr[0]) {
++ *label_ptr[0] |= INSN_OFF19((unsigned long)s->code_ptr -
++ (unsigned long)label_ptr[0]);
++ }
++ n = 0;
++ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[n++], TCG_AREG0);
++ if (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) {
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++],
++ args[addrlo_idx + 1]);
++ }
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++],
++ args[addrlo_idx]);
+
+- /* ld [arg1], arg2 */
+- tcg_out32(s, TARGET_LD_OP | INSN_RD(arg2) | INSN_RS1(arg1) |
+- INSN_RS2(TCG_REG_G0));
++ /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
++ global registers */
++ tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
+
+- /* subcc arg0, arg2, %g0 */
+- tcg_out_arith(s, TCG_REG_G0, arg0, arg2, ARITH_SUBCC);
+-
+- /* will become:
+- be label1
+- or
+- be,pt %xcc label1 */
+- label1_ptr = (uint32_t *)s->code_ptr;
+- tcg_out32(s, 0);
+-
+- /* mov (delay slot) */
+- tcg_out_mov(s, TCG_TYPE_PTR, arg0, addr_reg);
+-
+- /* mov */
+- tcg_out_movi(s, TCG_TYPE_I32, arg1, mem_index);
+- /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+- tcg_target_call_iarg_regs[2]);
+- tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+- tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
+- tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+- TCG_AREG0);
+-
+- /* XXX: move that code at the end of the TB */
+ /* qemu_ld_helper[s_bits](arg0, arg1) */
+ tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_ld_helpers[s_bits]
+ - (tcg_target_ulong)s->code_ptr) >> 2)
+ & 0x3fffffff));
+- /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+- global registers */
+- // delay slot
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_ST_OP);
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_LD_OP);
+-
+- /* data_reg = sign_extend(arg0) */
+- switch(opc) {
++ /* delay slot */
++ tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[n], memi);
++
++ /* Reload AREG0. */
++ tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
++
++ n = tcg_target_call_oarg_regs[0];
++ /* datalo = sign_extend(arg0) */
++ switch (sizeop) {
+ case 0 | 4:
+- /* sll arg0, 24/56, data_reg */
+- tcg_out_arithi(s, data_reg, arg0, (int)sizeof(tcg_target_long) * 8 - 8,
+- HOST_SLL_OP);
+- /* sra data_reg, 24/56, data_reg */
+- tcg_out_arithi(s, data_reg, data_reg,
+- (int)sizeof(tcg_target_long) * 8 - 8, HOST_SRA_OP);
++ /* Recall that SRA sign extends from bit 31 through bit 63. */
++ tcg_out_arithi(s, datalo, n, 24, SHIFT_SLL);
++ tcg_out_arithi(s, datalo, datalo, 24, SHIFT_SRA);
+ break;
+ case 1 | 4:
+- /* sll arg0, 16/48, data_reg */
+- tcg_out_arithi(s, data_reg, arg0,
+- (int)sizeof(tcg_target_long) * 8 - 16, HOST_SLL_OP);
+- /* sra data_reg, 16/48, data_reg */
+- tcg_out_arithi(s, data_reg, data_reg,
+- (int)sizeof(tcg_target_long) * 8 - 16, HOST_SRA_OP);
++ tcg_out_arithi(s, datalo, n, 16, SHIFT_SLL);
++ tcg_out_arithi(s, datalo, datalo, 16, SHIFT_SRA);
+ break;
+ case 2 | 4:
+- /* sll arg0, 32, data_reg */
+- tcg_out_arithi(s, data_reg, arg0, 32, HOST_SLL_OP);
+- /* sra data_reg, 32, data_reg */
+- tcg_out_arithi(s, data_reg, data_reg, 32, HOST_SRA_OP);
++ tcg_out_arithi(s, datalo, n, 0, SHIFT_SRA);
+ break;
++ case 3:
++ if (TCG_TARGET_REG_BITS == 32) {
++ tcg_out_mov(s, TCG_TYPE_REG, datahi, n);
++ tcg_out_mov(s, TCG_TYPE_REG, datalo, n + 1);
++ break;
++ }
++ /* FALLTHRU */
+ case 0:
+ case 1:
+ case 2:
+- case 3:
+ default:
+ /* mov */
+- tcg_out_mov(s, TCG_TYPE_REG, data_reg, arg0);
++ tcg_out_mov(s, TCG_TYPE_REG, datalo, n);
+ break;
+ }
+
+- /* will become:
+- ba label2 */
+- label2_ptr = (uint32_t *)s->code_ptr;
+- tcg_out32(s, 0);
+-
+- /* nop (delay slot */
+- tcg_out_nop(s);
+-
+- /* label1: */
+-#if TARGET_LONG_BITS == 32
+- /* be label1 */
+- *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x2) |
+- INSN_OFF22((unsigned long)s->code_ptr -
+- (unsigned long)label1_ptr));
+-#else
+- /* be,pt %xcc label1 */
+- *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x1) |
+- (0x5 << 19) | INSN_OFF19((unsigned long)s->code_ptr -
+- (unsigned long)label1_ptr));
+-#endif
+-
+- /* ld [arg1 + x], arg1 */
+- tcg_out_ldst(s, arg1, arg1, offsetof(CPUTLBEntry, addend) -
+- offsetof(CPUTLBEntry, addr_read), TARGET_ADDEND_LD_OP);
+-
+-#if TARGET_LONG_BITS == 32
+- /* and addr_reg, x, arg0 */
+- tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, 0xffffffff);
+- tcg_out_arith(s, arg0, addr_reg, TCG_REG_I5, ARITH_AND);
+- /* add arg0, arg1, arg0 */
+- tcg_out_arith(s, arg0, arg0, arg1, ARITH_ADD);
++ *label_ptr[1] |= INSN_OFF19((unsigned long)s->code_ptr -
++ (unsigned long)label_ptr[1]);
+ #else
+- /* add addr_reg, arg1, arg0 */
+- tcg_out_arith(s, arg0, addr_reg, arg1, ARITH_ADD);
+-#endif
++ addr_reg = args[addrlo_idx];
++ if (TCG_TARGET_REG_BITS == 64 && TARGET_LONG_BITS == 32) {
++ tcg_out_arithi(s, TCG_REG_I5, addr_reg, 0, SHIFT_SRL);
++ addr_reg = TCG_REG_I5;
++ }
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ int reg64 = (datalo < 16 ? datalo : TCG_REG_O0);
+
+-#else
+- arg0 = addr_reg;
+-#endif
++ tcg_out_ldst_rr(s, reg64, addr_reg, TCG_REG_G0, qemu_ld_opc[sizeop]);
+
+- switch(opc) {
+- case 0:
+- /* ldub [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDUB);
+- break;
+- case 0 | 4:
+- /* ldsb [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDSB);
+- break;
+- case 1:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* lduh [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDUH);
+-#else
+- /* lduha [arg0] ASI_PRIMARY_LITTLE, data_reg */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, LDUHA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 1 | 4:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* ldsh [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDSH);
+-#else
+- /* ldsha [arg0] ASI_PRIMARY_LITTLE, data_reg */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, LDSHA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 2:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* lduw [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDUW);
+-#else
+- /* lduwa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, LDUWA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 2 | 4:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* ldsw [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDSW);
+-#else
+- /* ldswa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, LDSWA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 3:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* ldx [arg0], data_reg */
+- tcg_out_ldst(s, data_reg, arg0, 0, LDX);
+-#else
+- /* ldxa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, LDXA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- default:
+- tcg_abort();
++ tcg_out_arithi(s, datahi, reg64, 32, SHIFT_SRLX);
++ if (reg64 != datalo) {
++ tcg_out_mov(s, TCG_TYPE_I32, datalo, reg64);
++ }
++ } else {
++ tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_G0, qemu_ld_opc[sizeop]);
+ }
+-
+-#if defined(CONFIG_SOFTMMU)
+- /* label2: */
+- *label2_ptr = (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x2) |
+- INSN_OFF22((unsigned long)s->code_ptr -
+- (unsigned long)label2_ptr));
+-#endif
++#endif /* CONFIG_SOFTMMU */
+ }
+
+-static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+- int opc)
++static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ {
+- int addr_reg, data_reg, arg0, arg1, arg2, mem_index, s_bits;
++ int addrlo_idx = 1, datalo, datahi, addr_reg;
+ #if defined(CONFIG_SOFTMMU)
+- uint32_t *label1_ptr, *label2_ptr;
++ int memi_idx, memi, n;
++ uint32_t *label_ptr;
+ #endif
+
+- data_reg = *args++;
+- addr_reg = *args++;
+- mem_index = *args;
+-
+- s_bits = opc;
+-
+- arg0 = TCG_REG_O0;
+- arg1 = TCG_REG_O1;
+- arg2 = TCG_REG_O2;
++ datahi = datalo = args[0];
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ datahi = args[1];
++ addrlo_idx = 2;
++ }
+
+ #if defined(CONFIG_SOFTMMU)
+- /* srl addr_reg, x, arg1 */
+- tcg_out_arithi(s, arg1, addr_reg, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS,
+- SHIFT_SRL);
+-
+- /* and addr_reg, x, arg0 */
+- tcg_out_arithi(s, arg0, addr_reg, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+- ARITH_AND);
+-
+- /* and arg1, x, arg1 */
+- tcg_out_andi(s, arg1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+-
+- /* add arg1, x, arg1 */
+- tcg_out_addi(s, arg1, offsetof(CPUArchState,
+- tlb_table[mem_index][0].addr_write));
++ memi_idx = addrlo_idx + 1 + (TARGET_LONG_BITS > TCG_TARGET_REG_BITS);
++ memi = args[memi_idx];
++
++ addr_reg = tcg_out_tlb_load(s, addrlo_idx, memi, sizeop, args,
++ offsetof(CPUTLBEntry, addr_write));
++
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ /* Reconstruct the full 64-bit value in %g1, using %o2 as temp. */
++ /* ??? Redefine the temps from %i4/%i5 so that we have a o/g temp. */
++ tcg_out_arithi(s, TCG_REG_G1, datalo, 0, SHIFT_SRL);
++ tcg_out_arithi(s, TCG_REG_O2, datahi, 32, SHIFT_SLLX);
++ tcg_out_arith(s, TCG_REG_G1, TCG_REG_G1, TCG_REG_O2, ARITH_OR);
++ datalo = TCG_REG_G1;
++ }
+
+- /* add env, arg1, arg1 */
+- tcg_out_arith(s, arg1, TCG_AREG0, arg1, ARITH_ADD);
++ /* The fast path is exactly one insn. Thus we can perform the entire
++ TLB Hit in the (annulled) delay slot of the branch over TLB Miss. */
++ /* beq,a,pt %[xi]cc, label0 */
++ label_ptr = (uint32_t *)s->code_ptr;
++ tcg_out32(s, (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x1)
++ | ((TARGET_LONG_BITS == 64) << 21)
++ | (1 << 29) | (1 << 19)));
++ /* delay slot */
++ tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_O1, qemu_st_opc[sizeop]);
++
++ /* TLB Miss. */
++
++ n = 0;
++ tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[n++], TCG_AREG0);
++ if (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) {
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++],
++ args[addrlo_idx + 1]);
++ }
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++],
++ args[addrlo_idx]);
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++], datahi);
++ }
++ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++], datalo);
+
+- /* ld [arg1], arg2 */
+- tcg_out32(s, TARGET_LD_OP | INSN_RD(arg2) | INSN_RS1(arg1) |
+- INSN_RS2(TCG_REG_G0));
++ /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
++ global registers */
++ tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
+
+- /* subcc arg0, arg2, %g0 */
+- tcg_out_arith(s, TCG_REG_G0, arg0, arg2, ARITH_SUBCC);
+-
+- /* will become:
+- be label1
+- or
+- be,pt %xcc label1 */
+- label1_ptr = (uint32_t *)s->code_ptr;
+- tcg_out32(s, 0);
+-
+- /* mov (delay slot) */
+- tcg_out_mov(s, TCG_TYPE_PTR, arg0, addr_reg);
+-
+- /* mov */
+- tcg_out_mov(s, TCG_TYPE_REG, arg1, data_reg);
+-
+- /* mov */
+- tcg_out_movi(s, TCG_TYPE_I32, arg2, mem_index);
+-
+- /* XXX/FIXME: suboptimal */
+- tcg_out_mov(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3],
+- tcg_target_call_iarg_regs[2]);
+- tcg_out_mov(s, TCG_TYPE_I64, tcg_target_call_iarg_regs[2],
+- tcg_target_call_iarg_regs[1]);
+- tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
+- tcg_target_call_iarg_regs[0]);
+- tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0],
+- TCG_AREG0);
+- /* XXX: move that code at the end of the TB */
+ /* qemu_st_helper[s_bits](arg0, arg1, arg2) */
+- tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_st_helpers[s_bits]
++ tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_st_helpers[sizeop]
+ - (tcg_target_ulong)s->code_ptr) >> 2)
+ & 0x3fffffff));
+- /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+- global registers */
+- // delay slot
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_ST_OP);
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_LD_OP);
+-
+- /* will become:
+- ba label2 */
+- label2_ptr = (uint32_t *)s->code_ptr;
+- tcg_out32(s, 0);
+-
+- /* nop (delay slot) */
+- tcg_out_nop(s);
++ /* delay slot */
++ tcg_out_movi(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n], memi);
+
+-#if TARGET_LONG_BITS == 32
+- /* be label1 */
+- *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x2) |
+- INSN_OFF22((unsigned long)s->code_ptr -
+- (unsigned long)label1_ptr));
+-#else
+- /* be,pt %xcc label1 */
+- *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x1) |
+- (0x5 << 19) | INSN_OFF19((unsigned long)s->code_ptr -
+- (unsigned long)label1_ptr));
+-#endif
+-
+- /* ld [arg1 + x], arg1 */
+- tcg_out_ldst(s, arg1, arg1, offsetof(CPUTLBEntry, addend) -
+- offsetof(CPUTLBEntry, addr_write), TARGET_ADDEND_LD_OP);
++ /* Reload AREG0. */
++ tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
+
+-#if TARGET_LONG_BITS == 32
+- /* and addr_reg, x, arg0 */
+- tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, 0xffffffff);
+- tcg_out_arith(s, arg0, addr_reg, TCG_REG_I5, ARITH_AND);
+- /* add arg0, arg1, arg0 */
+- tcg_out_arith(s, arg0, arg0, arg1, ARITH_ADD);
++ *label_ptr |= INSN_OFF19((unsigned long)s->code_ptr -
++ (unsigned long)label_ptr);
+ #else
+- /* add addr_reg, arg1, arg0 */
+- tcg_out_arith(s, arg0, addr_reg, arg1, ARITH_ADD);
+-#endif
+-
+-#else
+- arg0 = addr_reg;
+-#endif
+-
+- switch(opc) {
+- case 0:
+- /* stb data_reg, [arg0] */
+- tcg_out_ldst(s, data_reg, arg0, 0, STB);
+- break;
+- case 1:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* sth data_reg, [arg0] */
+- tcg_out_ldst(s, data_reg, arg0, 0, STH);
+-#else
+- /* stha data_reg, [arg0] ASI_PRIMARY_LITTLE */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, STHA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 2:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* stw data_reg, [arg0] */
+- tcg_out_ldst(s, data_reg, arg0, 0, STW);
+-#else
+- /* stwa data_reg, [arg0] ASI_PRIMARY_LITTLE */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, STWA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- case 3:
+-#ifdef TARGET_WORDS_BIGENDIAN
+- /* stx data_reg, [arg0] */
+- tcg_out_ldst(s, data_reg, arg0, 0, STX);
+-#else
+- /* stxa data_reg, [arg0] ASI_PRIMARY_LITTLE */
+- tcg_out_ldst_asi(s, data_reg, arg0, 0, STXA, ASI_PRIMARY_LITTLE);
+-#endif
+- break;
+- default:
+- tcg_abort();
++ addr_reg = args[addrlo_idx];
++ if (TCG_TARGET_REG_BITS == 64 && TARGET_LONG_BITS == 32) {
++ tcg_out_arithi(s, TCG_REG_I5, addr_reg, 0, SHIFT_SRL);
++ addr_reg = TCG_REG_I5;
+ }
+-
+-#if defined(CONFIG_SOFTMMU)
+- /* label2: */
+- *label2_ptr = (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x2) |
+- INSN_OFF22((unsigned long)s->code_ptr -
+- (unsigned long)label2_ptr));
+-#endif
++ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
++ /* Reconstruct the full 64-bit value in %g1, using %o2 as temp. */
++ /* ??? Redefine the temps from %i4/%i5 so that we have a o/g temp. */
++ tcg_out_arithi(s, TCG_REG_G1, datalo, 0, SHIFT_SRL);
++ tcg_out_arithi(s, TCG_REG_O2, datahi, 32, SHIFT_SLLX);
++ tcg_out_arith(s, TCG_REG_G1, TCG_REG_G1, TCG_REG_O2, ARITH_OR);
++ datalo = TCG_REG_G1;
++ }
++ tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_G0, qemu_st_opc[sizeop]);
++#endif /* CONFIG_SOFTMMU */
+ }
+
+ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+@@ -1175,12 +1073,12 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+ global registers */
+ // delay slot
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_ST_OP);
+- tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long), HOST_LD_OP);
++ tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
++ tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
++ TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
++ sizeof(long));
+ break;
+ case INDEX_op_jmp:
+ case INDEX_op_br:
+@@ -1348,6 +1246,9 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ tcg_out_qemu_ld(s, args, 2 | 4);
+ break;
+ #endif
++ case INDEX_op_qemu_ld64:
++ tcg_out_qemu_ld(s, args, 3);
++ break;
+ case INDEX_op_qemu_st8:
+ tcg_out_qemu_st(s, args, 0);
+ break;
+@@ -1357,6 +1258,9 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ case INDEX_op_qemu_st32:
+ tcg_out_qemu_st(s, args, 2);
+ break;
++ case INDEX_op_qemu_st64:
++ tcg_out_qemu_st(s, args, 3);
++ break;
+
+ #if TCG_TARGET_REG_BITS == 64
+ case INDEX_op_movi_i64:
+@@ -1421,13 +1325,6 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ args[2], const_args[2]);
+ break;
+
+- case INDEX_op_qemu_ld64:
+- tcg_out_qemu_ld(s, args, 3);
+- break;
+- case INDEX_op_qemu_st64:
+- tcg_out_qemu_st(s, args, 3);
+- break;
+-
+ #endif
+ gen_arith:
+ tcg_out_arithc(s, args[0], args[1], args[2], const_args[2], c);
+@@ -1492,20 +1389,6 @@ static const TCGTargetOpDef sparc_op_defs[] = {
+ { INDEX_op_mulu2_i32, { "r", "r", "r", "rJ" } },
+ #endif
+
+- { INDEX_op_qemu_ld8u, { "r", "L" } },
+- { INDEX_op_qemu_ld8s, { "r", "L" } },
+- { INDEX_op_qemu_ld16u, { "r", "L" } },
+- { INDEX_op_qemu_ld16s, { "r", "L" } },
+- { INDEX_op_qemu_ld32, { "r", "L" } },
+-#if TCG_TARGET_REG_BITS == 64
+- { INDEX_op_qemu_ld32u, { "r", "L" } },
+- { INDEX_op_qemu_ld32s, { "r", "L" } },
+-#endif
+-
+- { INDEX_op_qemu_st8, { "L", "L" } },
+- { INDEX_op_qemu_st16, { "L", "L" } },
+- { INDEX_op_qemu_st32, { "L", "L" } },
+-
+ #if TCG_TARGET_REG_BITS == 64
+ { INDEX_op_mov_i64, { "r", "r" } },
+ { INDEX_op_movi_i64, { "r" } },
+@@ -1520,8 +1403,6 @@ static const TCGTargetOpDef sparc_op_defs[] = {
+ { INDEX_op_st16_i64, { "r", "r" } },
+ { INDEX_op_st32_i64, { "r", "r" } },
+ { INDEX_op_st_i64, { "r", "r" } },
+- { INDEX_op_qemu_ld64, { "L", "L" } },
+- { INDEX_op_qemu_st64, { "L", "L" } },
+
+ { INDEX_op_add_i64, { "r", "r", "rJ" } },
+ { INDEX_op_mul_i64, { "r", "r", "rJ" } },
+@@ -1548,10 +1429,48 @@ static const TCGTargetOpDef sparc_op_defs[] = {
+
+ { INDEX_op_brcond_i64, { "r", "rJ" } },
+ { INDEX_op_setcond_i64, { "r", "r", "rJ" } },
+-#else
+- { INDEX_op_qemu_ld64, { "L", "L", "L" } },
++#endif
++
++#if TCG_TARGET_REG_BITS == 64
++ { INDEX_op_qemu_ld8u, { "r", "L" } },
++ { INDEX_op_qemu_ld8s, { "r", "L" } },
++ { INDEX_op_qemu_ld16u, { "r", "L" } },
++ { INDEX_op_qemu_ld16s, { "r", "L" } },
++ { INDEX_op_qemu_ld32, { "r", "L" } },
++ { INDEX_op_qemu_ld32u, { "r", "L" } },
++ { INDEX_op_qemu_ld32s, { "r", "L" } },
++ { INDEX_op_qemu_ld64, { "r", "L" } },
++
++ { INDEX_op_qemu_st8, { "L", "L" } },
++ { INDEX_op_qemu_st16, { "L", "L" } },
++ { INDEX_op_qemu_st32, { "L", "L" } },
++ { INDEX_op_qemu_st64, { "L", "L" } },
++#elif TARGET_LONG_BITS <= TCG_TARGET_REG_BITS
++ { INDEX_op_qemu_ld8u, { "r", "L" } },
++ { INDEX_op_qemu_ld8s, { "r", "L" } },
++ { INDEX_op_qemu_ld16u, { "r", "L" } },
++ { INDEX_op_qemu_ld16s, { "r", "L" } },
++ { INDEX_op_qemu_ld32, { "r", "L" } },
++ { INDEX_op_qemu_ld64, { "r", "r", "L" } },
++
++ { INDEX_op_qemu_st8, { "L", "L" } },
++ { INDEX_op_qemu_st16, { "L", "L" } },
++ { INDEX_op_qemu_st32, { "L", "L" } },
+ { INDEX_op_qemu_st64, { "L", "L", "L" } },
++#else
++ { INDEX_op_qemu_ld8u, { "r", "L", "L" } },
++ { INDEX_op_qemu_ld8s, { "r", "L", "L" } },
++ { INDEX_op_qemu_ld16u, { "r", "L", "L" } },
++ { INDEX_op_qemu_ld16s, { "r", "L", "L" } },
++ { INDEX_op_qemu_ld32, { "r", "L", "L" } },
++ { INDEX_op_qemu_ld64, { "L", "L", "L", "L" } },
++
++ { INDEX_op_qemu_st8, { "L", "L", "L" } },
++ { INDEX_op_qemu_st16, { "L", "L", "L" } },
++ { INDEX_op_qemu_st32, { "L", "L", "L" } },
++ { INDEX_op_qemu_st64, { "L", "L", "L", "L" } },
+ #endif
++
+ { -1 },
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From fecc7bd255206876152baab622c61902133066bd Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sat, 24 Mar 2012 22:11:25 +0100
+Subject: [PATCH] tcg-sparc: Support GUEST_BASE.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 ++
+ tcg/sparc/tcg-target.c | 26 +++++++++++++++++++++++---
+ tcg/sparc/tcg-target.h | 2 ++
+ 3 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/configure b/configure
+index 0590f16..9139b5c 100755
+--- a/configure
++++ b/configure
+@@ -872,6 +872,7 @@ case "$cpu" in
+ if test "$solaris" = "no" ; then
+ QEMU_CFLAGS="-ffixed-g1 -ffixed-g6 $QEMU_CFLAGS"
+ fi
++ host_guest_base="yes"
+ ;;
+ sparc64)
+ LDFLAGS="-m64 $LDFLAGS"
+@@ -880,6 +881,7 @@ case "$cpu" in
+ if test "$solaris" != "no" ; then
+ QEMU_CFLAGS="-ffixed-g1 $QEMU_CFLAGS"
+ fi
++ host_guest_base="yes"
+ ;;
+ s390)
+ QEMU_CFLAGS="-m31 -march=z990 $QEMU_CFLAGS"
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index d89c19b..5acfeba 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -59,6 +59,12 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+ };
+ #endif
+
++#ifdef CONFIG_USE_GUEST_BASE
++# define TCG_GUEST_BASE_REG TCG_REG_I3
++#else
++# define TCG_GUEST_BASE_REG TCG_REG_G0
++#endif
++
+ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_L0,
+ TCG_REG_L1,
+@@ -680,6 +686,14 @@ static void tcg_target_qemu_prologue(TCGContext *s)
+ tcg_out32(s, SAVE | INSN_RD(TCG_REG_O6) | INSN_RS1(TCG_REG_O6) |
+ INSN_IMM13(-(TCG_TARGET_STACK_MINFRAME +
+ CPU_TEMP_BUF_NLONGS * (int)sizeof(long))));
++
++#ifdef CONFIG_USE_GUEST_BASE
++ if (GUEST_BASE != 0) {
++ tcg_out_movi(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG, GUEST_BASE);
++ tcg_regset_set_reg(s->reserved_regs, TCG_GUEST_BASE_REG);
++ }
++#endif
++
+ tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I1) |
+ INSN_RS2(TCG_REG_G0));
+ tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_I0);
+@@ -925,14 +939,18 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
+ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
+ int reg64 = (datalo < 16 ? datalo : TCG_REG_O0);
+
+- tcg_out_ldst_rr(s, reg64, addr_reg, TCG_REG_G0, qemu_ld_opc[sizeop]);
++ tcg_out_ldst_rr(s, reg64, addr_reg,
++ (GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_G0),
++ qemu_ld_opc[sizeop]);
+
+ tcg_out_arithi(s, datahi, reg64, 32, SHIFT_SRLX);
+ if (reg64 != datalo) {
+ tcg_out_mov(s, TCG_TYPE_I32, datalo, reg64);
+ }
+ } else {
+- tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_G0, qemu_ld_opc[sizeop]);
++ tcg_out_ldst_rr(s, datalo, addr_reg,
++ (GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_G0),
++ qemu_ld_opc[sizeop]);
+ }
+ #endif /* CONFIG_SOFTMMU */
+ }
+@@ -1026,7 +1044,9 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ tcg_out_arith(s, TCG_REG_G1, TCG_REG_G1, TCG_REG_O2, ARITH_OR);
+ datalo = TCG_REG_G1;
+ }
+- tcg_out_ldst_rr(s, datalo, addr_reg, TCG_REG_G0, qemu_st_opc[sizeop]);
++ tcg_out_ldst_rr(s, datalo, addr_reg,
++ (GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_G0),
++ qemu_st_opc[sizeop]);
+ #endif /* CONFIG_SOFTMMU */
+ }
+
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index adca1d2..99e9f57 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -128,6 +128,8 @@ typedef enum {
+ #define TCG_TARGET_HAS_movcond_i64 0
+ #endif
+
++#define TCG_TARGET_HAS_GUEST_BASE
++
+ #ifdef CONFIG_SOLARIS
+ #define TCG_AREG0 TCG_REG_G2
+ #elif HOST_LONG_BITS == 64
+--
+1.7.12.1
+
--- /dev/null
+From d526285d4339f02e3be64a7287d1e009dd5bff3d Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sun, 25 Mar 2012 19:52:11 +0200
+Subject: [PATCH] tcg-sparc: Change AREG0 in generated code to %i0.
+
+We can now move the TCG variable from %g[56] to a call-preserved
+windowed register.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 3 ++-
+ tcg/sparc/tcg-target.h | 8 +-------
+ 2 files changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 5acfeba..9ab5746 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -696,7 +696,8 @@ static void tcg_target_qemu_prologue(TCGContext *s)
+
+ tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I1) |
+ INSN_RS2(TCG_REG_G0));
+- tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_I0);
++ /* delay slot */
++ tcg_out_nop(s);
+ }
+
+ #if defined(CONFIG_SOFTMMU)
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index 99e9f57..ee154d0 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -130,13 +130,7 @@ typedef enum {
+
+ #define TCG_TARGET_HAS_GUEST_BASE
+
+-#ifdef CONFIG_SOLARIS
+-#define TCG_AREG0 TCG_REG_G2
+-#elif HOST_LONG_BITS == 64
+-#define TCG_AREG0 TCG_REG_G5
+-#else
+-#define TCG_AREG0 TCG_REG_G6
+-#endif
++#define TCG_AREG0 TCG_REG_I0
+
+ static inline void flush_icache_range(tcg_target_ulong start,
+ tcg_target_ulong stop)
+--
+1.7.12.1
+
--- /dev/null
+From 5767c23140f2c92b899d9caeaa8e08711cb63868 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sun, 25 Mar 2012 21:21:46 +0200
+Subject: [PATCH] tcg-sparc: Clean up cruft stemming from attempts to use
+ global registers.
+
+Don't use -ffixed-gN. Don't link statically. Don't save/restore
+AREG0 around calls. Don't allocate space on the stack for AREG0 save.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 12 -----------
+ tcg/sparc/tcg-target.c | 55 +++++++++++++++++---------------------------------
+ tcg/sparc/tcg-target.h | 18 +++++++----------
+ 3 files changed, 26 insertions(+), 59 deletions(-)
+
+diff --git a/configure b/configure
+index 9139b5c..8ffddf4 100755
+--- a/configure
++++ b/configure
+@@ -868,19 +868,11 @@ case "$cpu" in
+ sparc)
+ LDFLAGS="-m32 $LDFLAGS"
+ QEMU_CFLAGS="-m32 -mcpu=ultrasparc $QEMU_CFLAGS"
+- QEMU_CFLAGS="-ffixed-g2 -ffixed-g3 $QEMU_CFLAGS"
+- if test "$solaris" = "no" ; then
+- QEMU_CFLAGS="-ffixed-g1 -ffixed-g6 $QEMU_CFLAGS"
+- fi
+ host_guest_base="yes"
+ ;;
+ sparc64)
+ LDFLAGS="-m64 $LDFLAGS"
+ QEMU_CFLAGS="-m64 -mcpu=ultrasparc $QEMU_CFLAGS"
+- QEMU_CFLAGS="-ffixed-g5 -ffixed-g6 -ffixed-g7 $QEMU_CFLAGS"
+- if test "$solaris" != "no" ; then
+- QEMU_CFLAGS="-ffixed-g1 $QEMU_CFLAGS"
+- fi
+ host_guest_base="yes"
+ ;;
+ s390)
+@@ -4055,10 +4047,6 @@ fi
+
+ if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
+ case "$ARCH" in
+- sparc)
+- # -static is used to avoid g1/g3 usage by the dynamic linker
+- ldflags="$linker_script -static $ldflags"
+- ;;
+ alpha | s390x)
+ # The default placement of the application is fine.
+ ;;
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 9ab5746..e625aa3 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -161,7 +161,6 @@ static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
+ tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+- tcg_regset_reset_reg(ct->u.regs, TCG_REG_O3);
+ break;
+ case 'I':
+ ct->ct |= TCG_CT_CONST_S11;
+@@ -681,11 +680,22 @@ static void tcg_out_setcond2_i32(TCGContext *s, TCGCond cond, TCGArg ret,
+ /* Generate global QEMU prologue and epilogue code */
+ static void tcg_target_qemu_prologue(TCGContext *s)
+ {
+- tcg_set_frame(s, TCG_REG_I6, TCG_TARGET_CALL_STACK_OFFSET,
+- CPU_TEMP_BUF_NLONGS * (int)sizeof(long));
++ int tmp_buf_size, frame_size;
++
++ /* The TCG temp buffer is at the top of the frame, immediately
++ below the frame pointer. */
++ tmp_buf_size = CPU_TEMP_BUF_NLONGS * (int)sizeof(long);
++ tcg_set_frame(s, TCG_REG_I6, TCG_TARGET_STACK_BIAS - tmp_buf_size,
++ tmp_buf_size);
++
++ /* TCG_TARGET_CALL_STACK_OFFSET includes the stack bias, but is
++ otherwise the minimal frame usable by callees. */
++ frame_size = TCG_TARGET_CALL_STACK_OFFSET - TCG_TARGET_STACK_BIAS;
++ frame_size += TCG_STATIC_CALL_ARGS_SIZE + tmp_buf_size;
++ frame_size += TCG_TARGET_STACK_ALIGN - 1;
++ frame_size &= -TCG_TARGET_STACK_ALIGN;
+ tcg_out32(s, SAVE | INSN_RD(TCG_REG_O6) | INSN_RS1(TCG_REG_O6) |
+- INSN_IMM13(-(TCG_TARGET_STACK_MINFRAME +
+- CPU_TEMP_BUF_NLONGS * (int)sizeof(long))));
++ INSN_IMM13(-frame_size));
+
+ #ifdef CONFIG_USE_GUEST_BASE
+ if (GUEST_BASE != 0) {
+@@ -698,6 +708,8 @@ static void tcg_target_qemu_prologue(TCGContext *s)
+ INSN_RS2(TCG_REG_G0));
+ /* delay slot */
+ tcg_out_nop(s);
++
++ /* No epilogue required. We issue ret + restore directly in the TB. */
+ }
+
+ #if defined(CONFIG_SOFTMMU)
+@@ -880,12 +892,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
+ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++],
+ args[addrlo_idx]);
+
+- /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+- global registers */
+- tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
+-
+ /* qemu_ld_helper[s_bits](arg0, arg1) */
+ tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_ld_helpers[s_bits]
+ - (tcg_target_ulong)s->code_ptr) >> 2)
+@@ -893,11 +899,6 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
+ /* delay slot */
+ tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[n], memi);
+
+- /* Reload AREG0. */
+- tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
+-
+ n = tcg_target_call_oarg_regs[0];
+ /* datalo = sign_extend(arg0) */
+ switch (sizeop) {
+@@ -1011,12 +1012,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ }
+ tcg_out_mov(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n++], datalo);
+
+- /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+- global registers */
+- tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
+-
+ /* qemu_st_helper[s_bits](arg0, arg1, arg2) */
+ tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_st_helpers[sizeop]
+ - (tcg_target_ulong)s->code_ptr) >> 2)
+@@ -1024,11 +1019,6 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ /* delay slot */
+ tcg_out_movi(s, TCG_TYPE_REG, tcg_target_call_iarg_regs[n], memi);
+
+- /* Reload AREG0. */
+- tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
+-
+ *label_ptr |= INSN_OFF19((unsigned long)s->code_ptr -
+ (unsigned long)label_ptr);
+ #else
+@@ -1091,15 +1081,8 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ tcg_out32(s, JMPL | INSN_RD(TCG_REG_O7) | INSN_RS1(TCG_REG_I5) |
+ INSN_RS2(TCG_REG_G0));
+ }
+- /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+- global registers */
+- // delay slot
+- tcg_out_st(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
+- tcg_out_ld(s, TCG_TYPE_REG, TCG_AREG0, TCG_REG_CALL_STACK,
+- TCG_TARGET_CALL_STACK_OFFSET - TCG_STATIC_CALL_ARGS_SIZE -
+- sizeof(long));
++ /* delay slot */
++ tcg_out_nop(s);
+ break;
+ case INDEX_op_jmp:
+ case INDEX_op_br:
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
+index ee154d0..6314ffb 100644
+--- a/tcg/sparc/tcg-target.h
++++ b/tcg/sparc/tcg-target.h
+@@ -66,20 +66,16 @@ typedef enum {
+ #define TCG_CT_CONST_S13 0x200
+
+ /* used for function call generation */
+-#define TCG_REG_CALL_STACK TCG_REG_I6
++#define TCG_REG_CALL_STACK TCG_REG_O6
+
+ #if TCG_TARGET_REG_BITS == 64
+-// Reserve space for AREG0
+-#define TCG_TARGET_STACK_MINFRAME (176 + 4 * (int)sizeof(long) + \
+- TCG_STATIC_CALL_ARGS_SIZE)
+-#define TCG_TARGET_CALL_STACK_OFFSET (2047 - 16)
+-#define TCG_TARGET_STACK_ALIGN 16
++#define TCG_TARGET_STACK_BIAS 2047
++#define TCG_TARGET_STACK_ALIGN 16
++#define TCG_TARGET_CALL_STACK_OFFSET (128 + 6*8 + TCG_TARGET_STACK_BIAS)
+ #else
+-// AREG0 + one word for alignment
+-#define TCG_TARGET_STACK_MINFRAME (92 + (2 + 1) * (int)sizeof(long) + \
+- TCG_STATIC_CALL_ARGS_SIZE)
+-#define TCG_TARGET_CALL_STACK_OFFSET TCG_TARGET_STACK_MINFRAME
+-#define TCG_TARGET_STACK_ALIGN 8
++#define TCG_TARGET_STACK_BIAS 0
++#define TCG_TARGET_STACK_ALIGN 8
++#define TCG_TARGET_CALL_STACK_OFFSET (64 + 4 + 6*4)
+ #endif
+
+ #if TCG_TARGET_REG_BITS == 64
+--
+1.7.12.1
+
--- /dev/null
+From 12e60f780a097837840ab1e7bb7d54b8c15112e8 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sun, 25 Mar 2012 21:36:28 +0200
+Subject: [PATCH] tcg-sparc: Mask shift immediates to avoid illegal insns.
+
+The xtensa-test image generates a sra_i32 with count 0x40.
+Whether this is accident of tcg constant propagation or
+originating directly from the instruction stream is immaterial.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index e625aa3..be5c170 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -1154,13 +1154,16 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ goto gen_arith;
+ case INDEX_op_shl_i32:
+ c = SHIFT_SLL;
+- goto gen_arith;
++ do_shift32:
++ /* Limit immediate shift count lest we create an illegal insn. */
++ tcg_out_arithc(s, args[0], args[1], args[2] & 31, const_args[2], c);
++ break;
+ case INDEX_op_shr_i32:
+ c = SHIFT_SRL;
+- goto gen_arith;
++ goto do_shift32;
+ case INDEX_op_sar_i32:
+ c = SHIFT_SRA;
+- goto gen_arith;
++ goto do_shift32;
+ case INDEX_op_mul_i32:
+ c = ARITH_UMUL;
+ goto gen_arith;
+@@ -1281,13 +1284,16 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ break;
+ case INDEX_op_shl_i64:
+ c = SHIFT_SLLX;
+- goto gen_arith;
++ do_shift64:
++ /* Limit immediate shift count lest we create an illegal insn. */
++ tcg_out_arithc(s, args[0], args[1], args[2] & 63, const_args[2], c);
++ break;
+ case INDEX_op_shr_i64:
+ c = SHIFT_SRLX;
+- goto gen_arith;
++ goto do_shift64;
+ case INDEX_op_sar_i64:
+ c = SHIFT_SRAX;
+- goto gen_arith;
++ goto do_shift64;
+ case INDEX_op_mul_i64:
+ c = ARITH_MULX;
+ goto gen_arith;
+--
+1.7.12.1
+
--- /dev/null
+From fc9726f880dea515a2cf98456c5f03a1388e4e14 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sun, 25 Mar 2012 22:04:59 +0200
+Subject: [PATCH] tcg-sparc: Use defines for temporaries.
+
+And change from %i4/%i5 to %g1/%o7 to remove a v8plus fixme.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 115 +++++++++++++++++++++++++------------------------
+ 1 file changed, 59 insertions(+), 56 deletions(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index be5c170..d401f8e 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -59,8 +59,12 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+ };
+ #endif
+
++/* Define some temporary registers. T2 is used for constant generation. */
++#define TCG_REG_T1 TCG_REG_G1
++#define TCG_REG_T2 TCG_REG_O7
++
+ #ifdef CONFIG_USE_GUEST_BASE
+-# define TCG_GUEST_BASE_REG TCG_REG_I3
++# define TCG_GUEST_BASE_REG TCG_REG_I5
+ #else
+ # define TCG_GUEST_BASE_REG TCG_REG_G0
+ #endif
+@@ -79,6 +83,7 @@ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_I2,
+ TCG_REG_I3,
+ TCG_REG_I4,
++ TCG_REG_I5,
+ };
+
+ static const int tcg_target_call_iarg_regs[6] = {
+@@ -366,10 +371,10 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
+ tcg_out_sethi(s, ret, ~arg);
+ tcg_out_arithi(s, ret, ret, (arg & 0x3ff) | -0x400, ARITH_XOR);
+ } else {
+- tcg_out_movi_imm32(s, TCG_REG_I4, arg >> (TCG_TARGET_REG_BITS / 2));
+- tcg_out_arithi(s, TCG_REG_I4, TCG_REG_I4, 32, SHIFT_SLLX);
+- tcg_out_movi_imm32(s, ret, arg);
+- tcg_out_arith(s, ret, ret, TCG_REG_I4, ARITH_OR);
++ tcg_out_movi_imm32(s, ret, arg >> (TCG_TARGET_REG_BITS / 2));
++ tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
++ tcg_out_movi_imm32(s, TCG_REG_T2, arg);
++ tcg_out_arith(s, ret, ret, TCG_REG_T2, ARITH_OR);
+ }
+ }
+
+@@ -386,8 +391,8 @@ static inline void tcg_out_ldst(TCGContext *s, int ret, int addr,
+ tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(addr) |
+ INSN_IMM13(offset));
+ } else {
+- tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, offset);
+- tcg_out_ldst_rr(s, ret, addr, TCG_REG_I5, op);
++ tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_T1, offset);
++ tcg_out_ldst_rr(s, ret, addr, TCG_REG_T1, op);
+ }
+ }
+
+@@ -428,8 +433,8 @@ static inline void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+ if (check_fit_tl(val, 13))
+ tcg_out_arithi(s, reg, reg, val, ARITH_ADD);
+ else {
+- tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, val);
+- tcg_out_arith(s, reg, reg, TCG_REG_I5, ARITH_ADD);
++ tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_T1, val);
++ tcg_out_arith(s, reg, reg, TCG_REG_T1, ARITH_ADD);
+ }
+ }
+ }
+@@ -441,8 +446,8 @@ static inline void tcg_out_andi(TCGContext *s, int rd, int rs,
+ if (check_fit_tl(val, 13))
+ tcg_out_arithi(s, rd, rs, val, ARITH_AND);
+ else {
+- tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, val);
+- tcg_out_arith(s, rd, rs, TCG_REG_I5, ARITH_AND);
++ tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_T1, val);
++ tcg_out_arith(s, rd, rs, TCG_REG_T1, ARITH_AND);
+ }
+ }
+ }
+@@ -454,8 +459,8 @@ static void tcg_out_div32(TCGContext *s, int rd, int rs1,
+ if (uns) {
+ tcg_out_sety(s, TCG_REG_G0);
+ } else {
+- tcg_out_arithi(s, TCG_REG_I5, rs1, 31, SHIFT_SRA);
+- tcg_out_sety(s, TCG_REG_I5);
++ tcg_out_arithi(s, TCG_REG_T1, rs1, 31, SHIFT_SRA);
++ tcg_out_sety(s, TCG_REG_T1);
+ }
+
+ tcg_out_arithc(s, rd, rs1, val2, val2const,
+@@ -601,8 +606,8 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGArg ret,
+ case TCG_COND_GTU:
+ case TCG_COND_GEU:
+ if (c2const && c2 != 0) {
+- tcg_out_movi_imm13(s, TCG_REG_I5, c2);
+- c2 = TCG_REG_I5;
++ tcg_out_movi_imm13(s, TCG_REG_T1, c2);
++ c2 = TCG_REG_T1;
+ }
+ t = c1, c1 = c2, c2 = t, c2const = 0;
+ cond = tcg_swap_cond(cond);
+@@ -649,15 +654,15 @@ static void tcg_out_setcond2_i32(TCGContext *s, TCGCond cond, TCGArg ret,
+
+ switch (cond) {
+ case TCG_COND_EQ:
+- tcg_out_setcond_i32(s, TCG_COND_EQ, TCG_REG_I5, al, bl, blconst);
++ tcg_out_setcond_i32(s, TCG_COND_EQ, TCG_REG_T1, al, bl, blconst);
+ tcg_out_setcond_i32(s, TCG_COND_EQ, ret, ah, bh, bhconst);
+- tcg_out_arith(s, ret, ret, TCG_REG_I5, ARITH_AND);
++ tcg_out_arith(s, ret, ret, TCG_REG_T1, ARITH_AND);
+ break;
+
+ case TCG_COND_NE:
+- tcg_out_setcond_i32(s, TCG_COND_NE, TCG_REG_I5, al, al, blconst);
++ tcg_out_setcond_i32(s, TCG_COND_NE, TCG_REG_T1, al, al, blconst);
+ tcg_out_setcond_i32(s, TCG_COND_NE, ret, ah, bh, bhconst);
+- tcg_out_arith(s, ret, ret, TCG_REG_I5, ARITH_OR);
++ tcg_out_arith(s, ret, ret, TCG_REG_T1, ARITH_OR);
+ break;
+
+ default:
+@@ -935,8 +940,8 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int sizeop)
+ #else
+ addr_reg = args[addrlo_idx];
+ if (TCG_TARGET_REG_BITS == 64 && TARGET_LONG_BITS == 32) {
+- tcg_out_arithi(s, TCG_REG_I5, addr_reg, 0, SHIFT_SRL);
+- addr_reg = TCG_REG_I5;
++ tcg_out_arithi(s, TCG_REG_T1, addr_reg, 0, SHIFT_SRL);
++ addr_reg = TCG_REG_T1;
+ }
+ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
+ int reg64 = (datalo < 16 ? datalo : TCG_REG_O0);
+@@ -979,12 +984,11 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ offsetof(CPUTLBEntry, addr_write));
+
+ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
+- /* Reconstruct the full 64-bit value in %g1, using %o2 as temp. */
+- /* ??? Redefine the temps from %i4/%i5 so that we have a o/g temp. */
+- tcg_out_arithi(s, TCG_REG_G1, datalo, 0, SHIFT_SRL);
++ /* Reconstruct the full 64-bit value. */
++ tcg_out_arithi(s, TCG_REG_T1, datalo, 0, SHIFT_SRL);
+ tcg_out_arithi(s, TCG_REG_O2, datahi, 32, SHIFT_SLLX);
+- tcg_out_arith(s, TCG_REG_G1, TCG_REG_G1, TCG_REG_O2, ARITH_OR);
+- datalo = TCG_REG_G1;
++ tcg_out_arith(s, TCG_REG_O2, TCG_REG_T1, TCG_REG_O2, ARITH_OR);
++ datalo = TCG_REG_O2;
+ }
+
+ /* The fast path is exactly one insn. Thus we can perform the entire
+@@ -1024,16 +1028,14 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int sizeop)
+ #else
+ addr_reg = args[addrlo_idx];
+ if (TCG_TARGET_REG_BITS == 64 && TARGET_LONG_BITS == 32) {
+- tcg_out_arithi(s, TCG_REG_I5, addr_reg, 0, SHIFT_SRL);
+- addr_reg = TCG_REG_I5;
++ tcg_out_arithi(s, TCG_REG_T1, addr_reg, 0, SHIFT_SRL);
++ addr_reg = TCG_REG_T1;
+ }
+ if (TCG_TARGET_REG_BITS == 32 && sizeop == 3) {
+- /* Reconstruct the full 64-bit value in %g1, using %o2 as temp. */
+- /* ??? Redefine the temps from %i4/%i5 so that we have a o/g temp. */
+- tcg_out_arithi(s, TCG_REG_G1, datalo, 0, SHIFT_SRL);
++ tcg_out_arithi(s, TCG_REG_T1, datalo, 0, SHIFT_SRL);
+ tcg_out_arithi(s, TCG_REG_O2, datahi, 32, SHIFT_SLLX);
+- tcg_out_arith(s, TCG_REG_G1, TCG_REG_G1, TCG_REG_O2, ARITH_OR);
+- datalo = TCG_REG_G1;
++ tcg_out_arith(s, TCG_REG_O2, TCG_REG_T1, TCG_REG_O2, ARITH_OR);
++ datalo = TCG_REG_O2;
+ }
+ tcg_out_ldst_rr(s, datalo, addr_reg,
+ (GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_G0),
+@@ -1057,28 +1059,29 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ case INDEX_op_goto_tb:
+ if (s->tb_jmp_offset) {
+ /* direct jump method */
+- tcg_out_sethi(s, TCG_REG_I5, args[0] & 0xffffe000);
+- tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I5) |
++ tcg_out_sethi(s, TCG_REG_T1, args[0] & 0xffffe000);
++ tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_T1) |
+ INSN_IMM13((args[0] & 0x1fff)));
+ s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+ } else {
+ /* indirect jump method */
+- tcg_out_ld_ptr(s, TCG_REG_I5, (tcg_target_long)(s->tb_next + args[0]));
+- tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I5) |
++ tcg_out_ld_ptr(s, TCG_REG_T1,
++ (tcg_target_long)(s->tb_next + args[0]));
++ tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_T1) |
+ INSN_RS2(TCG_REG_G0));
+ }
+ tcg_out_nop(s);
+ s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+ break;
+ case INDEX_op_call:
+- if (const_args[0])
++ if (const_args[0]) {
+ tcg_out32(s, CALL | ((((tcg_target_ulong)args[0]
+ - (tcg_target_ulong)s->code_ptr) >> 2)
+ & 0x3fffffff));
+- else {
+- tcg_out_ld_ptr(s, TCG_REG_I5,
++ } else {
++ tcg_out_ld_ptr(s, TCG_REG_T1,
+ (tcg_target_long)(s->tb_next + args[0]));
+- tcg_out32(s, JMPL | INSN_RD(TCG_REG_O7) | INSN_RS1(TCG_REG_I5) |
++ tcg_out32(s, JMPL | INSN_RD(TCG_REG_O7) | INSN_RS1(TCG_REG_T1) |
+ INSN_RS2(TCG_REG_G0));
+ }
+ /* delay slot */
+@@ -1184,11 +1187,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+
+ case INDEX_op_rem_i32:
+ case INDEX_op_remu_i32:
+- tcg_out_div32(s, TCG_REG_I5, args[1], args[2], const_args[2],
++ tcg_out_div32(s, TCG_REG_T1, args[1], args[2], const_args[2],
+ opc == INDEX_op_remu_i32);
+- tcg_out_arithc(s, TCG_REG_I5, TCG_REG_I5, args[2], const_args[2],
++ tcg_out_arithc(s, TCG_REG_T1, TCG_REG_T1, args[2], const_args[2],
+ ARITH_UMUL);
+- tcg_out_arith(s, args[0], args[1], TCG_REG_I5, ARITH_SUB);
++ tcg_out_arith(s, args[0], args[1], TCG_REG_T1, ARITH_SUB);
+ break;
+
+ case INDEX_op_brcond_i32:
+@@ -1305,11 +1308,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ goto gen_arith;
+ case INDEX_op_rem_i64:
+ case INDEX_op_remu_i64:
+- tcg_out_arithc(s, TCG_REG_I5, args[1], args[2], const_args[2],
++ tcg_out_arithc(s, TCG_REG_T1, args[1], args[2], const_args[2],
+ opc == INDEX_op_rem_i64 ? ARITH_SDIVX : ARITH_UDIVX);
+- tcg_out_arithc(s, TCG_REG_I5, TCG_REG_I5, args[2], const_args[2],
++ tcg_out_arithc(s, TCG_REG_T1, TCG_REG_T1, args[2], const_args[2],
+ ARITH_MULX);
+- tcg_out_arith(s, args[0], args[1], TCG_REG_I5, ARITH_SUB);
++ tcg_out_arith(s, args[0], args[1], TCG_REG_T1, ARITH_SUB);
+ break;
+ case INDEX_op_ext32s_i64:
+ if (const_args[1]) {
+@@ -1507,15 +1510,15 @@ static void tcg_target_init(TCGContext *s)
+ (1 << TCG_REG_O7));
+
+ tcg_regset_clear(s->reserved_regs);
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_G0);
+-#if TCG_TARGET_REG_BITS == 64
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_I4); // for internal use
+-#endif
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_I5); // for internal use
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_I6);
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_I7);
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_O6);
+- tcg_regset_set_reg(s->reserved_regs, TCG_REG_O7);
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_G0); /* zero */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_G6); /* reserved for os */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_G7); /* thread pointer */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_I6); /* frame pointer */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_I7); /* return address */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_O6); /* stack pointer */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_T1); /* for internal use */
++ tcg_regset_set_reg(s->reserved_regs, TCG_REG_T2); /* for internal use */
++
+ tcg_add_target_add_op_defs(sparc_op_defs);
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From ca72cdf648b56d851c4bc9145a1abfcbeeec0579 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Sun, 25 Mar 2012 22:43:17 +0200
+Subject: [PATCH] tcg-sparc: Add %g/%o registers to alloc_order
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index d401f8e..03c385a 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -78,12 +78,25 @@ static const int tcg_target_reg_alloc_order[] = {
+ TCG_REG_L5,
+ TCG_REG_L6,
+ TCG_REG_L7,
++
+ TCG_REG_I0,
+ TCG_REG_I1,
+ TCG_REG_I2,
+ TCG_REG_I3,
+ TCG_REG_I4,
+ TCG_REG_I5,
++
++ TCG_REG_G2,
++ TCG_REG_G3,
++ TCG_REG_G4,
++ TCG_REG_G5,
++
++ TCG_REG_O0,
++ TCG_REG_O1,
++ TCG_REG_O2,
++ TCG_REG_O3,
++ TCG_REG_O4,
++ TCG_REG_O5,
+ };
+
+ static const int tcg_target_call_iarg_regs[6] = {
+--
+1.7.12.1
+
--- /dev/null
+From 1338a6f18ff9b651c12ee1f7edd1d2b7684bd6aa Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 10:48:51 -0700
+Subject: [PATCH] tcg-sparc: Fix and enable direct TB chaining.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ exec-all.h | 9 ++++++---
+ tcg/sparc/tcg-target.c | 21 ++++++++++++++++++---
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/exec-all.h b/exec-all.h
+index c5d3a13..1f81da7 100644
+--- a/exec-all.h
++++ b/exec-all.h
+@@ -132,9 +132,10 @@ static inline void tlb_flush(CPUArchState *env, int flush_global)
+ #define CODE_GEN_AVG_BLOCK_SIZE 64
+ #endif
+
+-#if defined(_ARCH_PPC) || defined(__x86_64__) || defined(__arm__) || defined(__i386__)
+-#define USE_DIRECT_JUMP
+-#elif defined(CONFIG_TCG_INTERPRETER)
++#if defined(__arm__) || defined(_ARCH_PPC) \
++ || defined(__x86_64__) || defined(__i386__) \
++ || defined(__sparc__) \
++ || defined(CONFIG_TCG_INTERPRETER)
+ #define USE_DIRECT_JUMP
+ #endif
+
+@@ -244,6 +245,8 @@ static inline void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)
+ __asm __volatile__ ("swi 0x9f0002" : : "r" (_beg), "r" (_end), "r" (_flg));
+ #endif
+ }
++#elif defined(__sparc__)
++void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr);
+ #else
+ #error tb_set_jmp_target1 is missing
+ #endif
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 03c385a..1db0c9d 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -1072,10 +1072,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ case INDEX_op_goto_tb:
+ if (s->tb_jmp_offset) {
+ /* direct jump method */
+- tcg_out_sethi(s, TCG_REG_T1, args[0] & 0xffffe000);
+- tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_T1) |
+- INSN_IMM13((args[0] & 0x1fff)));
++ uint32_t old_insn = *(uint32_t *)s->code_ptr;
+ s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
++ /* Make sure to preserve links during retranslation. */
++ tcg_out32(s, CALL | (old_insn & ~INSN_OP(-1)));
+ } else {
+ /* indirect jump method */
+ tcg_out_ld_ptr(s, TCG_REG_T1,
+@@ -1595,3 +1595,18 @@ void tcg_register_jit(void *buf, size_t buf_size)
+
+ tcg_register_jit_int(buf, buf_size, &debug_frame, sizeof(debug_frame));
+ }
++
++void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)
++{
++ uint32_t *ptr = (uint32_t *)jmp_addr;
++ tcg_target_long disp = (tcg_target_long)(addr - jmp_addr) >> 2;
++
++ /* We can reach the entire address space for 32-bit. For 64-bit
++ the code_gen_buffer can't be larger than 2GB. */
++ if (TCG_TARGET_REG_BITS == 64 && !check_fit_tl(disp, 30)) {
++ tcg_abort();
++ }
++
++ *ptr = CALL | (disp & 0x3fffffff);
++ flush_icache_range(jmp_addr, jmp_addr + 4);
++}
+--
+1.7.12.1
+
--- /dev/null
+From 2cbc27913eb9eb7cdc4a41fc6efafccf3db7ebe6 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 11:00:23 -0700
+Subject: [PATCH] tcg-sparc: Preserve branch destinations during retranslation
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/sparc/tcg-target.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
+index 1db0c9d..876da4f 100644
+--- a/tcg/sparc/tcg-target.c
++++ b/tcg/sparc/tcg-target.c
+@@ -488,30 +488,33 @@ static inline void tcg_out_nop(TCGContext *s)
+ static void tcg_out_branch_i32(TCGContext *s, int opc, int label_index)
+ {
+ TCGLabel *l = &s->labels[label_index];
++ uint32_t off22;
+
+ if (l->has_value) {
+- tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x2)
+- | INSN_OFF22(l->u.value - (unsigned long)s->code_ptr)));
++ off22 = INSN_OFF22(l->u.value - (unsigned long)s->code_ptr);
+ } else {
++ /* Make sure to preserve destinations during retranslation. */
++ off22 = *(uint32_t *)s->code_ptr & INSN_OFF22(-1);
+ tcg_out_reloc(s, s->code_ptr, R_SPARC_WDISP22, label_index, 0);
+- tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x2) | 0));
+ }
++ tcg_out32(s, INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x2) | off22);
+ }
+
+ #if TCG_TARGET_REG_BITS == 64
+ static void tcg_out_branch_i64(TCGContext *s, int opc, int label_index)
+ {
+ TCGLabel *l = &s->labels[label_index];
++ uint32_t off19;
+
+ if (l->has_value) {
+- tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x1) |
+- (0x5 << 19) |
+- INSN_OFF19(l->u.value - (unsigned long)s->code_ptr)));
++ off19 = INSN_OFF19(l->u.value - (unsigned long)s->code_ptr);
+ } else {
++ /* Make sure to preserve destinations during retranslation. */
++ off19 = *(uint32_t *)s->code_ptr & INSN_OFF19(-1);
+ tcg_out_reloc(s, s->code_ptr, R_SPARC_WDISP19, label_index, 0);
+- tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x1) |
+- (0x5 << 19) | 0));
+ }
++ tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x1) |
++ (0x5 << 19) | off19));
+ }
+ #endif
+
+--
+1.7.12.1
+
--- /dev/null
+From fcf8cef0c7d8d197e863c1e8b7bcb567fa1fe729 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 14:15:36 +0200
+Subject: [PATCH] target-alpha: Initialize env->cpu_model_str
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Save the cpu_model_str so that we have a non-null value when
+creating a new cpu during clone.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-alpha/translate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target-alpha/translate.c b/target-alpha/translate.c
+index 4a9011a..3f9aee1 100644
+--- a/target-alpha/translate.c
++++ b/target-alpha/translate.c
+@@ -3543,6 +3543,7 @@ CPUAlphaState * cpu_alpha_init (const char *cpu_model)
+ }
+ env->implver = implver;
+ env->amask = amask;
++ env->cpu_model_str = cpu_model;
+
+ qemu_init_vcpu(env);
+ return env;
+--
+1.7.12.1
+
--- /dev/null
+From 66588d01b8cb710d746c249a34f31f7f353bc697 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Sat, 22 Sep 2012 23:08:38 +0200
+Subject: [PATCH] tcg/mips: fix MIPS32(R2) detection
+
+Fix the MIPS32(R2) cpu detection so that it also works with
+-march=octeon. Thanks to Andrew Pinski for the hint.
+
+Cc: Andrew Pinski <apinski@cavium.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/mips/tcg-target.c | 10 +++++-----
+ tcg/mips/tcg-target.h | 8 ++++----
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.c
+index c272b38..e9a1ffb 100644
+--- a/tcg/mips/tcg-target.c
++++ b/tcg/mips/tcg-target.c
+@@ -425,7 +425,7 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
+
+ static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
+ #else
+ /* ret and arg can't be register at */
+@@ -442,7 +442,7 @@ static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+
+ static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
+ tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);
+ #else
+@@ -460,7 +460,7 @@ static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
+
+ static inline void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
+ tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
+ #else
+@@ -486,7 +486,7 @@ static inline void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+
+ static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
+ #else
+ tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
+@@ -496,7 +496,7 @@ static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+
+ static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
+ #else
+ tcg_out_opc_sa(s, OPC_SLL, ret, arg, 16);
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index d147e70..7020d65 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -88,16 +88,16 @@ typedef enum {
+ #define TCG_TARGET_HAS_nand_i32 0
+
+ /* optional instructions only implemented on MIPS4, MIPS32 and Loongson 2 */
+-#if defined(_MIPS_ARCH_MIPS4) || defined(_MIPS_ARCH_MIPS32) || \
+- defined(_MIPS_ARCH_MIPS32R2) || defined(_MIPS_ARCH_LOONGSON2E) || \
+- defined(_MIPS_ARCH_LOONGSON2F)
++#if (defined(__mips_isa_rev) && (__mips_isa_rev >= 1)) || \
++ defined(_MIPS_ARCH_LOONGSON2E) || defined(_MIPS_ARCH_LOONGSON2F) || \
++ defined(_MIPS_ARCH_MIPS4)
+ #define TCG_TARGET_HAS_movcond_i32 1
+ #else
+ #define TCG_TARGET_HAS_movcond_i32 0
+ #endif
+
+ /* optional instructions only implemented on MIPS32R2 */
+-#ifdef _MIPS_ARCH_MIPS32R2
++#if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+ #define TCG_TARGET_HAS_bswap16_i32 1
+ #define TCG_TARGET_HAS_bswap32_i32 1
+ #define TCG_TARGET_HAS_rot_i32 1
+--
+1.7.12.1
+
--- /dev/null
+From a2c90b264762d3ddcc9a830653315a6fe9107055 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <rth@twiddle.net>
+Date: Fri, 21 Sep 2012 17:18:09 -0700
+Subject: [PATCH] tcg: Adjust descriptions of *cond opcodes
+
+The README file documented the operand ordering of the tcg_gen_*
+functions. Since we're documenting opcodes here, use the true
+operand ordering.
+
+Signed-off-by: Richard Henderson <rth@twiddle.net>
+Cc: malc <av1474@comtv.ru>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/README | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tcg/README b/tcg/README
+index 33783ee..27846f1 100644
+--- a/tcg/README
++++ b/tcg/README
+@@ -141,7 +141,7 @@ Define label 'label' at the current program point.
+
+ Jump to label.
+
+-* brcond_i32/i64 cond, t0, t1, label
++* brcond_i32/i64 t0, t1, cond, label
+
+ Conditional jump if t0 cond t1 is true. cond can be:
+ TCG_COND_EQ
+@@ -301,13 +301,13 @@ This operation would be equivalent to
+
+ ********* Conditional moves
+
+-* setcond_i32/i64 cond, dest, t1, t2
++* setcond_i32/i64 dest, t1, t2, cond
+
+ dest = (t1 cond t2)
+
+ Set DEST to 1 if (T1 cond T2) is true, otherwise set to 0.
+
+-* movcond_i32/i64 cond, dest, c1, c2, v1, v2
++* movcond_i32/i64 dest, c1, c2, v1, v2, cond
+
+ dest = (c1 cond c2 ? v1 : v2)
+
+@@ -360,7 +360,7 @@ The following opcodes are internal to TCG. Thus they are to be implemented by
+ 32-bit host code generators, but are not to be emitted by guest translators.
+ They are emitted as needed by inline functions within "tcg-op.h".
+
+-* brcond2_i32 cond, t0_low, t0_high, t1_low, t1_high, label
++* brcond2_i32 t0_low, t0_high, t1_low, t1_high, cond, label
+
+ Similar to brcond, except that the 64-bit values T0 and T1
+ are formed from two 32-bit arguments.
+@@ -377,7 +377,7 @@ is returned in two 32-bit outputs.
+ Similar to mul, except two 32-bit (unsigned) inputs T1 and T2 yielding
+ the full 64-bit product T0. The later is returned in two 32-bit outputs.
+
+-* setcond2_i32 cond, dest, t1_low, t1_high, t2_low, t2_high
++* setcond2_i32 dest, t1_low, t1_high, t2_low, t2_high, cond
+
+ Similar to setcond, except that the 64-bit values T1 and T2 are
+ formed from two 32-bit arguments. The result is a 32-bit value.
+--
+1.7.12.1
+
--- /dev/null
+From 5d3868bb343df0c13240521e36d0cc942c7a2d04 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Wed, 26 Sep 2012 00:30:12 +0200
+Subject: [PATCH] tcg/i386: fix build with -march < i686
+
+The movcond_i32 op has to be protected with TCG_TARGET_HAS_movcond_i32
+to fix the build with -march < i686.
+
+Thanks to Richard Henderson for the hint.
+
+Reported-by: Alex Barcelo <abarcelo@ac.upc.edu>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/i386/tcg-target.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
+index 85c6b81..616ef23 100644
+--- a/tcg/i386/tcg-target.c
++++ b/tcg/i386/tcg-target.c
+@@ -1907,7 +1907,9 @@ static const TCGTargetOpDef x86_op_defs[] = {
+ { INDEX_op_setcond_i32, { "q", "r", "ri" } },
+
+ { INDEX_op_deposit_i32, { "Q", "0", "Q" } },
++#if TCG_TARGET_HAS_movcond_i32
+ { INDEX_op_movcond_i32, { "r", "r", "ri", "r", "0" } },
++#endif
+
+ #if TCG_TARGET_REG_BITS == 32
+ { INDEX_op_mulu2_i32, { "a", "d", "a", "r" } },
+--
+1.7.12.1
+
--- /dev/null
+From 86aeba1e72542270a2ae2570cdfcfa6b9e59eeb8 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Wed, 12 Sep 2012 19:18:55 +0200
+Subject: [PATCH] tcg: Fix MAX_OPC_PARAM_IARGS
+
+DEF_HELPER_FLAGS_5 was added some time ago without adjusting
+MAX_OPC_PARAM_IARGS.
+
+Fixing the definition becomes more important as QEMU is using
+an increasing number of helper functions called with 5 arguments.
+
+Add also a comment to avoid future problems when DEF_HELPER_FLAGS_6
+will be added.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ def-helper.h | 2 ++
+ exec-all.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/def-helper.h b/def-helper.h
+index b98ff69..022a9ce 100644
+--- a/def-helper.h
++++ b/def-helper.h
+@@ -128,6 +128,8 @@
+ #define DEF_HELPER_5(name, ret, t1, t2, t3, t4, t5) \
+ DEF_HELPER_FLAGS_5(name, 0, ret, t1, t2, t3, t4, t5)
+
++/* MAX_OPC_PARAM_IARGS must be set to n if last entry is DEF_HELPER_FLAGS_n. */
++
+ #endif /* DEF_HELPER_H */
+
+ #ifndef GEN_HELPER
+diff --git a/exec-all.h b/exec-all.h
+index 1f81da7..6516da0 100644
+--- a/exec-all.h
++++ b/exec-all.h
+@@ -51,7 +51,7 @@ typedef struct TranslationBlock TranslationBlock;
+ #else
+ #define MAX_OPC_PARAM_PER_ARG 1
+ #endif
+-#define MAX_OPC_PARAM_IARGS 4
++#define MAX_OPC_PARAM_IARGS 5
+ #define MAX_OPC_PARAM_OARGS 1
+ #define MAX_OPC_PARAM_ARGS (MAX_OPC_PARAM_IARGS + MAX_OPC_PARAM_OARGS)
+
+--
+1.7.12.1
+
--- /dev/null
+From 2acbc7d596b022dca4fc147eb89e3d5f297acb1f Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 18 Sep 2012 22:43:38 +0200
+Subject: [PATCH] tci: Fix for AREG0 free mode
+
+Support for helper functions with 5 arguments was missing
+in the code generator and in the interpreter.
+
+There is no need to pass the constant TCG_AREG0 from the
+code generator to the interpreter. Remove that code for
+the INDEX_op_qemu_st* opcodes.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ tcg/tci/tcg-target.c | 10 +++++-----
+ tci.c | 13 +++++++++----
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c
+index 003244c..c8c2f1d 100644
+--- a/tcg/tci/tcg-target.c
++++ b/tcg/tci/tcg-target.c
+@@ -300,7 +300,7 @@ static const int tcg_target_reg_alloc_order[] = {
+ #endif
+ };
+
+-#if MAX_OPC_PARAM_IARGS != 4
++#if MAX_OPC_PARAM_IARGS != 5
+ # error Fix needed, number of supported input arguments changed!
+ #endif
+
+@@ -309,16 +309,18 @@ static const int tcg_target_call_iarg_regs[] = {
+ TCG_REG_R1,
+ TCG_REG_R2,
+ TCG_REG_R3,
+-#if TCG_TARGET_REG_BITS == 32
+- /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+ #if 0 /* used for TCG_REG_CALL_STACK */
+ TCG_REG_R4,
+ #endif
+ TCG_REG_R5,
++#if TCG_TARGET_REG_BITS == 32
++ /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+ TCG_REG_R6,
+ TCG_REG_R7,
+ #if TCG_TARGET_NB_REGS >= 16
+ TCG_REG_R8,
++ TCG_REG_R9,
++ TCG_REG_R10,
+ #else
+ # error Too few input registers available
+ #endif
+@@ -798,7 +800,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ case INDEX_op_qemu_st8:
+ case INDEX_op_qemu_st16:
+ case INDEX_op_qemu_st32:
+- tcg_out_r(s, TCG_AREG0);
+ tcg_out_r(s, *args++);
+ tcg_out_r(s, *args++);
+ #if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
+@@ -809,7 +810,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ #endif
+ break;
+ case INDEX_op_qemu_st64:
+- tcg_out_r(s, TCG_AREG0);
+ tcg_out_r(s, *args++);
+ #if TCG_TARGET_REG_BITS == 32
+ tcg_out_r(s, *args++);
+diff --git a/tci.c b/tci.c
+index ce8a988..a4f7b78 100644
+--- a/tci.c
++++ b/tci.c
+@@ -36,17 +36,19 @@
+ tcg_abort(); \
+ } while (0)
+
+-#if MAX_OPC_PARAM_IARGS != 4
++#if MAX_OPC_PARAM_IARGS != 5
+ # error Fix needed, number of supported input arguments changed!
+ #endif
+ #if TCG_TARGET_REG_BITS == 32
+ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
+ tcg_target_ulong, tcg_target_ulong,
+ tcg_target_ulong, tcg_target_ulong,
++ tcg_target_ulong, tcg_target_ulong,
+ tcg_target_ulong, tcg_target_ulong);
+ #else
+ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
+- tcg_target_ulong, tcg_target_ulong);
++ tcg_target_ulong, tcg_target_ulong,
++ tcg_target_ulong);
+ #endif
+
+ /* TCI can optionally use a global register variable for env. */
+@@ -489,14 +491,17 @@ tcg_target_ulong tcg_qemu_tb_exec(CPUArchState *cpustate, uint8_t *tb_ptr)
+ tci_read_reg(TCG_REG_R5),
+ tci_read_reg(TCG_REG_R6),
+ tci_read_reg(TCG_REG_R7),
+- tci_read_reg(TCG_REG_R8));
++ tci_read_reg(TCG_REG_R8),
++ tci_read_reg(TCG_REG_R9),
++ tci_read_reg(TCG_REG_R10));
+ tci_write_reg(TCG_REG_R0, tmp64);
+ tci_write_reg(TCG_REG_R1, tmp64 >> 32);
+ #else
+ tmp64 = ((helper_function)t0)(tci_read_reg(TCG_REG_R0),
+ tci_read_reg(TCG_REG_R1),
+ tci_read_reg(TCG_REG_R2),
+- tci_read_reg(TCG_REG_R3));
++ tci_read_reg(TCG_REG_R3),
++ tci_read_reg(TCG_REG_R5));
+ tci_write_reg(TCG_REG_R0, tmp64);
+ #endif
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From 9fa75115d0f300817a372dd8b9460d6b65a30b20 Mon Sep 17 00:00:00 2001
+From: Christophe Fergeau <cfergeau@redhat.com>
+Date: Mon, 13 Aug 2012 10:32:32 +0200
+Subject: [PATCH] spice: abort on invalid streaming cmdline params
+
+When parsing its command line parameters, spice aborts when it
+finds unexpected values, except for the 'streaming-video' option.
+This happens because the parsing of the parameters for this option
+is done using the 'name2enum' helper, which does not error out
+on unknown values. Using the 'parse_name' helper makes sure we
+error out in this case. Looking at git history, the use of
+'name2enum' instead of 'parse_name' seems to have been an oversight,
+so let's change to that now.
+
+Fixes rhbz#831708
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 835cab85ad83ed8dfe1c13243aeda5959b153e3e)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ ui/spice-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index 4fc48f8..bb4f585 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -344,7 +344,8 @@ static const char *stream_video_names[] = {
+ [ SPICE_STREAM_VIDEO_FILTER ] = "filter",
+ };
+ #define parse_stream_video(_name) \
+- name2enum(_name, stream_video_names, ARRAY_SIZE(stream_video_names))
++ parse_name(_name, "stream video control", \
++ stream_video_names, ARRAY_SIZE(stream_video_names))
+
+ static const char *compression_names[] = {
+ [ SPICE_IMAGE_COMPRESS_OFF ] = "off",
+--
+1.7.12.1
+
--- /dev/null
+From 7fbcbd48d2898935369b443a489ea79d49fe19c4 Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 11:51:55 +0300
+Subject: [PATCH] spice: notify spice server on vm start/stop
+
+Spice server needs to know about the vm state in order to prevent
+attempts to write to devices when they are stopped, mainly during
+the non-live stage of migration.
+Instead, spice will take care of restoring this writes, on the migration
+target side, after migration completes.
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit f5bb039c6d97ef3e664094eab3c9a4dc1824ed73)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ ui/spice-core.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index bb4f585..a515c94 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -546,6 +546,18 @@ static int add_channel(const char *name, const char *value, void *opaque)
+ return 0;
+ }
+
++static void vm_change_state_handler(void *opaque, int running,
++ RunState state)
++{
++#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
++ if (running) {
++ spice_server_vm_start(spice_server);
++ } else {
++ spice_server_vm_stop(spice_server);
++ }
++#endif
++}
++
+ void qemu_spice_init(void)
+ {
+ QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head);
+@@ -719,6 +731,8 @@ void qemu_spice_init(void)
+ qemu_spice_input_init();
+ qemu_spice_audio_init();
+
++ qemu_add_vm_change_state_handler(vm_change_state_handler, &spice_server);
++
+ g_free(x509_key_file);
+ g_free(x509_cert_file);
+ g_free(x509_cacert_file);
+--
+1.7.12.1
+
--- /dev/null
+From c50f358fbd549b5ec3b5dd82e29ed06ce969e50a Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 11:51:56 +0300
+Subject: [PATCH] spice: notify on vm state change only via
+ spice_server_vm_start/stop
+
+QXLWorker->start/stop are deprecated since spice-server 0.11.2
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 71d388d420e68ac77cd42f15f7e68cf5a6fb01b2)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/qxl.c | 7 ++++---
+ ui/spice-core.c | 4 ++++
+ ui/spice-display.c | 32 ++++++++++++++++++++++++++++++--
+ ui/spice-display.h | 9 +++++++--
+ 4 files changed, 45 insertions(+), 7 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index c2dd3b4..95bbc03 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -958,9 +958,10 @@ static void qxl_update_irq(PCIQXLDevice *d)
+ static void qxl_check_state(PCIQXLDevice *d)
+ {
+ QXLRam *ram = d->ram;
++ int spice_display_running = qemu_spice_display_is_running(&d->ssd);
+
+- assert(!d->ssd.running || SPICE_RING_IS_EMPTY(&ram->cmd_ring));
+- assert(!d->ssd.running || SPICE_RING_IS_EMPTY(&ram->cursor_ring));
++ assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cmd_ring));
++ assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cursor_ring));
+ }
+
+ static void qxl_reset_state(PCIQXLDevice *d)
+@@ -1538,7 +1539,7 @@ static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
+ uint32_t old_pending;
+ uint32_t le_events = cpu_to_le32(events);
+
+- assert(d->ssd.running);
++ assert(qemu_spice_display_is_running(&d->ssd));
+ old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
+ if ((old_pending & le_events) == le_events) {
+ return;
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index a515c94..1a7a773 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -37,6 +37,7 @@
+ #include "migration.h"
+ #include "monitor.h"
+ #include "hw/hw.h"
++#include "spice-display.h"
+
+ /* core bits */
+
+@@ -551,9 +552,11 @@ static void vm_change_state_handler(void *opaque, int running,
+ {
+ #if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
+ if (running) {
++ qemu_spice_display_start();
+ spice_server_vm_start(spice_server);
+ } else {
+ spice_server_vm_stop(spice_server);
++ qemu_spice_display_stop();
+ }
+ #endif
+ }
+@@ -755,6 +758,7 @@ int qemu_spice_add_interface(SpiceBaseInstance *sin)
+ spice_server = spice_server_new();
+ spice_server_init(spice_server, &core_interface);
+ }
++
+ return spice_server_add_interface(spice_server, sin);
+ }
+
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 3e8f0b3..1c31418 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -126,18 +126,44 @@ void qemu_spice_wakeup(SimpleSpiceDisplay *ssd)
+ ssd->worker->wakeup(ssd->worker);
+ }
+
+-void qemu_spice_start(SimpleSpiceDisplay *ssd)
++#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
++static void qemu_spice_start(SimpleSpiceDisplay *ssd)
+ {
+ trace_qemu_spice_start(ssd->qxl.id);
+ ssd->worker->start(ssd->worker);
+ }
+
+-void qemu_spice_stop(SimpleSpiceDisplay *ssd)
++static void qemu_spice_stop(SimpleSpiceDisplay *ssd)
+ {
+ trace_qemu_spice_stop(ssd->qxl.id);
+ ssd->worker->stop(ssd->worker);
+ }
+
++#else
++
++static int spice_display_is_running;
++
++void qemu_spice_display_start(void)
++{
++ spice_display_is_running = true;
++}
++
++void qemu_spice_display_stop(void)
++{
++ spice_display_is_running = false;
++}
++
++#endif
++
++int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd)
++{
++#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
++ return ssd->running;
++#else
++ return spice_display_is_running;
++#endif
++}
++
+ static SimpleSpiceUpdate *qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ {
+ SimpleSpiceUpdate *update;
+@@ -272,6 +298,7 @@ void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
+ void qemu_spice_vm_change_state_handler(void *opaque, int running,
+ RunState state)
+ {
++#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+ SimpleSpiceDisplay *ssd = opaque;
+
+ if (running) {
+@@ -281,6 +308,7 @@ void qemu_spice_vm_change_state_handler(void *opaque, int running,
+ qemu_spice_stop(ssd);
+ ssd->running = false;
+ }
++#endif
+ }
+
+ void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd, DisplayState *ds)
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index 12e50b6..672d65e 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -82,7 +82,9 @@ struct SimpleSpiceDisplay {
+
+ QXLRect dirty;
+ int notify;
++#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+ int running;
++#endif
+
+ /*
+ * All struct members below this comment can be accessed from
+@@ -129,5 +131,8 @@ void qemu_spice_create_primary_surface(SimpleSpiceDisplay *ssd, uint32_t id,
+ void qemu_spice_destroy_primary_surface(SimpleSpiceDisplay *ssd,
+ uint32_t id, qxl_async_io async);
+ void qemu_spice_wakeup(SimpleSpiceDisplay *ssd);
+-void qemu_spice_start(SimpleSpiceDisplay *ssd);
+-void qemu_spice_stop(SimpleSpiceDisplay *ssd);
++#if SPICE_SERVER_VERSION >= 0x000b02 /* before 0.11.2 */
++void qemu_spice_display_start(void);
++void qemu_spice_display_stop(void);
++#endif
++int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd);
+--
+1.7.12.1
+
--- /dev/null
+From 8470a0f943e8605739b7bc0081507f787bed412d Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 11:51:57 +0300
+Subject: [PATCH] spice migration: add QEVENT_SPICE_MIGRATE_COMPLETED
+
+When migrating, libvirt queries the migration status, and upon migration
+completions, it closes the migration src. On the other hand, when
+migration is completed, spice transfers data from the src to destination
+via the client. This data is required for keeping the spice session
+after migration, without suffering from data loss and inconsistencies.
+In order to allow this data transfer, we add QEVENT for signaling
+libvirt that spice migration has completed, and libvirt needs to wait
+for this event before quitting the src process.
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 2fdd16e239c2a2763aa3266e637718123328688c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ monitor.c | 1 +
+ monitor.h | 1 +
+ ui/spice-core.c | 9 ++++++++-
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/monitor.c b/monitor.c
+index 29e4287..f45cf92 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -455,6 +455,7 @@ static const char *monitor_event_names[] = {
+ [QEVENT_SUSPEND_DISK] = "SUSPEND_DISK",
+ [QEVENT_WAKEUP] = "WAKEUP",
+ [QEVENT_BALLOON_CHANGE] = "BALLOON_CHANGE",
++ [QEVENT_SPICE_MIGRATE_COMPLETED] = "SPICE_MIGRATE_COMPLETED",
+ };
+ QEMU_BUILD_BUG_ON(ARRAY_SIZE(monitor_event_names) != QEVENT_MAX)
+
+diff --git a/monitor.h b/monitor.h
+index 47d556b..5fc2983 100644
+--- a/monitor.h
++++ b/monitor.h
+@@ -43,6 +43,7 @@ typedef enum MonitorEvent {
+ QEVENT_SUSPEND_DISK,
+ QEVENT_WAKEUP,
+ QEVENT_BALLOON_CHANGE,
++ QEVENT_SPICE_MIGRATE_COMPLETED,
+
+ /* Add to 'monitor_event_names' array in monitor.c when
+ * defining new events here */
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index 1a7a773..851e869 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -285,6 +285,7 @@ typedef struct SpiceMigration {
+ } SpiceMigration;
+
+ static void migrate_connect_complete_cb(SpiceMigrateInstance *sin);
++static void migrate_end_complete_cb(SpiceMigrateInstance *sin);
+
+ static const SpiceMigrateInterface migrate_interface = {
+ .base.type = SPICE_INTERFACE_MIGRATION,
+@@ -292,7 +293,7 @@ static const SpiceMigrateInterface migrate_interface = {
+ .base.major_version = SPICE_INTERFACE_MIGRATION_MAJOR,
+ .base.minor_version = SPICE_INTERFACE_MIGRATION_MINOR,
+ .migrate_connect_complete = migrate_connect_complete_cb,
+- .migrate_end_complete = NULL,
++ .migrate_end_complete = migrate_end_complete_cb,
+ };
+
+ static SpiceMigration spice_migrate;
+@@ -305,6 +306,11 @@ static void migrate_connect_complete_cb(SpiceMigrateInstance *sin)
+ }
+ sm->connect_complete.cb = NULL;
+ }
++
++static void migrate_end_complete_cb(SpiceMigrateInstance *sin)
++{
++ monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
++}
+ #endif
+
+ /* config string parsing */
+@@ -489,6 +495,7 @@ static void migration_state_notifier(Notifier *notifier, void *data)
+ } else if (migration_has_finished(s)) {
+ #ifndef SPICE_INTERFACE_MIGRATION
+ spice_server_migrate_switch(spice_server);
++ monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
+ #else
+ spice_server_migrate_end(spice_server, true);
+ } else if (migration_has_failed(s)) {
+--
+1.7.12.1
+
--- /dev/null
+From a4155f1a9fac362bfc1558790de9ea4cdb0a3c8a Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 11:51:58 +0300
+Subject: [PATCH] spice: add 'migrated' flag to spice info
+
+The flag is 'true' when spice migration has completed on the src side.
+It is needed for a case where libvirt dies before migration completes
+and it misses the event QEVENT_SPICE_MIGRATE_COMPLETED.
+When libvirt is restored and queries the migration status, it also needs
+to query spice and check if its migration has completed.
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 61c4efe2cb85b0a9c6bc68f6a2dd107c8d7ec080)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hmp.c | 2 ++
+ qapi-schema.json | 5 ++++-
+ ui/spice-core.c | 4 ++++
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/hmp.c b/hmp.c
+index 81c8acb..ec4274b 100644
+--- a/hmp.c
++++ b/hmp.c
+@@ -413,6 +413,8 @@ void hmp_info_spice(Monitor *mon)
+ monitor_printf(mon, " address: %s:%" PRId64 " [tls]\n",
+ info->host, info->tls_port);
+ }
++ monitor_printf(mon, " migrated: %s\n",
++ info->migrated ? "true" : "false");
+ monitor_printf(mon, " auth: %s\n", info->auth);
+ monitor_printf(mon, " compiled: %s\n", info->compiled_version);
+ monitor_printf(mon, " mouse-mode: %s\n",
+diff --git a/qapi-schema.json b/qapi-schema.json
+index bd8ad74..8ddde12 100644
+--- a/qapi-schema.json
++++ b/qapi-schema.json
+@@ -808,6 +808,9 @@
+ #
+ # @enabled: true if the SPICE server is enabled, false otherwise
+ #
++# @migrated: true if the last guest migration completed and spice
++# migration had completed as well. false otherwise.
++#
+ # @host: #optional The hostname the SPICE server is bound to. This depends on
+ # the name resolution on the host and may be an IP address.
+ #
+@@ -833,7 +836,7 @@
+ # Since: 0.14.0
+ ##
+ { 'type': 'SpiceInfo',
+- 'data': {'enabled': 'bool', '*host': 'str', '*port': 'int',
++ 'data': {'enabled': 'bool', 'migrated': 'bool', '*host': 'str', '*port': 'int',
+ '*tls-port': 'int', '*auth': 'str', '*compiled-version': 'str',
+ 'mouse-mode': 'SpiceQueryMouseMode', '*channels': ['SpiceChannel']} }
+
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index 851e869..ab069c5 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -46,6 +46,7 @@ static Notifier migration_state;
+ static const char *auth = "spice";
+ static char *auth_passwd;
+ static time_t auth_expires = TIME_MAX;
++static int spice_migration_completed;
+ int using_spice = 0;
+
+ static QemuThread me;
+@@ -310,6 +311,7 @@ static void migrate_connect_complete_cb(SpiceMigrateInstance *sin)
+ static void migrate_end_complete_cb(SpiceMigrateInstance *sin)
+ {
+ monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
++ spice_migration_completed = true;
+ }
+ #endif
+
+@@ -443,6 +445,7 @@ SpiceInfo *qmp_query_spice(Error **errp)
+ }
+
+ info->enabled = true;
++ info->migrated = spice_migration_completed;
+
+ addr = qemu_opt_get(opts, "addr");
+ port = qemu_opt_get_number(opts, "port", 0);
+@@ -496,6 +499,7 @@ static void migration_state_notifier(Notifier *notifier, void *data)
+ #ifndef SPICE_INTERFACE_MIGRATION
+ spice_server_migrate_switch(spice_server);
+ monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
++ spice_migration_completed = true;
+ #else
+ spice_server_migrate_end(spice_server, true);
+ } else if (migration_has_failed(s)) {
+--
+1.7.12.1
+
--- /dev/null
+From b15c26620bb765e25c96163383d79c1c56df7901 Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 11:51:59 +0300
+Subject: [PATCH] spice: adding seamless-migration option to the command line
+
+The seamless-migration flag is required in order to identify
+whether libvirt supports the new QEVENT_SPICE_MIGRATE_COMPLETED or not
+(by default the flag is off).
+New libvirt versions that wait for QEVENT_SPICE_MIGRATE_COMPLETED should turn on this flag.
+When this flag is off, spice fallbacks to its old migration method, which
+can result in data loss.
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 8c9570530c819821b9b5cc3113d2b2966afe7621)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-config.c | 3 +++
+ qemu-options.hx | 3 +++
+ ui/spice-core.c | 7 +++++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/qemu-config.c b/qemu-config.c
+index 238390e..3eaee48 100644
+--- a/qemu-config.c
++++ b/qemu-config.c
+@@ -541,6 +541,9 @@ QemuOptsList qemu_spice_opts = {
+ },{
+ .name = "playback-compression",
+ .type = QEMU_OPT_BOOL,
++ }, {
++ .name = "seamless-migration",
++ .type = QEMU_OPT_BOOL,
+ },
+ { /* end of list */ }
+ },
+diff --git a/qemu-options.hx b/qemu-options.hx
+index ea06324..dd7aa63 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -920,6 +920,9 @@ Enable/disable passing mouse events via vdagent. Default is on.
+ @item playback-compression=[on|off]
+ Enable/disable audio stream compression (using celt 0.5.1). Default is on.
+
++@item seamless-migration=[on|off]
++Enable/disable spice seamless migration. Default is off.
++
+ @end table
+ ETEXI
+
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index ab069c5..ba0d0bd 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -585,6 +585,9 @@ void qemu_spice_init(void)
+ int port, tls_port, len, addr_flags;
+ spice_image_compression_t compression;
+ spice_wan_compression_t wan_compr;
++#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
++ bool seamless_migration;
++#endif
+
+ qemu_thread_get_self(&me);
+
+@@ -728,6 +731,10 @@ void qemu_spice_init(void)
+ spice_server_set_uuid(spice_server, qemu_uuid);
+ #endif
+
++#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
++ seamless_migration = qemu_opt_get_bool(opts, "seamless-migration", 0);
++ spice_server_set_seamless_migration(spice_server, seamless_migration);
++#endif
+ if (0 != spice_server_init(spice_server, &core_interface)) {
+ error_report("failed to initialize spice server");
+ exit(1);
+--
+1.7.12.1
+
--- /dev/null
+From 589cb6a669e11e1ce4b077e8ba0fbb9fc8d5bd40 Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Tue, 21 Aug 2012 13:54:20 +0300
+Subject: [PATCH] spice: increase the verbosity of spice section in "qemu
+ --help"
+
+Added all spice options to the help string. This can be used by libvirt
+to determine which spice related features are supported by qemu.
+
+Signed-off-by: Yonit Halperin <yhalperi@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 27af778828db9aa893fa1de928744141e5de20e5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-options.hx | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/qemu-options.hx b/qemu-options.hx
+index dd7aa63..1af4fec 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -838,7 +838,23 @@ Enable SDL.
+ ETEXI
+
+ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
+- "-spice <args> enable spice\n", QEMU_ARCH_ALL)
++ "-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]\n"
++ " [,x509-key-file=<file>][,x509-key-password=<file>]\n"
++ " [,x509-cert-file=<file>][,x509-cacert-file=<file>]\n"
++ " [,x509-dh-key-file=<file>][,addr=addr][,ipv4|ipv6]\n"
++ " [,tls-ciphers=<list>]\n"
++ " [,tls-channel=[main|display|cursor|inputs|record|playback]]\n"
++ " [,plaintext-channel=[main|display|cursor|inputs|record|playback]]\n"
++ " [,sasl][,password=<secret>][,disable-ticketing]\n"
++ " [,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]\n"
++ " [,jpeg-wan-compression=[auto|never|always]]\n"
++ " [,zlib-glz-wan-compression=[auto|never|always]]\n"
++ " [,streaming-video=[off|all|filter]][,disable-copy-paste]\n"
++ " [,agent-mouse=[on|off]][,playback-compression=[on|off]]\n"
++ " [,seamless-migration=[on|off]]\n"
++ " enable spice\n"
++ " at least one of {port, tls-port} is mandatory\n",
++ QEMU_ARCH_ALL)
+ STEXI
+ @item -spice @var{option}[,@var{option}[,...]]
+ @findex -spice
+--
+1.7.12.1
+
--- /dev/null
+From 8a3d428e1e0f3e4793b1a1353c638e155a3a8a86 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 21 Aug 2012 13:51:31 +0300
+Subject: [PATCH] qxl/update_area_io: guest_bug on invalid parameters
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 511b13e2c9b426b3c56060909693de5097f0b496)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/qxl.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 95bbc03..baf9bb4 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1386,6 +1386,18 @@ async_common:
+ QXLCookie *cookie = NULL;
+ QXLRect update = d->ram->update_area;
+
++ if (d->ram->update_surface > NUM_SURFACES) {
++ qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
++ d->ram->update_surface);
++ return;
++ }
++ if (update.left >= update.right || update.top >= update.bottom) {
++ qxl_set_guest_bug(d,
++ "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
++ update.left, update.top, update.right, update.bottom);
++ return;
++ }
++
+ if (async == QXL_ASYNC) {
+ cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
+ QXL_IO_UPDATE_AREA_ASYNC);
+--
+1.7.12.1
+
--- /dev/null
+From e9062966428416da41ec5f9ace3d2ef58b3265b1 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 22 Aug 2012 11:16:25 +0300
+Subject: [PATCH] qxl: add QXL_IO_MONITORS_CONFIG_ASYNC
+
+Revision bumped to 4 for new IO support, enabled for spice-server >=
+0.11.1. New io enabled if revision is 4. Revision can be set to 4.
+
+[ kraxel: 3 continues to be the default revision. Once we have a new
+ stable spice-server release and the qemu patches to enable
+ the new bits merged we'll go flip the switch and make rev4
+ the default ]
+
+This io calls the corresponding new spice api
+spice_qxl_monitors_config_async to let spice-server read a new guest set
+monitors config and notify the client.
+
+On migration reissue spice_qxl_monitors_config_async.
+
+RHBZ: 770842
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+fixup
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 020af1c45fec664d5d4cf3b8e5117f8bc1d691f2)
+
+Conflicts:
+
+ hw/qxl.c
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 7 ++++
+ hw/qxl.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
+ hw/qxl.h | 7 ++++
+ trace-events | 1 +
+ ui/spice-display.h | 1 +
+ 5 files changed, 111 insertions(+), 3 deletions(-)
+
+diff --git a/configure b/configure
+index 8ffddf4..b5cea26 100755
+--- a/configure
++++ b/configure
+@@ -2670,6 +2670,9 @@ EOF
+ spice="yes"
+ libs_softmmu="$libs_softmmu $spice_libs"
+ QEMU_CFLAGS="$QEMU_CFLAGS $spice_cflags"
++ if $pkg_config --atleast-version=0.12.0 spice-protocol >/dev/null 2>&1; then
++ spice_qxl_io_monitors_config_async="yes"
++ fi
+ else
+ if test "$spice" = "yes" ; then
+ feature_not_found "spice"
+@@ -3407,6 +3410,10 @@ if test "$spice" = "yes" ; then
+ echo "CONFIG_SPICE=y" >> $config_host_mak
+ fi
+
++if test "$spice_qxl_io_monitors_config_async" = "yes" ; then
++ echo "CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC=y" >> $config_host_mak
++fi
++
+ if test "$smartcard" = "yes" ; then
+ echo "CONFIG_SMARTCARD=y" >> $config_host_mak
+ fi
+diff --git a/hw/qxl.c b/hw/qxl.c
+index baf9bb4..27f3779 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -27,6 +27,11 @@
+
+ #include "qxl.h"
+
++#ifndef CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
++/* spice-protocol is too old, add missing definitions */
++#define QXL_IO_MONITORS_CONFIG_ASYNC (QXL_IO_FLUSH_RELEASE + 1)
++#endif
++
+ /*
+ * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
+ * such can be changed by the guest, so to avoid a guest trigerrable
+@@ -249,6 +254,39 @@ static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
+ }
+ }
+
++static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
++{
++ trace_qxl_spice_monitors_config(qxl->id);
++/* 0x000b01 == 0.11.1 */
++#if SPICE_SERVER_VERSION >= 0x000b01 && \
++ defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
++ if (replay) {
++ /*
++ * don't use QXL_COOKIE_TYPE_IO:
++ * - we are not running yet (post_load), we will assert
++ * in send_events
++ * - this is not a guest io, but a reply, so async_io isn't set.
++ */
++ spice_qxl_monitors_config_async(&qxl->ssd.qxl,
++ qxl->guest_monitors_config,
++ MEMSLOT_GROUP_GUEST,
++ (uintptr_t)qxl_cookie_new(
++ QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
++ 0));
++ } else {
++ qxl->guest_monitors_config = qxl->ram->monitors_config;
++ spice_qxl_monitors_config_async(&qxl->ssd.qxl,
++ qxl->ram->monitors_config,
++ MEMSLOT_GROUP_GUEST,
++ (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
++ QXL_IO_MONITORS_CONFIG_ASYNC));
++ }
++#else
++ fprintf(stderr, "qxl: too old spice-protocol/spice-server for "
++ "QXL_IO_MONITORS_CONFIG_ASYNC\n");
++#endif
++}
++
+ void qxl_spice_reset_image_cache(PCIQXLDevice *qxl)
+ {
+ trace_qxl_spice_reset_image_cache(qxl->id);
+@@ -538,6 +576,7 @@ static const char *io_port_to_string(uint32_t io_port)
+ = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
+ [QXL_IO_FLUSH_SURFACES_ASYNC] = "QXL_IO_FLUSH_SURFACES_ASYNC",
+ [QXL_IO_FLUSH_RELEASE] = "QXL_IO_FLUSH_RELEASE",
++ [QXL_IO_MONITORS_CONFIG_ASYNC] = "QXL_IO_MONITORS_CONFIG_ASYNC",
+ };
+ return io_port_to_string[io_port];
+ }
+@@ -819,6 +858,7 @@ static void interface_async_complete_io(PCIQXLDevice *qxl, QXLCookie *cookie)
+ case QXL_IO_DESTROY_PRIMARY_ASYNC:
+ case QXL_IO_UPDATE_AREA_ASYNC:
+ case QXL_IO_FLUSH_SURFACES_ASYNC:
++ case QXL_IO_MONITORS_CONFIG_ASYNC:
+ break;
+ case QXL_IO_CREATE_PRIMARY_ASYNC:
+ qxl_create_guest_primary_complete(qxl);
+@@ -894,6 +934,8 @@ static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
+ case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA:
+ qxl_render_update_area_done(qxl, cookie);
+ break;
++ case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG:
++ break;
+ default:
+ fprintf(stderr, "qxl: %s: unexpected cookie type %d\n",
+ __func__, cookie->type);
+@@ -1315,6 +1357,13 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ return;
+ }
+
++ if (d->revision <= QXL_REVISION_STABLE_V10 &&
++ io_port >= QXL_IO_FLUSH_SURFACES_ASYNC) {
++ qxl_set_guest_bug(d, "unsupported io %d for revision %d\n",
++ io_port, d->revision);
++ return;
++ }
++
+ switch (io_port) {
+ case QXL_IO_RESET:
+ case QXL_IO_SET_MODE:
+@@ -1334,7 +1383,7 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ io_port, io_port_to_string(io_port));
+ /* be nice to buggy guest drivers */
+ if (io_port >= QXL_IO_UPDATE_AREA_ASYNC &&
+- io_port <= QXL_IO_DESTROY_ALL_SURFACES_ASYNC) {
++ io_port < QXL_IO_RANGE_SIZE) {
+ qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
+ }
+ return;
+@@ -1362,6 +1411,7 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ io_port = QXL_IO_DESTROY_ALL_SURFACES;
+ goto async_common;
+ case QXL_IO_FLUSH_SURFACES_ASYNC:
++ case QXL_IO_MONITORS_CONFIG_ASYNC:
+ async_common:
+ async = QXL_ASYNC;
+ qemu_mutex_lock(&d->async_lock);
+@@ -1503,6 +1553,9 @@ async_common:
+ d->mode = QXL_MODE_UNDEFINED;
+ qxl_spice_destroy_surfaces(d, async);
+ break;
++ case QXL_IO_MONITORS_CONFIG_ASYNC:
++ qxl_spice_monitors_config_async(d, 0);
++ break;
+ default:
+ qxl_set_guest_bug(d, "%s: unexpected ioport=0x%x\n", __func__, io_port);
+ }
+@@ -1798,6 +1851,17 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+ io_size = 16;
+ break;
+ case 3: /* qxl-3 */
++ pci_device_rev = QXL_REVISION_STABLE_V10;
++ io_size = 32; /* PCI region size must be pow2 */
++ break;
++/* 0x000b01 == 0.11.1 */
++#if SPICE_SERVER_VERSION >= 0x000b01 && \
++ defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
++ case 4: /* qxl-4 */
++ pci_device_rev = QXL_REVISION_STABLE_V12;
++ io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
++ break;
++#endif
+ default:
+ pci_device_rev = QXL_DEFAULT_REVISION;
+ io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
+@@ -1996,7 +2060,9 @@ static int qxl_post_load(void *opaque, int version)
+ }
+ qxl_spice_loadvm_commands(d, cmds, out);
+ g_free(cmds);
+-
++ if (d->guest_monitors_config) {
++ qxl_spice_monitors_config_async(d, 1);
++ }
+ break;
+ case QXL_MODE_COMPAT:
+ /* note: no need to call qxl_create_memslots, qxl_set_mode
+@@ -2009,6 +2075,14 @@ static int qxl_post_load(void *opaque, int version)
+
+ #define QXL_SAVE_VERSION 21
+
++static bool qxl_monitors_config_needed(void *opaque)
++{
++ PCIQXLDevice *qxl = opaque;
++
++ return qxl->guest_monitors_config != 0;
++}
++
++
+ static VMStateDescription qxl_memslot = {
+ .name = "qxl-memslot",
+ .version_id = QXL_SAVE_VERSION,
+@@ -2039,6 +2113,16 @@ static VMStateDescription qxl_surface = {
+ }
+ };
+
++static VMStateDescription qxl_vmstate_monitors_config = {
++ .name = "qxl/monitors-config",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .fields = (VMStateField[]) {
++ VMSTATE_UINT64(guest_monitors_config, PCIQXLDevice),
++ VMSTATE_END_OF_LIST()
++ },
++};
++
+ static VMStateDescription qxl_vmstate = {
+ .name = "qxl",
+ .version_id = QXL_SAVE_VERSION,
+@@ -2046,7 +2130,7 @@ static VMStateDescription qxl_vmstate = {
+ .pre_save = qxl_pre_save,
+ .pre_load = qxl_pre_load,
+ .post_load = qxl_post_load,
+- .fields = (VMStateField []) {
++ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(pci, PCIQXLDevice),
+ VMSTATE_STRUCT(vga, PCIQXLDevice, 0, vmstate_vga_common, VGACommonState),
+ VMSTATE_UINT32(shadow_rom.mode, PCIQXLDevice),
+@@ -2065,6 +2149,14 @@ static VMStateDescription qxl_vmstate = {
+ VMSTATE_UINT64(guest_cursor, PCIQXLDevice),
+ VMSTATE_END_OF_LIST()
+ },
++ .subsections = (VMStateSubsection[]) {
++ {
++ .vmsd = &qxl_vmstate_monitors_config,
++ .needed = qxl_monitors_config_needed,
++ }, {
++ /* empty */
++ }
++ }
+ };
+
+ static Property qxl_properties[] = {
+diff --git a/hw/qxl.h b/hw/qxl.h
+index 172baf6..9cfedb7 100644
+--- a/hw/qxl.h
++++ b/hw/qxl.h
+@@ -71,6 +71,8 @@ typedef struct PCIQXLDevice {
+ } guest_surfaces;
+ QXLPHYSICAL guest_cursor;
+
++ QXLPHYSICAL guest_monitors_config;
++
+ QemuMutex track_lock;
+
+ /* thread signaling */
+@@ -128,7 +130,12 @@ typedef struct PCIQXLDevice {
+ } \
+ } while (0)
+
++#if 0
++/* spice-server 0.12 is still in development */
++#define QXL_DEFAULT_REVISION QXL_REVISION_STABLE_V12
++#else
+ #define QXL_DEFAULT_REVISION QXL_REVISION_STABLE_V10
++#endif
+
+ /* qxl.c */
+ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id);
+diff --git a/trace-events b/trace-events
+index 04b0723..8fcbc50 100644
+--- a/trace-events
++++ b/trace-events
+@@ -956,6 +956,7 @@ qxl_spice_destroy_surfaces(int qid, int async) "%d async=%d"
+ qxl_spice_destroy_surface_wait_complete(int qid, uint32_t id) "%d sid=%d"
+ qxl_spice_destroy_surface_wait(int qid, uint32_t id, int async) "%d sid=%d async=%d"
+ qxl_spice_flush_surfaces_async(int qid, uint32_t surface_count, uint32_t num_free_res) "%d s#=%d, res#=%d"
++qxl_spice_monitors_config(int id) "%d"
+ qxl_spice_loadvm_commands(int qid, void *ext, uint32_t count) "%d ext=%p count=%d"
+ qxl_spice_oom(int qid) "%d"
+ qxl_spice_reset_cursor(int qid) "%d"
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index 672d65e..bcff114 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -51,6 +51,7 @@ typedef enum qxl_async_io {
+ enum {
+ QXL_COOKIE_TYPE_IO,
+ QXL_COOKIE_TYPE_RENDER_UPDATE_AREA,
++ QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
+ };
+
+ typedef struct QXLCookie {
+--
+1.7.12.1
+
--- /dev/null
+From b132bd0cdb4d684105b91a8173c172296cd191af Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 22 Aug 2012 11:16:26 +0300
+Subject: [PATCH] configure: print spice-protocol and spice-server versions
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 2e0e3c399aa8067148055b9ea0edb822c5b584d2)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index b5cea26..d7a948f 100755
+--- a/configure
++++ b/configure
+@@ -2670,6 +2670,8 @@ EOF
+ spice="yes"
+ libs_softmmu="$libs_softmmu $spice_libs"
+ QEMU_CFLAGS="$QEMU_CFLAGS $spice_cflags"
++ spice_protocol_version=$($pkg_config --modversion spice-protocol)
++ spice_server_version=$($pkg_config --modversion spice-server)
+ if $pkg_config --atleast-version=0.12.0 spice-protocol >/dev/null 2>&1; then
+ spice_qxl_io_monitors_config_async="yes"
+ fi
+@@ -3128,7 +3130,7 @@ echo "libcap-ng support $cap_ng"
+ echo "vhost-net support $vhost_net"
+ echo "Trace backend $trace_backend"
+ echo "Trace output file $trace_file-<pid>"
+-echo "spice support $spice"
++echo "spice support $spice ($spice_protocol_version/$spice_server_version)"
+ echo "rbd support $rbd"
+ echo "xfsctl support $xfs"
+ echo "nss used $smartcard_nss"
+--
+1.7.12.1
+
--- /dev/null
+From 211b2548bfbdab72051a7ef1e9982ff4ec0fd98f Mon Sep 17 00:00:00 2001
+From: Amos Kong <akong@redhat.com>
+Date: Fri, 31 Aug 2012 10:56:20 +0800
+Subject: [PATCH] fix doc of using raw values with sendkey
+
+(qemu) sendkey a
+(qemu) sendkey 0x1e
+(qemu) sendkey #0x1e
+ unknown key: '#0x1e'
+
+The last command doesn't work, '#' is not requested before
+raw values, and the raw value in decimal format is not supported.
+
+Signed-off-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
+(cherry picked from commit 886cc706ce5d4d3d1c296f028ddc2991cfbe3bbe)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hmp-commands.hx | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hmp-commands.hx b/hmp-commands.hx
+index 13f28cf..a72614d 100644
+--- a/hmp-commands.hx
++++ b/hmp-commands.hx
+@@ -512,9 +512,9 @@ STEXI
+ @item sendkey @var{keys}
+ @findex sendkey
+
+-Send @var{keys} to the emulator. @var{keys} could be the name of the
+-key or @code{#} followed by the raw value in either decimal or hexadecimal
+-format. Use @code{-} to press several keys simultaneously. Example:
++Send @var{keys} to the guest. @var{keys} could be the name of the
++key or the raw value in hexadecimal format. Use @code{-} to press
++several keys simultaneously. Example:
+ @example
+ sendkey ctrl-alt-f1
+ @end example
+--
+1.7.12.1
+
--- /dev/null
+From d01c76a8d9d0d80ba00a407103e7b79112a21fce Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 09:30:39 +0200
+Subject: [PATCH] qapi: Fix potential NULL pointer segfault
+
+Report from smatch:
+
+qapi-visit.c:1640 visit_type_BlockdevAction(8) error:
+ we previously assumed 'obj' could be null (see line 1639)
+qapi-visit.c:2432 visit_type_NetClientOptions(8) error:
+ we previously assumed 'obj' could be null (see line 2431)
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
+(cherry picked from commit 227ccf6bff234c29974c2c18ecd3a29e6b965e3d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ scripts/qapi-visit.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
+index 04ef7c4..5b15ee3 100644
+--- a/scripts/qapi-visit.py
++++ b/scripts/qapi-visit.py
+@@ -157,7 +157,7 @@ void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **
+ if (!error_is_set(errp)) {
+ visit_start_struct(m, (void **)obj, "%(name)s", name, sizeof(%(name)s), &err);
+ if (!err) {
+- if (!obj || *obj) {
++ if (obj && *obj) {
+ visit_type_%(name)sKind(m, &(*obj)->kind, "type", &err);
+ if (!err) {
+ switch ((*obj)->kind) {
+--
+1.7.12.1
+
--- /dev/null
+From f6df33dc89bfa16645e3a8b76e9457986c07b271 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 3 Sep 2012 21:19:11 +0200
+Subject: [PATCH] json-parser: Fix potential NULL pointer segfault
+
+Report from smatch:
+json-parser.c:474 parse_object(62) error: potential null derefence 'dict'.
+json-parser.c:553 parse_array(75) error: potential null derefence 'list'.
+
+Label 'out' in json-parser.c can be called with list == NULL
+which is passed to QDECREF.
+
+Modify QDECREF to handle a NULL argument (inline function qobject_decref
+already handles them, too).
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
+(cherry picked from commit 149474c93490e1c66f838391bd491db83136d91d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qobject.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qobject.h b/qobject.h
+index d42386d..9124649 100644
+--- a/qobject.h
++++ b/qobject.h
+@@ -71,7 +71,7 @@ typedef struct QObject {
+
+ /* High-level interface for qobject_decref() */
+ #define QDECREF(obj) \
+- qobject_decref(QOBJECT(obj))
++ qobject_decref(obj ? QOBJECT(obj) : NULL)
+
+ /* Initialize an object to default values */
+ #define QOBJECT_INIT(obj, qtype_type) \
+--
+1.7.12.1
+
--- /dev/null
+From 7544abf3b783fc82b031d40d0685d2047709492a Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Wed, 8 Aug 2012 14:29:12 -0400
+Subject: [PATCH] pcie: drop version_id field for live migration
+
+While testing q35 live migration, I found that the migration would abort with
+the following error: "Unknown savevm section type 76".
+
+The error is due to this check failing in 'vmstate_load_state()':
+
+ while(field->name) {
+ if ((field->field_exists &&
+ field->field_exists(opaque, version_id)) ||
+ (!field->field_exists &&
+ field->version_id <= version_id)) {
+
+The VMSTATE_PCIE_DEVICE() currently has a 'version_id' set to 2. However,
+'version_id' in the above check is 1. And thus we fail to load the pcie device
+field. Further the code returns to 'qemu_loadvm_state()' which produces the
+error that I saw.
+
+I'm proposing to fix this by simply dropping the 'version_id' field from
+VMSTATE_PCIE_DEVICE(). VMSTATE_PCI_DEVICE() defines no such field and further
+the vmstate_pcie_device that VMSTATE_PCI_DEVICE() refers to is already
+versioned. Thus, any versioning issues could be detected at the vmsd level.
+
+Taking a step back, I think that the 'field->version_id' should be compared
+against a saved version number for the field not the 'version_id'. Futhermore,
+once vmstate_load_state() is called recursively on another vmsd, the check of:
+
+ if (version_id > vmsd->version_id) {
+ return -EINVAL;
+ }
+
+Will never fail since version_id is always equal to vmsd->version_id. So I'm
+wondering why we aren't storing the vmsd version id of the source in the
+migration stream?
+
+This patch also renames the 'name' field of vmstate_pcie_device from:
+PCIDevice -> PCIEDevice to differentiate it from vmstate_pci_device.
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 1de53459272d89c52bb21b45d5d970de40fbb642)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/pci.c | 2 +-
+ hw/pcie.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/hw/pci.c b/hw/pci.c
+index 4d95984..f855cf3 100644
+--- a/hw/pci.c
++++ b/hw/pci.c
+@@ -439,7 +439,7 @@ const VMStateDescription vmstate_pci_device = {
+ };
+
+ const VMStateDescription vmstate_pcie_device = {
+- .name = "PCIDevice",
++ .name = "PCIEDevice",
+ .version_id = 2,
+ .minimum_version_id = 1,
+ .minimum_version_id_old = 1,
+diff --git a/hw/pcie.h b/hw/pcie.h
+index b8ab0c7..4889194 100644
+--- a/hw/pcie.h
++++ b/hw/pcie.h
+@@ -133,7 +133,6 @@ extern const VMStateDescription vmstate_pcie_device;
+
+ #define VMSTATE_PCIE_DEVICE(_field, _state) { \
+ .name = (stringify(_field)), \
+- .version_id = 2, \
+ .size = sizeof(PCIDevice), \
+ .vmsd = &vmstate_pcie_device, \
+ .flags = VMS_STRUCT, \
+--
+1.7.12.1
+
--- /dev/null
+From 89df4609568433f67999c27f9b9cd12e91a7d0b5 Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Tue, 4 Sep 2012 16:22:46 -0400
+Subject: [PATCH] pcie_aer: clear cmask for Advanced Error Interrupt Message
+ Number
+
+The Advanced Error Interrupt Message Number (bits 31:27 of the Root
+Error Status Register) is updated when the number of msi messages assigned to a
+device changes. Migration of windows 7 on q35 chipset failed because the check
+in get_pci_config_device() fails due to cmask being set on these bits. Its valid
+to update these bits and we must restore this state across migration.
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 0e180d9c8a7429c55d23d2e7855f1e490a063aaa)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/pcie_aer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/pcie_aer.c b/hw/pcie_aer.c
+index 3b6981c..b04c164 100644
+--- a/hw/pcie_aer.c
++++ b/hw/pcie_aer.c
+@@ -738,6 +738,11 @@ void pcie_aer_root_init(PCIDevice *dev)
+ PCI_ERR_ROOT_CMD_EN_MASK);
+ pci_set_long(dev->w1cmask + pos + PCI_ERR_ROOT_STATUS,
+ PCI_ERR_ROOT_STATUS_REPORT_MASK);
++ /* PCI_ERR_ROOT_IRQ is RO but devices change it using a
++ * device-specific method.
++ */
++ pci_set_long(dev->cmask + pos + PCI_ERR_ROOT_STATUS,
++ ~PCI_ERR_ROOT_IRQ);
+ }
+
+ void pcie_aer_root_reset(PCIDevice *dev)
+--
+1.7.12.1
+
--- /dev/null
+From 3d24d0452bb11e371c710a68b88f09c3accee51f Mon Sep 17 00:00:00 2001
+From: Henning Schild <henning@hennsch.de>
+Date: Wed, 5 Sep 2012 14:56:39 +0200
+Subject: [PATCH] fix entry pointer for ELF kernels loaded with -kernel option
+
+ Find a hopefully proper patch attached. Take it or leave it.
+
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Henning Schild <henning@hennsch.de>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit 7e9c7ffe9fd9dfc3d0168dd584936db8144b230b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/elf_ops.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/elf_ops.h b/hw/elf_ops.h
+index fa65ce2..731a983 100644
+--- a/hw/elf_ops.h
++++ b/hw/elf_ops.h
+@@ -269,6 +269,17 @@ static int glue(load_elf, SZ)(const char *name, int fd,
+ addr = ph->p_paddr;
+ }
+
++ /* the entry pointer in the ELF header is a virtual
++ * address, if the text segments paddr and vaddr differ
++ * we need to adjust the entry */
++ if (pentry && !translate_fn &&
++ ph->p_vaddr != ph->p_paddr &&
++ ehdr.e_entry >= ph->p_vaddr &&
++ ehdr.e_entry < ph->p_vaddr + ph->p_filesz &&
++ ph->p_flags & PF_X) {
++ *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr;
++ }
++
+ snprintf(label, sizeof(label), "phdr #%d: %s", i, name);
+ rom_add_blob_fixed(label, data, mem_size, addr);
+
+--
+1.7.12.1
+
--- /dev/null
+From 0ea96930bcd85734da46de0cd44d1d0408cbb9be Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Sun, 10 Jun 2012 23:18:44 +0200
+Subject: [PATCH] lan9118: fix multicast filtering
+
+The lan9118 emulation tries to compute the multicast index by calling
+directly the crc32() function from zlib, but fails to get the correct
+result.
+
+Use the common compute_mcast_idx() function instead, which gives the
+correct result. This fixes IPv6 support.
+
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit 449bc90e1f2e2fbafb64eb0c76d16c9352b0d2df)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/lan9118.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/lan9118.c b/hw/lan9118.c
+index ff0a50b..ceaf96f 100644
+--- a/hw/lan9118.c
++++ b/hw/lan9118.c
+@@ -500,7 +500,7 @@ static int lan9118_filter(lan9118_state *s, const uint8_t *addr)
+ }
+ } else {
+ /* Hash matching */
+- hash = (crc32(~0, addr, 6) >> 26);
++ hash = compute_mcast_idx(addr);
+ if (hash & 0x20) {
+ return (s->mac_hashh >> (hash & 0x1f)) & 1;
+ } else {
+--
+1.7.12.1
+
--- /dev/null
+From 608a36df28b4db83124d06081029023e01901fc9 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@codesourcery.com>
+Date: Fri, 8 Jun 2012 02:04:40 +0100
+Subject: [PATCH] MIPS/user: Fix reset CPU state initialization
+
+ This change updates the CPU reset sequence to use a common piece of code
+that figures out CPU state flags, fixing the problem with MIPS_HFLAG_COP1X
+not being set where applicable that causes floating-point MADD family
+instructions (and other instructions from the MIPS IV FP subset) to trap.
+
+ As compute_hflags is now shared between op_helper.c and translate.c, the
+function is now moved to a common header. There are no changes to this
+function.
+
+ The problem was seen with the 24Kf MIPS32r2 processor in user emulation.
+The new approach prevents system and user emulation from diverging -- all
+the hflags state is initialized in one place now.
+
+Signed-off-by: Maciej W. Rozycki <macro@codesourcery.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit 03e6e5017757645f00b2f3b4f3a257973985e455)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-mips/cpu.h | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
+ target-mips/op_helper.c | 49 -------------------------------------------------
+ target-mips/translate.c | 16 +++-------------
+ 3 files changed, 52 insertions(+), 62 deletions(-)
+
+diff --git a/target-mips/cpu.h b/target-mips/cpu.h
+index be4f805..b7a5112 100644
+--- a/target-mips/cpu.h
++++ b/target-mips/cpu.h
+@@ -742,4 +742,53 @@ static inline void cpu_pc_from_tb(CPUMIPSState *env, TranslationBlock *tb)
+ env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
+ }
+
++static inline void compute_hflags(CPUMIPSState *env)
++{
++ env->hflags &= ~(MIPS_HFLAG_COP1X | MIPS_HFLAG_64 | MIPS_HFLAG_CP0 |
++ MIPS_HFLAG_F64 | MIPS_HFLAG_FPU | MIPS_HFLAG_KSU |
++ MIPS_HFLAG_UX);
++ if (!(env->CP0_Status & (1 << CP0St_EXL)) &&
++ !(env->CP0_Status & (1 << CP0St_ERL)) &&
++ !(env->hflags & MIPS_HFLAG_DM)) {
++ env->hflags |= (env->CP0_Status >> CP0St_KSU) & MIPS_HFLAG_KSU;
++ }
++#if defined(TARGET_MIPS64)
++ if (((env->hflags & MIPS_HFLAG_KSU) != MIPS_HFLAG_UM) ||
++ (env->CP0_Status & (1 << CP0St_PX)) ||
++ (env->CP0_Status & (1 << CP0St_UX))) {
++ env->hflags |= MIPS_HFLAG_64;
++ }
++ if (env->CP0_Status & (1 << CP0St_UX)) {
++ env->hflags |= MIPS_HFLAG_UX;
++ }
++#endif
++ if ((env->CP0_Status & (1 << CP0St_CU0)) ||
++ !(env->hflags & MIPS_HFLAG_KSU)) {
++ env->hflags |= MIPS_HFLAG_CP0;
++ }
++ if (env->CP0_Status & (1 << CP0St_CU1)) {
++ env->hflags |= MIPS_HFLAG_FPU;
++ }
++ if (env->CP0_Status & (1 << CP0St_FR)) {
++ env->hflags |= MIPS_HFLAG_F64;
++ }
++ if (env->insn_flags & ISA_MIPS32R2) {
++ if (env->active_fpu.fcr0 & (1 << FCR0_F64)) {
++ env->hflags |= MIPS_HFLAG_COP1X;
++ }
++ } else if (env->insn_flags & ISA_MIPS32) {
++ if (env->hflags & MIPS_HFLAG_64) {
++ env->hflags |= MIPS_HFLAG_COP1X;
++ }
++ } else if (env->insn_flags & ISA_MIPS4) {
++ /* All supported MIPS IV CPUs use the XX (CU3) to enable
++ and disable the MIPS IV extensions to the MIPS III ISA.
++ Some other MIPS IV CPUs ignore the bit, so the check here
++ would be too restrictive for them. */
++ if (env->CP0_Status & (1 << CP0St_CU3)) {
++ env->hflags |= MIPS_HFLAG_COP1X;
++ }
++ }
++}
++
+ #endif /* !defined (__MIPS_CPU_H__) */
+diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
+index d2a8a55..ce5ddaf 100644
+--- a/target-mips/op_helper.c
++++ b/target-mips/op_helper.c
+@@ -30,55 +30,6 @@
+ static inline void cpu_mips_tlb_flush (CPUMIPSState *env, int flush_global);
+ #endif
+
+-static inline void compute_hflags(CPUMIPSState *env)
+-{
+- env->hflags &= ~(MIPS_HFLAG_COP1X | MIPS_HFLAG_64 | MIPS_HFLAG_CP0 |
+- MIPS_HFLAG_F64 | MIPS_HFLAG_FPU | MIPS_HFLAG_KSU |
+- MIPS_HFLAG_UX);
+- if (!(env->CP0_Status & (1 << CP0St_EXL)) &&
+- !(env->CP0_Status & (1 << CP0St_ERL)) &&
+- !(env->hflags & MIPS_HFLAG_DM)) {
+- env->hflags |= (env->CP0_Status >> CP0St_KSU) & MIPS_HFLAG_KSU;
+- }
+-#if defined(TARGET_MIPS64)
+- if (((env->hflags & MIPS_HFLAG_KSU) != MIPS_HFLAG_UM) ||
+- (env->CP0_Status & (1 << CP0St_PX)) ||
+- (env->CP0_Status & (1 << CP0St_UX))) {
+- env->hflags |= MIPS_HFLAG_64;
+- }
+- if (env->CP0_Status & (1 << CP0St_UX)) {
+- env->hflags |= MIPS_HFLAG_UX;
+- }
+-#endif
+- if ((env->CP0_Status & (1 << CP0St_CU0)) ||
+- !(env->hflags & MIPS_HFLAG_KSU)) {
+- env->hflags |= MIPS_HFLAG_CP0;
+- }
+- if (env->CP0_Status & (1 << CP0St_CU1)) {
+- env->hflags |= MIPS_HFLAG_FPU;
+- }
+- if (env->CP0_Status & (1 << CP0St_FR)) {
+- env->hflags |= MIPS_HFLAG_F64;
+- }
+- if (env->insn_flags & ISA_MIPS32R2) {
+- if (env->active_fpu.fcr0 & (1 << FCR0_F64)) {
+- env->hflags |= MIPS_HFLAG_COP1X;
+- }
+- } else if (env->insn_flags & ISA_MIPS32) {
+- if (env->hflags & MIPS_HFLAG_64) {
+- env->hflags |= MIPS_HFLAG_COP1X;
+- }
+- } else if (env->insn_flags & ISA_MIPS4) {
+- /* All supported MIPS IV CPUs use the XX (CU3) to enable
+- and disable the MIPS IV extensions to the MIPS III ISA.
+- Some other MIPS IV CPUs ignore the bit, so the check here
+- would be too restrictive for them. */
+- if (env->CP0_Status & (1 << CP0St_CU3)) {
+- env->hflags |= MIPS_HFLAG_COP1X;
+- }
+- }
+-}
+-
+ /*****************************************************************************/
+ /* Exceptions processing helpers */
+
+diff --git a/target-mips/translate.c b/target-mips/translate.c
+index aba7935..4e04e97 100644
+--- a/target-mips/translate.c
++++ b/target-mips/translate.c
+@@ -12816,18 +12816,13 @@ void cpu_state_reset(CPUMIPSState *env)
+ env->insn_flags = env->cpu_model->insn_flags;
+
+ #if defined(CONFIG_USER_ONLY)
+- env->hflags = MIPS_HFLAG_UM;
++ env->CP0_Status = (MIPS_HFLAG_UM << CP0St_KSU);
+ /* Enable access to the CPUNum, SYNCI_Step, CC, and CCRes RDHWR
+ hardware registers. */
+ env->CP0_HWREna |= 0x0000000F;
+ if (env->CP0_Config1 & (1 << CP0C1_FP)) {
+- env->hflags |= MIPS_HFLAG_FPU;
++ env->CP0_Status |= (1 << CP0St_CU1);
+ }
+-#ifdef TARGET_MIPS64
+- if (env->active_fpu.fcr0 & (1 << FCR0_F64)) {
+- env->hflags |= MIPS_HFLAG_F64;
+- }
+-#endif
+ #else
+ if (env->hflags & MIPS_HFLAG_BMASK) {
+ /* If the exception was raised from a delay slot,
+@@ -12857,7 +12852,6 @@ void cpu_state_reset(CPUMIPSState *env)
+ }
+ /* Count register increments in debug mode, EJTAG version 1 */
+ env->CP0_Debug = (1 << CP0DB_CNT) | (0x1 << CP0DB_VER);
+- env->hflags = MIPS_HFLAG_CP0;
+
+ if (env->CP0_Config3 & (1 << CP0C3_MT)) {
+ int i;
+@@ -12885,11 +12879,7 @@ void cpu_state_reset(CPUMIPSState *env)
+ }
+ }
+ #endif
+-#if defined(TARGET_MIPS64)
+- if (env->cpu_model->insn_flags & ISA_MIPS3) {
+- env->hflags |= MIPS_HFLAG_64;
+- }
+-#endif
++ compute_hflags(env);
+ env->exception_index = EXCP_NONE;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 6bfc31b2f98dabc0e636cd8955c8de93bcac0961 Mon Sep 17 00:00:00 2001
+From: Fabien Chouteau <chouteau@adacore.com>
+Date: Tue, 22 May 2012 10:14:28 +0200
+Subject: [PATCH] Add MAINTAINERS entry for leon3
+
+Signed-off-by: Fabien Chouteau <chouteau@adacore.com>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+(cherry picked from commit ce6c760c37b9a88db87c5b9b9bf39ca866e570f6)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ MAINTAINERS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 6d864c1..61f8b45 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -398,6 +398,12 @@ M: Blue Swirl <blauwirbel@gmail.com>
+ S: Maintained
+ F: hw/sun4u.c
+
++Leon3
++M: Fabien Chouteau <chouteau@adacore.com>
++S: Maintained
++F: hw/leon3.c
++F: hw/grlib*
++
+ S390 Machines
+ -------------
+ S390 Virtio
+--
+1.7.12.1
+
--- /dev/null
+From 2182aa5c2ca5a5a6bf9c2d06d18b3e2db3aa3c7a Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@web.de>
+Date: Sat, 8 Sep 2012 11:52:39 +0200
+Subject: [PATCH] musicpal: Fix flash mapping
+
+The old arithmetic assumed 32 physical address bits which is no longer
+true for ARM since 3cc0cd61f4.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@web.de>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+(cherry picked from commit 0c267217ca9985e6d118ec8368bebd382db7a099)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/musicpal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/musicpal.c b/hw/musicpal.c
+index ad725b5..f305e21 100644
+--- a/hw/musicpal.c
++++ b/hw/musicpal.c
+@@ -1583,7 +1583,7 @@ static void musicpal_init(ram_addr_t ram_size,
+ * image is smaller than 32 MB.
+ */
+ #ifdef TARGET_WORDS_BIGENDIAN
+- pflash_cfi02_register(0-MP_FLASH_SIZE_MAX, NULL,
++ pflash_cfi02_register(0x100000000ULL-MP_FLASH_SIZE_MAX, NULL,
+ "musicpal.flash", flash_size,
+ dinfo->bdrv, 0x10000,
+ (flash_size + 0xffff) >> 16,
+@@ -1591,7 +1591,7 @@ static void musicpal_init(ram_addr_t ram_size,
+ 2, 0x00BF, 0x236D, 0x0000, 0x0000,
+ 0x5555, 0x2AAA, 1);
+ #else
+- pflash_cfi02_register(0-MP_FLASH_SIZE_MAX, NULL,
++ pflash_cfi02_register(0x100000000ULL-MP_FLASH_SIZE_MAX, NULL,
+ "musicpal.flash", flash_size,
+ dinfo->bdrv, 0x10000,
+ (flash_size + 0xffff) >> 16,
+--
+1.7.12.1
+
--- /dev/null
+From e688bfbda0f6893b08d1e51f4fb26d4b38e922d4 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Fri, 10 Aug 2012 15:11:45 +0200
+Subject: [PATCH] qemu: Use valgrind annotations to mark kvm guest memory as
+ defined
+
+valgrind with kvm produces a big amount of false positives regarding
+"Conditional jump or move depends on uninitialised value(s)". This
+happens because the guest memory is allocated with qemu_vmalloc which
+boils down posix_memalign etc. This function is (correctly) considered
+by valgrind as returning undefined memory.
+
+Since valgrind is based on jitting code, it will not be able to see
+changes made by the guest to guest memory if this is done by KVM_RUN,
+thus keeping most of the guest memory undefined.
+
+Now lots of places in qemu will then use guest memory to change behaviour.
+To avoid the flood of these messages, lets declare the whole guest
+memory as defined. This will reduce the noise and allows us to see real
+problems.
+
+In the future we might want to make this conditional, since there
+is actually something that we can use those false positives for:
+These messages will point to code that depends on guest memory, so
+we can use these backtraces to actually make an audit that is focussed
+only at those code places. For normal development we dont want to
+see those messages, though.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+(cherry picked from commit 62fe83318d2fc5b31f473d66326910d94c1c4907)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 3 ++-
+ kvm-all.c | 7 +++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index d7a948f..8874eff 100755
+--- a/configure
++++ b/configure
+@@ -2937,11 +2937,12 @@ if compile_prog "-Werror" "" ; then
+ fi
+
+ ########################################
+-# check if we have valgrind/valgrind.h
++# check if we have valgrind/valgrind.h and valgrind/memcheck.h
+
+ valgrind_h=no
+ cat > $TMPC << EOF
+ #include <valgrind/valgrind.h>
++#include <valgrind/memcheck.h>
+ int main(void) {
+ return 0;
+ }
+diff --git a/kvm-all.c b/kvm-all.c
+index badf1d8..90c71f9 100644
+--- a/kvm-all.c
++++ b/kvm-all.c
+@@ -39,6 +39,10 @@
+ #include <sys/eventfd.h>
+ #endif
+
++#ifdef CONFIG_VALGRIND_H
++#include <valgrind/memcheck.h>
++#endif
++
+ /* KVM uses PAGE_SIZE in its definition of COALESCED_MMIO_MAX */
+ #define PAGE_SIZE TARGET_PAGE_SIZE
+
+@@ -1769,6 +1773,9 @@ void *kvm_vmalloc(ram_addr_t size)
+
+ void kvm_setup_guest_memory(void *start, size_t size)
+ {
++#ifdef CONFIG_VALGRIND_H
++ VALGRIND_MAKE_MEM_DEFINED(start, size);
++#endif
+ if (!kvm_has_sync_mmu()) {
+ int ret = qemu_madvise(start, size, QEMU_MADV_DONTFORK);
+
+--
+1.7.12.1
+
--- /dev/null
+From 044cadadb3bb63396a1e8d72a0c90673ccd7be98 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 3 Sep 2012 22:56:00 +0200
+Subject: [PATCH] hw/wm8750: Fix potential buffer overflow
+
+Report from smatch:
+
+hw/wm8750.c:369 wm8750_tx(12) error: buffer overflow 's->i2c_data' 2 <= 2
+
+It looks like the preprocessor statements were simply misplaced.
+
+Replace also __FUNCTION__ by __func__ to please checkpatch.pl.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit 149eeb5fe57b853081e8059575d91b8a58a4f96c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/wm8750.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/wm8750.c b/hw/wm8750.c
+index 11bcec3..44f138f 100644
+--- a/hw/wm8750.c
++++ b/hw/wm8750.c
+@@ -361,10 +361,10 @@ static int wm8750_tx(I2CSlave *i2c, uint8_t data)
+ uint16_t value;
+
+ if (s->i2c_len >= 2) {
+- printf("%s: long message (%i bytes)\n", __FUNCTION__, s->i2c_len);
+ #ifdef VERBOSE
+- return 1;
++ printf("%s: long message (%i bytes)\n", __func__, s->i2c_len);
+ #endif
++ return 1;
+ }
+ s->i2c_data[s->i2c_len ++] = data;
+ if (s->i2c_len != 2)
+--
+1.7.12.1
+
--- /dev/null
+From 90c742c7f36f45249c62c0c5db2e138a604e44ac Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 4 Sep 2012 19:37:39 +0200
+Subject: [PATCH] hw/mcf5206: Fix buffer overflow for MBAR read / write
+
+Report from smatch:
+
+mcf5206.c:384 m5206_mbar_readb(7) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+mcf5206.c:403 m5206_mbar_readw(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+mcf5206.c:427 m5206_mbar_readl(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+mcf5206.c:451 m5206_mbar_writeb(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+mcf5206.c:475 m5206_mbar_writew(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+mcf5206.c:503 m5206_mbar_writel(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
+
+m5206_mbar_width has 0x80 elements and supports 0 <= offset < 0x200.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit a32354e206895400d17c3de9a8df1de96d3df289)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/mcf5206.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hw/mcf5206.c b/hw/mcf5206.c
+index 539b391..27753e2 100644
+--- a/hw/mcf5206.c
++++ b/hw/mcf5206.c
+@@ -378,7 +378,7 @@ static uint32_t m5206_mbar_readb(void *opaque, target_phys_addr_t offset)
+ {
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR read offset 0x%x", (int)offset);
+ }
+ if (m5206_mbar_width[offset >> 2] > 1) {
+@@ -397,7 +397,7 @@ static uint32_t m5206_mbar_readw(void *opaque, target_phys_addr_t offset)
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ int width;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR read offset 0x%x", (int)offset);
+ }
+ width = m5206_mbar_width[offset >> 2];
+@@ -421,7 +421,7 @@ static uint32_t m5206_mbar_readl(void *opaque, target_phys_addr_t offset)
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ int width;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR read offset 0x%x", (int)offset);
+ }
+ width = m5206_mbar_width[offset >> 2];
+@@ -445,7 +445,7 @@ static void m5206_mbar_writeb(void *opaque, target_phys_addr_t offset,
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ int width;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR write offset 0x%x", (int)offset);
+ }
+ width = m5206_mbar_width[offset >> 2];
+@@ -469,7 +469,7 @@ static void m5206_mbar_writew(void *opaque, target_phys_addr_t offset,
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ int width;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR write offset 0x%x", (int)offset);
+ }
+ width = m5206_mbar_width[offset >> 2];
+@@ -497,7 +497,7 @@ static void m5206_mbar_writel(void *opaque, target_phys_addr_t offset,
+ m5206_mbar_state *s = (m5206_mbar_state *)opaque;
+ int width;
+ offset &= 0x3ff;
+- if (offset > 0x200) {
++ if (offset >= 0x200) {
+ hw_error("Bad MBAR write offset 0x%x", (int)offset);
+ }
+ width = m5206_mbar_width[offset >> 2];
+--
+1.7.12.1
+
--- /dev/null
+From 6762c144443bca8fa97a389289bda7693bd4c8d4 Mon Sep 17 00:00:00 2001
+From: Michael Tokarev <mjt@tls.msk.ru>
+Date: Thu, 7 Jun 2012 01:11:00 +0400
+Subject: [PATCH] use --libexecdir instead of ignoring it first and
+ reinventing it later
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 7b93fadf3a38d1ed65ea5536a52efc2772c6e3b8 "Add basic version
+of bridge helper" put the bridge helper executable into a fixed
+${prefix}/libexec/ location, instead of using ${libexecdir} for
+this. At the same time, --libexecdir is being happily ignored
+by ./configure. Even more, the same patch sets unused $libexecdir
+variable in the generated config-host.mak, and uses fixed string
+(\${prefix}/libexecdir) for the bridge helper binary.
+
+Fix this braindamage by introducing $libexecdir variable, using
+it for the bridge helper binary, and recognizing --libexecdir.
+
+This patch is applicable to stable-1.1.
+
+Reviewed-by: Andreas Färber <afaerber@suse.de>
+Reviewed-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Corey Bryant <coreyb@linux.vnet.ibm.com>
+Cc: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 8bf188aa18ef7a8355d9edbd43871d590468c4ed)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/configure b/configure
+index 8874eff..d01f9dc 100755
+--- a/configure
++++ b/configure
+@@ -191,6 +191,7 @@ datadir="\${prefix}/share"
+ qemu_docdir="\${prefix}/share/doc/qemu"
+ bindir="\${prefix}/bin"
+ libdir="\${prefix}/lib"
++libexecdir="\${prefix}/libexec"
+ includedir="\${prefix}/include"
+ sysconfdir="\${prefix}/etc"
+ confsuffix="/qemu"
+@@ -624,6 +625,8 @@ for opt do
+ ;;
+ --libdir=*) libdir="$optarg"
+ ;;
++ --libexecdir=*) libexecdir="$optarg"
++ ;;
+ --includedir=*) includedir="$optarg"
+ ;;
+ --datadir=*) datadir="$optarg"
+@@ -634,7 +637,7 @@ for opt do
+ ;;
+ --sysconfdir=*) sysconfdir="$optarg"
+ ;;
+- --sbindir=*|--libexecdir=*|--sharedstatedir=*|--localstatedir=*|\
++ --sbindir=*|--sharedstatedir=*|--localstatedir=*|\
+ --oldincludedir=*|--datarootdir=*|--infodir=*|--localedir=*|\
+ --htmldir=*|--dvidir=*|--pdfdir=*|--psdir=*)
+ # These switches are silently ignored, for compatibility with
+@@ -3055,6 +3058,7 @@ echo "Install prefix $prefix"
+ echo "BIOS directory `eval echo $qemu_datadir`"
+ echo "binary directory `eval echo $bindir`"
+ echo "library directory `eval echo $libdir`"
++echo "libexec directory `eval echo $libexecdir`"
+ echo "include directory `eval echo $includedir`"
+ echo "config directory `eval echo $sysconfdir`"
+ if test "$mingw32" = "no" ; then
+@@ -3158,14 +3162,14 @@ echo all: >> $config_host_mak
+ echo "prefix=$prefix" >> $config_host_mak
+ echo "bindir=$bindir" >> $config_host_mak
+ echo "libdir=$libdir" >> $config_host_mak
++echo "libexecdir=$libexecdir" >> $config_host_mak
+ echo "includedir=$includedir" >> $config_host_mak
+ echo "mandir=$mandir" >> $config_host_mak
+ echo "sysconfdir=$sysconfdir" >> $config_host_mak
+ echo "qemu_confdir=$qemu_confdir" >> $config_host_mak
+ echo "qemu_datadir=$qemu_datadir" >> $config_host_mak
+ echo "qemu_docdir=$qemu_docdir" >> $config_host_mak
+-echo "libexecdir=\${prefix}/libexec" >> $config_host_mak
+-echo "CONFIG_QEMU_HELPERDIR=\"$prefix/libexec\"" >> $config_host_mak
++echo "CONFIG_QEMU_HELPERDIR=\"$libexecdir\"" >> $config_host_mak
+
+ echo "ARCH=$ARCH" >> $config_host_mak
+ if test "$debug_tcg" = "yes" ; then
+--
+1.7.12.1
+
--- /dev/null
+From 40874e295225675fec7b42bb8e015fb3f2065a69 Mon Sep 17 00:00:00 2001
+From: Anthony Liguori <aliguori@us.ibm.com>
+Date: Wed, 5 Sep 2012 13:52:49 -0500
+Subject: [PATCH] socket: don't attempt to reconnect a TCP socket in server
+ mode
+
+Commit c3767ed0eb5d0bb25fe409ae5dec06e3411ff1b6 introduced a possible SEGV when
+using a socket chardev with server=on because it assumes that all TCP sockets
+are in client mode.
+
+This patch adds a check to only reconnect when in client mode.
+
+Cc: Lei Li <lilei@linux.vnet.ibm.com>
+Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 455aa1e0818653c41fd794435b982426ce21ba2f)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-char.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index 398baf1..767da93 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2148,10 +2148,12 @@ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ TCPCharDriver *s = chr->opaque;
+ if (s->connected) {
+ return send_all(s->fd, buf, len);
+- } else {
++ } else if (s->listen_fd == -1) {
+ /* (Re-)connect for unconnected writing */
+ tcp_chr_connect(chr);
+ return 0;
++ } else {
++ return len;
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From d9f498f4b7b7ca2ff96b4d87827713caea3743b5 Mon Sep 17 00:00:00 2001
+From: "Daniel P. Berrange" <berrange@redhat.com>
+Date: Mon, 10 Sep 2012 12:26:29 +0100
+Subject: [PATCH] Add ability to force enable/disable of tools build
+
+The qemu-img, qemu-nbd and qemu-io tools are built conditionally
+based on whether any softmmu target is enabled. These are useful
+self-contained tools which can be used in many other scenarios.
+Add new --enable-tools/--disable-tools args to configure to allow
+the user to explicitly turn on / off their build. The default
+behaviour is now to build these tools are all times, regardless
+of whether any softmmu target is enabled
+
+Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 4b1c11fd20e8901f04a2d9c225cd10fc05a762ff)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/configure b/configure
+index d01f9dc..a8061c1 100755
+--- a/configure
++++ b/configure
+@@ -225,6 +225,7 @@ usb_redir=""
+ opengl=""
+ zlib="yes"
+ guest_agent="yes"
++want_tools="yes"
+ libiscsi=""
+ coroutine=""
+ seccomp=""
+@@ -857,6 +858,10 @@ for opt do
+ ;;
+ --disable-guest-agent) guest_agent="no"
+ ;;
++ --enable-tools) want_tools="yes"
++ ;;
++ --disable-tools) want_tools="no"
++ ;;
+ --enable-seccomp) seccomp="yes"
+ ;;
+ --disable-seccomp) seccomp="no"
+@@ -3017,9 +3022,14 @@ fi
+ qemu_confdir=$sysconfdir$confsuffix
+ qemu_datadir=$datadir$confsuffix
+
+-tools=
+-if test "$softmmu" = yes ; then
++tools=""
++if test "$want_tools" = "yes" ; then
+ tools="qemu-img\$(EXESUF) qemu-io\$(EXESUF) $tools"
++ if [ "$linux" = "yes" -o "$bsd" = "yes" -o "$solaris" = "yes" ] ; then
++ tools="qemu-nbd\$(EXESUF) $tools"
++ fi
++fi
++if test "$softmmu" = yes ; then
+ if test "$virtfs" != no ; then
+ if test "$cap" = yes && test "$linux" = yes && test "$attr" = yes ; then
+ virtfs=yes
+@@ -3033,14 +3043,13 @@ if test "$softmmu" = yes ; then
+ fi
+ fi
+ if [ "$linux" = "yes" -o "$bsd" = "yes" -o "$solaris" = "yes" ] ; then
+- tools="qemu-nbd\$(EXESUF) $tools"
+ if [ "$guest_agent" = "yes" ]; then
+ tools="qemu-ga\$(EXESUF) $tools"
+ fi
+ fi
+-fi
+-if test "$smartcard_nss" = "yes" ; then
+- tools="vscclient\$(EXESUF) $tools"
++ if test "$smartcard_nss" = "yes" ; then
++ tools="vscclient\$(EXESUF) $tools"
++ fi
+ fi
+
+ # Mac OS X ships with a broken assembler
+--
+1.7.12.1
+
--- /dev/null
+From 074f49c02e7f2fd50533a246b4060051f95f8b09 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 17 Aug 2012 11:39:16 +0200
+Subject: [PATCH] usb: controllers do not need to check for babble themselves
+
+If an (emulated) usb-device tries to write more data to a packet then
+its iov len, this will trigger an assert in usb_packet_copy(), and if
+a driver somehow circumvents that check and writes more data to the
+iov then there is space, we have a much bigger problem then not correctly
+reporting babble to the guest.
+
+In practice babble will only happen with (real) redirected devices, and there
+both the usb-host os and the qemu usb-device code already check for it.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 45b339b18c660eb85af2ba25bfcaed5469660d77)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 4 ----
+ hw/usb/hcd-uhci.c | 5 -----
+ 2 files changed, 9 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 017342b..9523247 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -1481,10 +1481,6 @@ static void ehci_execute_complete(EHCIQueue *q)
+ assert(0);
+ break;
+ }
+- } else if ((p->usb_status > p->tbytes) && (p->pid == USB_TOKEN_IN)) {
+- p->usb_status = USB_RET_BABBLE;
+- q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
+- ehci_raise_irq(q->ehci, USBSTS_ERRINT);
+ } else {
+ // TODO check 4.12 for splits
+
+diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
+index b0db921..c7c8786 100644
+--- a/hw/usb/hcd-uhci.c
++++ b/hw/usb/hcd-uhci.c
+@@ -729,11 +729,6 @@ static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_
+ *int_mask |= 0x01;
+
+ if (pid == USB_TOKEN_IN) {
+- if (len > max_len) {
+- ret = USB_RET_BABBLE;
+- goto out;
+- }
+-
+ if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
+ *int_mask |= 0x02;
+ /* short packet: do not update QH */
+--
+1.7.12.1
+
--- /dev/null
+From bcd7c845fbfbafe03e320fbffcaa32417cfd5267 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 12:33:44 +0200
+Subject: [PATCH] usb-core: Don't set packet state to complete on a nak
+
+This way the hcd can re-use the same packet to retry without needing
+to re-init it.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit cc40997489260f405aecccd30d4626ceee862502)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/usb/core.c b/hw/usb/core.c
+index 2da38e7..be6d936 100644
+--- a/hw/usb/core.c
++++ b/hw/usb/core.c
+@@ -399,8 +399,10 @@ int usb_handle_packet(USBDevice *dev, USBPacket *p)
+ * otherwise packets can complete out of order!
+ */
+ assert(!p->ep->pipeline);
+- p->result = ret;
+- usb_packet_set_state(p, USB_PACKET_COMPLETE);
++ if (ret != USB_RET_NAK) {
++ p->result = ret;
++ usb_packet_set_state(p, USB_PACKET_COMPLETE);
++ }
+ }
+ } else {
+ ret = USB_RET_ASYNC;
+--
+1.7.12.1
+
--- /dev/null
+From 3c2f94fdc5e776ee66bccc704884f3b1b090b4c6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 09:43:18 +0200
+Subject: [PATCH] usb-core: Add a usb_ep_find_packet_by_id() helper function
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit c13a9e61366cc3e28299d8faeb65e65c6e5964cf)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb.h | 2 ++
+ hw/usb/core.c | 15 +++++++++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/hw/usb.h b/hw/usb.h
+index b8fceec..684e3f4 100644
+--- a/hw/usb.h
++++ b/hw/usb.h
+@@ -377,6 +377,8 @@ void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
+ uint16_t raw);
+ int usb_ep_get_max_packet_size(USBDevice *dev, int pid, int ep);
+ void usb_ep_set_pipeline(USBDevice *dev, int pid, int ep, bool enabled);
++USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
++ uint64_t id);
+
+ void usb_attach(USBPort *port);
+ void usb_detach(USBPort *port);
+diff --git a/hw/usb/core.c b/hw/usb/core.c
+index be6d936..fe431d0 100644
+--- a/hw/usb/core.c
++++ b/hw/usb/core.c
+@@ -726,3 +726,18 @@ void usb_ep_set_pipeline(USBDevice *dev, int pid, int ep, bool enabled)
+ struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
+ uep->pipeline = enabled;
+ }
++
++USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
++ uint64_t id)
++{
++ struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
++ USBPacket *p;
++
++ while ((p = QTAILQ_FIRST(&uep->queue)) != NULL) {
++ if (p->id == id) {
++ return p;
++ }
++ }
++
++ return NULL;
++}
+--
+1.7.12.1
+
--- /dev/null
+From 2a2b40b145764ece12d0872ae5bb7b7ec2dc271f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 12:48:49 +0200
+Subject: [PATCH] usb-core: Allow the first packet of a pipelined ep to
+ complete immediately
+
+This can happen with usb-redir live-migration when the packet gets re-queued
+after the migration and the original queuing from the migration source side
+has already finished.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 9c1f67654ab611553bbfca54a1e0922728c25760)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/core.c b/hw/usb/core.c
+index fe431d0..b9f1f7a 100644
+--- a/hw/usb/core.c
++++ b/hw/usb/core.c
+@@ -398,7 +398,7 @@ int usb_handle_packet(USBDevice *dev, USBPacket *p)
+ * When pipelining is enabled usb-devices must always return async,
+ * otherwise packets can complete out of order!
+ */
+- assert(!p->ep->pipeline);
++ assert(!p->ep->pipeline || QTAILQ_EMPTY(&p->ep->queue));
+ if (ret != USB_RET_NAK) {
+ p->result = ret;
+ usb_packet_set_state(p, USB_PACKET_COMPLETE);
+--
+1.7.12.1
+
--- /dev/null
+From 4547897358a12c0f31d688da9922236984742242 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 29 Aug 2012 10:12:52 +0200
+Subject: [PATCH] Revert "ehci: don't flush cache on doorbell rings."
+
+This reverts commit 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0, which got
+added to fix an issue where the real, underlying cause was not stopping
+the ep queue on an error.
+
+Now that the underlying cause is fixed by the "usb: Halt ep queue and
+cancel pending packets on a packet error" patch, the "don't flush" fix
+is no longer needed.
+
+Not only is it not needed, it causes us to see cancellations (unlinks)
+done by the Linux EHCI driver too late, which in combination with the new
+usb-core packet-id generation where qtd addresses are used as ids, causes
+duplicate ids for in flight packets.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+(cherry picked from commit 66f092d25697e11847b61d761c38ddebedaed8d1)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 35 ++++++-----------------------------
+ 1 file changed, 6 insertions(+), 29 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 9523247..e7c36f4 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -365,7 +365,6 @@ struct EHCIQueue {
+ uint32_t seen;
+ uint64_t ts;
+ int async;
+- int revalidate;
+
+ /* cached data from guest - needs to be flushed
+ * when guest removes an entry (doorbell, handshake sequence)
+@@ -805,18 +804,7 @@ static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+ return NULL;
+ }
+
+-static void ehci_queues_tag_unused_async(EHCIState *ehci)
+-{
+- EHCIQueue *q;
+-
+- QTAILQ_FOREACH(q, &ehci->aqueues, next) {
+- if (!q->seen) {
+- q->revalidate = 1;
+- }
+- }
+-}
+-
+-static void ehci_queues_rip_unused(EHCIState *ehci, int async)
++static void ehci_queues_rip_unused(EHCIState *ehci, int async, int flush)
+ {
+ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
+ uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
+@@ -828,7 +816,7 @@ static void ehci_queues_rip_unused(EHCIState *ehci, int async)
+ q->ts = ehci->last_run_ns;
+ continue;
+ }
+- if (ehci->last_run_ns < q->ts + maxage) {
++ if (!flush && ehci->last_run_ns < q->ts + maxage) {
+ continue;
+ }
+ ehci_free_queue(q);
+@@ -1684,7 +1672,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
+ ehci_set_usbsts(ehci, USBSTS_REC);
+ }
+
+- ehci_queues_rip_unused(ehci, async);
++ ehci_queues_rip_unused(ehci, async, 0);
+
+ /* Find the head of the list (4.9.1.1) */
+ for(i = 0; i < MAX_QH; i++) {
+@@ -1769,7 +1757,6 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ EHCIPacket *p;
+ uint32_t entry, devaddr;
+ EHCIQueue *q;
+- EHCIqh qh;
+
+ entry = ehci_get_fetch_addr(ehci, async);
+ q = ehci_find_queue_by_qh(ehci, entry, async);
+@@ -1787,17 +1774,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ }
+
+ get_dwords(ehci, NLPTR_GET(q->qhaddr),
+- (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
+- if (q->revalidate && (q->qh.epchar != qh.epchar ||
+- q->qh.epcap != qh.epcap ||
+- q->qh.current_qtd != qh.current_qtd)) {
+- ehci_free_queue(q);
+- q = ehci_alloc_queue(ehci, entry, async);
+- q->seen++;
+- p = NULL;
+- }
+- q->qh = qh;
+- q->revalidate = 0;
++ (uint32_t *) &q->qh, sizeof(EHCIqh) >> 2);
+ ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &q->qh);
+
+ devaddr = get_field(q->qh.epchar, QH_EPCHAR_DEVADDR);
+@@ -2306,7 +2283,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
+ */
+ if (ehci->usbcmd & USBCMD_IAAD) {
+ /* Remove all unseen qhs from the async qhs queue */
+- ehci_queues_tag_unused_async(ehci);
++ ehci_queues_rip_unused(ehci, async, 1);
+ DPRINTF("ASYNC: doorbell request acknowledged\n");
+ ehci->usbcmd &= ~USBCMD_IAAD;
+ ehci_raise_irq(ehci, USBSTS_IAA);
+@@ -2359,7 +2336,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
+ ehci_set_fetch_addr(ehci, async,entry);
+ ehci_set_state(ehci, async, EST_FETCHENTRY);
+ ehci_advance_state(ehci, async);
+- ehci_queues_rip_unused(ehci, async);
++ ehci_queues_rip_unused(ehci, async, 0);
+ break;
+
+ default:
+--
+1.7.12.1
+
--- /dev/null
+From 46bfd14f89404e4a0eb93c3d9c5b9745724cee2d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 29 Aug 2012 10:37:37 +0200
+Subject: [PATCH] ehci: Validate qh is not changed unexpectedly by the guest
+
+-combine the qh check with the check for devaddr changes
+-also ensure that p gets set to NULL when the queue gets cancelled on
+ devaddr change, which was not done properly before this patch
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+(cherry picked from commit dafe31fc2a8653b535d58f8c7b250c0827b14420)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 39 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 28 insertions(+), 11 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index e7c36f4..35eb441 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -780,6 +780,14 @@ static void ehci_cancel_queue(EHCIQueue *q)
+ } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
+ }
+
++static void ehci_reset_queue(EHCIQueue *q)
++{
++ trace_usb_ehci_queue_action(q, "reset");
++ ehci_cancel_queue(q);
++ q->dev = NULL;
++ q->qtdaddr = 0;
++}
++
+ static void ehci_free_queue(EHCIQueue *q)
+ {
+ EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
+@@ -1755,8 +1763,9 @@ out:
+ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ {
+ EHCIPacket *p;
+- uint32_t entry, devaddr;
++ uint32_t entry, devaddr, endp;
+ EHCIQueue *q;
++ EHCIqh qh;
+
+ entry = ehci_get_fetch_addr(ehci, async);
+ q = ehci_find_queue_by_qh(ehci, entry, async);
+@@ -1774,17 +1783,25 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ }
+
+ get_dwords(ehci, NLPTR_GET(q->qhaddr),
+- (uint32_t *) &q->qh, sizeof(EHCIqh) >> 2);
+- ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &q->qh);
++ (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
++ ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
++
++ /*
++ * The overlay area of the qh should never be changed by the guest,
++ * except when idle, in which case the reset is a nop.
++ */
++ devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR);
++ endp = get_field(qh.epchar, QH_EPCHAR_EP);
++ if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
++ (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
++ (memcmp(&qh.current_qtd, &q->qh.current_qtd,
++ 9 * sizeof(uint32_t)) != 0) ||
++ (q->dev != NULL && q->dev->addr != devaddr)) {
++ ehci_reset_queue(q);
++ p = NULL;
++ }
++ q->qh = qh;
+
+- devaddr = get_field(q->qh.epchar, QH_EPCHAR_DEVADDR);
+- if (q->dev != NULL && q->dev->addr != devaddr) {
+- if (!QTAILQ_EMPTY(&q->packets)) {
+- /* should not happen (guest bug) */
+- ehci_cancel_queue(q);
+- }
+- q->dev = NULL;
+- }
+ if (q->dev == NULL) {
+ q->dev = ehci_find_device(q->ehci, devaddr);
+ }
+--
+1.7.12.1
+
--- /dev/null
+From cd7309e7fdd000a9b595ab24e6b03d66100c6fde Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 16:21:12 +0200
+Subject: [PATCH] ehci: Update copyright headers to reflect recent work
+
+Update copyright headers to reflect all the work Gerd and I have been doing
+on the EHCI emulation.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+(cherry picked from commit 522079dd4461c38b9a88bf31a65ea038c5b2be45)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 35eb441..78a248f 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -2,6 +2,11 @@
+ * QEMU USB EHCI Emulation
+ *
+ * Copyright(c) 2008 Emutex Ltd. (address@hidden)
++ * Copyright(c) 2011-2012 Red Hat, Inc.
++ *
++ * Red Hat Authors:
++ * Gerd Hoffmann <kraxel@redhat.com>
++ * Hans de Goede <hdegoede@redhat.com>
+ *
+ * EHCI project was started by Mark Burkley, with contributions by
+ * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
+--
+1.7.12.1
+
--- /dev/null
+From 35fe185a5455160db638820211bad5aed45a669f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 30 Aug 2012 15:00:33 +0200
+Subject: [PATCH] ehci: Properly cleanup packets on cancel
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+(cherry picked from commit 0e7953525f52aa6c098dc0c1ce0b4a80ce82da45)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 78a248f..4fe85c8 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -747,6 +747,8 @@ static void ehci_free_packet(EHCIPacket *p)
+ trace_usb_ehci_packet_action(p->queue, p, "free");
+ if (p->async == EHCI_ASYNC_INFLIGHT) {
+ usb_cancel_packet(&p->packet);
++ usb_packet_unmap(&p->packet, &p->sgl);
++ qemu_sglist_destroy(&p->sgl);
+ }
+ QTAILQ_REMOVE(&p->queue->packets, p, next);
+ usb_packet_cleanup(&p->packet);
+--
+1.7.12.1
+
--- /dev/null
+From c7251f2557d09ce4b8466eeccd0f3264c297c515 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 30 Aug 2012 15:18:24 +0200
+Subject: [PATCH] ehci: Properly report completed but not yet processed
+ packets to the guest
+
+Reported packets which have completed before being cancelled as such to the
+host. Note that the new code path this patch adds is untested since it I've
+been unable to actually trigger the race which needs this code path.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+(cherry picked from commit 4b63a0df3bda8a2c278e45d9d94d9ba6d5791d8d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 4fe85c8..0a6c9ef 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -489,6 +489,9 @@ static const char *ehci_mmio_names[] = {
+ [CONFIGFLAG] = "CONFIGFLAG",
+ };
+
++static int ehci_state_executing(EHCIQueue *q);
++static int ehci_state_writeback(EHCIQueue *q);
++
+ static const char *nr2str(const char **n, size_t len, uint32_t nr)
+ {
+ if (nr < len && n[nr] != NULL) {
+@@ -750,6 +753,16 @@ static void ehci_free_packet(EHCIPacket *p)
+ usb_packet_unmap(&p->packet, &p->sgl);
+ qemu_sglist_destroy(&p->sgl);
+ }
++ if (p->async == EHCI_ASYNC_FINISHED) {
++ int state = ehci_get_state(p->queue->ehci, p->queue->async);
++ /* This is a normal, but rare condition (cancel racing completion) */
++ fprintf(stderr, "EHCI: Warning packet completed but not processed\n");
++ ehci_state_executing(p->queue);
++ ehci_state_writeback(p->queue);
++ ehci_set_state(p->queue->ehci, p->queue->async, state);
++ /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
++ return;
++ }
+ QTAILQ_REMOVE(&p->queue->packets, p, next);
+ usb_packet_cleanup(&p->packet);
+ g_free(p);
+--
+1.7.12.1
+
--- /dev/null
+From b3950fe894e2b26f9dba0888af092cb43d01a466 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 31 Aug 2012 10:31:54 +0200
+Subject: [PATCH] ehci: check for EHCI_ASYNC_FINISHED first in
+ ehci_free_packet
+
+Otherwise we'll see the packet free twice in the trace log even though
+it actually happens only once.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 616789cde2a83fad5e634880fd20214f0c984fd5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 0a6c9ef..23221d0 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -747,12 +747,6 @@ static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
+
+ static void ehci_free_packet(EHCIPacket *p)
+ {
+- trace_usb_ehci_packet_action(p->queue, p, "free");
+- if (p->async == EHCI_ASYNC_INFLIGHT) {
+- usb_cancel_packet(&p->packet);
+- usb_packet_unmap(&p->packet, &p->sgl);
+- qemu_sglist_destroy(&p->sgl);
+- }
+ if (p->async == EHCI_ASYNC_FINISHED) {
+ int state = ehci_get_state(p->queue->ehci, p->queue->async);
+ /* This is a normal, but rare condition (cancel racing completion) */
+@@ -763,6 +757,12 @@ static void ehci_free_packet(EHCIPacket *p)
+ /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
+ return;
+ }
++ trace_usb_ehci_packet_action(p->queue, p, "free");
++ if (p->async == EHCI_ASYNC_INFLIGHT) {
++ usb_cancel_packet(&p->packet);
++ usb_packet_unmap(&p->packet, &p->sgl);
++ qemu_sglist_destroy(&p->sgl);
++ }
+ QTAILQ_REMOVE(&p->queue->packets, p, next);
+ usb_packet_cleanup(&p->packet);
+ g_free(p);
+--
+1.7.12.1
+
--- /dev/null
+From 82b29b635d26ad0f5e14fabdf0956e9b8e7dbbfb Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 31 Aug 2012 10:44:21 +0200
+Subject: [PATCH] ehci: trace guest bugs
+
+make qemu_queue_{cancel,reset} return the number of packets released,
+so the caller can figure whenever there have been active packets even
+though there shouldn't have been any. Add tracepoint to log this.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 5c514681abbb3ae2f61f517c1aa3197f2f3ca93c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 26 ++++++++++++++++++++------
+ trace-events | 1 +
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 23221d0..4564615 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -716,6 +716,12 @@ static void ehci_trace_sitd(EHCIState *s, target_phys_addr_t addr,
+ (bool)(sitd->results & SITD_RESULTS_ACTIVE));
+ }
+
++static void ehci_trace_guest_bug(EHCIState *s, const char *message)
++{
++ trace_usb_ehci_guest_bug(message);
++ fprintf(stderr, "ehci warning: %s\n", message);
++}
++
+ static inline bool ehci_enabled(EHCIState *s)
+ {
+ return s->usbcmd & USBCMD_RUNSTOP;
+@@ -785,27 +791,33 @@ static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
+ return q;
+ }
+
+-static void ehci_cancel_queue(EHCIQueue *q)
++static int ehci_cancel_queue(EHCIQueue *q)
+ {
+ EHCIPacket *p;
++ int packets = 0;
+
+ p = QTAILQ_FIRST(&q->packets);
+ if (p == NULL) {
+- return;
++ return 0;
+ }
+
+ trace_usb_ehci_queue_action(q, "cancel");
+ do {
+ ehci_free_packet(p);
++ packets++;
+ } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
++ return packets;
+ }
+
+-static void ehci_reset_queue(EHCIQueue *q)
++static int ehci_reset_queue(EHCIQueue *q)
+ {
++ int packets;
++
+ trace_usb_ehci_queue_action(q, "reset");
+- ehci_cancel_queue(q);
++ packets = ehci_cancel_queue(q);
+ q->dev = NULL;
+ q->qtdaddr = 0;
++ return packets;
+ }
+
+ static void ehci_free_queue(EHCIQueue *q)
+@@ -1817,7 +1829,9 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ (memcmp(&qh.current_qtd, &q->qh.current_qtd,
+ 9 * sizeof(uint32_t)) != 0) ||
+ (q->dev != NULL && q->dev->addr != devaddr)) {
+- ehci_reset_queue(q);
++ if (ehci_reset_queue(q) > 0) {
++ ehci_trace_guest_bug(ehci, "guest updated active QH");
++ }
+ p = NULL;
+ }
+ q->qh = qh;
+@@ -1979,8 +1993,8 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
+ (!NLPTR_TBIT(p->qtd.next) && (p->qtd.next != qtd.next)) ||
+ (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) ||
+ p->qtd.bufptr[0] != qtd.bufptr[0]) {
+- /* guest bug: guest updated active QH or qTD underneath us */
+ ehci_cancel_queue(q);
++ ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD");
+ p = NULL;
+ } else {
+ p->qtd = qtd;
+diff --git a/trace-events b/trace-events
+index 8fcbc50..5112a47 100644
+--- a/trace-events
++++ b/trace-events
+@@ -263,6 +263,7 @@ usb_ehci_data(int rw, uint32_t cpage, uint32_t offset, uint32_t addr, uint32_t l
+ usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
+ usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
+ usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
++usb_ehci_guest_bug(const char *reason) "%s"
+
+ # hw/usb/hcd-uhci.c
+ usb_uhci_reset(void) "=== RESET ==="
+--
+1.7.12.1
+
--- /dev/null
+From bd1c78528cbd45629fe31127f5bde708263d6e17 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 31 Aug 2012 12:41:43 +0200
+Subject: [PATCH] ehci: add doorbell trace events
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 1defcbd1e81d67476b6e4e486bcd4d869162900d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 3 ++-
+ trace-events | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 4564615..398f5e0 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -1241,6 +1241,7 @@ static void ehci_mem_writel(void *ptr, target_phys_addr_t addr, uint32_t val)
+ */
+ s->async_stepdown = 0;
+ qemu_bh_schedule(s->async_bh);
++ trace_usb_ehci_doorbell_ring();
+ }
+
+ if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
+@@ -2335,7 +2336,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
+ if (ehci->usbcmd & USBCMD_IAAD) {
+ /* Remove all unseen qhs from the async qhs queue */
+ ehci_queues_rip_unused(ehci, async, 1);
+- DPRINTF("ASYNC: doorbell request acknowledged\n");
++ trace_usb_ehci_doorbell_ack();
+ ehci->usbcmd &= ~USBCMD_IAAD;
+ ehci_raise_irq(ehci, USBSTS_IAA);
+ }
+diff --git a/trace-events b/trace-events
+index 5112a47..10bc04e 100644
+--- a/trace-events
++++ b/trace-events
+@@ -264,6 +264,8 @@ usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
+ usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
+ usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
+ usb_ehci_guest_bug(const char *reason) "%s"
++usb_ehci_doorbell_ring(void) ""
++usb_ehci_doorbell_ack(void) ""
+
+ # hw/usb/hcd-uhci.c
+ usb_uhci_reset(void) "=== RESET ==="
+--
+1.7.12.1
+
--- /dev/null
+From 9dc252544b41a626bbdf436a3e6f229fa0014143 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 10:22:16 +0200
+Subject: [PATCH] ehci: Add some additional ehci_trace_guest_bug() calls
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 3a8ca08e01ea4baafff2a513655008cdd00feebf)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 398f5e0..5a88268 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -820,12 +820,16 @@ static int ehci_reset_queue(EHCIQueue *q)
+ return packets;
+ }
+
+-static void ehci_free_queue(EHCIQueue *q)
++static void ehci_free_queue(EHCIQueue *q, const char *warn)
+ {
+ EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
++ int cancelled;
+
+ trace_usb_ehci_queue_action(q, "free");
+- ehci_cancel_queue(q);
++ cancelled = ehci_cancel_queue(q);
++ if (warn && cancelled > 0) {
++ ehci_trace_guest_bug(q->ehci, warn);
++ }
+ QTAILQ_REMOVE(head, q, next);
+ g_free(q);
+ }
+@@ -847,6 +851,7 @@ static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+ static void ehci_queues_rip_unused(EHCIState *ehci, int async, int flush)
+ {
+ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
++ const char *warn = (async && !flush) ? "guest unlinked busy QH" : NULL;
+ uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
+ EHCIQueue *q, *tmp;
+
+@@ -859,7 +864,7 @@ static void ehci_queues_rip_unused(EHCIState *ehci, int async, int flush)
+ if (!flush && ehci->last_run_ns < q->ts + maxage) {
+ continue;
+ }
+- ehci_free_queue(q);
++ ehci_free_queue(q, warn);
+ }
+ }
+
+@@ -872,17 +877,18 @@ static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
+ if (q->dev != dev) {
+ continue;
+ }
+- ehci_free_queue(q);
++ ehci_free_queue(q, NULL);
+ }
+ }
+
+ static void ehci_queues_rip_all(EHCIState *ehci, int async)
+ {
+ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
++ const char *warn = async ? "guest stopped busy async schedule" : NULL;
+ EHCIQueue *q, *tmp;
+
+ QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
+- ehci_free_queue(q);
++ ehci_free_queue(q, warn);
+ }
+ }
+
+@@ -1549,7 +1555,8 @@ static int ehci_execute(EHCIPacket *p, const char *action)
+
+ p->tbytes = (p->qtd.token & QTD_TOKEN_TBYTES_MASK) >> QTD_TOKEN_TBYTES_SH;
+ if (p->tbytes > BUFF_SIZE) {
+- fprintf(stderr, "Request for more bytes than allowed\n");
++ ehci_trace_guest_bug(p->queue->ehci,
++ "guest requested more bytes than allowed");
+ return USB_RET_PROCERR;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 5d369bd44cf2611f47fec52c7402472cd2436b4a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 11:01:13 +0200
+Subject: [PATCH] ehci: Fix memory leak in handling of NAK-ed packets
+
+Currently each time we try to execute a NAK-ed packet we redo
+ehci_init_transfer, and usb_packet_map, re-allocing (without freeing) the
+sg list every time.
+
+This patch fixes this, it does this by introducing another async state, so
+that we also properly cleanup a NAK-ed packet on cancel.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit ef5b234477df80700b128f561f5877a0688a70c8)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 38 +++++++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 5a88268..d87aca8 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -345,6 +345,7 @@ typedef struct EHCIState EHCIState;
+
+ enum async_state {
+ EHCI_ASYNC_NONE = 0,
++ EHCI_ASYNC_INITIALIZED,
+ EHCI_ASYNC_INFLIGHT,
+ EHCI_ASYNC_FINISHED,
+ };
+@@ -764,6 +765,10 @@ static void ehci_free_packet(EHCIPacket *p)
+ return;
+ }
+ trace_usb_ehci_packet_action(p->queue, p, "free");
++ if (p->async == EHCI_ASYNC_INITIALIZED) {
++ usb_packet_unmap(&p->packet, &p->sgl);
++ qemu_sglist_destroy(&p->sgl);
++ }
+ if (p->async == EHCI_ASYNC_INFLIGHT) {
+ usb_cancel_packet(&p->packet);
+ usb_packet_unmap(&p->packet, &p->sgl);
+@@ -1485,8 +1490,8 @@ static void ehci_execute_complete(EHCIQueue *q)
+
+ assert(p != NULL);
+ assert(p->qtdaddr == q->qtdaddr);
+- assert(p->async != EHCI_ASYNC_INFLIGHT);
+- p->async = EHCI_ASYNC_NONE;
++ assert(p->async == EHCI_ASYNC_INITIALIZED ||
++ p->async == EHCI_ASYNC_FINISHED);
+
+ DPRINTF("execute_complete: qhaddr 0x%x, next %x, qtdaddr 0x%x, status %d\n",
+ q->qhaddr, q->qh.next, q->qtdaddr, q->usb_status);
+@@ -1531,6 +1536,7 @@ static void ehci_execute_complete(EHCIQueue *q)
+ ehci_finish_transfer(q, p->usb_status);
+ usb_packet_unmap(&p->packet, &p->sgl);
+ qemu_sglist_destroy(&p->sgl);
++ p->async = EHCI_ASYNC_NONE;
+
+ q->qh.token ^= QTD_TOKEN_DTOGGLE;
+ q->qh.token &= ~QTD_TOKEN_ACTIVE;
+@@ -1548,6 +1554,9 @@ static int ehci_execute(EHCIPacket *p, const char *action)
+ int ret;
+ int endp;
+
++ assert(p->async == EHCI_ASYNC_NONE ||
++ p->async == EHCI_ASYNC_INITIALIZED);
++
+ if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
+ fprintf(stderr, "Attempting to execute inactive qtd\n");
+ return USB_RET_PROCERR;
+@@ -1576,15 +1585,18 @@ static int ehci_execute(EHCIPacket *p, const char *action)
+ break;
+ }
+
+- if (ehci_init_transfer(p) != 0) {
+- return USB_RET_PROCERR;
+- }
+-
+ endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
+ ep = usb_ep_get(p->queue->dev, p->pid, endp);
+
+- usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr);
+- usb_packet_map(&p->packet, &p->sgl);
++ if (p->async == EHCI_ASYNC_NONE) {
++ if (ehci_init_transfer(p) != 0) {
++ return USB_RET_PROCERR;
++ }
++
++ usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr);
++ usb_packet_map(&p->packet, &p->sgl);
++ p->async = EHCI_ASYNC_INITIALIZED;
++ }
+
+ trace_usb_ehci_packet_action(p->queue, p, action);
+ ret = usb_handle_packet(p->queue->dev, &p->packet);
+@@ -2021,11 +2033,15 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
+ } else if (p != NULL) {
+ switch (p->async) {
+ case EHCI_ASYNC_NONE:
++ /* Should never happen packet should at least be initialized */
++ assert(0);
++ break;
++ case EHCI_ASYNC_INITIALIZED:
+ /* Previously nacked packet (likely interrupt ep) */
+- ehci_set_state(q->ehci, q->async, EST_EXECUTE);
+- break;
++ ehci_set_state(q->ehci, q->async, EST_EXECUTE);
++ break;
+ case EHCI_ASYNC_INFLIGHT:
+- /* Unfinyshed async handled packet, go horizontal */
++ /* Unfinished async handled packet, go horizontal */
+ ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
+ break;
+ case EHCI_ASYNC_FINISHED:
+--
+1.7.12.1
+
--- /dev/null
+From 90905dca56de07f7c394ef8cbe480a0d08e0d8cd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 11:35:58 +0200
+Subject: [PATCH] ehci: Handle USB_RET_PROCERR in ehci_fill_queue
+
+USB_RET_PROCERR can be triggered by the guest (by for example requesting more
+then BUFFSIZE bytes), so don't assert on it.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit eff6dce79bd7ad3c16d75c5e55b5a2a137ba6a60)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index d87aca8..2534394 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -2076,7 +2076,7 @@ static int ehci_state_horizqh(EHCIQueue *q)
+ return again;
+ }
+
+-static void ehci_fill_queue(EHCIPacket *p)
++static int ehci_fill_queue(EHCIPacket *p)
+ {
+ EHCIQueue *q = p->queue;
+ EHCIqtd qtd = p->qtd;
+@@ -2100,9 +2100,13 @@ static void ehci_fill_queue(EHCIPacket *p)
+ p->qtdaddr = qtdaddr;
+ p->qtd = qtd;
+ p->usb_status = ehci_execute(p, "queue");
++ if (p->usb_status == USB_RET_PROCERR) {
++ break;
++ }
+ assert(p->usb_status == USB_RET_ASYNC);
+ p->async = EHCI_ASYNC_INFLIGHT;
+ }
++ return p->usb_status;
+ }
+
+ static int ehci_state_execute(EHCIQueue *q)
+@@ -2144,8 +2148,7 @@ static int ehci_state_execute(EHCIQueue *q)
+ trace_usb_ehci_packet_action(p->queue, p, "async");
+ p->async = EHCI_ASYNC_INFLIGHT;
+ ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
+- again = 1;
+- ehci_fill_queue(p);
++ again = (ehci_fill_queue(p) == USB_RET_PROCERR) ? -1 : 1;
+ goto out;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From e598e28401bb25d4d639b29f297a549badbf0cfa Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 12:17:48 +0200
+Subject: [PATCH] ehci: Correct a comment in fetchqtd packet processing
+
+Since my previous comment said "Should never happen", I tried changing the
+next line to an assert(0), which did not go well, which as the new comments
+explains is logical if you think about it for a moment.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit cf1f81691d1998fa8fe5bfcb8b498fb3723cf3c3)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 2534394..2f3e9c0 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -2045,7 +2045,10 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
+ ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
+ break;
+ case EHCI_ASYNC_FINISHED:
+- /* Should never happen, as this case is caught by fetchqh */
++ /*
++ * We get here when advqueue moves to a packet which is already
++ * finished, which can happen with packets queued up by fill_queue
++ */
+ ehci_set_state(q->ehci, q->async, EST_EXECUTING);
+ break;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 262c9bb1e59c2cd561dad1cf9d47c50f07af0e0f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 17 Aug 2012 17:27:08 +0200
+Subject: [PATCH] usb-redir: Never return USB_RET_NAK for async handled
+ packets
+
+USB_RET_NAK is not a valid response for async handled packets (and will
+trigger an assert as such).
+
+Also drop the warning when receiving a status of cancelled for packets not
+cancelled by qemu itself, this can happen when a device gets unredirected
+by the usbredir-host while transfers are pending.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 181133404f520fab40a3ad40d935d91cf3cf546c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 10b4fbb..7f3719b 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -1028,11 +1028,14 @@ static int usbredir_handle_status(USBRedirDevice *dev,
+ case usb_redir_stall:
+ return USB_RET_STALL;
+ case usb_redir_cancelled:
+- WARNING("returning cancelled packet to HC?\n");
+- return USB_RET_NAK;
++ /*
++ * When the usbredir-host unredirects a device, it will report a status
++ * of cancelled for all pending packets, followed by a disconnect msg.
++ */
++ return USB_RET_IOERROR;
+ case usb_redir_inval:
+ WARNING("got invalid param error from usb-host?\n");
+- return USB_RET_NAK;
++ return USB_RET_IOERROR;
+ case usb_redir_babble:
+ return USB_RET_BABBLE;
+ case usb_redir_ioerror:
+--
+1.7.12.1
+
--- /dev/null
+From b89a0cc1ec9dbe30cbe002f12d487a52950da166 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 23 Aug 2012 16:37:19 +0200
+Subject: [PATCH] usb-redir: Don't delay handling of open events to a bottom
+ half
+
+There is no need for this, and doing so means that a backend trying to
+write immediately after an open event will see qemu_chr_be_can_write
+returning 0, which not all backends handle well as there is no wakeup
+mechanism to detect when the frontend does become writable.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit ed9873bfbf145c084d039baab08c63b9d67e7bd3)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 100 +++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 53 insertions(+), 47 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 7f3719b..5cc3334 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -79,8 +79,8 @@ struct USBRedirDevice {
+ /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
+ const uint8_t *read_buf;
+ int read_buf_size;
+- /* For async handling of open/close */
+- QEMUBH *open_close_bh;
++ /* For async handling of close */
++ QEMUBH *chardev_close_bh;
+ /* To delay the usb attach in case of quick chardev close + open */
+ QEMUTimer *attach_timer;
+ int64_t next_attach_time;
+@@ -784,18 +784,11 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ * from within the USBDevice data / control packet callbacks and doing a
+ * usb_detach from within these callbacks is not a good idea.
+ *
+- * So we use a bh handler to take care of close events. We also handle
+- * open events from this callback to make sure that a close directly followed
+- * by an open gets handled in the right order.
++ * So we use a bh handler to take care of close events.
+ */
+-static void usbredir_open_close_bh(void *opaque)
++static void usbredir_chardev_close_bh(void *opaque)
+ {
+ USBRedirDevice *dev = opaque;
+- uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
+- char version[32];
+-
+- strcpy(version, "qemu usb-redir guest ");
+- pstrcat(version, sizeof(version), qemu_get_version());
+
+ usbredir_device_disconnect(dev);
+
+@@ -803,36 +796,47 @@ static void usbredir_open_close_bh(void *opaque)
+ usbredirparser_destroy(dev->parser);
+ dev->parser = NULL;
+ }
++}
+
+- if (dev->cs->opened) {
+- dev->parser = qemu_oom_check(usbredirparser_create());
+- dev->parser->priv = dev;
+- dev->parser->log_func = usbredir_log;
+- dev->parser->read_func = usbredir_read;
+- dev->parser->write_func = usbredir_write;
+- dev->parser->hello_func = usbredir_hello;
+- dev->parser->device_connect_func = usbredir_device_connect;
+- dev->parser->device_disconnect_func = usbredir_device_disconnect;
+- dev->parser->interface_info_func = usbredir_interface_info;
+- dev->parser->ep_info_func = usbredir_ep_info;
+- dev->parser->configuration_status_func = usbredir_configuration_status;
+- dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
+- dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
+- dev->parser->interrupt_receiving_status_func =
+- usbredir_interrupt_receiving_status;
+- dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
+- dev->parser->control_packet_func = usbredir_control_packet;
+- dev->parser->bulk_packet_func = usbredir_bulk_packet;
+- dev->parser->iso_packet_func = usbredir_iso_packet;
+- dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
+- dev->read_buf = NULL;
+- dev->read_buf_size = 0;
++static void usbredir_chardev_open(USBRedirDevice *dev)
++{
++ uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
++ char version[32];
+
+- usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
+- usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
+- usbredirparser_init(dev->parser, version, caps, USB_REDIR_CAPS_SIZE, 0);
+- usbredirparser_do_write(dev->parser);
+- }
++ /* Make sure any pending closes are handled (no-op if none pending) */
++ usbredir_chardev_close_bh(dev);
++ qemu_bh_cancel(dev->chardev_close_bh);
++
++ strcpy(version, "qemu usb-redir guest ");
++ pstrcat(version, sizeof(version), qemu_get_version());
++
++ dev->parser = qemu_oom_check(usbredirparser_create());
++ dev->parser->priv = dev;
++ dev->parser->log_func = usbredir_log;
++ dev->parser->read_func = usbredir_read;
++ dev->parser->write_func = usbredir_write;
++ dev->parser->hello_func = usbredir_hello;
++ dev->parser->device_connect_func = usbredir_device_connect;
++ dev->parser->device_disconnect_func = usbredir_device_disconnect;
++ dev->parser->interface_info_func = usbredir_interface_info;
++ dev->parser->ep_info_func = usbredir_ep_info;
++ dev->parser->configuration_status_func = usbredir_configuration_status;
++ dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
++ dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
++ dev->parser->interrupt_receiving_status_func =
++ usbredir_interrupt_receiving_status;
++ dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
++ dev->parser->control_packet_func = usbredir_control_packet;
++ dev->parser->bulk_packet_func = usbredir_bulk_packet;
++ dev->parser->iso_packet_func = usbredir_iso_packet;
++ dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
++ dev->read_buf = NULL;
++ dev->read_buf_size = 0;
++
++ usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
++ usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
++ usbredirparser_init(dev->parser, version, caps, USB_REDIR_CAPS_SIZE, 0);
++ usbredirparser_do_write(dev->parser);
+ }
+
+ static void usbredir_do_attach(void *opaque)
+@@ -856,13 +860,13 @@ static int usbredir_chardev_can_read(void *opaque)
+ {
+ USBRedirDevice *dev = opaque;
+
+- if (dev->parser) {
+- /* usbredir_parser_do_read will consume *all* data we give it */
+- return 1024 * 1024;
+- } else {
+- /* usbredir_open_close_bh hasn't handled the open event yet */
++ if (!dev->parser) {
++ WARNING("chardev_can_read called on non open chardev!\n");
+ return 0;
+ }
++
++ /* usbredir_parser_do_read will consume *all* data we give it */
++ return 1024 * 1024;
+ }
+
+ static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
+@@ -886,8 +890,10 @@ static void usbredir_chardev_event(void *opaque, int event)
+
+ switch (event) {
+ case CHR_EVENT_OPENED:
++ usbredir_chardev_open(dev);
++ break;
+ case CHR_EVENT_CLOSED:
+- qemu_bh_schedule(dev->open_close_bh);
++ qemu_bh_schedule(dev->chardev_close_bh);
+ break;
+ }
+ }
+@@ -917,7 +923,7 @@ static int usbredir_initfn(USBDevice *udev)
+ }
+ }
+
+- dev->open_close_bh = qemu_bh_new(usbredir_open_close_bh, dev);
++ dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
+ dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
+
+ QTAILQ_INIT(&dev->asyncq);
+@@ -957,7 +963,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
+ qemu_chr_fe_close(dev->cs);
+ qemu_chr_delete(dev->cs);
+ /* Note must be done after qemu_chr_close, as that causes a close event */
+- qemu_bh_delete(dev->open_close_bh);
++ qemu_bh_delete(dev->chardev_close_bh);
+
+ qemu_del_timer(dev->attach_timer);
+ qemu_free_timer(dev->attach_timer);
+--
+1.7.12.1
+
--- /dev/null
+From a9fd3192a956ed1bce0f945f6b35bf9b162b30c3 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 27 Aug 2012 16:33:08 +0200
+Subject: [PATCH] usb-redir: Get rid of async-struct get member
+
+This is a preparation patch for completely getting rid of the async-packet
+struct in usb-redir, instead relying on the (new) per ep queues in the
+qemu usb core.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit cb897117cdedd488f19985c8ec5ea05971103a27)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 5cc3334..2cae8c5 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -1,7 +1,7 @@
+ /*
+ * USB redirector usb-guest
+ *
+- * Copyright (c) 2011 Red Hat, Inc.
++ * Copyright (c) 2011-2012 Red Hat, Inc.
+ *
+ * Red Hat Authors:
+ * Hans de Goede <hdegoede@redhat.com>
+@@ -99,7 +99,6 @@ struct AsyncURB {
+ USBRedirDevice *dev;
+ USBPacket *packet;
+ uint32_t packet_id;
+- int get;
+ union {
+ struct usb_redir_control_packet_header control_packet;
+ struct usb_redir_bulk_packet_header bulk_packet;
+@@ -672,7 +671,6 @@ static int usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
+
+ DPRINTF("get config id %u\n", aurb->packet_id);
+
+- aurb->get = 1;
+ usbredirparser_send_get_configuration(dev->parser, aurb->packet_id);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+@@ -721,7 +719,6 @@ static int usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
+ DPRINTF("get interface %d id %u\n", interface, aurb->packet_id);
+
+ get_alt.interface = interface;
+- aurb->get = 1;
+ usbredirparser_send_get_alt_setting(dev->parser, aurb->packet_id,
+ &get_alt);
+ usbredirparser_do_write(dev->parser);
+@@ -1226,7 +1223,7 @@ static void usbredir_configuration_status(void *priv, uint32_t id,
+ return;
+ }
+ if (aurb->packet) {
+- if (aurb->get) {
++ if (dev->dev.setup_buf[0] & USB_DIR_IN) {
+ dev->dev.data_buf[0] = config_status->configuration;
+ len = 1;
+ }
+@@ -1254,7 +1251,7 @@ static void usbredir_alt_setting_status(void *priv, uint32_t id,
+ return;
+ }
+ if (aurb->packet) {
+- if (aurb->get) {
++ if (dev->dev.setup_buf[0] & USB_DIR_IN) {
+ dev->dev.data_buf[0] = alt_setting_status->alt;
+ len = 1;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 40d22426e0e12f26c7bfa5848cf0a9857d52dc99 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 09:05:38 +0200
+Subject: [PATCH] usb-redir: Get rid of local shadow copy of packet headers
+
+The shadow copy only serves as an extra check (besides the packet-id) to
+ensure the packet we get back is a reply to the packet we think it is.
+
+This check has never triggered in all the time usb-redir is in use now,
+and since the verified data in the returned packet-header is not used
+otherwise, removing the check does not open any possibilities for the
+usbredirhost to confuse us.
+
+This is a preparation patch for completely getting rid of the async-packet
+struct in usb-redir, instead relying on the (new) per ep queues in the
+qemu usb core.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 104981d52b63dc3d68f39d4442881c667f44bbb9)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 27 ---------------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 2cae8c5..e4ef372 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -99,11 +99,6 @@ struct AsyncURB {
+ USBRedirDevice *dev;
+ USBPacket *packet;
+ uint32_t packet_id;
+- union {
+- struct usb_redir_control_packet_header control_packet;
+- struct usb_redir_bulk_packet_header bulk_packet;
+- struct usb_redir_interrupt_packet_header interrupt_packet;
+- };
+ QTAILQ_ENTRY(AsyncURB)next;
+ };
+
+@@ -500,7 +495,6 @@ static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
+ bulk_packet.endpoint = ep;
+ bulk_packet.length = p->iov.size;
+ bulk_packet.stream_id = 0;
+- aurb->bulk_packet = bulk_packet;
+
+ if (ep & USB_DIR_IN) {
+ usbredirparser_send_bulk_packet(dev->parser, aurb->packet_id,
+@@ -581,7 +575,6 @@ static int usbredir_handle_interrupt_data(USBRedirDevice *dev,
+
+ interrupt_packet.endpoint = ep;
+ interrupt_packet.length = p->iov.size;
+- aurb->interrupt_packet = interrupt_packet;
+
+ usb_packet_copy(p, buf, p->iov.size);
+ usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
+@@ -762,7 +755,6 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ control_packet.value = value;
+ control_packet.index = index;
+ control_packet.length = length;
+- aurb->control_packet = control_packet;
+
+ if (control_packet.requesttype & USB_DIR_IN) {
+ usbredirparser_send_control_packet(dev->parser, aurb->packet_id,
+@@ -1326,14 +1318,6 @@ static void usbredir_control_packet(void *priv, uint32_t id,
+ return;
+ }
+
+- aurb->control_packet.status = control_packet->status;
+- aurb->control_packet.length = control_packet->length;
+- if (memcmp(&aurb->control_packet, control_packet,
+- sizeof(*control_packet))) {
+- ERROR("return control packet mismatch, please report this!\n");
+- len = USB_RET_NAK;
+- }
+-
+ if (aurb->packet) {
+ len = usbredir_handle_status(dev, control_packet->status, len);
+ if (len > 0) {
+@@ -1371,12 +1355,6 @@ static void usbredir_bulk_packet(void *priv, uint32_t id,
+ return;
+ }
+
+- if (aurb->bulk_packet.endpoint != bulk_packet->endpoint ||
+- aurb->bulk_packet.stream_id != bulk_packet->stream_id) {
+- ERROR("return bulk packet mismatch, please report this!\n");
+- len = USB_RET_NAK;
+- }
+-
+ if (aurb->packet) {
+ len = usbredir_handle_status(dev, bulk_packet->status, len);
+ if (len > 0) {
+@@ -1455,11 +1433,6 @@ static void usbredir_interrupt_packet(void *priv, uint32_t id,
+ return;
+ }
+
+- if (aurb->interrupt_packet.endpoint != interrupt_packet->endpoint) {
+- ERROR("return int packet mismatch, please report this!\n");
+- len = USB_RET_NAK;
+- }
+-
+ if (aurb->packet) {
+ aurb->packet->result = usbredir_handle_status(dev,
+ interrupt_packet->status, len);
+--
+1.7.12.1
+
--- /dev/null
+From 008e2fcbeea527c3aff3078ed5a178d59757bc28 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 09:08:45 +0200
+Subject: [PATCH] usb-redir: Get rid of unused async-struct dev member
+
+This is a preparation patch for completely getting rid of the async-packet
+struct in usb-redir, instead relying on the (new) per ep queues in the
+qemu usb core.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 206e7f20fe7b920b362bcc02608680c5d5527f2a)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index e4ef372..6593d50 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -96,7 +96,6 @@ struct USBRedirDevice {
+ };
+
+ struct AsyncURB {
+- USBRedirDevice *dev;
+ USBPacket *packet;
+ uint32_t packet_id;
+ QTAILQ_ENTRY(AsyncURB)next;
+@@ -245,7 +244,6 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
+ static AsyncURB *async_alloc(USBRedirDevice *dev, USBPacket *p)
+ {
+ AsyncURB *aurb = (AsyncURB *) g_malloc0(sizeof(AsyncURB));
+- aurb->dev = dev;
+ aurb->packet = p;
+ aurb->packet_id = dev->packet_id;
+ QTAILQ_INSERT_TAIL(&dev->asyncq, aurb, next);
+--
+1.7.12.1
+
--- /dev/null
+From 111194442fa38ba6dc26bc695ba0d3b76584663b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 11:30:13 +0200
+Subject: [PATCH] usb-redir: Move to core packet id and queue handling
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit de550a6afb468ed3b8171019e19b63ae8254886d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 226 ++++++++++++++++++++++--------------------------------
+ 1 file changed, 92 insertions(+), 134 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 6593d50..fd1f8cc 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -43,7 +43,7 @@
+ #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
+ #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
+
+-typedef struct AsyncURB AsyncURB;
++typedef struct Cancelled Cancelled;
+ typedef struct USBRedirDevice USBRedirDevice;
+
+ /* Struct to hold buffered packets (iso or int input packets) */
+@@ -86,8 +86,7 @@ struct USBRedirDevice {
+ int64_t next_attach_time;
+ struct usbredirparser *parser;
+ struct endp_data endpoint[MAX_ENDPOINTS];
+- uint32_t packet_id;
+- QTAILQ_HEAD(, AsyncURB) asyncq;
++ QTAILQ_HEAD(, Cancelled) cancelled;
+ /* Data for device filtering */
+ struct usb_redir_device_connect_header device_info;
+ struct usb_redir_interface_info_header interface_info;
+@@ -95,10 +94,9 @@ struct USBRedirDevice {
+ int filter_rules_count;
+ };
+
+-struct AsyncURB {
+- USBPacket *packet;
+- uint32_t packet_id;
+- QTAILQ_ENTRY(AsyncURB)next;
++struct Cancelled {
++ uint64_t id;
++ QTAILQ_ENTRY(Cancelled)next;
+ };
+
+ static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
+@@ -238,57 +236,58 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
+ }
+
+ /*
+- * Async and buffered packets helpers
++ * Cancelled and buffered packets helpers
+ */
+
+-static AsyncURB *async_alloc(USBRedirDevice *dev, USBPacket *p)
++static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
+ {
+- AsyncURB *aurb = (AsyncURB *) g_malloc0(sizeof(AsyncURB));
+- aurb->packet = p;
+- aurb->packet_id = dev->packet_id;
+- QTAILQ_INSERT_TAIL(&dev->asyncq, aurb, next);
+- dev->packet_id++;
++ USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
++ Cancelled *c;
+
+- return aurb;
+-}
++ DPRINTF("cancel packet id %"PRIu64"\n", p->id);
+
+-static void async_free(USBRedirDevice *dev, AsyncURB *aurb)
+-{
+- QTAILQ_REMOVE(&dev->asyncq, aurb, next);
+- g_free(aurb);
++ c = g_malloc0(sizeof(Cancelled));
++ c->id = p->id;
++ QTAILQ_INSERT_TAIL(&dev->cancelled, c, next);
++
++ usbredirparser_send_cancel_data_packet(dev->parser, p->id);
++ usbredirparser_do_write(dev->parser);
+ }
+
+-static AsyncURB *async_find(USBRedirDevice *dev, uint32_t packet_id)
++static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
+ {
+- AsyncURB *aurb;
++ Cancelled *c;
++
++ if (!dev->dev.attached) {
++ return 1; /* Treat everything as cancelled after a disconnect */
++ }
+
+- QTAILQ_FOREACH(aurb, &dev->asyncq, next) {
+- if (aurb->packet_id == packet_id) {
+- return aurb;
++ QTAILQ_FOREACH(c, &dev->cancelled, next) {
++ if (c->id == id) {
++ QTAILQ_REMOVE(&dev->cancelled, c, next);
++ g_free(c);
++ return 1;
+ }
+ }
+- DPRINTF("could not find async urb for packet_id %u\n", packet_id);
+- return NULL;
++ return 0;
+ }
+
+-static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
++static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
++ uint8_t ep, uint64_t id)
+ {
+- USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
+- AsyncURB *aurb;
+-
+- QTAILQ_FOREACH(aurb, &dev->asyncq, next) {
+- if (p != aurb->packet) {
+- continue;
+- }
++ USBPacket *p;
+
+- DPRINTF("async cancel id %u\n", aurb->packet_id);
+- usbredirparser_send_cancel_data_packet(dev->parser, aurb->packet_id);
+- usbredirparser_do_write(dev->parser);
++ if (usbredir_is_cancelled(dev, id)) {
++ return NULL;
++ }
+
+- /* Mark it as dead */
+- aurb->packet = NULL;
+- break;
++ p = usb_ep_find_packet_by_id(&dev->dev,
++ (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
++ ep & 0x0f, id);
++ if (p == NULL) {
++ ERROR("could not find packet with id %"PRIu64"\n", id);
+ }
++ return p;
+ }
+
+ static void bufp_alloc(USBRedirDevice *dev,
+@@ -484,24 +483,22 @@ static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
+ static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
+ uint8_t ep)
+ {
+- AsyncURB *aurb = async_alloc(dev, p);
+ struct usb_redir_bulk_packet_header bulk_packet;
+
+- DPRINTF("bulk-out ep %02X len %zd id %u\n", ep,
+- p->iov.size, aurb->packet_id);
++ DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, p->iov.size, p->id);
+
+ bulk_packet.endpoint = ep;
+ bulk_packet.length = p->iov.size;
+ bulk_packet.stream_id = 0;
+
+ if (ep & USB_DIR_IN) {
+- usbredirparser_send_bulk_packet(dev->parser, aurb->packet_id,
++ usbredirparser_send_bulk_packet(dev->parser, p->id,
+ &bulk_packet, NULL, 0);
+ } else {
+ uint8_t buf[p->iov.size];
+ usb_packet_copy(p, buf, p->iov.size);
+ usbredir_log_data(dev, "bulk data out:", buf, p->iov.size);
+- usbredirparser_send_bulk_packet(dev->parser, aurb->packet_id,
++ usbredirparser_send_bulk_packet(dev->parser, p->id,
+ &bulk_packet, buf, p->iov.size);
+ }
+ usbredirparser_do_write(dev->parser);
+@@ -564,19 +561,18 @@ static int usbredir_handle_interrupt_data(USBRedirDevice *dev,
+ return len;
+ } else {
+ /* Output interrupt endpoint, normal async operation */
+- AsyncURB *aurb = async_alloc(dev, p);
+ struct usb_redir_interrupt_packet_header interrupt_packet;
+ uint8_t buf[p->iov.size];
+
+- DPRINTF("interrupt-out ep %02X len %zd id %u\n", ep, p->iov.size,
+- aurb->packet_id);
++ DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
++ p->iov.size, p->id);
+
+ interrupt_packet.endpoint = ep;
+ interrupt_packet.length = p->iov.size;
+
+ usb_packet_copy(p, buf, p->iov.size);
+ usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
+- usbredirparser_send_interrupt_packet(dev->parser, aurb->packet_id,
++ usbredirparser_send_interrupt_packet(dev->parser, p->id,
+ &interrupt_packet, buf, p->iov.size);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+@@ -630,10 +626,9 @@ static int usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
+ int config)
+ {
+ struct usb_redir_set_configuration_header set_config;
+- AsyncURB *aurb = async_alloc(dev, p);
+ int i;
+
+- DPRINTF("set config %d id %u\n", config, aurb->packet_id);
++ DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
+
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ switch (dev->endpoint[i].type) {
+@@ -650,19 +645,16 @@ static int usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
+ }
+
+ set_config.configuration = config;
+- usbredirparser_send_set_configuration(dev->parser, aurb->packet_id,
+- &set_config);
++ usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+ }
+
+ static int usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
+ {
+- AsyncURB *aurb = async_alloc(dev, p);
+-
+- DPRINTF("get config id %u\n", aurb->packet_id);
++ DPRINTF("get config id %"PRIu64"\n", p->id);
+
+- usbredirparser_send_get_configuration(dev->parser, aurb->packet_id);
++ usbredirparser_send_get_configuration(dev->parser, p->id);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+ }
+@@ -671,11 +663,9 @@ static int usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
+ int interface, int alt)
+ {
+ struct usb_redir_set_alt_setting_header set_alt;
+- AsyncURB *aurb = async_alloc(dev, p);
+ int i;
+
+- DPRINTF("set interface %d alt %d id %u\n", interface, alt,
+- aurb->packet_id);
++ DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
+
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ if (dev->endpoint[i].interface == interface) {
+@@ -695,8 +685,7 @@ static int usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
+
+ set_alt.interface = interface;
+ set_alt.alt = alt;
+- usbredirparser_send_set_alt_setting(dev->parser, aurb->packet_id,
+- &set_alt);
++ usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+ }
+@@ -705,13 +694,11 @@ static int usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
+ int interface)
+ {
+ struct usb_redir_get_alt_setting_header get_alt;
+- AsyncURB *aurb = async_alloc(dev, p);
+
+- DPRINTF("get interface %d id %u\n", interface, aurb->packet_id);
++ DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
+
+ get_alt.interface = interface;
+- usbredirparser_send_get_alt_setting(dev->parser, aurb->packet_id,
+- &get_alt);
++ usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
+ usbredirparser_do_write(dev->parser);
+ return USB_RET_ASYNC;
+ }
+@@ -721,7 +708,6 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ {
+ USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
+ struct usb_redir_control_packet_header control_packet;
+- AsyncURB *aurb;
+
+ /* Special cases for certain standard device requests */
+ switch (request) {
+@@ -739,13 +725,10 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ return usbredir_get_interface(dev, p, index);
+ }
+
+- /* "Normal" ctrl requests */
+- aurb = async_alloc(dev, p);
+-
+- /* Note request is (bRequestType << 8) | bRequest */
+- DPRINTF("ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %u\n",
+- request >> 8, request & 0xff, value, index, length,
+- aurb->packet_id);
++ /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
++ DPRINTF(
++ "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
++ request >> 8, request & 0xff, value, index, length, p->id);
+
+ control_packet.request = request & 0xFF;
+ control_packet.requesttype = request >> 8;
+@@ -755,11 +738,11 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ control_packet.length = length;
+
+ if (control_packet.requesttype & USB_DIR_IN) {
+- usbredirparser_send_control_packet(dev->parser, aurb->packet_id,
++ usbredirparser_send_control_packet(dev->parser, p->id,
+ &control_packet, NULL, 0);
+ } else {
+ usbredir_log_data(dev, "ctrl data out:", data, length);
+- usbredirparser_send_control_packet(dev->parser, aurb->packet_id,
++ usbredirparser_send_control_packet(dev->parser, p->id,
+ &control_packet, data, length);
+ }
+ usbredirparser_do_write(dev->parser);
+@@ -913,7 +896,7 @@ static int usbredir_initfn(USBDevice *udev)
+ dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
+ dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
+
+- QTAILQ_INIT(&dev->asyncq);
++ QTAILQ_INIT(&dev->cancelled);
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ QTAILQ_INIT(&dev->endpoint[i].bufpq);
+ }
+@@ -932,11 +915,12 @@ static int usbredir_initfn(USBDevice *udev)
+
+ static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
+ {
+- AsyncURB *aurb, *next_aurb;
++ Cancelled *c, *next_c;
+ int i;
+
+- QTAILQ_FOREACH_SAFE(aurb, &dev->asyncq, next, next_aurb) {
+- async_free(dev, aurb);
++ QTAILQ_FOREACH_SAFE(c, &dev->cancelled, next, next_c) {
++ QTAILQ_REMOVE(&dev->cancelled, c, next);
++ g_free(c);
+ }
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ usbredir_free_bufpq(dev, I2EP(i));
+@@ -1202,33 +1186,28 @@ static void usbredir_configuration_status(void *priv, uint32_t id,
+ struct usb_redir_configuration_status_header *config_status)
+ {
+ USBRedirDevice *dev = priv;
+- AsyncURB *aurb;
++ USBPacket *p;
+ int len = 0;
+
+ DPRINTF("set config status %d config %d id %u\n", config_status->status,
+ config_status->configuration, id);
+
+- aurb = async_find(dev, id);
+- if (!aurb) {
+- return;
+- }
+- if (aurb->packet) {
++ p = usbredir_find_packet_by_id(dev, 0, id);
++ if (p) {
+ if (dev->dev.setup_buf[0] & USB_DIR_IN) {
+ dev->dev.data_buf[0] = config_status->configuration;
+ len = 1;
+ }
+- aurb->packet->result =
+- usbredir_handle_status(dev, config_status->status, len);
+- usb_generic_async_ctrl_complete(&dev->dev, aurb->packet);
++ p->result = usbredir_handle_status(dev, config_status->status, len);
++ usb_generic_async_ctrl_complete(&dev->dev, p);
+ }
+- async_free(dev, aurb);
+ }
+
+ static void usbredir_alt_setting_status(void *priv, uint32_t id,
+ struct usb_redir_alt_setting_status_header *alt_setting_status)
+ {
+ USBRedirDevice *dev = priv;
+- AsyncURB *aurb;
++ USBPacket *p;
+ int len = 0;
+
+ DPRINTF("alt status %d intf %d alt %d id: %u\n",
+@@ -1236,20 +1215,16 @@ static void usbredir_alt_setting_status(void *priv, uint32_t id,
+ alt_setting_status->interface,
+ alt_setting_status->alt, id);
+
+- aurb = async_find(dev, id);
+- if (!aurb) {
+- return;
+- }
+- if (aurb->packet) {
++ p = usbredir_find_packet_by_id(dev, 0, id);
++ if (p) {
+ if (dev->dev.setup_buf[0] & USB_DIR_IN) {
+ dev->dev.data_buf[0] = alt_setting_status->alt;
+ len = 1;
+ }
+- aurb->packet->result =
++ p->result =
+ usbredir_handle_status(dev, alt_setting_status->status, len);
+- usb_generic_async_ctrl_complete(&dev->dev, aurb->packet);
++ usb_generic_async_ctrl_complete(&dev->dev, p);
+ }
+- async_free(dev, aurb);
+ }
+
+ static void usbredir_iso_stream_status(void *priv, uint32_t id,
+@@ -1304,19 +1279,14 @@ static void usbredir_control_packet(void *priv, uint32_t id,
+ uint8_t *data, int data_len)
+ {
+ USBRedirDevice *dev = priv;
++ USBPacket *p;
+ int len = control_packet->length;
+- AsyncURB *aurb;
+
+ DPRINTF("ctrl-in status %d len %d id %u\n", control_packet->status,
+ len, id);
+
+- aurb = async_find(dev, id);
+- if (!aurb) {
+- free(data);
+- return;
+- }
+-
+- if (aurb->packet) {
++ p = usbredir_find_packet_by_id(dev, 0, id);
++ if (p) {
+ len = usbredir_handle_status(dev, control_packet->status, len);
+ if (len > 0) {
+ usbredir_log_data(dev, "ctrl data in:", data, data_len);
+@@ -1328,10 +1298,9 @@ static void usbredir_control_packet(void *priv, uint32_t id,
+ len = USB_RET_STALL;
+ }
+ }
+- aurb->packet->result = len;
+- usb_generic_async_ctrl_complete(&dev->dev, aurb->packet);
++ p->result = len;
++ usb_generic_async_ctrl_complete(&dev->dev, p);
+ }
+- async_free(dev, aurb);
+ free(data);
+ }
+
+@@ -1342,33 +1311,27 @@ static void usbredir_bulk_packet(void *priv, uint32_t id,
+ USBRedirDevice *dev = priv;
+ uint8_t ep = bulk_packet->endpoint;
+ int len = bulk_packet->length;
+- AsyncURB *aurb;
++ USBPacket *p;
+
+ DPRINTF("bulk-in status %d ep %02X len %d id %u\n", bulk_packet->status,
+ ep, len, id);
+
+- aurb = async_find(dev, id);
+- if (!aurb) {
+- free(data);
+- return;
+- }
+-
+- if (aurb->packet) {
++ p = usbredir_find_packet_by_id(dev, ep, id);
++ if (p) {
+ len = usbredir_handle_status(dev, bulk_packet->status, len);
+ if (len > 0) {
+ usbredir_log_data(dev, "bulk data in:", data, data_len);
+- if (data_len <= aurb->packet->iov.size) {
+- usb_packet_copy(aurb->packet, data, data_len);
++ if (data_len <= p->iov.size) {
++ usb_packet_copy(p, data, data_len);
+ } else {
+ ERROR("bulk buffer too small (%d > %zd)\n", data_len,
+- aurb->packet->iov.size);
++ p->iov.size);
+ len = USB_RET_STALL;
+ }
+ }
+- aurb->packet->result = len;
+- usb_packet_complete(&dev->dev, aurb->packet);
++ p->result = len;
++ usb_packet_complete(&dev->dev, p);
+ }
+- async_free(dev, aurb);
+ free(data);
+ }
+
+@@ -1426,17 +1389,12 @@ static void usbredir_interrupt_packet(void *priv, uint32_t id,
+ } else {
+ int len = interrupt_packet->length;
+
+- AsyncURB *aurb = async_find(dev, id);
+- if (!aurb) {
+- return;
+- }
+-
+- if (aurb->packet) {
+- aurb->packet->result = usbredir_handle_status(dev,
++ USBPacket *p = usbredir_find_packet_by_id(dev, ep, id);
++ if (p) {
++ p->result = usbredir_handle_status(dev,
+ interrupt_packet->status, len);
+- usb_packet_complete(&dev->dev, aurb->packet);
++ usb_packet_complete(&dev->dev, p);
+ }
+- async_free(dev, aurb);
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 138e9d997e487dafbf686e0e1eba44a8b26dcaf7 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 28 Aug 2012 11:33:47 +0200
+Subject: [PATCH] usb-redir: Return babble when getting more bulk data then
+ requested
+
+Babble is the appropriate error in this case (rather then signalling a stall).
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 2979a36183a3902cd75665e7c6bbc8668668fd17)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index fd1f8cc..ee75217 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -1324,9 +1324,9 @@ static void usbredir_bulk_packet(void *priv, uint32_t id,
+ if (data_len <= p->iov.size) {
+ usb_packet_copy(p, data, data_len);
+ } else {
+- ERROR("bulk buffer too small (%d > %zd)\n", data_len,
+- p->iov.size);
+- len = USB_RET_STALL;
++ ERROR("bulk got more data then requested (%d > %zd)\n",
++ data_len, p->iov.size);
++ len = USB_RET_BABBLE;
+ }
+ }
+ p->result = len;
+--
+1.7.12.1
+
--- /dev/null
+From 23d25cd58aa7da678cad0ad98d52efe37d0be4e6 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Thu, 23 Aug 2012 09:59:27 +0200
+Subject: [PATCH] Better name usb braille device
+
+Windows users need to know that they have to use the Baum driver to make
+the qemu braille device work.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 2964cd9bfa5100e433471d3e3fedcc9d62891894)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/dev-serial.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
+index 8aa6552..69b6e48 100644
+--- a/hw/usb/dev-serial.c
++++ b/hw/usb/dev-serial.c
+@@ -113,7 +113,7 @@ enum {
+ static const USBDescStrings desc_strings = {
+ [STR_MANUFACTURER] = "QEMU",
+ [STR_PRODUCT_SERIAL] = "QEMU USB SERIAL",
+- [STR_PRODUCT_BRAILLE] = "QEMU USB BRAILLE",
++ [STR_PRODUCT_BRAILLE] = "QEMU USB BAUM BRAILLE",
+ [STR_SERIALNUMBER] = "1",
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From 3f8a570db1637c0e7e2dd7a3bd997c92c69efc65 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 16:43:34 +0200
+Subject: [PATCH] usb-audio: fix usb version
+
+usb-audio is a full speed (1.1) device,
+but bcdUSB claims it is usb 2.0. Fix it.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 2bbd086c41a00dc4384727ec895a94890c688eb5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/dev-audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
+index 79b75fb..2594c78 100644
+--- a/hw/usb/dev-audio.c
++++ b/hw/usb/dev-audio.c
+@@ -217,7 +217,7 @@ static const USBDescIface desc_iface[] = {
+ };
+
+ static const USBDescDevice desc_device = {
+- .bcdUSB = 0x0200,
++ .bcdUSB = 0x0100,
+ .bMaxPacketSize0 = 64,
+ .bNumConfigurations = 1,
+ .confs = (USBDescConfig[]) {
+--
+1.7.12.1
+
--- /dev/null
+From f9416f401c9eac3f69b4705a999c6ea1ff457016 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 17 Aug 2012 14:05:21 +0200
+Subject: [PATCH] xhci: rip out background transfer code
+
+original xhci code (the one which used libusb directly) used to use
+'background transfers' for iso streams. In upstream qemu the iso
+stream buffering is handled by usb-host & usb-redir, so we will
+never ever need this. It has been left in as reference, but is dead
+code anyway. Rip it out.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 331e9406f152b6bae6859a153d36e5076c58901d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-xhci.c | 223 +-----------------------------------------------------
+ 1 file changed, 4 insertions(+), 219 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 3eb27fa..c0a2476 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -45,8 +45,6 @@
+ #define MAXPORTS (USB2_PORTS+USB3_PORTS)
+
+ #define TD_QUEUE 24
+-#define BG_XFERS 8
+-#define BG_PKTS 8
+
+ /* Very pessimistic, let's hope it's enough for all cases */
+ #define EV_QUEUE (((3*TD_QUEUE)+16)*MAXSLOTS)
+@@ -311,13 +309,11 @@ typedef struct XHCITransfer {
+ bool running_retry;
+ bool cancelled;
+ bool complete;
+- bool backgrounded;
+ unsigned int iso_pkts;
+ unsigned int slotid;
+ unsigned int epid;
+ bool in_xfer;
+ bool iso_xfer;
+- bool bg_xfer;
+
+ unsigned int trb_count;
+ unsigned int trb_alloced;
+@@ -340,14 +336,9 @@ typedef struct XHCIEPContext {
+ unsigned int comp_xfer;
+ XHCITransfer transfers[TD_QUEUE];
+ XHCITransfer *retry;
+- bool bg_running;
+- bool bg_updating;
+- unsigned int next_bg;
+- XHCITransfer bg_transfers[BG_XFERS];
+ EPType type;
+ dma_addr_t pctx;
+ unsigned int max_psize;
+- bool has_bg;
+ uint32_t state;
+ } XHCIEPContext;
+
+@@ -866,10 +857,6 @@ static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
+ epctx->pctx = pctx;
+ epctx->max_psize = ctx[1]>>16;
+ epctx->max_psize *= 1+((ctx[1]>>8)&0xff);
+- epctx->has_bg = false;
+- if (epctx->type == ET_ISO_IN) {
+- epctx->has_bg = true;
+- }
+ DPRINTF("xhci: endpoint %d.%d max transaction (burst) size is %d\n",
+ epid/2, epid%2, epctx->max_psize);
+ for (i = 0; i < ARRAY_SIZE(epctx->transfers); i++) {
+@@ -916,9 +903,6 @@ static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
+ t->running_retry = 0;
+ epctx->retry = NULL;
+ }
+- if (t->backgrounded) {
+- t->backgrounded = 0;
+- }
+ if (t->trbs) {
+ g_free(t->trbs);
+ }
+@@ -932,25 +916,6 @@ static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
+ t->data_length = t->data_alloced = 0;
+ xferi = (xferi + 1) % TD_QUEUE;
+ }
+- if (epctx->has_bg) {
+- xferi = epctx->next_bg;
+- for (i = 0; i < BG_XFERS; i++) {
+- XHCITransfer *t = &epctx->bg_transfers[xferi];
+- if (t->running_async) {
+- usb_cancel_packet(&t->packet);
+- t->running_async = 0;
+- t->cancelled = 1;
+- DPRINTF("xhci: cancelling bg transfer %d, waiting for it to complete...\n", i);
+- killed++;
+- }
+- if (t->data) {
+- g_free(t->data);
+- }
+-
+- t->data = NULL;
+- xferi = (xferi + 1) % BG_XFERS;
+- }
+- }
+ return killed;
+ }
+
+@@ -1231,160 +1196,6 @@ static void xhci_stall_ep(XHCITransfer *xfer)
+ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer,
+ XHCIEPContext *epctx);
+
+-static void xhci_bg_update(XHCIState *xhci, XHCIEPContext *epctx)
+-{
+- if (epctx->bg_updating) {
+- return;
+- }
+- DPRINTF("xhci_bg_update(%p, %p)\n", xhci, epctx);
+- assert(epctx->has_bg);
+- DPRINTF("xhci: fg=%d bg=%d\n", epctx->comp_xfer, epctx->next_bg);
+- epctx->bg_updating = 1;
+- while (epctx->transfers[epctx->comp_xfer].backgrounded &&
+- epctx->bg_transfers[epctx->next_bg].complete) {
+- XHCITransfer *fg = &epctx->transfers[epctx->comp_xfer];
+- XHCITransfer *bg = &epctx->bg_transfers[epctx->next_bg];
+-#if 0
+- DPRINTF("xhci: completing fg %d from bg %d.%d (stat: %d)\n",
+- epctx->comp_xfer, epctx->next_bg, bg->cur_pkt,
+- bg->usbxfer->iso_packet_desc[bg->cur_pkt].status
+- );
+-#endif
+- assert(epctx->type == ET_ISO_IN);
+- assert(bg->iso_xfer);
+- assert(bg->in_xfer);
+- uint8_t *p = bg->data + bg->cur_pkt * bg->pktsize;
+-#if 0
+- int len = bg->usbxfer->iso_packet_desc[bg->cur_pkt].actual_length;
+- fg->status = libusb_to_ccode(bg->usbxfer->iso_packet_desc[bg->cur_pkt].status);
+-#else
+- int len = 0;
+- FIXME();
+-#endif
+- fg->complete = 1;
+- fg->backgrounded = 0;
+-
+- if (fg->status == CC_STALL_ERROR) {
+- xhci_stall_ep(fg);
+- }
+-
+- xhci_xfer_data(fg, p, len, 1, 0, 1);
+-
+- epctx->comp_xfer++;
+- if (epctx->comp_xfer == TD_QUEUE) {
+- epctx->comp_xfer = 0;
+- }
+- DPRINTF("next fg xfer: %d\n", epctx->comp_xfer);
+- bg->cur_pkt++;
+- if (bg->cur_pkt == bg->pkts) {
+- bg->complete = 0;
+- if (xhci_submit(xhci, bg, epctx) < 0) {
+- fprintf(stderr, "xhci: bg resubmit failed\n");
+- }
+- epctx->next_bg++;
+- if (epctx->next_bg == BG_XFERS) {
+- epctx->next_bg = 0;
+- }
+- DPRINTF("next bg xfer: %d\n", epctx->next_bg);
+-
+- xhci_kick_ep(xhci, fg->slotid, fg->epid);
+- }
+- }
+- epctx->bg_updating = 0;
+-}
+-
+-#if 0
+-static void xhci_xfer_cb(struct libusb_transfer *transfer)
+-{
+- XHCIState *xhci;
+- XHCITransfer *xfer;
+-
+- xfer = (XHCITransfer *)transfer->user_data;
+- xhci = xfer->xhci;
+-
+- DPRINTF("xhci_xfer_cb(slot=%d, ep=%d, status=%d)\n", xfer->slotid,
+- xfer->epid, transfer->status);
+-
+- assert(xfer->slotid >= 1 && xfer->slotid <= MAXSLOTS);
+- assert(xfer->epid >= 1 && xfer->epid <= 31);
+-
+- if (xfer->cancelled) {
+- DPRINTF("xhci: transfer cancelled, not reporting anything\n");
+- xfer->running = 0;
+- return;
+- }
+-
+- XHCIEPContext *epctx;
+- XHCISlot *slot;
+- slot = &xhci->slots[xfer->slotid-1];
+- assert(slot->eps[xfer->epid-1]);
+- epctx = slot->eps[xfer->epid-1];
+-
+- if (xfer->bg_xfer) {
+- DPRINTF("xhci: background transfer, updating\n");
+- xfer->complete = 1;
+- xfer->running = 0;
+- xhci_bg_update(xhci, epctx);
+- return;
+- }
+-
+- if (xfer->iso_xfer) {
+- transfer->status = transfer->iso_packet_desc[0].status;
+- transfer->actual_length = transfer->iso_packet_desc[0].actual_length;
+- }
+-
+- xfer->status = libusb_to_ccode(transfer->status);
+-
+- xfer->complete = 1;
+- xfer->running = 0;
+-
+- if (transfer->status == LIBUSB_TRANSFER_STALL)
+- xhci_stall_ep(xhci, epctx, xfer);
+-
+- DPRINTF("xhci: transfer actual length = %d\n", transfer->actual_length);
+-
+- if (xfer->in_xfer) {
+- if (xfer->epid == 1) {
+- xhci_xfer_data(xhci, xfer, xfer->data + 8,
+- transfer->actual_length, 1, 0, 1);
+- } else {
+- xhci_xfer_data(xhci, xfer, xfer->data,
+- transfer->actual_length, 1, 0, 1);
+- }
+- } else {
+- xhci_xfer_data(xhci, xfer, NULL, transfer->actual_length, 0, 0, 1);
+- }
+-
+- xhci_kick_ep(xhci, xfer->slotid, xfer->epid);
+-}
+-
+-static int xhci_hle_control(XHCIState *xhci, XHCITransfer *xfer,
+- uint8_t bmRequestType, uint8_t bRequest,
+- uint16_t wValue, uint16_t wIndex, uint16_t wLength)
+-{
+- uint16_t type_req = (bmRequestType << 8) | bRequest;
+-
+- switch (type_req) {
+- case 0x0000 | USB_REQ_SET_CONFIGURATION:
+- DPRINTF("xhci: HLE switch configuration\n");
+- return xhci_switch_config(xhci, xfer->slotid, wValue) == 0;
+- case 0x0100 | USB_REQ_SET_INTERFACE:
+- DPRINTF("xhci: HLE set interface altsetting\n");
+- return xhci_set_iface_alt(xhci, xfer->slotid, wIndex, wValue) == 0;
+- case 0x0200 | USB_REQ_CLEAR_FEATURE:
+- if (wValue == 0) { // endpoint halt
+- DPRINTF("xhci: HLE clear halt\n");
+- return xhci_clear_halt(xhci, xfer->slotid, wIndex);
+- }
+- case 0x0000 | USB_REQ_SET_ADDRESS:
+- fprintf(stderr, "xhci: warn: illegal SET_ADDRESS request\n");
+- return 0;
+- default:
+- return 0;
+- }
+-}
+-#endif
+-
+ static int xhci_setup_packet(XHCITransfer *xfer, USBDevice *dev)
+ {
+ USBEndpoint *ep;
+@@ -1559,9 +1370,7 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+ xfer->data_alloced = xfer->data_length;
+ }
+ if (epctx->type == ET_ISO_IN || epctx->type == ET_ISO_OUT) {
+- if (!xfer->bg_xfer) {
+- xfer->pkts = 1;
+- }
++ xfer->pkts = 1;
+ } else {
+ xfer->pkts = 0;
+ }
+@@ -1620,32 +1429,8 @@ static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext
+
+ trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid, length);
+
+- if (!epctx->has_bg) {
+- xfer->data_length = length;
+- xfer->backgrounded = 0;
+- return xhci_submit(xhci, xfer, epctx);
+- } else {
+- if (!epctx->bg_running) {
+- for (i = 0; i < BG_XFERS; i++) {
+- XHCITransfer *t = &epctx->bg_transfers[i];
+- t->xhci = xhci;
+- t->epid = xfer->epid;
+- t->slotid = xfer->slotid;
+- t->pkts = BG_PKTS;
+- t->pktsize = epctx->max_psize;
+- t->data_length = t->pkts * t->pktsize;
+- t->bg_xfer = 1;
+- if (xhci_submit(xhci, t, epctx) < 0) {
+- fprintf(stderr, "xhci: bg submit failed\n");
+- return -1;
+- }
+- }
+- epctx->bg_running = 1;
+- }
+- xfer->backgrounded = 1;
+- xhci_bg_update(xhci, epctx);
+- return 0;
+- }
++ xfer->data_length = length;
++ return xhci_submit(xhci, xfer, epctx);
+ }
+
+ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid)
+@@ -1695,7 +1480,7 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid
+
+ while (1) {
+ XHCITransfer *xfer = &epctx->transfers[epctx->next_xfer];
+- if (xfer->running_async || xfer->running_retry || xfer->backgrounded) {
++ if (xfer->running_async || xfer->running_retry) {
+ break;
+ }
+ length = xhci_ring_chain_length(xhci, &epctx->ring);
+--
+1.7.12.1
+
--- /dev/null
+From 985807ab66338c6a9cab8d68a2b52b0cff0423ee Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 17 Aug 2012 11:04:36 +0200
+Subject: [PATCH] xhci: drop buffering
+
+This patch splits the xhci_xfer_data function into three.
+The xhci_xfer_data function used to do does two things:
+
+ (1) copy transfer data between guest memory and a temporary buffer.
+ (2) report transfer results to the guest using events.
+
+Now we three functions to handle this:
+
+ (1) xhci_xfer_map creates a scatter list for the transfer and
+ uses that (instead of the temporary buffer) to build a
+ USBPacket.
+ (2) xhci_xfer_unmap undoes the mapping.
+ (3) xhci_xfer_report sends out events.
+
+The patch also fixes reporting of transaction errors which must be
+reported unconditinally, not only in case the guest asks for it
+using the ISP flag.
+
+[ v2: fix warning ]
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit d5a15814b413869667b2a3215772986885be574a)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-xhci.c | 185 +++++++++++++++++++++---------------------------------
+ trace-events | 2 +-
+ 2 files changed, 72 insertions(+), 115 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index c0a2476..446d692 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -305,6 +305,7 @@ typedef struct XHCIState XHCIState;
+ typedef struct XHCITransfer {
+ XHCIState *xhci;
+ USBPacket packet;
++ QEMUSGList sgl;
+ bool running_async;
+ bool running_retry;
+ bool cancelled;
+@@ -319,10 +320,6 @@ typedef struct XHCITransfer {
+ unsigned int trb_alloced;
+ XHCITRB *trbs;
+
+- unsigned int data_length;
+- unsigned int data_alloced;
+- uint8_t *data;
+-
+ TRBCCode status;
+
+ unsigned int pkts;
+@@ -906,14 +903,9 @@ static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
+ if (t->trbs) {
+ g_free(t->trbs);
+ }
+- if (t->data) {
+- g_free(t->data);
+- }
+
+ t->trbs = NULL;
+- t->data = NULL;
+ t->trb_count = t->trb_alloced = 0;
+- t->data_length = t->data_alloced = 0;
+ xferi = (xferi + 1) % TD_QUEUE;
+ }
+ return killed;
+@@ -1072,24 +1064,13 @@ static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
+ return CC_SUCCESS;
+ }
+
+-static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
+- unsigned int length, bool in_xfer, bool out_xfer,
+- bool report)
++static int xhci_xfer_map(XHCITransfer *xfer)
+ {
+- int i;
+- uint32_t edtla = 0;
+- unsigned int transferred = 0;
+- unsigned int left = length;
+- bool reported = 0;
+- bool shortpkt = 0;
+- XHCIEvent event = {ER_TRANSFER, CC_SUCCESS};
++ int in_xfer = (xfer->packet.pid == USB_TOKEN_IN);
+ XHCIState *xhci = xfer->xhci;
++ int i;
+
+- DPRINTF("xhci_xfer_data(len=%d, in_xfer=%d, out_xfer=%d, report=%d)\n",
+- length, in_xfer, out_xfer, report);
+-
+- assert(!(in_xfer && out_xfer));
+-
++ pci_dma_sglist_init(&xfer->sgl, &xhci->pci_dev, xfer->trb_count);
+ for (i = 0; i < xfer->trb_count; i++) {
+ XHCITRB *trb = &xfer->trbs[i];
+ dma_addr_t addr;
+@@ -1099,54 +1080,70 @@ static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
+ case TR_DATA:
+ if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
+ fprintf(stderr, "xhci: data direction mismatch for TR_DATA\n");
+- xhci_die(xhci);
+- return transferred;
++ goto err;
+ }
+ /* fallthrough */
+ case TR_NORMAL:
+ case TR_ISOCH:
+ addr = xhci_mask64(trb->parameter);
+ chunk = trb->status & 0x1ffff;
++ if (trb->control & TRB_TR_IDT) {
++ if (chunk > 8 || in_xfer) {
++ fprintf(stderr, "xhci: invalid immediate data TRB\n");
++ goto err;
++ }
++ qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
++ } else {
++ qemu_sglist_add(&xfer->sgl, addr, chunk);
++ }
++ break;
++ }
++ }
++
++ usb_packet_map(&xfer->packet, &xfer->sgl);
++ return 0;
++
++err:
++ qemu_sglist_destroy(&xfer->sgl);
++ xhci_die(xhci);
++ return -1;
++}
++
++static void xhci_xfer_unmap(XHCITransfer *xfer)
++{
++ usb_packet_unmap(&xfer->packet, &xfer->sgl);
++ qemu_sglist_destroy(&xfer->sgl);
++}
++
++static void xhci_xfer_report(XHCITransfer *xfer)
++{
++ uint32_t edtla = 0;
++ unsigned int left;
++ bool reported = 0;
++ bool shortpkt = 0;
++ XHCIEvent event = {ER_TRANSFER, CC_SUCCESS};
++ XHCIState *xhci = xfer->xhci;
++ int i;
++
++ left = xfer->packet.result < 0 ? 0 : xfer->packet.result;
++
++ for (i = 0; i < xfer->trb_count; i++) {
++ XHCITRB *trb = &xfer->trbs[i];
++ unsigned int chunk = 0;
++
++ switch (TRB_TYPE(*trb)) {
++ case TR_DATA:
++ case TR_NORMAL:
++ case TR_ISOCH:
++ chunk = trb->status & 0x1ffff;
+ if (chunk > left) {
+ chunk = left;
+- shortpkt = 1;
+- }
+- if (in_xfer || out_xfer) {
+- if (trb->control & TRB_TR_IDT) {
+- uint64_t idata;
+- if (chunk > 8 || in_xfer) {
+- fprintf(stderr, "xhci: invalid immediate data TRB\n");
+- xhci_die(xhci);
+- return transferred;
+- }
+- idata = le64_to_cpu(trb->parameter);
+- memcpy(data, &idata, chunk);
+- } else {
+- DPRINTF("xhci_xfer_data: r/w(%d) %d bytes at "
+- DMA_ADDR_FMT "\n", in_xfer, chunk, addr);
+- if (in_xfer) {
+- pci_dma_write(&xhci->pci_dev, addr, data, chunk);
+- } else {
+- pci_dma_read(&xhci->pci_dev, addr, data, chunk);
+- }
+-#ifdef DEBUG_DATA
+- unsigned int count = chunk;
+- int i;
+- if (count > 16) {
+- count = 16;
+- }
+- DPRINTF(" ::");
+- for (i = 0; i < count; i++) {
+- DPRINTF(" %02x", data[i]);
+- }
+- DPRINTF("\n");
+-#endif
++ if (xfer->status == CC_SUCCESS) {
++ shortpkt = 1;
+ }
+ }
+ left -= chunk;
+- data += chunk;
+ edtla += chunk;
+- transferred += chunk;
+ break;
+ case TR_STATUS:
+ reported = 0;
+@@ -1154,8 +1151,9 @@ static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
+ break;
+ }
+
+- if (report && !reported && (trb->control & TRB_TR_IOC ||
+- (shortpkt && (trb->control & TRB_TR_ISP)))) {
++ if (!reported && ((trb->control & TRB_TR_IOC) ||
++ (shortpkt && (trb->control & TRB_TR_ISP)) ||
++ (xfer->status != CC_SUCCESS))) {
+ event.slotid = xfer->slotid;
+ event.epid = xfer->epid;
+ event.length = (trb->status & 0x1ffff) - chunk;
+@@ -1175,9 +1173,11 @@ static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
+ }
+ xhci_event(xhci, &event);
+ reported = 1;
++ if (xfer->status != CC_SUCCESS) {
++ return;
++ }
+ }
+ }
+- return transferred;
+ }
+
+ static void xhci_stall_ep(XHCITransfer *xfer)
+@@ -1204,7 +1204,7 @@ static int xhci_setup_packet(XHCITransfer *xfer, USBDevice *dev)
+ dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT;
+ ep = usb_ep_get(dev, dir, xfer->epid >> 1);
+ usb_packet_setup(&xfer->packet, dir, ep, xfer->trbs[0].addr);
+- usb_packet_addbuf(&xfer->packet, xfer->data, xfer->data_length);
++ xhci_xfer_map(xfer);
+ DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n",
+ xfer->packet.pid, dev->addr, ep->nr);
+ return 0;
+@@ -1230,12 +1230,13 @@ static int xhci_complete_packet(XHCITransfer *xfer, int ret)
+ xfer->running_async = 0;
+ xfer->running_retry = 0;
+ xfer->complete = 1;
++ xhci_xfer_unmap(xfer);
+ }
+
+ if (ret >= 0) {
+- xfer->status = CC_SUCCESS;
+- xhci_xfer_data(xfer, xfer->data, ret, xfer->in_xfer, 0, 1);
+ trace_usb_xhci_xfer_success(xfer, ret);
++ xfer->status = CC_SUCCESS;
++ xhci_xfer_report(xfer);
+ return 0;
+ }
+
+@@ -1244,12 +1245,12 @@ static int xhci_complete_packet(XHCITransfer *xfer, int ret)
+ switch (ret) {
+ case USB_RET_NODEV:
+ xfer->status = CC_USB_TRANSACTION_ERROR;
+- xhci_xfer_data(xfer, xfer->data, 0, xfer->in_xfer, 0, 1);
++ xhci_xfer_report(xfer);
+ xhci_stall_ep(xfer);
+ break;
+ case USB_RET_STALL:
+ xfer->status = CC_STALL_ERROR;
+- xhci_xfer_data(xfer, xfer->data, 0, xfer->in_xfer, 0, 1);
++ xhci_xfer_report(xfer);
+ xhci_stall_ep(xfer);
+ break;
+ default:
+@@ -1271,7 +1272,6 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+ {
+ XHCITRB *trb_setup, *trb_status;
+ uint8_t bmRequestType;
+- uint16_t wLength;
+ XHCIPort *port;
+ USBDevice *dev;
+ int ret;
+@@ -1279,8 +1279,7 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+ trb_setup = &xfer->trbs[0];
+ trb_status = &xfer->trbs[xfer->trb_count-1];
+
+- trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid,
+- trb_setup->parameter >> 48);
++ trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
+
+ /* at most one Event Data TRB allowed after STATUS */
+ if (TRB_TYPE(*trb_status) == TR_EVDATA && xfer->trb_count > 2) {
+@@ -1309,19 +1308,6 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+ }
+
+ bmRequestType = trb_setup->parameter;
+- wLength = trb_setup->parameter >> 48;
+-
+- if (xfer->data && xfer->data_alloced < wLength) {
+- xfer->data_alloced = 0;
+- g_free(xfer->data);
+- xfer->data = NULL;
+- }
+- if (!xfer->data) {
+- DPRINTF("xhci: alloc %d bytes data\n", wLength);
+- xfer->data = g_malloc(wLength+1);
+- xfer->data_alloced = wLength;
+- }
+- xfer->data_length = wLength;
+
+ port = &xhci->ports[xhci->slots[xfer->slotid-1].port-1];
+ dev = xhci_find_device(port, xhci->slots[xfer->slotid-1].devaddr);
+@@ -1336,9 +1322,6 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+
+ xhci_setup_packet(xfer, dev);
+ xfer->packet.parameter = trb_setup->parameter;
+- if (!xfer->in_xfer) {
+- xhci_xfer_data(xfer, xfer->data, wLength, 0, 1, 0);
+- }
+
+ ret = usb_handle_packet(dev, &xfer->packet);
+
+@@ -1359,16 +1342,6 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+
+ xfer->in_xfer = epctx->type>>2;
+
+- if (xfer->data && xfer->data_alloced < xfer->data_length) {
+- xfer->data_alloced = 0;
+- g_free(xfer->data);
+- xfer->data = NULL;
+- }
+- if (!xfer->data && xfer->data_length) {
+- DPRINTF("xhci: alloc %d bytes data\n", xfer->data_length);
+- xfer->data = g_malloc(xfer->data_length);
+- xfer->data_alloced = xfer->data_length;
+- }
+ if (epctx->type == ET_ISO_IN || epctx->type == ET_ISO_OUT) {
+ xfer->pkts = 1;
+ } else {
+@@ -1402,9 +1375,6 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+ return -1;
+ }
+
+- if (!xfer->in_xfer) {
+- xhci_xfer_data(xfer, xfer->data, xfer->data_length, 0, 1, 0);
+- }
+ ret = usb_handle_packet(dev, &xfer->packet);
+
+ xhci_complete_packet(xfer, ret);
+@@ -1416,20 +1386,7 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+
+ static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
+ {
+- int i;
+- unsigned int length = 0;
+- XHCITRB *trb;
+-
+- for (i = 0; i < xfer->trb_count; i++) {
+- trb = &xfer->trbs[i];
+- if (TRB_TYPE(*trb) == TR_NORMAL || TRB_TYPE(*trb) == TR_ISOCH) {
+- length += trb->status & 0x1ffff;
+- }
+- }
+-
+- trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid, length);
+-
+- xfer->data_length = length;
++ trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
+ return xhci_submit(xhci, xfer, epctx);
+ }
+
+diff --git a/trace-events b/trace-events
+index 10bc04e..c83d65e 100644
+--- a/trace-events
++++ b/trace-events
+@@ -326,7 +326,7 @@ usb_xhci_ep_disable(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_kick(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_stop(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_reset(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+-usb_xhci_xfer_start(void *xfer, uint32_t slotid, uint32_t epid, uint32_t length) "%p: slotid %d, epid %d, length %d"
++usb_xhci_xfer_start(void *xfer, uint32_t slotid, uint32_t epid) "%p: slotid %d, epid %d"
+ usb_xhci_xfer_async(void *xfer) "%p"
+ usb_xhci_xfer_nak(void *xfer) "%p"
+ usb_xhci_xfer_retry(void *xfer) "%p"
+--
+1.7.12.1
+
--- /dev/null
+From 6dacb38ce3cb2ffe8c6e3a3a1bc86eee49d1e07c Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 12:42:32 +0200
+Subject: [PATCH] xhci: fix runtime write tracepoint
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 8e9f18b6db1cd67f0a7efd7d0285bee489445197)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 446d692..24b1f87 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -2348,7 +2348,7 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+
+ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ {
+- trace_usb_xhci_runtime_read(reg, val);
++ trace_usb_xhci_runtime_write(reg, val);
+
+ switch (reg) {
+ case 0x20: /* IMAN */
+--
+1.7.12.1
+
--- /dev/null
+From 0233069eb2724255f03253f0afe814773eaf345c Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 4 Sep 2012 14:48:03 +0200
+Subject: [PATCH] xhci: allow bytewise capability register reads
+
+Some guests need this according to
+Alejandro Martinez Ruiz <alex@securiforest.com>
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 6ee021d41078844df60a3a466e3829a3e82776f3)
+
+Conflicts:
+
+ hw/usb/hcd-xhci.c
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-xhci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 24b1f87..333df59 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -2474,8 +2474,10 @@ static void xhci_mem_write(void *ptr, target_phys_addr_t addr,
+ static const MemoryRegionOps xhci_mem_ops = {
+ .read = xhci_mem_read,
+ .write = xhci_mem_write,
+- .valid.min_access_size = 4,
++ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
++ .impl.min_access_size = 4,
++ .impl.max_access_size = 4,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From 4007ba909e0188ed03d5a1fc1dde094d0ac14488 Mon Sep 17 00:00:00 2001
+From: Dunrong Huang <riegamaths@gmail.com>
+Date: Fri, 31 Aug 2012 00:44:44 +0800
+Subject: [PATCH] qxl: dont update invalid area
+
+This patch fixes the following error:
+
+$ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso
+(/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed
+Aborted
+
+spice server terminates QEMU process if we pass invalid area to it,
+so dont update those invalid areas.
+
+Signed-off-by: Dunrong Huang <riegamaths@gmail.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit ccc2960d654a233a6ed415b37d8ff41728d817c5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/qxl.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 27f3779..038a8bb 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1448,6 +1448,13 @@ async_common:
+ return;
+ }
+
++ if (update.left < 0 || update.top < 0 || update.left >= update.right ||
++ update.top >= update.bottom) {
++ qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: "
++ "invalid area(%d,%d,%d,%d)\n", update.left,
++ update.right, update.top, update.bottom);
++ break;
++ }
+ if (async == QXL_ASYNC) {
+ cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
+ QXL_IO_UPDATE_AREA_ASYNC);
+--
+1.7.12.1
+
--- /dev/null
+From e84037892a04dac64104b43d0a6342aee4c4e6f4 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 6 Sep 2012 12:03:41 +0200
+Subject: [PATCH] usb-host: allow emulated (non-async) control requests
+ without USBPacket
+
+xhci needs this for USB_REQ_SET_ADDRESS due to the way
+usb addressing is handled by the xhci hardware.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 63587e31353b6652cadfcfb869f5692a2b69daeb)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/host-linux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
+index 8df9207..44f1a64 100644
+--- a/hw/usb/host-linux.c
++++ b/hw/usb/host-linux.c
+@@ -1045,7 +1045,6 @@ static int usb_host_handle_control(USBDevice *dev, USBPacket *p,
+
+ /* Note request is (bRequestType << 8) | bRequest */
+ trace_usb_host_req_control(s->bus_num, s->addr, p, request, value, index);
+- assert(p->result == 0);
+
+ switch (request) {
+ case DeviceOutRequest | USB_REQ_SET_ADDRESS:
+@@ -1074,6 +1073,7 @@ static int usb_host_handle_control(USBDevice *dev, USBPacket *p,
+ }
+
+ /* The rest are asynchronous */
++ assert(p && p->result == 0);
+
+ if (length > sizeof(dev->data_buf)) {
+ fprintf(stderr, "husb: ctrl buffer too small (%d > %zu)\n",
+--
+1.7.12.1
+
--- /dev/null
+From 57ec733394ec42f8a144751de3b9406fb7e17217 Mon Sep 17 00:00:00 2001
+From: Uri Lublin <uril@redhat.com>
+Date: Tue, 11 Sep 2012 10:09:58 +0300
+Subject: [PATCH] qxl: better cleanup for surface destroy
+
+Add back a call to qxl_spice_destroy_surface_wait_complete() in qxl_spice_destroy_surface_wait(),
+that was removed by commit c480bb7da465186b84d8427e068ef7502e47ffbf
+
+It is needed to complete surface-removal cleanup, for non async.
+For async, qxl_spice_destroy_surface_wait_complete is called upon operation completion.
+
+Signed-off-by: Uri Lublin <uril@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 753b8b0d77ba1b343a35f9679cc777ea10a62bba)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/qxl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 038a8bb..67f7100 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -201,6 +201,7 @@ static void qxl_spice_destroy_surface_wait(PCIQXLDevice *qxl, uint32_t id,
+ spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id, (uintptr_t)cookie);
+ } else {
+ qxl->ssd.worker->destroy_surface_wait(qxl->ssd.worker, id);
++ qxl_spice_destroy_surface_wait_complete(qxl, id);
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 093374b8c759db877691fde602912a7cafd72a2e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 6 Sep 2012 11:24:51 +0200
+Subject: [PATCH] ehci: switch to new-style memory ops
+
+Also register different memory regions for capabilities,
+operational registers and port status registers. Create
+separate tracepoints for operational regs and port status
+regs. Ditch a bunch of sanity checks because the memory
+core will do this for us now.
+
+Offloading the byte, word and dword access handling to the
+memory core also has the side effect of fixing ehci register
+access on bigendian hosts.
+
+Cc: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 3e4f910c8d490a1490409a7e381dbbb229f9d272)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 173 ++++++++++++++++++++++++++----------------------------
+ trace-events | 9 ++-
+ 2 files changed, 90 insertions(+), 92 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 2f3e9c0..f5ba8e1 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -389,6 +389,9 @@ struct EHCIState {
+ USBBus bus;
+ qemu_irq irq;
+ MemoryRegion mem;
++ MemoryRegion mem_caps;
++ MemoryRegion mem_opreg;
++ MemoryRegion mem_ports;
+ int companion_count;
+
+ /* properties */
+@@ -398,10 +401,10 @@ struct EHCIState {
+ * EHCI spec version 1.0 Section 2.3
+ * Host Controller Operational Registers
+ */
++ uint8_t caps[OPREGBASE];
+ union {
+- uint8_t mmio[MMIO_SIZE];
++ uint32_t opreg[(PORTSC_BEGIN-OPREGBASE)/sizeof(uint32_t)];
+ struct {
+- uint8_t cap[OPREGBASE];
+ uint32_t usbcmd;
+ uint32_t usbsts;
+ uint32_t usbintr;
+@@ -411,9 +414,9 @@ struct EHCIState {
+ uint32_t asynclistaddr;
+ uint32_t notused[9];
+ uint32_t configflag;
+- uint32_t portsc[NB_PORTS];
+ };
+ };
++ uint32_t portsc[NB_PORTS];
+
+ /*
+ * Internal states, shadow registers, etc
+@@ -471,22 +474,12 @@ static const char *ehci_state_names[] = {
+ };
+
+ static const char *ehci_mmio_names[] = {
+- [CAPLENGTH] = "CAPLENGTH",
+- [HCIVERSION] = "HCIVERSION",
+- [HCSPARAMS] = "HCSPARAMS",
+- [HCCPARAMS] = "HCCPARAMS",
+ [USBCMD] = "USBCMD",
+ [USBSTS] = "USBSTS",
+ [USBINTR] = "USBINTR",
+ [FRINDEX] = "FRINDEX",
+ [PERIODICLISTBASE] = "P-LIST BASE",
+ [ASYNCLISTADDR] = "A-LIST ADDR",
+- [PORTSC_BEGIN] = "PORTSC #0",
+- [PORTSC_BEGIN + 4] = "PORTSC #1",
+- [PORTSC_BEGIN + 8] = "PORTSC #2",
+- [PORTSC_BEGIN + 12] = "PORTSC #3",
+- [PORTSC_BEGIN + 16] = "PORTSC #4",
+- [PORTSC_BEGIN + 20] = "PORTSC #5",
+ [CONFIGFLAG] = "CONFIGFLAG",
+ };
+
+@@ -509,7 +502,8 @@ static const char *state2str(uint32_t state)
+
+ static const char *addr2str(target_phys_addr_t addr)
+ {
+- return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
++ return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names),
++ addr + OPREGBASE);
+ }
+
+ static void ehci_trace_usbsts(uint32_t mask, int state)
+@@ -1018,7 +1012,7 @@ static int ehci_register_companion(USBBus *bus, USBPort *ports[],
+ }
+
+ s->companion_count++;
+- s->mmio[0x05] = (s->companion_count << 4) | portcount;
++ s->caps[0x05] = (s->companion_count << 4) | portcount;
+
+ return 0;
+ }
+@@ -1063,7 +1057,8 @@ static void ehci_reset(void *opaque)
+ }
+ }
+
+- memset(&s->mmio[OPREGBASE], 0x00, MMIO_SIZE - OPREGBASE);
++ memset(&s->opreg, 0x00, sizeof(s->opreg));
++ memset(&s->portsc, 0x00, sizeof(s->portsc));
+
+ s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
+ s->usbsts = USBSTS_HALT;
+@@ -1090,50 +1085,35 @@ static void ehci_reset(void *opaque)
+ qemu_bh_cancel(s->async_bh);
+ }
+
+-static uint32_t ehci_mem_readb(void *ptr, target_phys_addr_t addr)
++static uint64_t ehci_caps_read(void *ptr, target_phys_addr_t addr,
++ unsigned size)
+ {
+ EHCIState *s = ptr;
+- uint32_t val;
+-
+- val = s->mmio[addr];
+-
+- return val;
++ return s->caps[addr];
+ }
+
+-static uint32_t ehci_mem_readw(void *ptr, target_phys_addr_t addr)
++static uint64_t ehci_opreg_read(void *ptr, target_phys_addr_t addr,
++ unsigned size)
+ {
+ EHCIState *s = ptr;
+ uint32_t val;
+
+- val = s->mmio[addr] | (s->mmio[addr+1] << 8);
+-
++ val = s->opreg[addr >> 2];
++ trace_usb_ehci_opreg_read(addr + OPREGBASE, addr2str(addr), val);
+ return val;
+ }
+
+-static uint32_t ehci_mem_readl(void *ptr, target_phys_addr_t addr)
++static uint64_t ehci_port_read(void *ptr, target_phys_addr_t addr,
++ unsigned size)
+ {
+ EHCIState *s = ptr;
+ uint32_t val;
+
+- val = s->mmio[addr] | (s->mmio[addr+1] << 8) |
+- (s->mmio[addr+2] << 16) | (s->mmio[addr+3] << 24);
+-
+- trace_usb_ehci_mmio_readl(addr, addr2str(addr), val);
++ val = s->portsc[addr >> 2];
++ trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
+ return val;
+ }
+
+-static void ehci_mem_writeb(void *ptr, target_phys_addr_t addr, uint32_t val)
+-{
+- fprintf(stderr, "EHCI doesn't handle byte writes to MMIO\n");
+- exit(1);
+-}
+-
+-static void ehci_mem_writew(void *ptr, target_phys_addr_t addr, uint32_t val)
+-{
+- fprintf(stderr, "EHCI doesn't handle 16-bit writes to MMIO\n");
+- exit(1);
+-}
+-
+ static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
+ {
+ USBDevice *dev = s->ports[port].dev;
+@@ -1162,11 +1142,17 @@ static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
+ }
+ }
+
+-static void handle_port_status_write(EHCIState *s, int port, uint32_t val)
++static void ehci_port_write(void *ptr, target_phys_addr_t addr,
++ uint64_t val, unsigned size)
+ {
++ EHCIState *s = ptr;
++ int port = addr >> 2;
+ uint32_t *portsc = &s->portsc[port];
++ uint32_t old = *portsc;
+ USBDevice *dev = s->ports[port].dev;
+
++ trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
++
+ /* Clear rwc bits */
+ *portsc &= ~(val & PORTSC_RWC_MASK);
+ /* The guest may clear, but not set the PED bit */
+@@ -1198,39 +1184,20 @@ static void handle_port_status_write(EHCIState *s, int port, uint32_t val)
+
+ *portsc &= ~PORTSC_RO_MASK;
+ *portsc |= val;
++ trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
+ }
+
+-static void ehci_mem_writel(void *ptr, target_phys_addr_t addr, uint32_t val)
++static void ehci_opreg_write(void *ptr, target_phys_addr_t addr,
++ uint64_t val, unsigned size)
+ {
+ EHCIState *s = ptr;
+- uint32_t *mmio = (uint32_t *)(&s->mmio[addr]);
++ uint32_t *mmio = s->opreg + (addr >> 2);
+ uint32_t old = *mmio;
+ int i;
+
+- trace_usb_ehci_mmio_writel(addr, addr2str(addr), val);
+-
+- /* Only aligned reads are allowed on OHCI */
+- if (addr & 3) {
+- fprintf(stderr, "usb-ehci: Mis-aligned write to addr 0x"
+- TARGET_FMT_plx "\n", addr);
+- return;
+- }
+-
+- if (addr >= PORTSC && addr < PORTSC + 4 * NB_PORTS) {
+- handle_port_status_write(s, (addr-PORTSC)/4, val);
+- trace_usb_ehci_mmio_change(addr, addr2str(addr), *mmio, old);
+- return;
+- }
+-
+- if (addr < OPREGBASE) {
+- fprintf(stderr, "usb-ehci: write attempt to read-only register"
+- TARGET_FMT_plx "\n", addr);
+- return;
+- }
+-
++ trace_usb_ehci_opreg_write(addr + OPREGBASE, addr2str(addr), val);
+
+- /* Do any register specific pre-write processing here. */
+- switch(addr) {
++ switch (addr + OPREGBASE) {
+ case USBCMD:
+ if (val & USBCMD_HCRESET) {
+ ehci_reset(s);
+@@ -1241,7 +1208,7 @@ static void ehci_mem_writel(void *ptr, target_phys_addr_t addr, uint32_t val)
+ /* not supporting dynamic frame list size at the moment */
+ if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
+ fprintf(stderr, "attempt to set frame list size -- value %d\n",
+- val & USBCMD_FLS);
++ (int)val & USBCMD_FLS);
+ val &= ~USBCMD_FLS;
+ }
+
+@@ -1308,7 +1275,7 @@ static void ehci_mem_writel(void *ptr, target_phys_addr_t addr, uint32_t val)
+ }
+
+ *mmio = val;
+- trace_usb_ehci_mmio_change(addr, addr2str(addr), *mmio, old);
++ trace_usb_ehci_opreg_change(addr + OPREGBASE, addr2str(addr), *mmio, old);
+ }
+
+
+@@ -2520,11 +2487,28 @@ static void ehci_async_bh(void *opaque)
+ ehci_advance_async_state(ehci);
+ }
+
+-static const MemoryRegionOps ehci_mem_ops = {
+- .old_mmio = {
+- .read = { ehci_mem_readb, ehci_mem_readw, ehci_mem_readl },
+- .write = { ehci_mem_writeb, ehci_mem_writew, ehci_mem_writel },
+- },
++static const MemoryRegionOps ehci_mmio_caps_ops = {
++ .read = ehci_caps_read,
++ .valid.min_access_size = 1,
++ .valid.max_access_size = 4,
++ .impl.min_access_size = 1,
++ .impl.max_access_size = 1,
++ .endianness = DEVICE_LITTLE_ENDIAN,
++};
++
++static const MemoryRegionOps ehci_mmio_opreg_ops = {
++ .read = ehci_opreg_read,
++ .write = ehci_opreg_write,
++ .valid.min_access_size = 4,
++ .valid.max_access_size = 4,
++ .endianness = DEVICE_LITTLE_ENDIAN,
++};
++
++static const MemoryRegionOps ehci_mmio_port_ops = {
++ .read = ehci_port_read,
++ .write = ehci_port_write,
++ .valid.min_access_size = 4,
++ .valid.max_access_size = 4,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ };
+
+@@ -2681,19 +2665,19 @@ static int usb_ehci_initfn(PCIDevice *dev)
+ pci_conf[0x6e] = 0x00;
+ pci_conf[0x6f] = 0xc0; // USBLEFCTLSTS
+
+- // 2.2 host controller interface version
+- s->mmio[0x00] = (uint8_t) OPREGBASE;
+- s->mmio[0x01] = 0x00;
+- s->mmio[0x02] = 0x00;
+- s->mmio[0x03] = 0x01; // HC version
+- s->mmio[0x04] = NB_PORTS; // Number of downstream ports
+- s->mmio[0x05] = 0x00; // No companion ports at present
+- s->mmio[0x06] = 0x00;
+- s->mmio[0x07] = 0x00;
+- s->mmio[0x08] = 0x80; // We can cache whole frame, not 64-bit capable
+- s->mmio[0x09] = 0x68; // EECP
+- s->mmio[0x0a] = 0x00;
+- s->mmio[0x0b] = 0x00;
++ /* 2.2 host controller interface version */
++ s->caps[0x00] = (uint8_t) OPREGBASE;
++ s->caps[0x01] = 0x00;
++ s->caps[0x02] = 0x00;
++ s->caps[0x03] = 0x01; /* HC version */
++ s->caps[0x04] = NB_PORTS; /* Number of downstream ports */
++ s->caps[0x05] = 0x00; /* No companion ports at present */
++ s->caps[0x06] = 0x00;
++ s->caps[0x07] = 0x00;
++ s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
++ s->caps[0x09] = 0x68; /* EECP */
++ s->caps[0x0a] = 0x00;
++ s->caps[0x0b] = 0x00;
+
+ s->irq = s->dev.irq[3];
+
+@@ -2712,7 +2696,18 @@ static int usb_ehci_initfn(PCIDevice *dev)
+
+ qemu_register_reset(ehci_reset, s);
+
+- memory_region_init_io(&s->mem, &ehci_mem_ops, s, "ehci", MMIO_SIZE);
++ memory_region_init(&s->mem, "ehci", MMIO_SIZE);
++ memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
++ "capabilities", OPREGBASE);
++ memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
++ "operational", PORTSC_BEGIN - OPREGBASE);
++ memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
++ "ports", PORTSC_END - PORTSC_BEGIN);
++
++ memory_region_add_subregion(&s->mem, 0, &s->mem_caps);
++ memory_region_add_subregion(&s->mem, OPREGBASE, &s->mem_opreg);
++ memory_region_add_subregion(&s->mem, PORTSC_BEGIN, &s->mem_ports);
++
+ pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
+
+ return 0;
+diff --git a/trace-events b/trace-events
+index c83d65e..cf05414 100644
+--- a/trace-events
++++ b/trace-events
+@@ -243,9 +243,12 @@ usb_port_release(int bus, const char *port) "bus %d, port %s"
+
+ # hw/usb/hcd-ehci.c
+ usb_ehci_reset(void) "=== RESET ==="
+-usb_ehci_mmio_readl(uint32_t addr, const char *str, uint32_t val) "rd mmio %04x [%s] = %x"
+-usb_ehci_mmio_writel(uint32_t addr, const char *str, uint32_t val) "wr mmio %04x [%s] = %x"
+-usb_ehci_mmio_change(uint32_t addr, const char *str, uint32_t new, uint32_t old) "ch mmio %04x [%s] = %x (old: %x)"
++usb_ehci_opreg_read(uint32_t addr, const char *str, uint32_t val) "rd mmio %04x [%s] = %x"
++usb_ehci_opreg_write(uint32_t addr, const char *str, uint32_t val) "wr mmio %04x [%s] = %x"
++usb_ehci_opreg_change(uint32_t addr, const char *str, uint32_t new, uint32_t old) "ch mmio %04x [%s] = %x (old: %x)"
++usb_ehci_portsc_read(uint32_t addr, uint32_t port, uint32_t val) "rd mmio %04x [port %d] = %x"
++usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio %04x [port %d] = %x"
++usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio %04x [port %d] = %x (old: %x)"
+ usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
+ usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
+ usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ %08x: next %08x qtds %08x,%08x,%08x"
+--
+1.7.12.1
+
--- /dev/null
+From c84ed39e601ff69d93e0ad81d92cb7234ad5d4cd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 10 Sep 2012 12:44:10 +0200
+Subject: [PATCH] ehci: Fix interrupts stopping when Interrupt Threshold
+ Control is 8
+
+If Interrupt Threshold Control is 8 or a multiple of 8, then
+s->usbsts_frindex can become exactly 0x4000, at which point
+(s->usbsts_frindex > s->frindex) will never become true, as
+s->usbsts_frindex will not be lowered / reset in this case.
+
+This patch fixes this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit ffa1f2e088eb7e3d57f2fc35f21e7bdb23e592c5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index f5ba8e1..54273d7 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -2413,7 +2413,7 @@ static void ehci_update_frindex(EHCIState *ehci, int frames)
+ if (ehci->frindex == 0x00004000) {
+ ehci_raise_irq(ehci, USBSTS_FLR);
+ ehci->frindex = 0;
+- if (ehci->usbsts_frindex > 0x00004000) {
++ if (ehci->usbsts_frindex >= 0x00004000) {
+ ehci->usbsts_frindex -= 0x00004000;
+ } else {
+ ehci->usbsts_frindex = 0;
+--
+1.7.12.1
+
--- /dev/null
+From a5022829821b27e00790f8fe2fd9cd8090a47e36 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 10 Sep 2012 12:44:11 +0200
+Subject: [PATCH] ehci: Don't process too much frames in 1 timer tick (v2)
+
+The Linux ehci isoc scheduling code fills the entire schedule ahead of
+time minus 80 frames. If we make a large jump in where we are in the
+schedule, ie 40 frames, then the scheduler all of a sudden will only have
+40 frames left to work in, causing it to fail packet submissions
+with error -27 (-EFBIG).
+
+Changes in v2:
+-Don't hardcode a maximum number of frames to process in one tick, instead:
+ -Process a minimum number of frames to ensure we do eventually catch up
+ -Stop (after the minimum number) when the guest has requested an irq
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 8f74ed1e43263293301031a10e440549bab19a6e)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 54273d7..017a01d 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -139,6 +139,7 @@
+ #define NB_PORTS 6 // Number of downstream ports
+ #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction
+ #define MAX_QH 100 // Max allowable queue heads in a chain
++#define MIN_FR_PER_TICK 3 // Min frames to process when catching up
+
+ /* Internal periodic / asynchronous schedule state machine states
+ */
+@@ -2448,6 +2449,19 @@ static void ehci_frame_timer(void *opaque)
+ }
+
+ for (i = 0; i < frames; i++) {
++ /*
++ * If we're running behind schedule, we should not catch up
++ * too fast, as that will make some guests unhappy:
++ * 1) We must process a minimum of MIN_FR_PER_TICK frames,
++ * otherwise we will never catch up
++ * 2) Process frames until the guest has requested an irq (IOC)
++ */
++ if (i >= MIN_FR_PER_TICK) {
++ ehci_commit_irq(ehci);
++ if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
++ break;
++ }
++ }
+ ehci_update_frindex(ehci, 1);
+ ehci_advance_periodic_state(ehci);
+ ehci->last_run_ns += FRAME_TIMER_NS;
+--
+1.7.12.1
+
--- /dev/null
+From f065553b45322bb0ba14a4c9d1fb65554ae3e325 Mon Sep 17 00:00:00 2001
+From: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
+Date: Thu, 30 Aug 2012 03:39:45 +0900
+Subject: [PATCH] sheepdog: fix savevm and loadvm
+
+This patch sets data to be sent to Sheepdog correctly and fixes savevm
+and loadvm operations on a Sheepdog image.
+
+Signed-off-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 1f7a48de4467f31afc51169122453318efdb0f33)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block/sheepdog.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/sheepdog.c b/block/sheepdog.c
+index df4f441..e0753ee 100644
+--- a/block/sheepdog.c
++++ b/block/sheepdog.c
+@@ -1986,7 +1986,7 @@ static int do_load_save_vmstate(BDRVSheepdogState *s, uint8_t *data,
+ vdi_index = pos / SD_DATA_OBJ_SIZE;
+ offset = pos % SD_DATA_OBJ_SIZE;
+
+- data_len = MIN(remaining, SD_DATA_OBJ_SIZE);
++ data_len = MIN(remaining, SD_DATA_OBJ_SIZE - offset);
+
+ vmstate_oid = vid_to_vmstate_oid(s->inode.vdi_id, vdi_index);
+
+@@ -2007,6 +2007,7 @@ static int do_load_save_vmstate(BDRVSheepdogState *s, uint8_t *data,
+ }
+
+ pos += data_len;
++ data += data_len;
+ remaining -= data_len;
+ }
+ ret = size;
+--
+1.7.12.1
+
--- /dev/null
+From 8557d38b8d660d07c7b6fd1bfa62182cc6c52400 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 3 Sep 2012 22:13:56 +0200
+Subject: [PATCH] ide: Fix error messages from static code analysis (no real
+ error)
+
+Report from smatch:
+hw/ide/core.c:1472 ide_exec_cmd(423) error: buffer overflow 'smart_attributes' 8 <= 29
+hw/ide/core.c:1474 ide_exec_cmd(425) error: buffer overflow 'smart_attributes' 8 <= 29
+hw/ide/core.c:1475 ide_exec_cmd(426) error: buffer overflow 'smart_attributes' 8 <= 29
+...
+
+The upper limit of 30 was never reached because both for loops terminated
+when 'smart_attributes' reached end of list, so there was no real buffer
+overflow.
+
+Nevertheless, changing the code not only fixes the error report, but also
+reduces the size of smart_attributes and simplifies the for loops.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 1e53537fdaa4657d11f130a0f2673fcfb1956381)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/ide/core.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index d65ef3d..d6fb69c 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -53,8 +53,6 @@ static const int smart_attributes[][12] = {
+ { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+ /* airflow-temperature-celsius */
+ { 190, 0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
+- /* end of list */
+- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
+ };
+
+ static int ide_handle_rw_error(IDEState *s, int error, int op);
+@@ -1468,9 +1466,7 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
+ case SMART_READ_THRESH:
+ memset(s->io_buffer, 0, 0x200);
+ s->io_buffer[0] = 0x01; /* smart struct version */
+- for (n=0; n<30; n++) {
+- if (smart_attributes[n][0] == 0)
+- break;
++ for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
+ s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
+ s->io_buffer[2+1+(n*12)] = smart_attributes[n][11];
+ }
+@@ -1484,10 +1480,7 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
+ case SMART_READ_DATA:
+ memset(s->io_buffer, 0, 0x200);
+ s->io_buffer[0] = 0x01; /* smart struct version */
+- for (n=0; n<30; n++) {
+- if (smart_attributes[n][0] == 0) {
+- break;
+- }
++ for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
+ int i;
+ for(i = 0; i < 11; i++) {
+ s->io_buffer[2+i+(n*12)] = smart_attributes[n][i];
+--
+1.7.12.1
+
--- /dev/null
+From a29b7f5390e33d089dcdbf75d6e92c20bbedc562 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 11:06:45 +0200
+Subject: [PATCH] block/curl: Fix wrong free statement
+
+Report from smatch:
+block/curl.c:546 curl_close(21) info: redundant null check on s->url calling free()
+
+The check was redundant, and free was also wrong because the memory
+was allocated using g_strdup.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 45724d6d02383b0d7d4a90e05787fca7c55cb070)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block/curl.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/block/curl.c b/block/curl.c
+index e7c3634..c1074cd 100644
+--- a/block/curl.c
++++ b/block/curl.c
+@@ -542,8 +542,7 @@ static void curl_close(BlockDriverState *bs)
+ }
+ if (s->multi)
+ curl_multi_cleanup(s->multi);
+- if (s->url)
+- free(s->url);
++ g_free(s->url);
+ }
+
+ static int64_t curl_getlength(BlockDriverState *bs)
+--
+1.7.12.1
+
--- /dev/null
+From 928865de80da6a23e6f0d4d86187c52f6c940255 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 17 Aug 2012 15:23:24 +0200
+Subject: [PATCH] vdi: Fix warning from clang
+
+ccc-analyzer reports these warnings:
+
+block/vdi.c:704:13: warning: Dereference of null pointer
+ bmap[i] = VDI_UNALLOCATED;
+ ^
+block/vdi.c:702:13: warning: Dereference of null pointer
+ bmap[i] = i;
+ ^
+
+Moving some code into the if block fixes this.
+It also avoids calling function write with 0 bytes of data.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 514f21a5d4613e495adc2e2dd48f18091454efb8)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block/vdi.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/block/vdi.c b/block/vdi.c
+index c4f1529..550cf58 100644
+--- a/block/vdi.c
++++ b/block/vdi.c
+@@ -628,7 +628,6 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
+ VdiHeader header;
+ size_t i;
+ size_t bmap_size;
+- uint32_t *bmap;
+
+ logout("\n");
+
+@@ -693,21 +692,21 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
+ result = -errno;
+ }
+
+- bmap = NULL;
+ if (bmap_size > 0) {
+- bmap = (uint32_t *)g_malloc0(bmap_size);
+- }
+- for (i = 0; i < blocks; i++) {
+- if (image_type == VDI_TYPE_STATIC) {
+- bmap[i] = i;
+- } else {
+- bmap[i] = VDI_UNALLOCATED;
++ uint32_t *bmap = g_malloc0(bmap_size);
++ for (i = 0; i < blocks; i++) {
++ if (image_type == VDI_TYPE_STATIC) {
++ bmap[i] = i;
++ } else {
++ bmap[i] = VDI_UNALLOCATED;
++ }
+ }
++ if (write(fd, bmap, bmap_size) < 0) {
++ result = -errno;
++ }
++ g_free(bmap);
+ }
+- if (write(fd, bmap, bmap_size) < 0) {
+- result = -errno;
+- }
+- g_free(bmap);
++
+ if (image_type == VDI_TYPE_STATIC) {
+ if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
+ result = -errno;
+--
+1.7.12.1
+
--- /dev/null
+From 8794685f3ebb2d0001ab01bc8692d99242aedb4f Mon Sep 17 00:00:00 2001
+From: Pavel Hrdina <phrdina@redhat.com>
+Date: Thu, 9 Aug 2012 12:44:48 +0200
+Subject: [PATCH] block: fix block tray status
+
+The tray status should change also if you eject empty block device.
+
+Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 9ca111544c64b5abed2e79cf52e19a8f227b347b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block.c b/block.c
+index 470bdcc..c754353 100644
+--- a/block.c
++++ b/block.c
+@@ -897,10 +897,10 @@ void bdrv_close(BlockDriverState *bs)
+ bdrv_delete(bs->file);
+ bs->file = NULL;
+ }
+-
+- bdrv_dev_change_media_cb(bs, false);
+ }
+
++ bdrv_dev_change_media_cb(bs, false);
++
+ /*throttling disk I/O limits*/
+ if (bs->io_limits_enabled) {
+ bdrv_io_limits_disable(bs);
+--
+1.7.12.1
+
--- /dev/null
+From 3248d5fbbf9c0fbfd8d42af08aa81fe1e3fe2841 Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Tue, 4 Sep 2012 16:08:08 -0400
+Subject: [PATCH] ahci: properly reset PxCMD on HBA reset
+
+While testing q35, I found that windows 7 (specifically, windows 7 ultimate
+with sp1 x64), wouldn't install because it can't find the cdrom or disk drive.
+The failure message is: 'A required cd/dvd device driver is missing. If you
+have a driver floppy disk, CD, DVD, or USB flash drive, please insert it now.'
+This can also be reproduced on piix by adding an ahci controller, and
+observing that windows 7 does not see any devices behind it.
+
+The problem is that when windows issues a HBA reset, qemu does not reset the
+individual ports' PxCMD register. Windows 7 then reads back the PxCMD register
+and presumably assumes that the ahci controller has already been initialized.
+Windows then never sets up the PxIE register to enable interrupts, and thus it
+never gets irqs back when it sends ata device inquiry commands.
+
+This change brings qemu into ahci 1.3 specification compliance.
+
+Section 10.4.3 HBA Reset:
+
+"
+When GHC.HR is set to '1', GHC.AE, GHC.IE, the IS register, and all port
+register fields (except PxFB/PxFBU/PxCLB/PxCLBU) that are not HwInit in the
+HBA's register memory space are reset.
+"
+
+I've also re-tested Fedora 16 and 17 to verify that they continue to work with
+this change.
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Acked-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 2a4f4f34e6fe55f4c82507c3e7ec9b58c2e24ad4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/ide/ahci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
+index 5ea3cad..68671bc 100644
+--- a/hw/ide/ahci.c
++++ b/hw/ide/ahci.c
+@@ -1175,7 +1175,6 @@ void ahci_init(AHCIState *s, DeviceState *qdev, DMAContext *dma, int ports)
+ ad->port_no = i;
+ ad->port.dma = &ad->dma;
+ ad->port.dma->ops = &ahci_dma_ops;
+- ad->port_regs.cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
+ }
+ }
+
+@@ -1199,6 +1198,7 @@ void ahci_reset(AHCIState *s)
+ pr->irq_stat = 0;
+ pr->irq_mask = 0;
+ pr->scr_ctl = 0;
++ pr->cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
+ ahci_reset_port(s, i);
+ }
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 4812a358ff2d7442c33a517a6c80d7d3c301ec56 Mon Sep 17 00:00:00 2001
+From: "Daniel P. Berrange" <berrange@redhat.com>
+Date: Mon, 10 Sep 2012 12:11:31 +0100
+Subject: [PATCH] Don't require encryption password for 'qemu-img info'
+ command
+
+The encryption password is only required if I/O is going to be
+performed on a disk image. The 'qemu-img info' command merely
+reports metadata, so it should not ask for a decryption password
+
+Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit f0536bb848ad6eb2709a7dc675f261bd160c751b)
+
+Conflicts:
+
+ qemu-img.c
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-img.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/qemu-img.c b/qemu-img.c
+index b41e670..0d208e8 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -221,7 +221,8 @@ static int print_block_option_help(const char *filename, const char *fmt)
+
+ static BlockDriverState *bdrv_new_open(const char *filename,
+ const char *fmt,
+- int flags)
++ int flags,
++ bool require_io)
+ {
+ BlockDriverState *bs;
+ BlockDriver *drv;
+@@ -246,7 +247,7 @@ static BlockDriverState *bdrv_new_open(const char *filename,
+ goto fail;
+ }
+
+- if (bdrv_is_encrypted(bs)) {
++ if (bdrv_is_encrypted(bs) && require_io) {
+ printf("Disk image '%s' is encrypted.\n", filename);
+ if (read_password(password, sizeof(password)) < 0) {
+ error_report("No password given");
+@@ -413,7 +414,7 @@ static int img_check(int argc, char **argv)
+ }
+ filename = argv[optind++];
+
+- bs = bdrv_new_open(filename, fmt, flags);
++ bs = bdrv_new_open(filename, fmt, flags, true);
+ if (!bs) {
+ return 1;
+ }
+@@ -520,7 +521,7 @@ static int img_commit(int argc, char **argv)
+ return -1;
+ }
+
+- bs = bdrv_new_open(filename, fmt, flags);
++ bs = bdrv_new_open(filename, fmt, flags, true);
+ if (!bs) {
+ return 1;
+ }
+@@ -762,7 +763,7 @@ static int img_convert(int argc, char **argv)
+
+ total_sectors = 0;
+ for (bs_i = 0; bs_i < bs_n; bs_i++) {
+- bs[bs_i] = bdrv_new_open(argv[optind + bs_i], fmt, BDRV_O_FLAGS);
++ bs[bs_i] = bdrv_new_open(argv[optind + bs_i], fmt, BDRV_O_FLAGS, true);
+ if (!bs[bs_i]) {
+ error_report("Could not open '%s'", argv[optind + bs_i]);
+ ret = -1;
+@@ -881,7 +882,7 @@ static int img_convert(int argc, char **argv)
+ return -1;
+ }
+
+- out_bs = bdrv_new_open(out_filename, out_fmt, flags);
++ out_bs = bdrv_new_open(out_filename, out_fmt, flags, true);
+ if (!out_bs) {
+ ret = -1;
+ goto out;
+@@ -1135,7 +1136,7 @@ static int img_info(int argc, char **argv)
+ }
+ filename = argv[optind++];
+
+- bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_NO_BACKING);
++ bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_NO_BACKING, false);
+ if (!bs) {
+ return 1;
+ }
+@@ -1248,7 +1249,7 @@ static int img_snapshot(int argc, char **argv)
+ filename = argv[optind++];
+
+ /* Open the image */
+- bs = bdrv_new_open(filename, NULL, bdrv_oflags);
++ bs = bdrv_new_open(filename, NULL, bdrv_oflags, true);
+ if (!bs) {
+ return 1;
+ }
+@@ -1366,7 +1367,7 @@ static int img_rebase(int argc, char **argv)
+ * Ignore the old backing file for unsafe rebase in case we want to correct
+ * the reference to a renamed or moved backing file.
+ */
+- bs = bdrv_new_open(filename, fmt, flags);
++ bs = bdrv_new_open(filename, fmt, flags, true);
+ if (!bs) {
+ return 1;
+ }
+@@ -1639,7 +1640,7 @@ static int img_resize(int argc, char **argv)
+ n = qemu_opt_get_size(param, BLOCK_OPT_SIZE, 0);
+ qemu_opts_del(param);
+
+- bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_RDWR);
++ bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_RDWR, true);
+ if (!bs) {
+ ret = -1;
+ goto out;
+--
+1.7.12.1
+
--- /dev/null
+From 3306981d5631182fb1384b05d66be26918521511 Mon Sep 17 00:00:00 2001
+From: Dunrong Huang <riegamaths@gmail.com>
+Date: Wed, 5 Sep 2012 21:26:22 +0800
+Subject: [PATCH] block: Don't forget to delete temporary file
+
+The caller would not delete temporary file after failed get_tmp_filename().
+
+Signed-off-by: Dunrong Huang <riegamaths@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit fe235a06e1e008dedd2ac3cc0a3a655169ce9b33)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block.c b/block.c
+index c754353..e78039b 100644
+--- a/block.c
++++ b/block.c
+@@ -433,7 +433,11 @@ int get_tmp_filename(char *filename, int size)
+ return -EOVERFLOW;
+ }
+ fd = mkstemp(filename);
+- if (fd < 0 || close(fd)) {
++ if (fd < 0) {
++ return -errno;
++ }
++ if (close(fd) != 0) {
++ unlink(filename);
+ return -errno;
+ }
+ return 0;
+--
+1.7.12.1
+
--- /dev/null
+From e4a803d8ebd69719f4d997052e5bc3a5a7d91124 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 12 Sep 2012 16:13:26 +0300
+Subject: [PATCH] hw/qxl: tracing fixes
+
+Add two new trace events:
+qxl_send_events(int qid, uint32_t events) "%d %d"
+qxl_set_guest_bug(int qid) "%d"
+
+Change qxl_io_unexpected_vga_mode parameters to be equivalent to those
+of qxl_io_write for easier grouping under a single systemtap probe.
+
+Change d to qxl in one place.
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 917ae08ca1565aab2d10c8b6269cd905d6c5c05b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/qxl.c | 8 +++++---
+ trace-events | 6 ++++--
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 67f7100..59bf822 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -141,6 +141,7 @@ static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
+
+ void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
+ {
++ trace_qxl_set_guest_bug(qxl->id);
+ qxl_send_events(qxl, QXL_INTERRUPT_ERROR);
+ qxl->guest_bug = 1;
+ if (qxl->guestdebug) {
+@@ -1381,7 +1382,7 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ break;
+ }
+ trace_qxl_io_unexpected_vga_mode(d->id,
+- io_port, io_port_to_string(io_port));
++ addr, val, io_port_to_string(io_port));
+ /* be nice to buggy guest drivers */
+ if (io_port >= QXL_IO_UPDATE_AREA_ASYNC &&
+ io_port < QXL_IO_RANGE_SIZE) {
+@@ -1580,9 +1581,9 @@ cancel_async:
+ static uint64_t ioport_read(void *opaque, target_phys_addr_t addr,
+ unsigned size)
+ {
+- PCIQXLDevice *d = opaque;
++ PCIQXLDevice *qxl = opaque;
+
+- trace_qxl_io_read_unexpected(d->id);
++ trace_qxl_io_read_unexpected(qxl->id);
+ return 0xff;
+ }
+
+@@ -1612,6 +1613,7 @@ static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
+ uint32_t old_pending;
+ uint32_t le_events = cpu_to_le32(events);
+
++ trace_qxl_send_events(d->id, events);
+ assert(qemu_spice_display_is_running(&d->ssd));
+ old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
+ if ((old_pending & le_events) == le_events) {
+diff --git a/trace-events b/trace-events
+index cf05414..aa79836 100644
+--- a/trace-events
++++ b/trace-events
+@@ -931,7 +931,7 @@ qxl_interface_update_area_complete_overflow(int qid, int max) "%d max=%d"
+ qxl_interface_update_area_complete_schedule_bh(int qid, uint32_t num_dirty) "%d #dirty=%d"
+ qxl_io_destroy_primary_ignored(int qid, const char *mode) "%d %s"
+ qxl_io_read_unexpected(int qid) "%d"
+-qxl_io_unexpected_vga_mode(int qid, uint32_t io_port, const char *desc) "%d 0x%x (%s)"
++qxl_io_unexpected_vga_mode(int qid, uint64_t addr, uint64_t val, const char *desc) "%d 0x%"PRIx64"=%"PRIu64" (%s)"
+ qxl_io_write(int qid, const char *mode, uint64_t addr, uint64_t val, unsigned size, int async) "%d %s addr=%"PRIu64 " val=%"PRIu64" size=%u async=%d"
+ qxl_memslot_add_guest(int qid, uint32_t slot_id, uint64_t guest_start, uint64_t guest_end) "%d %u: guest phys 0x%"PRIx64 " - 0x%" PRIx64
+ qxl_post_load(int qid, const char *mode) "%d %s"
+@@ -962,7 +962,7 @@ qxl_spice_destroy_surfaces(int qid, int async) "%d async=%d"
+ qxl_spice_destroy_surface_wait_complete(int qid, uint32_t id) "%d sid=%d"
+ qxl_spice_destroy_surface_wait(int qid, uint32_t id, int async) "%d sid=%d async=%d"
+ qxl_spice_flush_surfaces_async(int qid, uint32_t surface_count, uint32_t num_free_res) "%d s#=%d, res#=%d"
+-qxl_spice_monitors_config(int id) "%d"
++qxl_spice_monitors_config(int qid) "%d"
+ qxl_spice_loadvm_commands(int qid, void *ext, uint32_t count) "%d ext=%p count=%d"
+ qxl_spice_oom(int qid) "%d"
+ qxl_spice_reset_cursor(int qid) "%d"
+@@ -971,6 +971,8 @@ qxl_spice_reset_memslots(int qid) "%d"
+ qxl_spice_update_area(int qid, uint32_t surface_id, uint32_t left, uint32_t right, uint32_t top, uint32_t bottom) "%d sid=%d [%d,%d,%d,%d]"
+ qxl_spice_update_area_rest(int qid, uint32_t num_dirty_rects, uint32_t clear_dirty_region) "%d #d=%d clear=%d"
+ qxl_surfaces_dirty(int qid, int surface, int offset, int size) "%d surface=%d offset=%d size=%d"
++qxl_send_events(int qid, uint32_t events) "%d %d"
++qxl_set_guest_bug(int qid) "%d"
+
+ # hw/qxl-render.c
+ qxl_render_blit_guest_primary_initialized(void) ""
+--
+1.7.12.1
+
--- /dev/null
+From 00d9118be03020d3a905bd0a61f74eccd76edee9 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Tue, 11 Sep 2012 20:57:58 +0200
+Subject: [PATCH] configure: usbredir fixes
+
+usbredir is only used by system emulation, so add the libraries to
+libs_softmmu instead of LIBS.
+
+Cc: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 56ab2ad177dc43d474dc0a0bd84e81ef00f31e11)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index a8061c1..dcd8e7b 100755
+--- a/configure
++++ b/configure
+@@ -2737,7 +2737,7 @@ if test "$usb_redir" != "no" ; then
+ usb_redir_cflags=$($pkg_config --cflags libusbredirparser 2>/dev/null)
+ usb_redir_libs=$($pkg_config --libs libusbredirparser 2>/dev/null)
+ QEMU_CFLAGS="$QEMU_CFLAGS $usb_redir_cflags"
+- LIBS="$LIBS $usb_redir_libs"
++ libs_softmmu="$libs_softmmu $usb_redir_libs"
+ else
+ if test "$usb_redir" = "yes"; then
+ feature_not_found "usb-redir"
+--
+1.7.12.1
+
--- /dev/null
+From ade9c6dfbbf573c22800d7ff6df7f0de933e7c96 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2012 15:08:32 +0200
+Subject: [PATCH] ehci: Don't set seen to 0 when removing unseen queue-heads
+
+When removing unseen queue-heads from the async queue list, we should not
+set the seen flag to 0, as this may cause them to be removed by
+ehci_queues_rip_unused() during the next call to ehci_advance_async_state()
+if the timer is late or running at a low frequency.
+
+Note:
+1) This *may* have caused the instant unlink / relinks described in commit
+ 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0
+
+2) Rather then putting more if-s inside ehci_queues_rip_unused, this patch
+ instead introduces a new ehci_queues_rip_unseen function.
+
+3) This patch also makes it save to call ehci_queues_rip_unseen() multiple
+ times, which gets used in the folluw up patch titled:
+ "ehci: Walk async schedule before and after migration"
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 8f5457eb04140714eaf57a99bc08dc661d83fa87)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 017a01d..bc86460 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -848,10 +848,10 @@ static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+ return NULL;
+ }
+
+-static void ehci_queues_rip_unused(EHCIState *ehci, int async, int flush)
++static void ehci_queues_rip_unused(EHCIState *ehci, int async)
+ {
+ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
+- const char *warn = (async && !flush) ? "guest unlinked busy QH" : NULL;
++ const char *warn = async ? "guest unlinked busy QH" : NULL;
+ uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
+ EHCIQueue *q, *tmp;
+
+@@ -861,13 +861,25 @@ static void ehci_queues_rip_unused(EHCIState *ehci, int async, int flush)
+ q->ts = ehci->last_run_ns;
+ continue;
+ }
+- if (!flush && ehci->last_run_ns < q->ts + maxage) {
++ if (ehci->last_run_ns < q->ts + maxage) {
+ continue;
+ }
+ ehci_free_queue(q, warn);
+ }
+ }
+
++static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
++{
++ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
++ EHCIQueue *q, *tmp;
++
++ QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
++ if (!q->seen) {
++ ehci_free_queue(q, NULL);
++ }
++ }
++}
++
+ static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
+ {
+ EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
+@@ -1700,7 +1712,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
+ ehci_set_usbsts(ehci, USBSTS_REC);
+ }
+
+- ehci_queues_rip_unused(ehci, async, 0);
++ ehci_queues_rip_unused(ehci, async);
+
+ /* Find the head of the list (4.9.1.1) */
+ for(i = 0; i < MAX_QH; i++) {
+@@ -2332,7 +2344,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
+ */
+ if (ehci->usbcmd & USBCMD_IAAD) {
+ /* Remove all unseen qhs from the async qhs queue */
+- ehci_queues_rip_unused(ehci, async, 1);
++ ehci_queues_rip_unseen(ehci, async);
+ trace_usb_ehci_doorbell_ack();
+ ehci->usbcmd &= ~USBCMD_IAAD;
+ ehci_raise_irq(ehci, USBSTS_IAA);
+@@ -2385,7 +2397,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
+ ehci_set_fetch_addr(ehci, async,entry);
+ ehci_set_state(ehci, async, EST_FETCHENTRY);
+ ehci_advance_state(ehci, async);
+- ehci_queues_rip_unused(ehci, async, 0);
++ ehci_queues_rip_unused(ehci, async);
+ break;
+
+ default:
+--
+1.7.12.1
+
--- /dev/null
+From 6b145e32e9e219c723b4911aac0a96ea2aa70e77 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2012 15:08:33 +0200
+Subject: [PATCH] ehci: Walk async schedule before and after migration
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit ceab6f96454fe6589d1b09ce64403c041d79f9d9)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-ehci.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index bc86460..6a5da84 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -34,6 +34,7 @@
+ #include "monitor.h"
+ #include "trace.h"
+ #include "dma.h"
++#include "sysemu.h"
+
+ #define EHCI_DEBUG 0
+
+@@ -2572,6 +2573,32 @@ static int usb_ehci_post_load(void *opaque, int version_id)
+ return 0;
+ }
+
++static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
++{
++ EHCIState *ehci = opaque;
++
++ /*
++ * We don't migrate the EHCIQueue-s, instead we rebuild them for the
++ * schedule in guest memory. We must do the rebuilt ASAP, so that
++ * USB-devices which have async handled packages have a packet in the
++ * ep queue to match the completion with.
++ */
++ if (state == RUN_STATE_RUNNING) {
++ ehci_advance_async_state(ehci);
++ }
++
++ /*
++ * The schedule rebuilt from guest memory could cause the migration dest
++ * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
++ * will never have existed on the destination. Therefor we must flush the
++ * async schedule on savevm to catch any not yet noticed unlinks.
++ */
++ if (state == RUN_STATE_SAVE_VM) {
++ ehci_advance_async_state(ehci);
++ ehci_queues_rip_unseen(ehci, 1);
++ }
++}
++
+ static const VMStateDescription vmstate_ehci = {
+ .name = "ehci",
+ .version_id = 2,
+@@ -2721,6 +2748,7 @@ static int usb_ehci_initfn(PCIDevice *dev)
+ usb_packet_init(&s->ipacket);
+
+ qemu_register_reset(ehci_reset, s);
++ qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
+
+ memory_region_init(&s->mem, "ehci", MMIO_SIZE);
+ memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
+--
+1.7.12.1
+
--- /dev/null
+From 9f6674cd9bf6e0e3bafa8b8ec8388576756a6d13 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2012 15:08:39 +0200
+Subject: [PATCH] usb-redir: Revert usb-redir part of commit 93bfef4c
+
+Commit 93bfef4c6e4b23caea9d51e1099d06433d8835a4 makes qemu-devices
+which report the qemu version string to the guest in some way use a
+qemu_get_version function which reports a machine-specific version string.
+
+However usb-redir does not expose the qemu version to the guest, only to
+the usbredir-host as part of the initial handshake. This can then be logged
+on the usbredir-host side for debugging purposes and is otherwise completely
+unused! For debugging purposes it is important to have the real qemu version
+in there, rather then the machine-specific version.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 35efba2cc6812dc980c336d7b9bf81dbfb5daf00)
+
+Conflicts:
+
+ hw/usb/redirect.c
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/redirect.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index ee75217..ab8d79a 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -134,6 +134,8 @@ static void usbredir_interrupt_packet(void *priv, uint32_t id,
+ static int usbredir_handle_status(USBRedirDevice *dev,
+ int status, int actual_len);
+
++#define VERSION "qemu usb-redir guest " QEMU_VERSION
++
+ /*
+ * Logging stuff
+ */
+@@ -777,9 +779,6 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+ usbredir_chardev_close_bh(dev);
+ qemu_bh_cancel(dev->chardev_close_bh);
+
+- strcpy(version, "qemu usb-redir guest ");
+- pstrcat(version, sizeof(version), qemu_get_version());
+-
+ dev->parser = qemu_oom_check(usbredirparser_create());
+ dev->parser->priv = dev;
+ dev->parser->log_func = usbredir_log;
+@@ -805,7 +804,7 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
+- usbredirparser_init(dev->parser, version, caps, USB_REDIR_CAPS_SIZE, 0);
++ usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 0);
+ usbredirparser_do_write(dev->parser);
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 48dbbecb0b010ff1c6a64a3a18a7272cce314bf8 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2012 15:08:40 +0200
+Subject: [PATCH] uhci: Don't queue up packets after one with the SPD flag set
+
+Don't queue up packets after a packet with the SPD (short packet detect)
+flag set. Since we won't know if the packet will actually be short until it
+has completed, and if it is short we should stop the queue.
+
+This fixes a miniature photoframe emulating a USB cdrom with the windows
+software for it not working.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 72a04d0c178f01908d74539230d9de64ffc6da19)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/hcd-uhci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
+index c7c8786..cdc8bc3 100644
+--- a/hw/usb/hcd-uhci.c
++++ b/hw/usb/hcd-uhci.c
+@@ -1000,6 +1000,9 @@ static void uhci_fill_queue(UHCIState *s, UHCI_TD *td)
+ }
+ assert(ret == TD_RESULT_ASYNC_START);
+ assert(int_mask == 0);
++ if (ptd.ctrl & TD_CTRL_SPD) {
++ break;
++ }
+ plink = ptd.link;
+ }
+ }
+@@ -1097,7 +1100,7 @@ static void uhci_process_frame(UHCIState *s)
+
+ case TD_RESULT_ASYNC_START:
+ trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
+- if (is_valid(td.link)) {
++ if (is_valid(td.link) && !(td.ctrl & TD_CTRL_SPD)) {
+ uhci_fill_queue(s, &td);
+ }
+ link = curr_qh ? qh.link : td.link;
+--
+1.7.12.1
+
--- /dev/null
+From 3196332dd2ca39a9b06562856b80b825217e3c96 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 4 Sep 2012 23:20:35 +0200
+Subject: [PATCH] slirp: Remove wrong type casts ins debug statements
+
+The type casts of pointers to long are not allowed
+when sizeof(pointer) != sizeof(long).
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+(cherry picked from commit c4d12a743c73a5b88a8705ca68ff620ce0f8bba7)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ slirp/tcp_subr.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
+index 025b374..5890d7a 100644
+--- a/slirp/tcp_subr.c
++++ b/slirp/tcp_subr.c
+@@ -114,9 +114,9 @@ tcp_respond(struct tcpcb *tp, struct tcpiphdr *ti, struct mbuf *m,
+ int win = 0;
+
+ DEBUG_CALL("tcp_respond");
+- DEBUG_ARG("tp = %lx", (long)tp);
+- DEBUG_ARG("ti = %lx", (long)ti);
+- DEBUG_ARG("m = %lx", (long)m);
++ DEBUG_ARG("tp = %p", tp);
++ DEBUG_ARG("ti = %p", ti);
++ DEBUG_ARG("m = %p", m);
+ DEBUG_ARG("ack = %u", ack);
+ DEBUG_ARG("seq = %u", seq);
+ DEBUG_ARG("flags = %x", flags);
+--
+1.7.12.1
+
--- /dev/null
+From b88c1cb2b263de9ffc3dcaa2822ef7b1fbd8575a Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 4 Sep 2012 23:20:36 +0200
+Subject: [PATCH] slirp: Fix error reported by static code analysis
+
+Report from smatch:
+
+slirp/tcp_subr.c:127 tcp_respond(17) error:
+ we previously assumed 'tp' could be null (see line 124)
+
+Return if 'tp' is NULL.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+(cherry picked from commit e56afbc54a2132c56931f44bae1992c28119944f)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ slirp/tcp_subr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
+index 5890d7a..1542e43 100644
+--- a/slirp/tcp_subr.c
++++ b/slirp/tcp_subr.c
+@@ -124,7 +124,7 @@ tcp_respond(struct tcpcb *tp, struct tcpiphdr *ti, struct mbuf *m,
+ if (tp)
+ win = sbspace(&tp->t_socket->so_rcv);
+ if (m == NULL) {
+- if ((m = m_get(tp->t_socket->slirp)) == NULL)
++ if (!tp || (m = m_get(tp->t_socket->slirp)) == NULL)
+ return;
+ tlen = 0;
+ m->m_data += IF_MAXLINKHDR;
+--
+1.7.12.1
+
--- /dev/null
+From c1b408d0c9d836e0a95d1e0695c0c6c605ceb368 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Poussineau?= <hpoussin@reactos.org>
+Date: Mon, 10 Sep 2012 20:52:25 +0200
+Subject: [PATCH] slirp: improve TFTP performance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When transferring a file, keep it open during the whole transfer,
+instead of opening/closing it for each block.
+
+Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+(cherry picked from commit 78be056628c76ff73eedeade86fde44b97343c79)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ slirp/tftp.c | 32 ++++++++++++++++++--------------
+ slirp/tftp.h | 1 +
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/slirp/tftp.c b/slirp/tftp.c
+index b78765f..520dbd6 100644
+--- a/slirp/tftp.c
++++ b/slirp/tftp.c
+@@ -37,6 +37,10 @@ static inline void tftp_session_update(struct tftp_session *spt)
+
+ static void tftp_session_terminate(struct tftp_session *spt)
+ {
++ if (spt->fd >= 0) {
++ close(spt->fd);
++ spt->fd = -1;
++ }
+ g_free(spt->filename);
+ spt->slirp = NULL;
+ }
+@@ -54,7 +58,7 @@ static int tftp_session_allocate(Slirp *slirp, struct tftp_t *tp)
+
+ /* sessions time out after 5 inactive seconds */
+ if ((int)(curtime - spt->timestamp) > 5000) {
+- g_free(spt->filename);
++ tftp_session_terminate(spt);
+ goto found;
+ }
+ }
+@@ -64,6 +68,7 @@ static int tftp_session_allocate(Slirp *slirp, struct tftp_t *tp)
+ found:
+ memset(spt, 0, sizeof(*spt));
+ memcpy(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip));
++ spt->fd = -1;
+ spt->client_port = tp->udp.uh_sport;
+ spt->slirp = slirp;
+
+@@ -95,24 +100,23 @@ static int tftp_session_find(Slirp *slirp, struct tftp_t *tp)
+ static int tftp_read_data(struct tftp_session *spt, uint16_t block_nr,
+ uint8_t *buf, int len)
+ {
+- int fd;
+- int bytes_read = 0;
+-
+- fd = open(spt->filename, O_RDONLY | O_BINARY);
++ int bytes_read = 0;
+
+- if (fd < 0) {
+- return -1;
+- }
++ if (spt->fd < 0) {
++ spt->fd = open(spt->filename, O_RDONLY | O_BINARY);
++ }
+
+- if (len) {
+- lseek(fd, block_nr * 512, SEEK_SET);
++ if (spt->fd < 0) {
++ return -1;
++ }
+
+- bytes_read = read(fd, buf, len);
+- }
++ if (len) {
++ lseek(spt->fd, block_nr * 512, SEEK_SET);
+
+- close(fd);
++ bytes_read = read(spt->fd, buf, len);
++ }
+
+- return bytes_read;
++ return bytes_read;
+ }
+
+ static int tftp_send_oack(struct tftp_session *spt,
+diff --git a/slirp/tftp.h b/slirp/tftp.h
+index 72e5e91..9c364ea 100644
+--- a/slirp/tftp.h
++++ b/slirp/tftp.h
+@@ -33,6 +33,7 @@ struct tftp_t {
+ struct tftp_session {
+ Slirp *slirp;
+ char *filename;
++ int fd;
+
+ struct in_addr client_ip;
+ uint16_t client_port;
+--
+1.7.12.1
+
--- /dev/null
+From 5579c7740b29be4766ace824af36acb9ab254ecb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Poussineau?= <hpoussin@reactos.org>
+Date: Thu, 13 Sep 2012 12:39:36 +0200
+Subject: [PATCH] slirp: Handle more than 65535 blocks in TFTP transfers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RFC 1350 does not mention block count roll-over. However, a lot of TFTP servers
+implement it to be able to transmit big files, so do it also.
+
+Current block size is 512 bytes, so TFTP files were limited to 32 MB.
+
+Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+(cherry picked from commit 4aa401f39e048e71020cceb59f126ab941095a42)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ slirp/tftp.c | 24 ++++++++++--------------
+ slirp/tftp.h | 1 +
+ 2 files changed, 11 insertions(+), 14 deletions(-)
+
+diff --git a/slirp/tftp.c b/slirp/tftp.c
+index 520dbd6..c6a5df2 100644
+--- a/slirp/tftp.c
++++ b/slirp/tftp.c
+@@ -97,7 +97,7 @@ static int tftp_session_find(Slirp *slirp, struct tftp_t *tp)
+ return -1;
+ }
+
+-static int tftp_read_data(struct tftp_session *spt, uint16_t block_nr,
++static int tftp_read_data(struct tftp_session *spt, uint32_t block_nr,
+ uint8_t *buf, int len)
+ {
+ int bytes_read = 0;
+@@ -197,19 +197,14 @@ out:
+ tftp_session_terminate(spt);
+ }
+
+-static int tftp_send_data(struct tftp_session *spt,
+- uint16_t block_nr,
+- struct tftp_t *recv_tp)
++static int tftp_send_next_block(struct tftp_session *spt,
++ struct tftp_t *recv_tp)
+ {
+ struct sockaddr_in saddr, daddr;
+ struct mbuf *m;
+ struct tftp_t *tp;
+ int nobytes;
+
+- if (block_nr < 1) {
+- return -1;
+- }
+-
+ m = m_get(spt->slirp);
+
+ if (!m) {
+@@ -223,7 +218,7 @@ static int tftp_send_data(struct tftp_session *spt,
+ m->m_data += sizeof(struct udpiphdr);
+
+ tp->tp_op = htons(TFTP_DATA);
+- tp->x.tp_data.tp_block_nr = htons(block_nr);
++ tp->x.tp_data.tp_block_nr = htons((spt->block_nr + 1) & 0xffff);
+
+ saddr.sin_addr = recv_tp->ip.ip_dst;
+ saddr.sin_port = recv_tp->udp.uh_dport;
+@@ -231,7 +226,7 @@ static int tftp_send_data(struct tftp_session *spt,
+ daddr.sin_addr = spt->client_ip;
+ daddr.sin_port = spt->client_port;
+
+- nobytes = tftp_read_data(spt, block_nr - 1, tp->x.tp_data.tp_buf, 512);
++ nobytes = tftp_read_data(spt, spt->block_nr, tp->x.tp_data.tp_buf, 512);
+
+ if (nobytes < 0) {
+ m_free(m);
+@@ -255,6 +250,7 @@ static int tftp_send_data(struct tftp_session *spt,
+ tftp_session_terminate(spt);
+ }
+
++ spt->block_nr++;
+ return 0;
+ }
+
+@@ -373,7 +369,8 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
+ }
+ }
+
+- tftp_send_data(spt, 1, tp);
++ spt->block_nr = 0;
++ tftp_send_next_block(spt, tp);
+ }
+
+ static void tftp_handle_ack(Slirp *slirp, struct tftp_t *tp, int pktlen)
+@@ -386,9 +383,8 @@ static void tftp_handle_ack(Slirp *slirp, struct tftp_t *tp, int pktlen)
+ return;
+ }
+
+- if (tftp_send_data(&slirp->tftp_sessions[s],
+- ntohs(tp->x.tp_data.tp_block_nr) + 1,
+- tp) < 0) {
++ if (tftp_send_next_block(&slirp->tftp_sessions[s],
++ tp) < 0) {
+ return;
+ }
+ }
+diff --git a/slirp/tftp.h b/slirp/tftp.h
+index 9c364ea..51704e4 100644
+--- a/slirp/tftp.h
++++ b/slirp/tftp.h
+@@ -37,6 +37,7 @@ struct tftp_session {
+
+ struct in_addr client_ip;
+ uint16_t client_port;
++ uint32_t block_nr;
+
+ int timestamp;
+ };
+--
+1.7.12.1
+
--- /dev/null
+From e070dc7276c7958c322ca0fbf5ac10e639502b4d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Poussineau?= <hpoussin@reactos.org>
+Date: Thu, 13 Sep 2012 07:55:01 +0200
+Subject: [PATCH] slirp: Implement TFTP Blocksize option
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This option is described in RFC 1783. As this is only an optional field,
+we may ignore it in some situations and handle it in some others.
+
+However, MS Windows 2003 PXE boot client requests a block size of the MTU
+(most of the times 1472 bytes), and doesn't work if the option is not
+acknowledged (with whatever value).
+
+According to the RFC 1783, we cannot acknowledge the option with a bigger
+value than the requested one.
+
+As current implementation is using 512 bytes by block, accept the option
+with a value of 512 if the option was specified, and don't acknowledge it
+if it is not present or less than 512 bytes.
+
+Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+(cherry picked from commit 95b1ad7ad86793c27ab8e9987be69571937900d1)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ slirp/tftp.c | 42 +++++++++++++++++++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 9 deletions(-)
+
+diff --git a/slirp/tftp.c b/slirp/tftp.c
+index c6a5df2..37b0387 100644
+--- a/slirp/tftp.c
++++ b/slirp/tftp.c
+@@ -120,13 +120,13 @@ static int tftp_read_data(struct tftp_session *spt, uint32_t block_nr,
+ }
+
+ static int tftp_send_oack(struct tftp_session *spt,
+- const char *key, uint32_t value,
++ const char *keys[], uint32_t values[], int nb,
+ struct tftp_t *recv_tp)
+ {
+ struct sockaddr_in saddr, daddr;
+ struct mbuf *m;
+ struct tftp_t *tp;
+- int n = 0;
++ int i, n = 0;
+
+ m = m_get(spt->slirp);
+
+@@ -140,10 +140,12 @@ static int tftp_send_oack(struct tftp_session *spt,
+ m->m_data += sizeof(struct udpiphdr);
+
+ tp->tp_op = htons(TFTP_OACK);
+- n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",
+- key) + 1;
+- n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",
+- value) + 1;
++ for (i = 0; i < nb; i++) {
++ n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",
++ keys[i]) + 1;
++ n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",
++ values[i]) + 1;
++ }
+
+ saddr.sin_addr = recv_tp->ip.ip_dst;
+ saddr.sin_port = recv_tp->udp.uh_dport;
+@@ -260,6 +262,9 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
+ int s, k;
+ size_t prefix_len;
+ char *req_fname;
++ const char *option_name[2];
++ uint32_t option_value[2];
++ int nb_options = 0;
+
+ /* check if a session already exists and if so terminate it */
+ s = tftp_session_find(slirp, tp);
+@@ -337,7 +342,7 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
+ return;
+ }
+
+- while (k < pktlen) {
++ while (k < pktlen && nb_options < ARRAY_SIZE(option_name)) {
+ const char *key, *value;
+
+ key = &tp->x.tp_buf[k];
+@@ -364,11 +369,30 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
+ }
+ }
+
+- tftp_send_oack(spt, "tsize", tsize, tp);
+- return;
++ option_name[nb_options] = "tsize";
++ option_value[nb_options] = tsize;
++ nb_options++;
++ } else if (strcasecmp(key, "blksize") == 0) {
++ int blksize = atoi(value);
++
++ /* If blksize option is bigger than what we will
++ * emit, accept the option with our packet size.
++ * Otherwise, simply do as we didn't see the option.
++ */
++ if (blksize >= 512) {
++ option_name[nb_options] = "blksize";
++ option_value[nb_options] = 512;
++ nb_options++;
++ }
+ }
+ }
+
++ if (nb_options > 0) {
++ assert(nb_options <= ARRAY_SIZE(option_name));
++ tftp_send_oack(spt, option_name, option_value, nb_options, tp);
++ return;
++ }
++
+ spt->block_nr = 0;
+ tftp_send_next_block(spt, tp);
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 66cbaa761bc0f6d528957f9e3bc5762acb7f5f1c Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 10 Aug 2012 22:03:27 +0200
+Subject: [PATCH] srp: Don't use QEMU_PACKED for single elements of a
+ structured type
+
+QEMU_PACKED results in a MinGW compiler warning when it is
+used for single structure elements:
+
+warning: 'gcc_struct' attribute ignored
+
+Using QEMU_PACKED for the whole structure avoids the compiler warning
+without changing the memory layout.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 93d3ad2a8048469d2b2bb157697425b66b2a37aa)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/srp.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/srp.h b/hw/srp.h
+index 3009bd5..5e0cad5 100644
+--- a/hw/srp.h
++++ b/hw/srp.h
+@@ -177,13 +177,13 @@ struct srp_tsk_mgmt {
+ uint8_t reserved1[6];
+ uint64_t tag;
+ uint8_t reserved2[4];
+- uint64_t lun QEMU_PACKED;
++ uint64_t lun;
+ uint8_t reserved3[2];
+ uint8_t tsk_mgmt_func;
+ uint8_t reserved4;
+ uint64_t task_tag;
+ uint8_t reserved5[8];
+-};
++} QEMU_PACKED;
+
+ /*
+ * We need the packed attribute because the SRP spec only aligns the
+@@ -198,14 +198,14 @@ struct srp_cmd {
+ uint8_t data_in_desc_cnt;
+ uint64_t tag;
+ uint8_t reserved2[4];
+- uint64_t lun QEMU_PACKED;
++ uint64_t lun;
+ uint8_t reserved3;
+ uint8_t task_attr;
+ uint8_t reserved4;
+ uint8_t add_cdb_len;
+ uint8_t cdb[16];
+ uint8_t add_data[0];
+-};
++} QEMU_PACKED;
+
+ enum {
+ SRP_RSP_FLAG_RSPVALID = 1 << 0,
+--
+1.7.12.1
+
--- /dev/null
+From ca94ceccca88d284e5d638961b21bd83eac944db Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 10 Aug 2012 22:03:25 +0200
+Subject: [PATCH] Spelling fixes in comments and documentation
+
+These wrong spellings were detected by codespell:
+
+* successully -> successfully
+
+* alot -> a lot
+
+* wanna -> want to
+
+* infomation -> information
+
+* occured -> occurred
+
+["also is" -> "is also" and "ressources" -> "resources" suggested by
+Peter Maydell <peter.maydell@linaro.org>]
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 0546b8c2f089867cd7606ff47e026e8931157828)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ docs/specs/ppc-spapr-hcalls.txt | 2 +-
+ docs/usb2.txt | 4 ++--
+ hw/xen_pt.h | 4 ++--
+ hw/xen_pt_config_init.c | 14 +++++++-------
+ qemu-img.c | 2 +-
+ qemu-img.texi | 2 +-
+ 6 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/docs/specs/ppc-spapr-hcalls.txt b/docs/specs/ppc-spapr-hcalls.txt
+index 52ba8d4..667b3fa 100644
+--- a/docs/specs/ppc-spapr-hcalls.txt
++++ b/docs/specs/ppc-spapr-hcalls.txt
+@@ -31,7 +31,7 @@ Arguments:
+
+ Returns:
+
+- H_SUCCESS : Successully called the RTAS function (RTAS result
++ H_SUCCESS : Successfully called the RTAS function (RTAS result
+ will have been stored in the parameter block)
+ H_PARAMETER : Unknown token
+
+diff --git a/docs/usb2.txt b/docs/usb2.txt
+index d17e3c0..43dacde 100644
+--- a/docs/usb2.txt
++++ b/docs/usb2.txt
+@@ -58,11 +58,11 @@ try ...
+ xhci controller support
+ -----------------------
+
+-There also is xhci host controller support available. It got alot
++There is also xhci host controller support available. It got a lot
+ less testing than ehci and there are a bunch of known limitations, so
+ ehci may work better for you. On the other hand the xhci hardware
+ design is much more virtualization-friendly, thus xhci emulation uses
+-less ressources (especially cpu). If you wanna give xhci a try
++less resources (especially cpu). If you want to give xhci a try
+ use this to add the host controller ...
+
+ qemu -device nec-usb-xhci,id=xhci
+diff --git a/hw/xen_pt.h b/hw/xen_pt.h
+index 41904ec..112477a 100644
+--- a/hw/xen_pt.h
++++ b/hw/xen_pt.h
+@@ -96,7 +96,7 @@ typedef struct XenPTRegion {
+ * - do NOT use ALL F for init_val, otherwise the tbl will not be registered.
+ */
+
+-/* emulated register infomation */
++/* emulated register information */
+ struct XenPTRegInfo {
+ uint32_t offset;
+ uint32_t size;
+@@ -140,7 +140,7 @@ typedef int (*xen_pt_reg_size_init_fn)
+ (XenPCIPassthroughState *, const XenPTRegGroupInfo *,
+ uint32_t base_offset, uint8_t *size);
+
+-/* emulated register group infomation */
++/* emulated register group information */
+ struct XenPTRegGroupInfo {
+ uint8_t grp_id;
+ XenPTRegisterGroupType grp_type;
+diff --git a/hw/xen_pt_config_init.c b/hw/xen_pt_config_init.c
+index 00eb3d9..e524a40 100644
+--- a/hw/xen_pt_config_init.c
++++ b/hw/xen_pt_config_init.c
+@@ -562,7 +562,7 @@ static int xen_pt_exp_rom_bar_reg_write(XenPCIPassthroughState *s,
+ return 0;
+ }
+
+-/* Header Type0 reg static infomation table */
++/* Header Type0 reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_header0[] = {
+ /* Vendor ID reg */
+ {
+@@ -753,7 +753,7 @@ static XenPTRegInfo xen_pt_emu_reg_header0[] = {
+ * Vital Product Data Capability
+ */
+
+-/* Vital Product Data Capability Structure reg static infomation table */
++/* Vital Product Data Capability Structure reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_vpd[] = {
+ {
+ .offset = PCI_CAP_LIST_NEXT,
+@@ -775,7 +775,7 @@ static XenPTRegInfo xen_pt_emu_reg_vpd[] = {
+ * Vendor Specific Capability
+ */
+
+-/* Vendor Specific Capability Structure reg static infomation table */
++/* Vendor Specific Capability Structure reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_vendor[] = {
+ {
+ .offset = PCI_CAP_LIST_NEXT,
+@@ -866,7 +866,7 @@ static int xen_pt_linkctrl2_reg_init(XenPCIPassthroughState *s,
+ return 0;
+ }
+
+-/* PCI Express Capability Structure reg static infomation table */
++/* PCI Express Capability Structure reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_pcie[] = {
+ /* Next Pointer reg */
+ {
+@@ -981,7 +981,7 @@ static int xen_pt_pmcsr_reg_write(XenPCIPassthroughState *s,
+ return 0;
+ }
+
+-/* Power Management Capability reg static infomation table */
++/* Power Management Capability reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_pm[] = {
+ /* Next Pointer reg */
+ {
+@@ -1259,7 +1259,7 @@ static int xen_pt_msgdata_reg_write(XenPCIPassthroughState *s,
+ return 0;
+ }
+
+-/* MSI Capability Structure reg static infomation table */
++/* MSI Capability Structure reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_msi[] = {
+ /* Next Pointer reg */
+ {
+@@ -1396,7 +1396,7 @@ static int xen_pt_msixctrl_reg_write(XenPCIPassthroughState *s,
+ return 0;
+ }
+
+-/* MSI-X Capability Structure reg static infomation table */
++/* MSI-X Capability Structure reg static information table */
+ static XenPTRegInfo xen_pt_emu_reg_msix[] = {
+ /* Next Pointer reg */
+ {
+diff --git a/qemu-img.c b/qemu-img.c
+index 0d208e8..7615e91 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -89,7 +89,7 @@ static void help(void)
+ " '-r' tries to repair any inconsistencies that are found during the check.\n"
+ " '-r leaks' repairs only cluster leaks, whereas '-r all' fixes all\n"
+ " kinds of errors, with a higher risk of choosing the wrong fix or\n"
+- " hiding corruption that has already occured.\n"
++ " hiding corruption that has already occurred.\n"
+ "\n"
+ "Parameters to snapshot subcommand:\n"
+ " 'snapshot' is the name of the snapshot to create, apply or delete\n"
+diff --git a/qemu-img.texi b/qemu-img.texi
+index 6b42e35..360543b 100644
+--- a/qemu-img.texi
++++ b/qemu-img.texi
+@@ -87,7 +87,7 @@ Perform a consistency check on the disk image @var{filename}.
+ If @code{-r} is specified, qemu-img tries to repair any inconsistencies found
+ during the check. @code{-r leaks} repairs only cluster leaks, whereas
+ @code{-r all} fixes all kinds of errors, with a higher risk of choosing the
+-wrong fix or hiding corruption that has already occured.
++wrong fix or hiding corruption that has already occurred.
+
+ Only the formats @code{qcow2}, @code{qed} and @code{vdi} support
+ consistency checks.
+--
+1.7.12.1
+
--- /dev/null
+From 9c6751bf2b2c817c3f52a638566b99125a0ba0f1 Mon Sep 17 00:00:00 2001
+From: BALATON Zoltan <balaton@eik.bme.hu>
+Date: Wed, 22 Aug 2012 17:19:42 +0200
+Subject: [PATCH] console: Clean up bytes per pixel calculation
+
+Division with round up is the correct way to compute this even if the
+only case where division with round down gives incorrect result is
+probably 15 bpp. This case was explicitely patched up in one of these
+functions but was unhandled in the other. (I'm not sure about setting
+16 bpp for the 15bpp case either but I left that there for now.)
+
+Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit feadf1a4de0d7468ffb671a2b9f681925469fa58)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ console.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/console.c b/console.c
+index 3b5cabb..8b5e21d 100644
+--- a/console.c
++++ b/console.c
+@@ -1611,7 +1611,7 @@ PixelFormat qemu_different_endianness_pixelformat(int bpp)
+ memset(&pf, 0x00, sizeof(PixelFormat));
+
+ pf.bits_per_pixel = bpp;
+- pf.bytes_per_pixel = bpp / 8;
++ pf.bytes_per_pixel = DIV_ROUND_UP(bpp, 8);
+ pf.depth = bpp == 32 ? 24 : bpp;
+
+ switch (bpp) {
+@@ -1660,13 +1660,12 @@ PixelFormat qemu_default_pixelformat(int bpp)
+ memset(&pf, 0x00, sizeof(PixelFormat));
+
+ pf.bits_per_pixel = bpp;
+- pf.bytes_per_pixel = bpp / 8;
++ pf.bytes_per_pixel = DIV_ROUND_UP(bpp, 8);
+ pf.depth = bpp == 32 ? 24 : bpp;
+
+ switch (bpp) {
+ case 15:
+ pf.bits_per_pixel = 16;
+- pf.bytes_per_pixel = 2;
+ pf.rmask = 0x00007c00;
+ pf.gmask = 0x000003E0;
+ pf.bmask = 0x0000001F;
+--
+1.7.12.1
+
--- /dev/null
+From 0ac82308def3b77162f0d9cecb11e6ffd2bd7939 Mon Sep 17 00:00:00 2001
+From: Lei Li <lilei@linux.vnet.ibm.com>
+Date: Thu, 23 Aug 2012 13:14:25 +0800
+Subject: [PATCH] qapi: Fix enumeration typo error
+
+Signed-off-by: Lei Li <lilei@linux.vnet.ibm.com>
+Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 6932a69b20a88428c531805cdd20eec8acf05b27)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qapi-schema-guest.json | 2 +-
+ qapi-schema.json | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/qapi-schema-guest.json b/qapi-schema-guest.json
+index d955cf1..ed0eb69 100644
+--- a/qapi-schema-guest.json
++++ b/qapi-schema-guest.json
+@@ -293,7 +293,7 @@
+ ##
+ # @GuestFsFreezeStatus
+ #
+-# An enumation of filesystem freeze states
++# An enumeration of filesystem freeze states
+ #
+ # @thawed: filesystems thawed/unfrozen
+ #
+diff --git a/qapi-schema.json b/qapi-schema.json
+index 8ddde12..29dacb5 100644
+--- a/qapi-schema.json
++++ b/qapi-schema.json
+@@ -118,7 +118,7 @@
+ ##
+ # @RunState
+ #
+-# An enumation of VM run states.
++# An enumeration of VM run states.
+ #
+ # @debug: QEMU is running on a debugger
+ #
+@@ -785,7 +785,7 @@
+ ##
+ # @SpiceQueryMouseMode
+ #
+-# An enumation of Spice mouse states.
++# An enumeration of Spice mouse states.
+ #
+ # @client: Mouse cursor position is determined by the client.
+ #
+--
+1.7.12.1
+
--- /dev/null
+From 0a8b8d39763f05c7862dceec9d4f44e902a9d192 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 3 Sep 2012 22:40:40 +0200
+Subject: [PATCH] kvm: Fix warning from static code analysis
+
+Report from smatch:
+
+kvm-all.c:1373 kvm_init(135) warn:
+ variable dereferenced before check 's' (see line 1360)
+
+'s' cannot by NULL (it was alloced using g_malloc0), so there is no need
+to check it here.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 6d1cc3210ccc4372ffa337c187da9db68314c0c4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ kvm-all.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kvm-all.c b/kvm-all.c
+index 90c71f9..08d6051 100644
+--- a/kvm-all.c
++++ b/kvm-all.c
+@@ -1419,13 +1419,11 @@ int kvm_init(void)
+ return 0;
+
+ err:
+- if (s) {
+- if (s->vmfd >= 0) {
+- close(s->vmfd);
+- }
+- if (s->fd != -1) {
+- close(s->fd);
+- }
++ if (s->vmfd >= 0) {
++ close(s->vmfd);
++ }
++ if (s->fd != -1) {
++ close(s->fd);
+ }
+ g_free(s);
+
+--
+1.7.12.1
+
--- /dev/null
+From df075bd97f2d88969e3178ec9cb302f955d31737 Mon Sep 17 00:00:00 2001
+From: Igor Mitsyanko <i.mitsyanko@samsung.com>
+Date: Wed, 5 Sep 2012 13:04:56 +0400
+Subject: [PATCH] arch_init.c: add missing '%' symbols before PRIu64 in debug
+ printfs
+
+'%' symbols were missing in front of PRIu64 macros in DPRINTF() messages in
+arch_init.c, this caused compilation warnings when compiled with DEBUG_ARCH_INIT defined.
+
+Signed-off-by: Igor Mitsyanko <i.mitsyanko@samsung.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit ef37a699a06f96e098ee00683b7052b5fbb6ad7d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ arch_init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch_init.c b/arch_init.c
+index 5a1173e..47977de 100644
+--- a/arch_init.c
++++ b/arch_init.c
+@@ -562,7 +562,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
+ if ((i & 63) == 0) {
+ uint64_t t1 = (qemu_get_clock_ns(rt_clock) - bwidth) / 1000000;
+ if (t1 > MAX_WAIT) {
+- DPRINTF("big wait: " PRIu64 " milliseconds, %d iterations\n",
++ DPRINTF("big wait: %" PRIu64 " milliseconds, %d iterations\n",
+ t1, i);
+ break;
+ }
+@@ -587,7 +587,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
+
+ expected_time = ram_save_remaining() * TARGET_PAGE_SIZE / bwidth;
+
+- DPRINTF("ram_save_live: expected(" PRIu64 ") <= max(" PRIu64 ")?\n",
++ DPRINTF("ram_save_live: expected(%" PRIu64 ") <= max(%" PRIu64 ")?\n",
+ expected_time, migrate_max_downtime());
+
+ if (expected_time <= migrate_max_downtime()) {
+@@ -799,8 +799,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
+ } while (!(flags & RAM_SAVE_FLAG_EOS));
+
+ done:
+- DPRINTF("Completed load of VM with exit code %d seq iteration " PRIu64 "\n",
+- ret, seq_iter);
++ DPRINTF("Completed load of VM with exit code %d seq iteration "
++ "%" PRIu64 "\n", ret, seq_iter);
+ return ret;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 7d797af90c5293b518a072da9b23ec14a1a917f7 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 Aug 2012 16:45:55 +0200
+Subject: [PATCH] net: notify iothread after flushing queue
+
+virtio-net has code to flush the queue and notify the iothread
+whenever new receive buffers are added by the guest. That is
+fine, and indeed we need to do the same in all other drivers.
+However, notifying the iothread should be work for the network
+subsystem. And since we are at it we can add a little smartness:
+if some of the queued packets already could not be delivered,
+there is no need to notify the iothread.
+
+Reported-by: Luigi Rizzo <rizzo@iet.unipi.it>
+Cc: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 987a9b4800003567b1a47a379255e886a77d57ea)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/virtio-net.c | 4 ----
+ net.c | 7 ++++++-
+ net/queue.c | 5 +++--
+ net/queue.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/hw/virtio-net.c b/hw/virtio-net.c
+index b1998b2..6490743 100644
+--- a/hw/virtio-net.c
++++ b/hw/virtio-net.c
+@@ -447,10 +447,6 @@ static void virtio_net_handle_rx(VirtIODevice *vdev, VirtQueue *vq)
+ VirtIONet *n = to_virtio_net(vdev);
+
+ qemu_flush_queued_packets(&n->nic->nc);
+-
+- /* We now have RX buffers, signal to the IO thread to break out of the
+- * select to re-poll the tap file descriptor */
+- qemu_notify_event();
+ }
+
+ static int virtio_net_can_receive(NetClientState *nc)
+diff --git a/net.c b/net.c
+index 60043dd..76a8336 100644
+--- a/net.c
++++ b/net.c
+@@ -357,7 +357,12 @@ void qemu_flush_queued_packets(NetClientState *nc)
+ {
+ nc->receive_disabled = 0;
+
+- qemu_net_queue_flush(nc->send_queue);
++ if (qemu_net_queue_flush(nc->send_queue)) {
++ /* We emptied the queue successfully, signal to the IO thread to repoll
++ * the file descriptor (for tap, for example).
++ */
++ qemu_notify_event();
++ }
+ }
+
+ static ssize_t qemu_send_packet_async_with_flags(NetClientState *sender,
+diff --git a/net/queue.c b/net/queue.c
+index e8030aa..6e64091 100644
+--- a/net/queue.c
++++ b/net/queue.c
+@@ -228,7 +228,7 @@ void qemu_net_queue_purge(NetQueue *queue, NetClientState *from)
+ }
+ }
+
+-void qemu_net_queue_flush(NetQueue *queue)
++bool qemu_net_queue_flush(NetQueue *queue)
+ {
+ while (!QTAILQ_EMPTY(&queue->packets)) {
+ NetPacket *packet;
+@@ -244,7 +244,7 @@ void qemu_net_queue_flush(NetQueue *queue)
+ packet->size);
+ if (ret == 0) {
+ QTAILQ_INSERT_HEAD(&queue->packets, packet, entry);
+- break;
++ return false;
+ }
+
+ if (packet->sent_cb) {
+@@ -253,4 +253,5 @@ void qemu_net_queue_flush(NetQueue *queue)
+
+ g_free(packet);
+ }
++ return true;
+ }
+diff --git a/net/queue.h b/net/queue.h
+index 9d44a9b..fc02b33 100644
+--- a/net/queue.h
++++ b/net/queue.h
+@@ -53,6 +53,6 @@ ssize_t qemu_net_queue_send_iov(NetQueue *queue,
+ NetPacketSent *sent_cb);
+
+ void qemu_net_queue_purge(NetQueue *queue, NetClientState *from);
+-void qemu_net_queue_flush(NetQueue *queue);
++bool qemu_net_queue_flush(NetQueue *queue);
+
+ #endif /* QEMU_NET_QUEUE_H */
+--
+1.7.12.1
+
--- /dev/null
+From a71b6050a88402c3f388b8f13afed51e6ba6f41a Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 Aug 2012 16:45:56 +0200
+Subject: [PATCH] e1000: flush queue whenever can_receive can go from false to
+ true
+
+When the guests replenish the receive ring buffer, the network device
+should flush its queue of pending packets. This is done with
+qemu_flush_queued_packets.
+
+e1000's can_receive can go from false to true when RCTL or RDT are
+modified.
+
+Reported-by: Luigi Rizzo <rizzo@iet.unipi.it>
+Cc: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit e8b4c680b41bd960ecccd9ff076b7b058e0afcd4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/e1000.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/e1000.c b/hw/e1000.c
+index ae8a6c5..ec3a7c4 100644
+--- a/hw/e1000.c
++++ b/hw/e1000.c
+@@ -295,6 +295,7 @@ set_rx_control(E1000State *s, int index, uint32_t val)
+ s->rxbuf_min_shift = ((val / E1000_RCTL_RDMTS_QUAT) & 3) + 1;
+ DBGOUT(RX, "RCTL: %d, mac_reg[RCTL] = 0x%x\n", s->mac_reg[RDT],
+ s->mac_reg[RCTL]);
++ qemu_flush_queued_packets(&s->nic->nc);
+ }
+
+ static void
+@@ -926,6 +927,9 @@ set_rdt(E1000State *s, int index, uint32_t val)
+ {
+ s->check_rxov = 0;
+ s->mac_reg[index] = val & 0xffff;
++ if (e1000_has_rxbufs(s, 1)) {
++ qemu_flush_queued_packets(&s->nic->nc);
++ }
+ }
+
+ static void
+--
+1.7.12.1
+
--- /dev/null
+From 7fc16be815b8ff85f174fc93d67f82400da08120 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 Aug 2012 16:45:57 +0200
+Subject: [PATCH] xen: flush queue when getting an event
+
+xen does not have a register that, when written, will cause can_receive
+to go from false to true. However, flushing the queue can be attempted
+whenever the front-end raises its side of the Xen event channel. There
+is a single event channel for tx and rx.
+
+Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Cc: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit a98b140223d3a627eab7ee3ddec645bab630d756)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/xen_nic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/xen_nic.c b/hw/xen_nic.c
+index 8b79bfb..cf7d559 100644
+--- a/hw/xen_nic.c
++++ b/hw/xen_nic.c
+@@ -415,6 +415,7 @@ static void net_event(struct XenDevice *xendev)
+ {
+ struct XenNetDev *netdev = container_of(xendev, struct XenNetDev, xendev);
+ net_tx_packets(netdev);
++ qemu_flush_queued_packets(&netdev->nic->nc);
+ }
+
+ static int net_free(struct XenDevice *xendev)
+--
+1.7.12.1
+
--- /dev/null
+From 154f1e30c09d261b12937c385632c05474989b02 Mon Sep 17 00:00:00 2001
+From: Bo Yang <boyang@suse.com>
+Date: Wed, 29 Aug 2012 19:26:11 +0800
+Subject: [PATCH] eepro100: Fix network hang when rx buffers run out
+
+This is reported by QA. When installing os with pxe, after the initial
+kernel and initrd are loaded, the procedure tries to copy files from install
+server to local harddisk, the network becomes stall because of running out of
+receive descriptor.
+
+[Whitespace fixes and removed qemu_notify_event() because Paolo's
+earlier net patches have moved it into qemu_flush_queued_packets().
+
+Additional info:
+
+I can reproduce the network hang with a tap device doing a iPXE HTTP
+boot as follows:
+
+ $ qemu -enable-kvm -m 1024 \
+ -netdev tap,id=netdev0,script=no,downscript=no \
+ -device i82559er,netdev=netdev0,romfile=80861209.rom \
+ -drive if=virtio,cache=none,file=test.img
+ iPXE> ifopen net0
+ iPXE> config # set static network configuration
+ iPXE> kernel http://mirror.bytemark.co.uk/fedora/linux/releases/17/Fedora/x86_64/os/images/pxeboot/vmlinuz
+
+I needed a vanilla iPXE ROM to get to the iPXE prompt. I think the boot
+prompt has been disabled in the ROMs that ship with QEMU to reduce boot
+time.
+
+During the vmlinuz HTTP download there is a network hang. hw/eepro100.c
+has reached the end of the rx descriptor list. When the iPXE driver
+replenishes the rx descriptor list we don't kick the QEMU net subsystem
+and event loop, thereby leaving the tap netdev without its file
+descriptor in select(2).
+
+Stefan Hajnoczi <stefanha@gmail.com>]
+
+Signed-off-by: Bo Yang <boyang@suse.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 1069985fb132cd4324fc02d371f1e61492a1823f)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/eepro100.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/eepro100.c b/hw/eepro100.c
+index 50d117e..5b23116 100644
+--- a/hw/eepro100.c
++++ b/hw/eepro100.c
+@@ -1036,6 +1036,7 @@ static void eepro100_ru_command(EEPRO100State * s, uint8_t val)
+ }
+ set_ru_state(s, ru_ready);
+ s->ru_offset = e100_read_reg4(s, SCBPointer);
++ qemu_flush_queued_packets(&s->nic->nc);
+ TRACE(OTHER, logout("val=0x%02x (rx start)\n", val));
+ break;
+ case RX_RESUME:
+@@ -1770,7 +1771,8 @@ static ssize_t nic_receive(NetClientState *nc, const uint8_t * buf, size_t size)
+ if (rfd_command & COMMAND_EL) {
+ /* EL bit is set, so this was the last frame. */
+ logout("receive: Running out of frames\n");
+- set_ru_state(s, ru_suspended);
++ set_ru_state(s, ru_no_resources);
++ eepro100_rnr_interrupt(s);
+ }
+ if (rfd_command & COMMAND_S) {
+ /* S bit is set. */
+--
+1.7.12.1
+
--- /dev/null
+From eccdc01e744cf3a389a527406f4d529420133e89 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Fri, 17 Aug 2012 21:16:42 +0100
+Subject: [PATCH] net: add receive_disabled logic to iov delivery path
+
+This patch adds the missing NetClient->receive_disabled logic in the
+sendv delivery code path. It seems that commit
+893379efd0e1b84ceb0c42a713293f3dbd27b1bd ("net: disable receiving if
+client returns zero") only added the logic to qemu_deliver_packet() and
+not qemu_deliver_packet_iov().
+
+The receive_disabled flag should be automatically set when .receive(),
+.receive_raw(), or .receive_iov() return 0. No further packets will be
+delivered to the NetClient until the receive_disabled flag is cleared
+again by calling qemu_flush_queued_packets().
+
+Typically the NetClient will wait until its file descriptor becomes
+writable and then invoke qemu_flush_queued_packets() to resume
+transmission.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit c67f5dc10573687497f0f5c3aec19b15c35c63d7)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/net.c b/net.c
+index 76a8336..1303819 100644
+--- a/net.c
++++ b/net.c
+@@ -423,16 +423,27 @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender,
+ void *opaque)
+ {
+ NetClientState *nc = opaque;
++ int ret;
+
+ if (nc->link_down) {
+ return iov_size(iov, iovcnt);
+ }
+
++ if (nc->receive_disabled) {
++ return 0;
++ }
++
+ if (nc->info->receive_iov) {
+- return nc->info->receive_iov(nc, iov, iovcnt);
++ ret = nc->info->receive_iov(nc, iov, iovcnt);
+ } else {
+- return nc_sendv_compat(nc, iov, iovcnt);
++ ret = nc_sendv_compat(nc, iov, iovcnt);
+ }
++
++ if (ret == 0) {
++ nc->receive_disabled = 1;
++ }
++
++ return ret;
+ }
+
+ ssize_t qemu_sendv_packet_async(NetClientState *sender,
+--
+1.7.12.1
+
--- /dev/null
+From 17df2130cd8be0cd6892b86103947746f95efc2c Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Mon, 20 Aug 2012 13:35:23 +0100
+Subject: [PATCH] net: do not report queued packets as sent
+
+Net send functions have a return value where 0 means the packet has not
+been sent and will be queued. A non-zero value means the packet was
+sent or an error caused the packet to be dropped.
+
+This patch fixes two instances where packets are queued but we return
+their size. This causes callers to believe the packets were sent. When
+the caller uses the async send interface this creates a real problem
+because the callback will be invoked for a packet that the caller
+believed to be already sent. This bug can cause double-frees in the
+caller.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 06b5f36d052b540a59b52150582d65674199b2ce)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/queue.c | 35 ++++++++++++++++-------------------
+ 1 file changed, 16 insertions(+), 19 deletions(-)
+
+diff --git a/net/queue.c b/net/queue.c
+index 6e64091..254f280 100644
+--- a/net/queue.c
++++ b/net/queue.c
+@@ -83,12 +83,12 @@ void qemu_del_net_queue(NetQueue *queue)
+ g_free(queue);
+ }
+
+-static ssize_t qemu_net_queue_append(NetQueue *queue,
+- NetClientState *sender,
+- unsigned flags,
+- const uint8_t *buf,
+- size_t size,
+- NetPacketSent *sent_cb)
++static void qemu_net_queue_append(NetQueue *queue,
++ NetClientState *sender,
++ unsigned flags,
++ const uint8_t *buf,
++ size_t size,
++ NetPacketSent *sent_cb)
+ {
+ NetPacket *packet;
+
+@@ -100,16 +100,14 @@ static ssize_t qemu_net_queue_append(NetQueue *queue,
+ memcpy(packet->data, buf, size);
+
+ QTAILQ_INSERT_TAIL(&queue->packets, packet, entry);
+-
+- return size;
+ }
+
+-static ssize_t qemu_net_queue_append_iov(NetQueue *queue,
+- NetClientState *sender,
+- unsigned flags,
+- const struct iovec *iov,
+- int iovcnt,
+- NetPacketSent *sent_cb)
++static void qemu_net_queue_append_iov(NetQueue *queue,
++ NetClientState *sender,
++ unsigned flags,
++ const struct iovec *iov,
++ int iovcnt,
++ NetPacketSent *sent_cb)
+ {
+ NetPacket *packet;
+ size_t max_len = 0;
+@@ -133,8 +131,6 @@ static ssize_t qemu_net_queue_append_iov(NetQueue *queue,
+ }
+
+ QTAILQ_INSERT_TAIL(&queue->packets, packet, entry);
+-
+- return packet->size;
+ }
+
+ static ssize_t qemu_net_queue_deliver(NetQueue *queue,
+@@ -177,7 +173,8 @@ ssize_t qemu_net_queue_send(NetQueue *queue,
+ ssize_t ret;
+
+ if (queue->delivering || !qemu_can_send_packet(sender)) {
+- return qemu_net_queue_append(queue, sender, flags, data, size, sent_cb);
++ qemu_net_queue_append(queue, sender, flags, data, size, sent_cb);
++ return 0;
+ }
+
+ ret = qemu_net_queue_deliver(queue, sender, flags, data, size);
+@@ -201,8 +198,8 @@ ssize_t qemu_net_queue_send_iov(NetQueue *queue,
+ ssize_t ret;
+
+ if (queue->delivering || !qemu_can_send_packet(sender)) {
+- return qemu_net_queue_append_iov(queue, sender, flags,
+- iov, iovcnt, sent_cb);
++ qemu_net_queue_append_iov(queue, sender, flags, iov, iovcnt, sent_cb);
++ return 0;
+ }
+
+ ret = qemu_net_queue_deliver_iov(queue, sender, flags, iov, iovcnt);
+--
+1.7.12.1
+
--- /dev/null
+From 773b0a456b236ccdcf1e5329992c0d4669f0af26 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Tue, 14 Aug 2012 14:14:27 +0100
+Subject: [PATCH] net: add -netdev options to man page
+
+Document the -netdev syntax which supercedes the older -net syntax.
+This patch is a first step to making -netdev prominent in the QEMU
+manual.
+
+Reported-by: Anatoly Techtonik <techtonik@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 08d12022c7f1aba6acccc75150659c6e4c9dff23)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-options.hx | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/qemu-options.hx b/qemu-options.hx
+index 1af4fec..1021ab7 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -1357,6 +1357,7 @@ Valid values for @var{type} are
+ Not all devices are supported on all targets. Use -net nic,model=?
+ for a list of available devices for your target.
+
++@item -netdev user,id=@var{id}[,@var{option}][,@var{option}][,...]
+ @item -net user[,@var{option}][,@var{option}][,...]
+ Use the user mode network stack which requires no administrator
+ privilege to run. Valid options are:
+@@ -1365,6 +1366,7 @@ privilege to run. Valid options are:
+ @item vlan=@var{n}
+ Connect user mode stack to VLAN @var{n} (@var{n} = 0 is the default).
+
++@item id=@var{id}
+ @item name=@var{name}
+ Assign symbolic name for use in monitor commands.
+
+@@ -1490,6 +1492,7 @@ processed and applied to -net user. Mixing them with the new configuration
+ syntax gives undefined results. Their use for new applications is discouraged
+ as they will be removed from future versions.
+
++@item -netdev tap,id=@var{id}[,fd=@var{h}][,ifname=@var{name}][,script=@var{file}][,downscript=@var{dfile}][,helper=@var{helper}]
+ @item -net tap[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}][,ifname=@var{name}][,script=@var{file}][,downscript=@var{dfile}][,helper=@var{helper}]
+ Connect the host TAP network interface @var{name} to VLAN @var{n}.
+
+@@ -1529,6 +1532,7 @@ qemu-system-i386 linux.img \
+ -net nic -net tap,"helper=/usr/local/libexec/qemu-bridge-helper"
+ @end example
+
++@item -netdev bridge,id=@var{id}[,br=@var{bridge}][,helper=@var{helper}]
+ @item -net bridge[,vlan=@var{n}][,name=@var{name}][,br=@var{bridge}][,helper=@var{helper}]
+ Connect a host TAP network interface to a host bridge device.
+
+@@ -1551,6 +1555,7 @@ qemu-system-i386 linux.img -net bridge -net nic,model=virtio
+ qemu-system-i386 linux.img -net bridge,br=qemubr0 -net nic,model=virtio
+ @end example
+
++@item -netdev socket,id=@var{id}[,fd=@var{h}][,listen=[@var{host}]:@var{port}][,connect=@var{host}:@var{port}]
+ @item -net socket[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}] [,listen=[@var{host}]:@var{port}][,connect=@var{host}:@var{port}]
+
+ Connect the VLAN @var{n} to a remote VLAN in another QEMU virtual
+@@ -1573,6 +1578,7 @@ qemu-system-i386 linux.img \
+ -net socket,connect=127.0.0.1:1234
+ @end example
+
++@item -netdev socket,id=@var{id}[,fd=@var{h}][,mcast=@var{maddr}:@var{port}[,localaddr=@var{addr}]]
+ @item -net socket[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}][,mcast=@var{maddr}:@var{port}[,localaddr=@var{addr}]]
+
+ Create a VLAN @var{n} shared with another QEMU virtual
+@@ -1624,6 +1630,7 @@ qemu-system-i386 linux.img \
+ -net socket,mcast=239.192.168.1:1102,localaddr=1.2.3.4
+ @end example
+
++@item -netdev vde,id=@var{id}[,sock=@var{socketpath}][,port=@var{n}][,group=@var{groupname}][,mode=@var{octalmode}]
+ @item -net vde[,vlan=@var{n}][,name=@var{name}][,sock=@var{socketpath}] [,port=@var{n}][,group=@var{groupname}][,mode=@var{octalmode}]
+ Connect VLAN @var{n} to PORT @var{n} of a vde switch running on host and
+ listening for incoming connections on @var{socketpath}. Use GROUP @var{groupname}
+--
+1.7.12.1
+
--- /dev/null
+From f3f975860db11101ccef2f75238032328de00ce0 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Fri, 24 Aug 2012 13:32:16 +0100
+Subject: [PATCH] net: clean up usbnet_receive()
+
+The USB network interface has two code paths depending on whether or not
+RNDIS mode is enabled. Refactor usbnet_receive() so that there is a
+common path throughout the function instead of duplicating everything
+across if (is_rndis(s)) ... else ... code paths.
+
+Clean up coding style and 80 character line wrap along the way.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit f237ddbb89142c6948a2257c459e49dee7500a7c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/dev-network.c | 30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
+index c84892c..0b5cb71 100644
+--- a/hw/usb/dev-network.c
++++ b/hw/usb/dev-network.c
+@@ -1250,20 +1250,27 @@ static int usb_net_handle_data(USBDevice *dev, USBPacket *p)
+ static ssize_t usbnet_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+ {
+ USBNetState *s = DO_UPCAST(NICState, nc, nc)->opaque;
+- struct rndis_packet_msg_type *msg;
++ uint8_t *in_buf = s->in_buf;
++ size_t total_size = size;
+
+ if (is_rndis(s)) {
+- msg = (struct rndis_packet_msg_type *) s->in_buf;
+ if (s->rndis_state != RNDIS_DATA_INITIALIZED) {
+ return -1;
+ }
+- if (size + sizeof(struct rndis_packet_msg_type) > sizeof(s->in_buf))
+- return -1;
++ total_size += sizeof(struct rndis_packet_msg_type);
++ }
++ if (total_size > sizeof(s->in_buf)) {
++ return -1;
++ }
+
++ if (is_rndis(s)) {
++ struct rndis_packet_msg_type *msg;
++
++ msg = (struct rndis_packet_msg_type *)in_buf;
+ memset(msg, 0, sizeof(struct rndis_packet_msg_type));
+ msg->MessageType = cpu_to_le32(RNDIS_PACKET_MSG);
+- msg->MessageLength = cpu_to_le32(size + sizeof(struct rndis_packet_msg_type));
+- msg->DataOffset = cpu_to_le32(sizeof(struct rndis_packet_msg_type) - 8);
++ msg->MessageLength = cpu_to_le32(size + sizeof(*msg));
++ msg->DataOffset = cpu_to_le32(sizeof(*msg) - 8);
+ msg->DataLength = cpu_to_le32(size);
+ /* msg->OOBDataOffset;
+ * msg->OOBDataLength;
+@@ -1273,14 +1280,11 @@ static ssize_t usbnet_receive(NetClientState *nc, const uint8_t *buf, size_t siz
+ * msg->VcHandle;
+ * msg->Reserved;
+ */
+- memcpy(msg + 1, buf, size);
+- s->in_len = size + sizeof(struct rndis_packet_msg_type);
+- } else {
+- if (size > sizeof(s->in_buf))
+- return -1;
+- memcpy(s->in_buf, buf, size);
+- s->in_len = size;
++ in_buf += sizeof(*msg);
+ }
++
++ memcpy(in_buf, buf, size);
++ s->in_len = total_size;
+ s->in_ptr = 0;
+ return size;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 14294fa1c903ab239bce3d2839e9e1883141b4f1 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Fri, 24 Aug 2012 13:37:29 +0100
+Subject: [PATCH] net: fix usbnet_receive() packet drops
+
+The USB network interface has a single buffer which the guest reads
+from. This patch prevents multiple calls to usbnet_receive() from
+clobbering the input buffer. Instead we queue packets until buffer
+space becomes available again.
+
+This is inspired by virtio-net and e1000 rxbuf handling.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 190563f9a90c9df8ad32fc7f3e4b166deda949a6)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/usb/dev-network.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
+index 0b5cb71..e4a4359 100644
+--- a/hw/usb/dev-network.c
++++ b/hw/usb/dev-network.c
+@@ -1001,6 +1001,13 @@ static int rndis_keepalive_response(USBNetState *s,
+ return 0;
+ }
+
++/* Prepare to receive the next packet */
++static void usb_net_reset_in_buf(USBNetState *s)
++{
++ s->in_ptr = s->in_len = 0;
++ qemu_flush_queued_packets(&s->nic->nc);
++}
++
+ static int rndis_parse(USBNetState *s, uint8_t *data, int length)
+ {
+ uint32_t msg_type;
+@@ -1025,7 +1032,8 @@ static int rndis_parse(USBNetState *s, uint8_t *data, int length)
+
+ case RNDIS_RESET_MSG:
+ rndis_clear_responsequeue(s);
+- s->out_ptr = s->in_ptr = s->in_len = 0;
++ s->out_ptr = 0;
++ usb_net_reset_in_buf(s);
+ return rndis_reset_response(s, (rndis_reset_msg_type *) data);
+
+ case RNDIS_KEEPALIVE_MSG:
+@@ -1135,7 +1143,7 @@ static int usb_net_handle_datain(USBNetState *s, USBPacket *p)
+ int ret = USB_RET_NAK;
+
+ if (s->in_ptr > s->in_len) {
+- s->in_ptr = s->in_len = 0;
++ usb_net_reset_in_buf(s);
+ ret = USB_RET_NAK;
+ return ret;
+ }
+@@ -1152,7 +1160,7 @@ static int usb_net_handle_datain(USBNetState *s, USBPacket *p)
+ if (s->in_ptr >= s->in_len &&
+ (is_rndis(s) || (s->in_len & (64 - 1)) || !ret)) {
+ /* no short packet necessary */
+- s->in_ptr = s->in_len = 0;
++ usb_net_reset_in_buf(s);
+ }
+
+ #ifdef TRAFFIC_DEBUG
+@@ -1263,6 +1271,11 @@ static ssize_t usbnet_receive(NetClientState *nc, const uint8_t *buf, size_t siz
+ return -1;
+ }
+
++ /* Only accept packet if input buffer is empty */
++ if (s->in_len > 0) {
++ return 0;
++ }
++
+ if (is_rndis(s)) {
+ struct rndis_packet_msg_type *msg;
+
+--
+1.7.12.1
+
--- /dev/null
+From 25ade2154673396e432de2b3c413865d1552c9b3 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Fri, 24 Aug 2012 13:50:30 +0100
+Subject: [PATCH] net: broadcast hub packets if at least one port can receive
+
+In commit 60c07d933c66c4b30a83b7ccbc8a0cb3df1b2d0e ("net: fix
+qemu_can_send_packet logic") the "VLAN" broadcast behavior was changed
+to queue packets if any net client cannot receive. It turns out that
+this was not actually the right fix and just hides the real bug that
+hw/usb/dev-network.c:usbnet_receive() clobbers its receive buffer when
+called multiple times in a row. The commit also introduced a new bug
+that "VLAN" packets would not be sent if one of multiple net clients was
+down.
+
+The hw/usb/dev-network.c bug has since been fixed, so this patch reverts
+broadcast behavior to send packets as long as one net client can
+receive. Packets simply get queued for the net clients that are
+temporarily unable to receive.
+
+Reported-by: Roy.Li <rongqing.li@windriver.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 61518a74ca98870e8ff132f91dd5dda252e31f58)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/hub.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/hub.c b/net/hub.c
+index ac157e3..650a8b4 100644
+--- a/net/hub.c
++++ b/net/hub.c
+@@ -97,12 +97,12 @@ static int net_hub_port_can_receive(NetClientState *nc)
+ continue;
+ }
+
+- if (!qemu_can_send_packet(&port->nc)) {
+- return 0;
++ if (qemu_can_send_packet(&port->nc)) {
++ return 1;
+ }
+ }
+
+- return 1;
++ return 0;
+ }
+
+ static ssize_t net_hub_port_receive(NetClientState *nc,
+--
+1.7.12.1
+
--- /dev/null
+From 176b159d70cb26b24ce928497ae269b294e503d8 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Mon, 20 Aug 2012 10:21:54 +0100
+Subject: [PATCH] net: asynchronous send/receive infrastructure for
+ net/socket.c
+
+The net/socket.c net client is not truly asynchronous. This patch
+borrows the qemu_set_fd_handler2() code from net/tap.c as the basis for
+proper asynchronous send/receive.
+
+Only read packets from the socket when the peer is able to receive.
+This avoids needless queuing.
+
+Later patches implement asynchronous send.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 863f678fba4191f3b695620f41056cb7c124425d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/socket.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 52 insertions(+), 6 deletions(-)
+
+diff --git a/net/socket.c b/net/socket.c
+index c172c24..54e32f0 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -42,9 +42,51 @@ typedef struct NetSocketState {
+ unsigned int packet_len;
+ uint8_t buf[4096];
+ struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
++ IOHandler *send_fn; /* differs between SOCK_STREAM/SOCK_DGRAM */
++ bool read_poll; /* waiting to receive data? */
++ bool write_poll; /* waiting to transmit data? */
+ } NetSocketState;
+
+ static void net_socket_accept(void *opaque);
++static void net_socket_writable(void *opaque);
++
++/* Only read packets from socket when peer can receive them */
++static int net_socket_can_send(void *opaque)
++{
++ NetSocketState *s = opaque;
++
++ return qemu_can_send_packet(&s->nc);
++}
++
++static void net_socket_update_fd_handler(NetSocketState *s)
++{
++ qemu_set_fd_handler2(s->fd,
++ s->read_poll ? net_socket_can_send : NULL,
++ s->read_poll ? s->send_fn : NULL,
++ s->write_poll ? net_socket_writable : NULL,
++ s);
++}
++
++static void net_socket_read_poll(NetSocketState *s, bool enable)
++{
++ s->read_poll = enable;
++ net_socket_update_fd_handler(s);
++}
++
++static void net_socket_write_poll(NetSocketState *s, bool enable)
++{
++ s->write_poll = enable;
++ net_socket_update_fd_handler(s);
++}
++
++static void net_socket_writable(void *opaque)
++{
++ NetSocketState *s = opaque;
++
++ net_socket_write_poll(s, false);
++
++ qemu_flush_queued_packets(&s->nc);
++}
+
+ /* XXX: we consider we can send the whole packet without blocking */
+ static ssize_t net_socket_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+@@ -81,7 +123,8 @@ static void net_socket_send(void *opaque)
+ } else if (size == 0) {
+ /* end of connection */
+ eoc:
+- qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
++ net_socket_read_poll(s, false);
++ net_socket_write_poll(s, false);
+ if (s->listen_fd != -1) {
+ qemu_set_fd_handler(s->listen_fd, net_socket_accept, NULL, s);
+ }
+@@ -152,7 +195,8 @@ static void net_socket_send_dgram(void *opaque)
+ return;
+ if (size == 0) {
+ /* end of connection */
+- qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
++ net_socket_read_poll(s, false);
++ net_socket_write_poll(s, false);
+ return;
+ }
+ qemu_send_packet(&s->nc, s->buf, size);
+@@ -243,7 +287,8 @@ static void net_socket_cleanup(NetClientState *nc)
+ {
+ NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);
+ if (s->fd != -1) {
+- qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
++ net_socket_read_poll(s, false);
++ net_socket_write_poll(s, false);
+ close(s->fd);
+ s->fd = -1;
+ }
+@@ -314,8 +359,8 @@ static NetSocketState *net_socket_fd_init_dgram(NetClientState *peer,
+
+ s->fd = fd;
+ s->listen_fd = -1;
+-
+- qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
++ s->send_fn = net_socket_send_dgram;
++ net_socket_read_poll(s, true);
+
+ /* mcast: save bound address as dst */
+ if (is_connected) {
+@@ -332,7 +377,8 @@ err:
+ static void net_socket_connect(void *opaque)
+ {
+ NetSocketState *s = opaque;
+- qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
++ s->send_fn = net_socket_send;
++ net_socket_read_poll(s, true);
+ }
+
+ static NetClientInfo net_socket_info = {
+--
+1.7.12.1
+
--- /dev/null
+From a2374b78f298d5755e96468bb97e4d7b660ff9d6 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Mon, 20 Aug 2012 10:28:53 +0100
+Subject: [PATCH] net: EAGAIN handling for net/socket.c UDP
+
+Implement asynchronous send for UDP (or other SOCK_DGRAM) sockets. If
+send fails with EAGAIN we wait for the socket to become writable again.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 213fd5087e2e4e2da10ad266df0ba950cf7618bf)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/socket.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/net/socket.c b/net/socket.c
+index 54e32f0..e5e4e8d 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -102,9 +102,19 @@ static ssize_t net_socket_receive(NetClientState *nc, const uint8_t *buf, size_t
+ static ssize_t net_socket_receive_dgram(NetClientState *nc, const uint8_t *buf, size_t size)
+ {
+ NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);
++ ssize_t ret;
+
+- return sendto(s->fd, (const void *)buf, size, 0,
+- (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
++ do {
++ ret = sendto(s->fd, buf, size, 0,
++ (struct sockaddr *)&s->dgram_dst,
++ sizeof(s->dgram_dst));
++ } while (ret == -1 && errno == EINTR);
++
++ if (ret == -1 && errno == EAGAIN) {
++ net_socket_write_poll(s, true);
++ return 0;
++ }
++ return ret;
+ }
+
+ static void net_socket_send(void *opaque)
+--
+1.7.12.1
+
--- /dev/null
+From 52d73aa49799848042c09be1c64c1bff2159a5e1 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+Date: Mon, 20 Aug 2012 10:14:35 +0100
+Subject: [PATCH] net: EAGAIN handling for net/socket.c TCP
+
+Replace spinning send_all() with a proper non-blocking send. When the
+socket write buffer limit is reached, we should stop trying to send and
+wait for the socket to become writable again.
+
+Non-blocking TCP sockets can return in two different ways when the write
+buffer limit is reached:
+
+1. ret = -1 and errno = EAGAIN/EWOULDBLOCK. No data has been written.
+
+2. ret < total_size. Short write, only part of the message was
+ transmitted.
+
+Handle both cases and keep track of how many bytes have been written in
+s->send_index. (This includes the 'length' header before the actual
+payload buffer.)
+
+Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
+(cherry picked from commit 45a7f54a8bb3928ffa58d522e0d61acaee8277bb)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/socket.c | 36 +++++++++++++++++++++++++++++++-----
+ 1 file changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/net/socket.c b/net/socket.c
+index e5e4e8d..c3e55b8 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -32,6 +32,7 @@
+ #include "qemu-error.h"
+ #include "qemu-option.h"
+ #include "qemu_socket.h"
++#include "iov.h"
+
+ typedef struct NetSocketState {
+ NetClientState nc;
+@@ -40,6 +41,7 @@ typedef struct NetSocketState {
+ int state; /* 0 = getting length, 1 = getting data */
+ unsigned int index;
+ unsigned int packet_len;
++ unsigned int send_index; /* number of bytes sent (only SOCK_STREAM) */
+ uint8_t buf[4096];
+ struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
+ IOHandler *send_fn; /* differs between SOCK_STREAM/SOCK_DGRAM */
+@@ -88,15 +90,39 @@ static void net_socket_writable(void *opaque)
+ qemu_flush_queued_packets(&s->nc);
+ }
+
+-/* XXX: we consider we can send the whole packet without blocking */
+ static ssize_t net_socket_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+ {
+ NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);
+- uint32_t len;
+- len = htonl(size);
++ uint32_t len = htonl(size);
++ struct iovec iov[] = {
++ {
++ .iov_base = &len,
++ .iov_len = sizeof(len),
++ }, {
++ .iov_base = (void *)buf,
++ .iov_len = size,
++ },
++ };
++ size_t remaining;
++ ssize_t ret;
++
++ remaining = iov_size(iov, 2) - s->send_index;
++ ret = iov_send(s->fd, iov, 2, s->send_index, remaining);
+
+- send_all(s->fd, (const uint8_t *)&len, sizeof(len));
+- return send_all(s->fd, buf, size);
++ if (ret == -1 && errno == EAGAIN) {
++ ret = 0; /* handled further down */
++ }
++ if (ret == -1) {
++ s->send_index = 0;
++ return -errno;
++ }
++ if (ret < (ssize_t)remaining) {
++ s->send_index += ret;
++ net_socket_write_poll(s, true);
++ return 0;
++ }
++ s->send_index = 0;
++ return size;
+ }
+
+ static ssize_t net_socket_receive_dgram(NetClientState *nc, const uint8_t *buf, size_t size)
+--
+1.7.12.1
+
--- /dev/null
+From 4a151cbe99766a8da4582234a93d4292f064108f Mon Sep 17 00:00:00 2001
+From: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Date: Thu, 6 Sep 2012 22:40:30 +0200
+Subject: [PATCH] configure: fix seccomp check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Currently, if libseccomp is missing but the user explicitly requested
+seccomp support using --enable-seccomp, configure silently ignores the
+situation and disables seccomp support.
+
+This is unlike all other tests that explicitly fail in such situation.
+
+Fix that.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Reviewed-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit e84d5956cc6215d2f098e7b6090fc5ec4cba1be3)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index dcd8e7b..9e53cc2 100755
+--- a/configure
++++ b/configure
+@@ -1405,10 +1405,10 @@ if test "$seccomp" != "no" ; then
+ LIBS=`$pkg_config --libs libseccomp`
+ seccomp="yes"
+ else
+- seccomp="no"
+ if test "$seccomp" = "yes"; then
+ feature_not_found "libseccomp"
+ fi
++ seccomp="no"
+ fi
+ fi
+ ##########################################
+--
+1.7.12.1
+
--- /dev/null
+From 39b2ed0e73ac5b220accf7116bdaecb71ce759af Mon Sep 17 00:00:00 2001
+From: Natanael Copa <natanael.copa@gmail.com>
+Date: Wed, 12 Sep 2012 09:06:51 +0000
+Subject: [PATCH] configure: properly check if -lrt and -lm is needed
+
+Fixes build against uClibc.
+
+uClibc provides 2 versions of clock_gettime(), one with realtime
+support and one without (this is so you can avoid linking in -lrt
+unless actually needed). This means that the clock_gettime() don't
+need -lrt. We still need it for timer_create() so we check for this
+function in addition.
+
+We also need check if -lm is needed for isnan().
+
+Both -lm and -lrt are needed for libs_qga.
+
+Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+(cherry picked from commit 8bacde8d86a09699207d85d4bab06162aed18dc4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ configure | 31 +++++++++++++++++++++++++++++--
+ 1 file changed, 29 insertions(+), 2 deletions(-)
+
+diff --git a/configure b/configure
+index 9e53cc2..a1f256c 100755
+--- a/configure
++++ b/configure
+@@ -2645,17 +2645,44 @@ fi
+
+
+ ##########################################
++# Do we need libm
++cat > $TMPC << EOF
++#include <math.h>
++int main(void) { return isnan(sin(0.0)); }
++EOF
++if compile_prog "" "" ; then
++ :
++elif compile_prog "" "-lm" ; then
++ LIBS="-lm $LIBS"
++ libs_qga="-lm $libs_qga"
++else
++ echo
++ echo "Error: libm check failed"
++ echo
++ exit 1
++fi
++
++##########################################
+ # Do we need librt
++# uClibc provides 2 versions of clock_gettime(), one with realtime
++# support and one without. This means that the clock_gettime() don't
++# need -lrt. We still need it for timer_create() so we check for this
++# function in addition.
+ cat > $TMPC <<EOF
+ #include <signal.h>
+ #include <time.h>
+-int main(void) { return clock_gettime(CLOCK_REALTIME, NULL); }
++int main(void) {
++ timer_create(CLOCK_REALTIME, NULL, NULL);
++ return clock_gettime(CLOCK_REALTIME, NULL);
++}
+ EOF
+
+ if compile_prog "" "" ; then
+ :
+-elif compile_prog "" "-lrt" ; then
++# we need pthread for static linking. use previous pthread test result
++elif compile_prog "" "-lrt $pthread_lib" ; then
+ LIBS="-lrt $LIBS"
++ libs_qga="-lrt $libs_qga"
+ fi
+
+ if test "$darwin" != "yes" -a "$mingw32" != "yes" -a "$solaris" != yes -a \
+--
+1.7.12.1
+
--- /dev/null
+From 423df48a1277f20511f21f4d249ea977aa4fa721 Mon Sep 17 00:00:00 2001
+From: Anthony Liguori <aliguori@us.ibm.com>
+Date: Wed, 12 Sep 2012 14:34:07 -0500
+Subject: [PATCH] Revert 455aa1e08 and c3767ed0eb
+
+ commit c3767ed0eb5d0bb25fe409ae5dec06e3411ff1b6
+ qemu-char: (Re-)connect for tcp_chr_write() unconnected writing
+
+Has no hope of working because tcp_chr_connect() does not actually connect.
+
+455aa1e08 just fixes the SEGV with server() but the attempt to connect a client
+socket is still completely broken.
+
+This patch reverts both.
+
+Reported-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 6db0fdce02d72546a4c47100a9b2cd0090cf464d)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-char.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index 767da93..10d1504 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2141,18 +2141,13 @@ typedef struct {
+
+ static void tcp_chr_accept(void *opaque);
+
+-static void tcp_chr_connect(void *opaque);
+-
+ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ {
+ TCPCharDriver *s = chr->opaque;
+ if (s->connected) {
+ return send_all(s->fd, buf, len);
+- } else if (s->listen_fd == -1) {
+- /* (Re-)connect for unconnected writing */
+- tcp_chr_connect(chr);
+- return 0;
+ } else {
++ /* XXX: indicate an error ? */
+ return len;
+ }
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 04eefabaae59ad624f0baf3b97a1d1d15cf2a23d Mon Sep 17 00:00:00 2001
+From: David Gibson <david@gibson.dropbear.id.au>
+Date: Mon, 10 Sep 2012 12:30:56 +1000
+Subject: [PATCH] qemu-char: BUGFIX, don't call FD_ISSET with negative fd
+
+tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does
+not check if the fd it is using is valid (>= 0) before passing it to
+qemu_set_fd_handler2(). If using e.g. a TCP serial port, which is not
+initially connected, this can result in -1 being passed to FD_ISSET, which
+has undefined behaviour. On x86 it seems to harmlessly return 0, but on
+PowerPC, it causes a fortify buffer overflow error to be thrown.
+
+This patch fixes this by putting an extra test in tcp_chr_connect(), and
+also adds an assert qemu_set_fd_handler2() to catch other such errors on
+all platforms, rather than just some.
+
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit bbdd2ad0814ea0911076419ea21b7957505cf1cc)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ iohandler.c | 2 ++
+ qemu-char.c | 6 ++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/iohandler.c b/iohandler.c
+index dea4355..a2d871b 100644
+--- a/iohandler.c
++++ b/iohandler.c
+@@ -56,6 +56,8 @@ int qemu_set_fd_handler2(int fd,
+ {
+ IOHandlerRecord *ioh;
+
++ assert(fd >= 0);
++
+ if (!fd_read && !fd_write) {
+ QLIST_FOREACH(ioh, &io_handlers, next) {
+ if (ioh->fd == fd) {
+diff --git a/qemu-char.c b/qemu-char.c
+index 10d1504..7f0f895 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2329,8 +2329,10 @@ static void tcp_chr_connect(void *opaque)
+ TCPCharDriver *s = chr->opaque;
+
+ s->connected = 1;
+- qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
+- tcp_chr_read, NULL, chr);
++ if (s->fd >= 0) {
++ qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
++ tcp_chr_read, NULL, chr);
++ }
+ qemu_chr_generic_open(chr);
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 897815f54c446671cae0f202c54e9548e969d427 Mon Sep 17 00:00:00 2001
+From: David Gibson <david@gibson.dropbear.id.au>
+Date: Mon, 10 Sep 2012 12:30:57 +1000
+Subject: [PATCH] cpu_physical_memory_write_rom() needs to do TB invalidates
+
+cpu_physical_memory_write_rom(), despite the name, can also be used to
+write images into RAM - and will often be used that way if the machine
+uses load_image_targphys() into RAM addresses.
+
+However, cpu_physical_memory_write_rom(), unlike cpu_physical_memory_rw()
+doesn't invalidate any cached TBs which might be affected by the region
+written.
+
+This was breaking reset (under full emu) on the pseries machine - we loaded
+our firmware image into RAM, and while executing it rewrite the code at
+the entry point (correctly causing a TB invalidate/refresh). When we
+reset the firmware image was reloaded, but the TB from the rewrite was
+still active and caused us to get an illegal instruction trap.
+
+This patch fixes the bug by duplicating the tb invalidate code from
+cpu_physical_memory_rw() in cpu_physical_memory_write_rom().
+
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 0b57e287138728f72d88b06e69b970c5d745c44a)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ exec.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/exec.c b/exec.c
+index ad175db..3fdbbde 100644
+--- a/exec.c
++++ b/exec.c
+@@ -3521,6 +3521,13 @@ void cpu_physical_memory_write_rom(target_phys_addr_t addr,
+ /* ROM/RAM case */
+ ptr = qemu_get_ram_ptr(addr1);
+ memcpy(ptr, buf, l);
++ if (!cpu_physical_memory_is_dirty(addr1)) {
++ /* invalidate code */
++ tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
++ /* set dirty bit */
++ cpu_physical_memory_set_dirty_flags(
++ addr1, (0xff & ~CODE_DIRTY_FLAG));
++ }
+ qemu_put_ram_ptr(ptr);
+ }
+ len -= l;
+--
+1.7.12.1
+
--- /dev/null
+From 8daf993d3d75acea92ef5054c924c7d825ae812e Mon Sep 17 00:00:00 2001
+From: Peter Maydell <peter.maydell@linaro.org>
+Date: Wed, 19 Sep 2012 14:51:38 +0100
+Subject: [PATCH] arch_init.c: Improve '-soundhw help' for
+ non-HAS_AUDIO_CHOICE archs
+
+For architectures which don't set HAS_AUDIO_CHOICE, improve the
+'-soundhw help' message so that it doesn't simply print an empty
+list, implying no sound support at all.
+
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: malc <av1474@comtv.ru>
+(cherry picked from commit 55d4fd3c24bd253bd96270c7fdf1bb862f3a3400)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ arch_init.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch_init.c b/arch_init.c
+index 47977de..f849f9b 100644
+--- a/arch_init.c
++++ b/arch_init.c
+@@ -922,11 +922,16 @@ void select_soundhw(const char *optarg)
+ if (is_help_option(optarg)) {
+ show_valid_cards:
+
++#ifdef HAS_AUDIO_CHOICE
+ printf("Valid sound card names (comma separated):\n");
+ for (c = soundhw; c->name; ++c) {
+ printf ("%-11s %s\n", c->name, c->descr);
+ }
+ printf("\n-soundhw all will enable all of the above\n");
++#else
++ printf("Machine has no user-selectable audio hardware "
++ "(it may or may not have always-present audio hardware).\n");
++#endif
+ exit(!is_help_option(optarg));
+ }
+ else {
+--
+1.7.12.1
+
--- /dev/null
+From 030d44c473036d44abc76562860a89b21220ca2f Mon Sep 17 00:00:00 2001
+From: "Peter A. G. Crosthwaite" <peter.crosthwaite@petalogix.com>
+Date: Thu, 28 Jun 2012 12:52:23 +1000
+Subject: [PATCH] xilinx_timer: Removed comma in device name
+
+Fixes an error in a61e4b07a30c062260d2d01771773f14820d1eb7
+
+Signed-off-by: Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
+(cherry picked from commit c0a1dcb9f0baf9269f8baeb02cbcca8dad75454c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/xilinx.h | 2 +-
+ hw/xilinx_timer.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/xilinx.h b/hw/xilinx.h
+index 556c5aa..df06a00 100644
+--- a/hw/xilinx.h
++++ b/hw/xilinx.h
+@@ -21,7 +21,7 @@ xilinx_timer_create(target_phys_addr_t base, qemu_irq irq, int oto, int freq)
+ {
+ DeviceState *dev;
+
+- dev = qdev_create(NULL, "xlnx,xps-timer");
++ dev = qdev_create(NULL, "xlnx.xps-timer");
+ qdev_prop_set_uint32(dev, "one-timer-only", oto);
+ qdev_prop_set_uint32(dev, "frequency", freq);
+ qdev_init_nofail(dev);
+diff --git a/hw/xilinx_timer.c b/hw/xilinx_timer.c
+index b562bd0..053ba02 100644
+--- a/hw/xilinx_timer.c
++++ b/hw/xilinx_timer.c
+@@ -217,7 +217,7 @@ static int xilinx_timer_init(SysBusDevice *dev)
+ ptimer_set_freq(xt->ptimer, t->freq_hz);
+ }
+
+- memory_region_init_io(&t->mmio, &timer_ops, t, "xlnx,xps-timer",
++ memory_region_init_io(&t->mmio, &timer_ops, t, "xlnx.xps-timer",
+ R_MAX * 4 * num_timers(t));
+ sysbus_init_mmio(dev, &t->mmio);
+ return 0;
+@@ -239,7 +239,7 @@ static void xilinx_timer_class_init(ObjectClass *klass, void *data)
+ }
+
+ static TypeInfo xilinx_timer_info = {
+- .name = "xlnx,xps-timer",
++ .name = "xlnx.xps-timer",
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(struct timerblock),
+ .class_init = xilinx_timer_class_init,
+--
+1.7.12.1
+
--- /dev/null
+From c03bf619fe8eb416aaea1f8b75b313a4b314ffeb Mon Sep 17 00:00:00 2001
+From: "Peter A. G. Crosthwaite" <peter.crosthwaite@petalogix.com>
+Date: Thu, 28 Jun 2012 16:28:03 +1000
+Subject: [PATCH] xilinx_timer: Send dbg msgs to stderr not stdout
+
+Signed-off-by: Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
+(cherry picked from commit e03377ae75808d33d0a7afc803b37bcda9f796b3)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/xilinx_timer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/xilinx_timer.c b/hw/xilinx_timer.c
+index 053ba02..c02e6ca 100644
+--- a/hw/xilinx_timer.c
++++ b/hw/xilinx_timer.c
+@@ -119,7 +119,7 @@ timer_read(void *opaque, target_phys_addr_t addr, unsigned int size)
+ break;
+
+ }
+- D(printf("%s timer=%d %x=%x\n", __func__, timer, addr * 4, r));
++ D(fprintf(stderr, "%s timer=%d %x=%x\n", __func__, timer, addr * 4, r));
+ return r;
+ }
+
+@@ -127,7 +127,7 @@ static void timer_enable(struct xlx_timer *xt)
+ {
+ uint64_t count;
+
+- D(printf("%s timer=%d down=%d\n", __func__,
++ D(fprintf(stderr, "%s timer=%d down=%d\n", __func__,
+ xt->nr, xt->regs[R_TCSR] & TCSR_UDT));
+
+ ptimer_stop(xt->ptimer);
+@@ -152,7 +152,7 @@ timer_write(void *opaque, target_phys_addr_t addr,
+ addr >>= 2;
+ timer = timer_from_addr(addr);
+ xt = &t->timers[timer];
+- D(printf("%s addr=%x val=%x (timer=%d off=%d)\n",
++ D(fprintf(stderr, "%s addr=%x val=%x (timer=%d off=%d)\n",
+ __func__, addr * 4, value, timer, addr & 3));
+ /* Further decoding to address a specific timers reg. */
+ addr &= 3;
+@@ -189,7 +189,7 @@ static void timer_hit(void *opaque)
+ {
+ struct xlx_timer *xt = opaque;
+ struct timerblock *t = xt->parent;
+- D(printf("%s %d\n", __func__, timer));
++ D(fprintf(stderr, "%s %d\n", __func__, timer));
+ xt->regs[R_TCSR] |= TCSR_TINT;
+
+ if (xt->regs[R_TCSR] & TCSR_ARHT)
+--
+1.7.12.1
+
--- /dev/null
+From bfec52da020f35304f4e059bf4725fe01dbdd154 Mon Sep 17 00:00:00 2001
+From: "Peter A. G. Crosthwaite" <peter.crosthwaite@petalogix.com>
+Date: Mon, 17 Sep 2012 13:41:39 +1000
+Subject: [PATCH] xilinx.h: Error check when setting links
+
+Assert that the ethernet and dma controller are sucessfully linked to their
+peers.
+
+Signed-off-by: Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
+(cherry picked from commit 4b5e52101f9ad077d1c016f2b7130e2fdae6d2da)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/xilinx.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/hw/xilinx.h b/hw/xilinx.h
+index df06a00..35d6681 100644
+--- a/hw/xilinx.h
++++ b/hw/xilinx.h
+@@ -55,13 +55,16 @@ xilinx_axiethernet_create(NICInfo *nd, StreamSlave *peer,
+ int txmem, int rxmem)
+ {
+ DeviceState *dev;
++ Error *errp = NULL;
++
+ qemu_check_nic_model(nd, "xlnx.axi-ethernet");
+
+ dev = qdev_create(NULL, "xlnx.axi-ethernet");
+ qdev_set_nic_properties(dev, nd);
+ qdev_prop_set_uint32(dev, "rxmem", rxmem);
+ qdev_prop_set_uint32(dev, "txmem", txmem);
+- object_property_set_link(OBJECT(dev), OBJECT(peer), "tx_dev", NULL);
++ object_property_set_link(OBJECT(dev), OBJECT(peer), "tx_dev", &errp);
++ assert_no_error(errp);
+ qdev_init_nofail(dev);
+ sysbus_mmio_map(sysbus_from_qdev(dev), 0, base);
+ sysbus_connect_irq(sysbus_from_qdev(dev), 0, irq);
+@@ -74,8 +77,11 @@ xilinx_axiethernetdma_init(DeviceState *dev, StreamSlave *peer,
+ target_phys_addr_t base, qemu_irq irq,
+ qemu_irq irq2, int freqhz)
+ {
++ Error *errp = NULL;
++
+ qdev_prop_set_uint32(dev, "freqhz", freqhz);
+- object_property_set_link(OBJECT(dev), OBJECT(peer), "tx_dev", NULL);
++ object_property_set_link(OBJECT(dev), OBJECT(peer), "tx_dev", &errp);
++ assert_no_error(errp);
+ qdev_init_nofail(dev);
+
+ sysbus_mmio_map(sysbus_from_qdev(dev), 0, base);
+--
+1.7.12.1
+
--- /dev/null
+From 593883a749b0659ab4a2f2d96e65c34a3bd0fcca Mon Sep 17 00:00:00 2001
+From: Chris Wulff <crwulff@gmail.com>
+Date: Sun, 9 Sep 2012 20:20:07 -0400
+Subject: [PATCH] xilinx_timer: Fix a compile error if debug enabled
+
+There was a missing include of qemu-log and a variable name in a printf was out
+of date.
+
+Signed-off-by: Chris Wulff <crwulff@gmail.com>
+Signed-off-by: Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
+(cherry picked from commit 8354cd722e0afae63bee3e4cb21c8f0ddb6874c2)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/xilinx_timer.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xilinx_timer.c b/hw/xilinx_timer.c
+index c02e6ca..f410487 100644
+--- a/hw/xilinx_timer.c
++++ b/hw/xilinx_timer.c
+@@ -24,6 +24,7 @@
+
+ #include "sysbus.h"
+ #include "ptimer.h"
++#include "qemu-log.h"
+
+ #define D(x)
+
+@@ -189,7 +190,7 @@ static void timer_hit(void *opaque)
+ {
+ struct xlx_timer *xt = opaque;
+ struct timerblock *t = xt->parent;
+- D(fprintf(stderr, "%s %d\n", __func__, timer));
++ D(fprintf(stderr, "%s %d\n", __func__, xt->nr));
+ xt->regs[R_TCSR] |= TCSR_TINT;
+
+ if (xt->regs[R_TCSR] & TCSR_ARHT)
+--
+1.7.12.1
+
--- /dev/null
+From a53ed08e1f8ee2a235213e802f3d5bb3342adaf3 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Mon, 3 Sep 2012 22:47:03 +0200
+Subject: [PATCH] pflash_cfi01: fix vendor specific extended query
+
+pflash_cfi01 announces a version number of 1.1, which implies
+"Protection Register Information" and "Burst Read information"
+sections, which are not provided.
+
+Decrease the version number to 1.0 so that only the "Protection
+Register Information" section is needed.
+
+Set the number of protection fields (0x3f) to 0x01, as 0x00 means 256
+protections field, which makes the CFI table bigger than the current
+implementation, causing some kernels to fail to read it.
+
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit 262e1eaafabf32d33a9fa0b03b3c8ea426c5ae1b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/pflash_cfi01.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
+index d1c7423..d56b51a 100644
+--- a/hw/pflash_cfi01.c
++++ b/hw/pflash_cfi01.c
+@@ -711,7 +711,7 @@ pflash_t *pflash_cfi01_register(target_phys_addr_t base,
+ pfl->cfi_table[0x33] = 'I';
+
+ pfl->cfi_table[0x34] = '1';
+- pfl->cfi_table[0x35] = '1';
++ pfl->cfi_table[0x35] = '0';
+
+ pfl->cfi_table[0x36] = 0x00;
+ pfl->cfi_table[0x37] = 0x00;
+@@ -723,6 +723,8 @@ pflash_t *pflash_cfi01_register(target_phys_addr_t base,
+ pfl->cfi_table[0x3b] = 0x00;
+ pfl->cfi_table[0x3c] = 0x00;
+
++ pfl->cfi_table[0x3f] = 0x01; /* Number of protection fields */
++
+ return pfl;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From a003aac48bda87a443bb312f478fb651e34998e5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20F=C3=A4rber?= <afaerber@suse.de>
+Date: Mon, 17 Sep 2012 19:10:32 +0200
+Subject: [PATCH] MAINTAINERS: Add entry for QOM CPU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Andreas Färber <afaerber@suse.de>
+(cherry picked from commit f2ca052414d7eddc10517e98a5a27ba8099b19b1)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ MAINTAINERS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 61f8b45..25733fc 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -531,6 +531,12 @@ M: Anthony Liguori <aliguori@us.ibm.com>
+ S: Maintained
+ F: qemu-char.c
+
++CPU
++M: Andreas Färber <afaerber@suse.de>
++S: Supported
++F: qom/cpu.c
++F: include/qemu/cpu.h
++
+ Device Tree
+ M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
+ M: Alexander Graf <agraf@suse.de>
+--
+1.7.12.1
+
--- /dev/null
+From 76fcbe46a52b467cd2cd96a671bfccd26871153e Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Date: Thu, 30 Aug 2012 17:28:40 -0700
+Subject: [PATCH] iSCSI: We need to support SG_IO also from iscsi_ioctl()
+
+We need to support SG_IO from the synchronous iscsi_ioctl() since
+scsi-block uses this to do an INQ to the device to discover its properties
+This patch makes scsi-block work with iscsi.
+
+Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit f1a12821d7df2e4d21be4f2206f84b4640533e53)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block/iscsi.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 0b96165..ea16609 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -628,9 +628,17 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
+ return &acb->common;
+ }
+
++
++static void ioctl_cb(void *opaque, int status)
++{
++ int *p_status = opaque;
++ *p_status = status;
++}
++
+ static int iscsi_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+ {
+ IscsiLun *iscsilun = bs->opaque;
++ int status;
+
+ switch (req) {
+ case SG_GET_VERSION_NUM:
+@@ -639,6 +647,15 @@ static int iscsi_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+ case SG_GET_SCSI_ID:
+ ((struct sg_scsi_id *)buf)->scsi_type = iscsilun->type;
+ break;
++ case SG_IO:
++ status = -EINPROGRESS;
++ iscsi_aio_ioctl(bs, req, buf, ioctl_cb, &status);
++
++ while (status == -EINPROGRESS) {
++ qemu_aio_wait();
++ }
++
++ return 0;
+ default:
+ return -1;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 05bfce1ee580c715dc3d220297b05097bdd007d2 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Date: Thu, 30 Aug 2012 16:56:36 -0700
+Subject: [PATCH] iSCSI: We dont need to explicitely call qemu_notify_event()
+ any more
+
+We no longer need to explicitely call qemu_notify_event() any more
+since this is now done automatically any time the filehandles we listen
+to change.
+
+Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 40a13ca8d28c21062e35b10d9b80e76b92405bdf)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block/iscsi.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index ea16609..fb001b9 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -167,12 +167,6 @@ iscsi_set_events(IscsiLun *iscsilun)
+
+ }
+
+- /* If we just added an event, the callback might be delayed
+- * unless we call qemu_notify_event().
+- */
+- if (ev & ~iscsilun->events) {
+- qemu_notify_event();
+- }
+ iscsilun->events = ev;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From dd43bce420668dcde639c55bc792cedb1bb8c950 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 5 Sep 2012 17:46:18 +0200
+Subject: [PATCH] scsi-disk: introduce check_lba_range
+
+Abstract the test for an out-of-range (starting block, block count)
+pair.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 444bc908611ccaf4512dc37c33ac3b54d873a62b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/scsi-disk.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
+index 1585683..3959603 100644
+--- a/hw/scsi-disk.c
++++ b/hw/scsi-disk.c
+@@ -1449,6 +1449,18 @@ invalid_field:
+ return;
+ }
+
++static inline bool check_lba_range(SCSIDiskState *s,
++ uint64_t sector_num, uint32_t nb_sectors)
++{
++ /*
++ * The first line tests that no overflow happens when computing the last
++ * sector. The second line tests that the last accessed sector is in
++ * range.
++ */
++ return (sector_num <= sector_num + nb_sectors &&
++ sector_num + nb_sectors - 1 <= s->qdev.max_lba);
++}
++
+ typedef struct UnmapCBData {
+ SCSIDiskReq *r;
+ uint8_t *inbuf;
+@@ -1473,8 +1485,7 @@ static void scsi_unmap_complete(void *opaque, int ret)
+ if (data->count > 0 && !r->req.io_canceled) {
+ sector_num = ldq_be_p(&data->inbuf[0]);
+ nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
+- if (sector_num > sector_num + nb_sectors ||
+- sector_num + nb_sectors - 1 > s->qdev.max_lba) {
++ if (!check_lba_range(s, sector_num, nb_sectors)) {
+ scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
+ goto done;
+ }
+@@ -1802,8 +1813,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
+ scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
+ return 0;
+ }
+- if (r->req.cmd.lba > r->req.cmd.lba + nb_sectors ||
+- r->req.cmd.lba + nb_sectors - 1 > s->qdev.max_lba) {
++ if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
+ goto illegal_lba;
+ }
+
+@@ -1878,8 +1888,7 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
+ if (r->req.cmd.buf[1] & 0xe0) {
+ goto illegal_request;
+ }
+- if (r->req.cmd.lba > r->req.cmd.lba + len ||
+- r->req.cmd.lba + len - 1 > s->qdev.max_lba) {
++ if (!check_lba_range(s, r->req.cmd.lba, len)) {
+ goto illegal_lba;
+ }
+ r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
+@@ -1907,8 +1916,7 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
+ if (r->req.cmd.buf[1] & 0xe0) {
+ goto illegal_request;
+ }
+- if (r->req.cmd.lba > r->req.cmd.lba + len ||
+- r->req.cmd.lba + len - 1 > s->qdev.max_lba) {
++ if (!check_lba_range(s, r->req.cmd.lba, len)) {
+ goto illegal_lba;
+ }
+ r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
+--
+1.7.12.1
+
--- /dev/null
+From 2fd88dcb7fdb90508a85c30a32516ff57f081cba Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 5 Sep 2012 17:54:36 +0200
+Subject: [PATCH] scsi-disk: fix check for out-of-range LBA
+
+This fix is needed to correctly handle 0-block read and writes.
+Without it, a 0-block access at LBA 0 would underflow.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 12ca76fc48081b3a0ad1a70546abfcf198aedfc4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/scsi-disk.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
+index 3959603..d621852 100644
+--- a/hw/scsi-disk.c
++++ b/hw/scsi-disk.c
+@@ -1456,9 +1456,13 @@ static inline bool check_lba_range(SCSIDiskState *s,
+ * The first line tests that no overflow happens when computing the last
+ * sector. The second line tests that the last accessed sector is in
+ * range.
++ *
++ * Careful, the computations should not underflow for nb_sectors == 0,
++ * and a 0-block read to the first LBA beyond the end of device is
++ * valid.
+ */
+ return (sector_num <= sector_num + nb_sectors &&
+- sector_num + nb_sectors - 1 <= s->qdev.max_lba);
++ sector_num + nb_sectors <= s->qdev.max_lba + 1);
+ }
+
+ typedef struct UnmapCBData {
+--
+1.7.12.1
+
--- /dev/null
+From 8444d4c996120a2fc21547a784c258e639f1e8fb Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Date: Fri, 14 Sep 2012 18:13:29 -0700
+Subject: [PATCH] SCSI: Standard INQUIRY data should report HiSup flag as set.
+
+QEMU as far as I know only reports LUN numbers using the modes that
+are described in SAM4.
+As such, since all LUN numbers generated by the SCSI emulation in QEMU
+follow SAM4, we should set the HiSup bit in the standard INQUIRY data
+to indicate such.
+
+From SAM4:
+ 4.6.3 LUNs overview
+ All LUN formats described in this standard are hierarchical in
+ structure even when only a single level in that hierarchy is used.
+ The HISUP bit shall be set to one in the standard INQUIRY data
+ (see SPC-4) when any LUN format described in this standard is used.
+ Non-hierarchical formats are outside the scope of this standard.
+
+Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+(cherry picked from commit 1109c894052751df99962c009fd7dbae397721f5)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/scsi-disk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
+index d621852..7ed1bde 100644
+--- a/hw/scsi-disk.c
++++ b/hw/scsi-disk.c
+@@ -678,7 +678,7 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
+ * is actually implemented, but we're good enough.
+ */
+ outbuf[2] = 5;
+- outbuf[3] = 2; /* Format 2 */
++ outbuf[3] = 2 | 0x10; /* Format 2, HiSup */
+
+ if (buflen > 36) {
+ outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
+--
+1.7.12.1
+
--- /dev/null
+From eb26fee60bcc7b1191395c21f41c22e5e4f24182 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 3 Sep 2012 09:25:16 +0000
+Subject: [PATCH] audio: Fix warning from static code analysis
+
+smatch report:
+audio/audio_template.h:416 AUD_open_out(18) warn:
+ variable dereferenced before check 'as' (see line 414)
+
+Moving the ldebug statement after the statement which checks 'as'
+fixes that warning.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: malc <av1474@comtv.ru>
+(cherry picked from commit 93b6599734f81328ee3d608f57667742cafeea72)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ audio/audio_template.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/audio/audio_template.h b/audio/audio_template.h
+index 519432a..16f7880 100644
+--- a/audio/audio_template.h
++++ b/audio/audio_template.h
+@@ -410,15 +410,15 @@ SW *glue (AUD_open_, TYPE) (
+ SW *old_sw = NULL;
+ #endif
+
+- ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
+- name, as->freq, as->nchannels, as->fmt);
+-
+ if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
+ dolog ("card=%p name=%p callback_fn=%p as=%p\n",
+ card, name, callback_fn, as);
+ goto fail;
+ }
+
++ ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
++ name, as->freq, as->nchannels, as->fmt);
++
+ if (audio_bug (AUDIO_FUNC, audio_validate_settings (as))) {
+ audio_print_settings (as);
+ goto fail;
+--
+1.7.12.1
+
--- /dev/null
+From 631ea4153ed0e1dc8688c463e0924b0dd8dc7ea5 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 09:34:15 +0200
+Subject: [PATCH] qemu-ga: Remove unreachable code after g_error
+
+Report from smatch:
+qemu-ga.c:117 register_signal_handlers(11) info: ignoring unreachable code.
+qemu-ga.c:122 register_signal_handlers(16) info: ignoring unreachable code.
+
+g_error calls abort which terminates the program.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit b548828862d3bf7214b7ef9cb361356b153b89c9)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-ga.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/qemu-ga.c b/qemu-ga.c
+index 7623079..b747470 100644
+--- a/qemu-ga.c
++++ b/qemu-ga.c
+@@ -114,12 +114,10 @@ static gboolean register_signal_handlers(void)
+ ret = sigaction(SIGINT, &sigact, NULL);
+ if (ret == -1) {
+ g_error("error configuring signal handler: %s", strerror(errno));
+- return false;
+ }
+ ret = sigaction(SIGTERM, &sigact, NULL);
+ if (ret == -1) {
+ g_error("error configuring signal handler: %s", strerror(errno));
+- return false;
+ }
+
+ return true;
+--
+1.7.12.1
+
--- /dev/null
+From 46193407875faf8a8be20dabc4ecfee4ceb6f1a3 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 09:40:26 +0200
+Subject: [PATCH] qemu-sockets: Fix potential memory leak
+
+The old code leaks variable 'peer'.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 39b384591fda27d6e1213cea0b11b1ebe0ed4b74)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-sockets.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qemu-sockets.c b/qemu-sockets.c
+index 361d890..037775b 100644
+--- a/qemu-sockets.c
++++ b/qemu-sockets.c
+@@ -353,7 +353,7 @@ int inet_dgram_opts(QemuOpts *opts)
+ if (0 != (rc = getaddrinfo(addr, port, &ai, &local))) {
+ fprintf(stderr,"getaddrinfo(%s,%s): %s\n", addr, port,
+ gai_strerror(rc));
+- return -1;
++ goto err;
+ }
+
+ /* create socket */
+--
+1.7.12.1
+
--- /dev/null
+From d563cd7529186355aa8dc11e2cc7d16342dca1c9 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 11:12:23 +0200
+Subject: [PATCH] cadence_uart: Fix buffer overflow
+
+Report from smatch:
+hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18
+
+This fixes read access to s->r[R_MAX] which is behind the limits of s->r.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 5d40097fc09fe5d34cf316a411dc27d455ac2cd0)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/cadence_uart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
+index d98e531..f8afc4e 100644
+--- a/hw/cadence_uart.c
++++ b/hw/cadence_uart.c
+@@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset,
+ uint32_t c = 0;
+
+ offset >>= 2;
+- if (offset > R_MAX) {
++ if (offset >= R_MAX) {
+ return 0;
+ } else if (offset == R_TX_RX) {
+ uart_read_rx_fifo(s, &c);
+--
+1.7.12.1
+
--- /dev/null
+From 00338325c4a2c5b0010462b21a4373cbb4341c9d Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 12:43:41 +0200
+Subject: [PATCH] lm4549: Fix buffer overflow
+
+Report from smatch:
+lm4549.c:234 lm4549_write_samples(14) error:
+ buffer overflow 's->buffer' 1024 <= 1024
+
+There must be enough space to add two entries starting with index
+s->buffer_level, therefore the old check was wrong.
+
+[Peter Maydell <peter.maydell@linaro.org> clarifies the nature of the
+analyser warning:
+
+I don't object to making the change to placate the analyser,
+but I don't think this is actually a buffer overrun. We always
+add and remove samples from the buffer two at a time, so it's
+not possible to get here with s->buffer_level == BUFFER_SIZE-1
+(which is the only case where the old and new conditions
+give different answers).]
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 8139626643cbe8dc07bd9acc88057effeedf8064)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/lm4549.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/lm4549.c b/hw/lm4549.c
+index 80b3ec4..e0137d5 100644
+--- a/hw/lm4549.c
++++ b/hw/lm4549.c
+@@ -224,7 +224,7 @@ uint32_t lm4549_write_samples(lm4549_state *s, uint32_t left, uint32_t right)
+ This model supports 16-bit playback.
+ */
+
+- if (s->buffer_level >= LM4549_BUFFER_SIZE) {
++ if (s->buffer_level > LM4549_BUFFER_SIZE - 2) {
+ DPRINTF("write_sample Buffer full\n");
+ return 0;
+ }
+--
+1.7.12.1
+
--- /dev/null
+From abb7dc3467f809d3d3dfc0aef70fce7ee542c550 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 12:56:03 +0200
+Subject: [PATCH] ioh3420: Remove unreachable code
+
+Report from smatch:
+hw/ioh3420.c:128 ioh3420_initfn(35) info: ignoring unreachable code.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 997f15672a5ca7714cf310d92f475d2c5fe40970)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/ioh3420.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/hw/ioh3420.c b/hw/ioh3420.c
+index 94a537c..4d31473 100644
+--- a/hw/ioh3420.c
++++ b/hw/ioh3420.c
+@@ -125,7 +125,6 @@ static int ioh3420_initfn(PCIDevice *d)
+ rc = pcie_chassis_add_slot(s);
+ if (rc < 0) {
+ goto err_pcie_cap;
+- return rc;
+ }
+ pcie_cap_root_init(d);
+ rc = pcie_aer_init(d, IOH_EP_AER_OFFSET);
+--
+1.7.12.1
+
--- /dev/null
+From 4377b521568c8dca87cfb8fad5629b3203c08032 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 1 Sep 2012 13:00:48 +0200
+Subject: [PATCH] pflash_cfi01: Fix warning caused by unreachable code
+
+Report from smatch:
+hw/pflash_cfi01.c:431 pflash_write(180) info: ignoring unreachable code.
+
+Instead of removing the return statement after the switch statement,
+the patch replaces the return statements in the switch statement by
+break statements. Other switch statements in the same code do it also
+like that.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 12dabc79f976d66755025272f7e2e8e4da31715a)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/pflash_cfi01.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
+index d56b51a..ac503cf 100644
+--- a/hw/pflash_cfi01.c
++++ b/hw/pflash_cfi01.c
+@@ -320,7 +320,7 @@ static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
+ }
+ pfl->wcycle++;
+ pfl->cmd = cmd;
+- return;
++ break;
+ case 1:
+ switch (pfl->cmd) {
+ case 0x10: /* Single Byte Program */
+@@ -375,7 +375,7 @@ static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
+ default:
+ goto error_flash;
+ }
+- return;
++ break;
+ case 2:
+ switch (pfl->cmd) {
+ case 0xe8: /* Block write */
+@@ -406,7 +406,7 @@ static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
+ default:
+ goto error_flash;
+ }
+- return;
++ break;
+ case 3: /* Confirm mode */
+ switch (pfl->cmd) {
+ case 0xe8: /* Block write */
+@@ -422,7 +422,7 @@ static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
+ default:
+ goto error_flash;
+ }
+- return;
++ break;
+ default:
+ /* Should never happen */
+ DPRINTF("%s: invalid write state\n", __func__);
+--
+1.7.12.1
+
--- /dev/null
+From 949f263f90b97dadae23ad205c4c5a3671ecb3aa Mon Sep 17 00:00:00 2001
+From: Hitoshi Mitake <h.mitake@gmail.com>
+Date: Sat, 15 Sep 2012 01:15:41 +0900
+Subject: [PATCH] curses: don't initialize curses when qemu is daemonized
+
+Current qemu initializes curses even if -daemonize option is
+passed. This cause problem because shell prompt appears without
+calling endwin().
+
+This patch adds new function, is_daemonized(), to OS dependent
+code. With this function, curses_display_init() can check that qemu is
+daemonized or not. If daemonized, curses_display_init() isn't called
+and the problem is avoided.
+
+Of course, -daemonize && -curses doesn't make sense. Users shouldn't
+pass the arguments at the same time. But the problem is very painful
+because Ctrl-C cannot be delivered to the terminal.
+
+Cc: Andrzej Zaborowski <balrog@zabor.org>
+Cc: Stefan Hajnoczi <stefanha@gmail.com>
+Cc: Anthony Liguori <aliguori@us.ibm.com>
+Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
+Signed-off-by: Hitoshi Mitake <h.mitake@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 995ee2bf469de6bbe5ce133ec853392b2a4ce34c)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ os-posix.c | 5 +++++
+ qemu-os-posix.h | 2 ++
+ qemu-os-win32.h | 5 +++++
+ vl.c | 4 +++-
+ 4 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/os-posix.c b/os-posix.c
+index 79fa228..eabccb8 100644
+--- a/os-posix.c
++++ b/os-posix.c
+@@ -360,3 +360,8 @@ int qemu_create_pidfile(const char *filename)
+ /* keep pidfile open & locked forever */
+ return 0;
+ }
++
++bool is_daemonized(void)
++{
++ return daemonize;
++}
+diff --git a/qemu-os-posix.h b/qemu-os-posix.h
+index 8e1149d..7f198e4 100644
+--- a/qemu-os-posix.h
++++ b/qemu-os-posix.h
+@@ -46,4 +46,6 @@ typedef struct timeval qemu_timeval;
+ typedef struct timespec qemu_timespec;
+ int qemu_utimens(const char *path, const qemu_timespec *times);
+
++bool is_daemonized(void);
++
+ #endif
+diff --git a/qemu-os-win32.h b/qemu-os-win32.h
+index 753679b..b3e451b 100644
+--- a/qemu-os-win32.h
++++ b/qemu-os-win32.h
+@@ -86,4 +86,9 @@ typedef struct {
+ } qemu_timeval;
+ int qemu_gettimeofday(qemu_timeval *tp);
+
++static inline bool is_daemonized(void)
++{
++ return false;
++}
++
+ #endif
+diff --git a/vl.c b/vl.c
+index c681c33..49d7a52 100644
+--- a/vl.c
++++ b/vl.c
+@@ -3692,7 +3692,9 @@ int main(int argc, char **argv, char **envp)
+ break;
+ #if defined(CONFIG_CURSES)
+ case DT_CURSES:
+- curses_display_init(ds, full_screen);
++ if (!is_daemonized()) {
++ curses_display_init(ds, full_screen);
++ }
+ break;
+ #endif
+ #if defined(CONFIG_SDL)
+--
+1.7.12.1
+
--- /dev/null
+From 93eaa3c8e14988fb38dfa9ae35067472bfd089b8 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 17 Sep 2012 11:10:03 +0200
+Subject: [PATCH] TextConsole: saturate escape parameter in TTY_STATE_CSI
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit c10600af60865ba6c60987be313102ebb5fcee57)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ console.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/console.c b/console.c
+index 8b5e21d..314f5a5 100644
+--- a/console.c
++++ b/console.c
+@@ -937,8 +937,11 @@ static void console_putchar(TextConsole *s, int ch)
+ case TTY_STATE_CSI: /* handle escape sequence parameters */
+ if (ch >= '0' && ch <= '9') {
+ if (s->nb_esc_params < MAX_ESC_PARAMS) {
+- s->esc_params[s->nb_esc_params] =
+- s->esc_params[s->nb_esc_params] * 10 + ch - '0';
++ int *param = &s->esc_params[s->nb_esc_params];
++ int digit = (ch - '0');
++
++ *param = (*param <= (INT_MAX - digit) / 10) ?
++ *param * 10 + digit : INT_MAX;
+ }
+ } else {
+ if (s->nb_esc_params < MAX_ESC_PARAMS)
+--
+1.7.12.1
+
--- /dev/null
+From 755055c908ccda2dd9410bb1bde1f3621017fb0c Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Tue, 4 Sep 2012 22:14:19 +0200
+Subject: [PATCH] linux-user: Remove redundant null check and replace free by
+ g_free
+
+Report from smatch:
+
+linux-user/syscall.c:3632 do_ioctl_dm(220) info:
+ redundant null check on big_buf calling free()
+
+'big_buf' was allocated by g_malloc0, therefore free was also
+replaced by g_free.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit ad11ad77748bdd8016370db210751683dc038dd6)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ linux-user/syscall.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index 6257a04..471d060 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -3628,9 +3628,7 @@ static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
+ unlock_user(argptr, arg, target_size);
+ }
+ out:
+- if (big_buf) {
+- free(big_buf);
+- }
++ g_free(big_buf);
+ return ret;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 96f47b0d2c307173e0a545ea230e21f1ce8d3fa2 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 22 Sep 2012 21:13:28 +0200
+Subject: [PATCH] net/socket: Fix compiler warning (regression for MinGW)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 213fd5087e2e4e2da10ad266df0ba950cf7618bf removed a type cast
+which is needed for MinGW:
+
+net/socket.c:136: warning:
+ pointer targets in passing argument 2 of ‘sendto’ differ in signedness
+/usr/lib/gcc/amd64-mingw32msvc/4.4.4/../../../../amd64-mingw32msvc/include/winsock2.h:1313: note:
+ expected ‘const char *’ but argument is of type ‘const uint8_t *’
+
+Add a 'qemu_sendto' macro which provides that type cast where needed
+and use the new macro instead of 'sendto'.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 73062dfe6be0050dbd43ce3516e935ebb2545add)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ net/socket.c | 6 +++---
+ qemu-common.h | 5 +++++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/net/socket.c b/net/socket.c
+index c3e55b8..83f21b5 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -131,9 +131,9 @@ static ssize_t net_socket_receive_dgram(NetClientState *nc, const uint8_t *buf,
+ ssize_t ret;
+
+ do {
+- ret = sendto(s->fd, buf, size, 0,
+- (struct sockaddr *)&s->dgram_dst,
+- sizeof(s->dgram_dst));
++ ret = qemu_sendto(s->fd, buf, size, 0,
++ (struct sockaddr *)&s->dgram_dst,
++ sizeof(s->dgram_dst));
+ } while (ret == -1 && errno == EINTR);
+
+ if (ret == -1 && errno == EAGAIN) {
+diff --git a/qemu-common.h b/qemu-common.h
+index e5c2bcd..15d9e4e 100644
+--- a/qemu-common.h
++++ b/qemu-common.h
+@@ -223,9 +223,14 @@ int qemu_pipe(int pipefd[2]);
+ #endif
+
+ #ifdef _WIN32
++/* MinGW needs a type cast for the 'buf' argument. */
+ #define qemu_recv(sockfd, buf, len, flags) recv(sockfd, (void *)buf, len, flags)
++#define qemu_sendto(sockfd, buf, len, flags, destaddr, addrlen) \
++ sendto(sockfd, (const void *)buf, len, flags, destaddr, addrlen)
+ #else
+ #define qemu_recv(sockfd, buf, len, flags) recv(sockfd, buf, len, flags)
++#define qemu_sendto(sockfd, buf, len, flags, destaddr, addrlen) \
++ sendto(sockfd, buf, len, flags, destaddr, addrlen)
+ #endif
+
+ /* Error handling. */
+--
+1.7.12.1
+
--- /dev/null
+From 675a9bdcd5bf5bd663ee58cf5e4be4acf12d34ce Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Wed, 22 Aug 2012 21:42:32 +0200
+Subject: [PATCH] w32: Always use standard instead of native format strings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+GLib 2.0 include files use __printf__ for the format attribute
+which resolves to native format strings on w32 hosts.
+
+QEMU wants standard format strings instead of native format
+strings, so we simply change any declaration with __printf__
+to use __gnu_printf__.
+
+This works because all basic printf functions support both
+kinds of format strings.
+
+This fixes a compiler warning:
+
+qapi/string-output-visitor.c: In function ‘print_type_int’:
+qapi/string-output-visitor.c:34:5: warning: unknown conversion type character ‘l’ in format [-Wformat]
+qapi/string-output-visitor.c:34:5: warning: too many arguments for format [-Wformat-extra-args]
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+(cherry picked from commit 95df51a4a02a853af8828c281bce2d4f2a41d6fd)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ compiler.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/compiler.h b/compiler.h
+index 07ba1f8..c734a71 100644
+--- a/compiler.h
++++ b/compiler.h
+@@ -44,6 +44,11 @@
+ /* Use gnu_printf when supported (qemu uses standard format strings). */
+ # define GCC_ATTR __attribute__((__unused__, format(gnu_printf, 1, 2)))
+ # define GCC_FMT_ATTR(n, m) __attribute__((format(gnu_printf, n, m)))
++# if defined(_WIN32)
++ /* Map __printf__ to __gnu_printf__ because we want standard format strings
++ * even when MinGW or GLib include files use __printf__. */
++# define __printf__ __gnu_printf__
++# endif
+ # endif
+ #if defined(_WIN32)
+ #define GCC_WEAK __attribute__((weak))
+--
+1.7.12.1
+
--- /dev/null
+From 27ca56812d2140c774f9d2b67a2919ef47c69758 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Sat, 22 Sep 2012 22:26:19 +0200
+Subject: [PATCH] w32: Add implementation of gmtime_r, localtime_r
+
+Those functions are missing in MinGW.
+
+Some versions of MinGW-w64 include defines for gmtime_r and localtime_r.
+Older versions of these macros are buggy (they return a pointer to a
+static variable), therefore we don't want them. Newer versions are
+similar to the code used here, but without the memset.
+
+The implementation which is used here is not strictly reentrant,
+but sufficiently good for QEMU on w32 or w64.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+[blauwirbel@gmail.com: added comment about locking]
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+(cherry picked from commit d3e8f95753114a827f9cd8e819b1d5cc8333f76b)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ oslib-win32.c | 24 ++++++++++++++++++++++++
+ qemu-os-win32.h | 6 ++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/oslib-win32.c b/oslib-win32.c
+index ffbc6d0..51b33e8 100644
+--- a/oslib-win32.c
++++ b/oslib-win32.c
+@@ -74,6 +74,30 @@ void qemu_vfree(void *ptr)
+ VirtualFree(ptr, 0, MEM_RELEASE);
+ }
+
++/* FIXME: add proper locking */
++struct tm *gmtime_r(const time_t *timep, struct tm *result)
++{
++ struct tm *p = gmtime(timep);
++ memset(result, 0, sizeof(*result));
++ if (p) {
++ *result = *p;
++ p = result;
++ }
++ return p;
++}
++
++/* FIXME: add proper locking */
++struct tm *localtime_r(const time_t *timep, struct tm *result)
++{
++ struct tm *p = localtime(timep);
++ memset(result, 0, sizeof(*result));
++ if (p) {
++ *result = *p;
++ p = result;
++ }
++ return p;
++}
++
+ void socket_set_block(int fd)
+ {
+ unsigned long opt = 0;
+diff --git a/qemu-os-win32.h b/qemu-os-win32.h
+index b3e451b..8ba466d 100644
+--- a/qemu-os-win32.h
++++ b/qemu-os-win32.h
+@@ -68,6 +68,12 @@
+ /* Declaration of ffs() is missing in MinGW's strings.h. */
+ int ffs(int i);
+
++/* Missing POSIX functions. Don't use MinGW-w64 macros. */
++#undef gmtime_r
++struct tm *gmtime_r(const time_t *timep, struct tm *result);
++#undef localtime_r
++struct tm *localtime_r(const time_t *timep, struct tm *result);
++
+ static inline void os_setup_signal_handling(void) {}
+ static inline void os_daemonize(void) {}
+ static inline void os_setup_post(void) {}
+--
+1.7.12.1
+
--- /dev/null
+From 2afae8c7d44a043e36038d5f6f600034ad2b2aca Mon Sep 17 00:00:00 2001
+From: Kevin Shanahan <kmshanah@disenchant.net>
+Date: Fri, 21 Sep 2012 08:50:22 +0930
+Subject: [PATCH] blockdev: preserve readonly and snapshot states across media
+ changes
+
+If readonly=on is given at device creation time, the ->readonly flag
+needs to be set in the block driver state for this device so that
+readonly-ness is preserved across media changes (qmp change command).
+Similarly, to preserve the snapshot property requires ->open_flags to
+be correct.
+
+Signed-off-by: Kevin Shanahan <kmshanah@disenchant.net>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 80dd1aae3657a902d262f5d20a7a3c655b23705e)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ blockdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/blockdev.c b/blockdev.c
+index 4a5266e..9ba3503 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -533,6 +533,8 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
+ if_name[type], mediastr, unit_id);
+ }
+ dinfo->bdrv = bdrv_new(dinfo->id);
++ dinfo->bdrv->open_flags = snapshot ? BDRV_O_SNAPSHOT : 0;
++ dinfo->bdrv->read_only = ro;
+ dinfo->devaddr = devaddr;
+ dinfo->type = type;
+ dinfo->bus = bus_id;
+--
+1.7.12.1
+
--- /dev/null
+From 48f550221420bd90ddca06c6c7492ea3aca9b644 Mon Sep 17 00:00:00 2001
+From: Jeff Cody <jcody@redhat.com>
+Date: Thu, 20 Sep 2012 15:13:17 -0400
+Subject: [PATCH] block: correctly set the keep_read_only flag
+
+I believe the bs->keep_read_only flag is supposed to reflect
+the initial open state of the device. If the device is initially
+opened R/O, then commit operations, or reopen operations changing
+to R/W, are prohibited.
+
+Currently, the keep_read_only flag is only accurate for the active
+layer, and its backing file. Subsequent images end up always having
+the keep_read_only flag set.
+
+For instance, what happens now:
+
+[ base ] kro = 1, ro = 1
+ |
+ v
+[ snap-1 ] kro = 1, ro = 1
+ |
+ v
+[ snap-2 ] kro = 0, ro = 1
+ |
+ v
+[ active ] kro = 0, ro = 0
+
+What we want:
+
+[ base ] kro = 0, ro = 1
+ |
+ v
+[ snap-1 ] kro = 0, ro = 1
+ |
+ v
+[ snap-2 ] kro = 0, ro = 1
+ |
+ v
+[ active ] kro = 0, ro = 0
+
+Signed-off-by: Jeff Cody <jcody@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit be028adcedd68ca4d78fdc43e7e2fa4f1cdbc653)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ block.c | 14 +++++++-------
+ block.h | 1 +
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/block.c b/block.c
+index e78039b..4c0e7f5 100644
+--- a/block.c
++++ b/block.c
+@@ -668,7 +668,7 @@ static int bdrv_open_common(BlockDriverState *bs, const char *filename,
+ open_flags |= BDRV_O_RDWR;
+ }
+
+- bs->keep_read_only = bs->read_only = !(open_flags & BDRV_O_RDWR);
++ bs->read_only = !(open_flags & BDRV_O_RDWR);
+
+ /* Open the image, either directly or using a protocol */
+ if (drv->bdrv_file_open) {
+@@ -808,6 +808,12 @@ int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
+ goto unlink_and_fail;
+ }
+
++ if (flags & BDRV_O_RDWR) {
++ flags |= BDRV_O_ALLOW_RDWR;
++ }
++
++ bs->keep_read_only = !(flags & BDRV_O_ALLOW_RDWR);
++
+ /* Open the image */
+ ret = bdrv_open_common(bs, filename, flags, drv);
+ if (ret < 0) {
+@@ -837,12 +843,6 @@ int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
+ bdrv_close(bs);
+ return ret;
+ }
+- if (bs->is_temporary) {
+- bs->backing_hd->keep_read_only = !(flags & BDRV_O_RDWR);
+- } else {
+- /* base image inherits from "parent" */
+- bs->backing_hd->keep_read_only = bs->keep_read_only;
+- }
+ }
+
+ if (!bdrv_key_required(bs)) {
+diff --git a/block.h b/block.h
+index 2e2be11..4d919c2 100644
+--- a/block.h
++++ b/block.h
+@@ -80,6 +80,7 @@ typedef struct BlockDevOps {
+ #define BDRV_O_COPY_ON_READ 0x0400 /* copy read backing sectors into image */
+ #define BDRV_O_INCOMING 0x0800 /* consistency hint for incoming migration */
+ #define BDRV_O_CHECK 0x1000 /* open solely for consistency check */
++#define BDRV_O_ALLOW_RDWR 0x2000 /* allow reopen to change from r/o to r/w */
+
+ #define BDRV_O_CACHE_MASK (BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH)
+
+--
+1.7.12.1
+
--- /dev/null
+From 20936a5a29113b32aeb319ca5ebe2a754cd3e014 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 14 Sep 2012 19:02:30 +0200
+Subject: [PATCH] configure: Allow builds without any system or user emulation
+
+The old code aborted configure when no emulation target was selected.
+Even after removing the 'exit 1', it tried to read from STDIN
+when QEMU was configured with
+
+ configure' '--disable-user' '--disable-system'
+
+This is fixed here.
+
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 8bdd3d499fe0ddffa9901c56ab3bc8911d5b8be0)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ Makefile | 5 +++++
+ configure | 4 ----
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 1cd5bc8..dd11e3c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -52,8 +52,13 @@ SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
+ SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
+ SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %/config-devices.mak.d, $(TARGET_DIRS))
+
++ifeq ($(SUBDIR_DEVICES_MAK),)
++config-all-devices.mak:
++ $(call quiet-command,echo '# no devices' > $@," GEN $@")
++else
+ config-all-devices.mak: $(SUBDIR_DEVICES_MAK)
+ $(call quiet-command,cat $(SUBDIR_DEVICES_MAK) | grep =y | sort -u > $@," GEN $@")
++endif
+
+ -include $(SUBDIR_DEVICES_MAK_DEP)
+
+diff --git a/configure b/configure
+index a1f256c..f528146 100755
+--- a/configure
++++ b/configure
+@@ -1296,10 +1296,6 @@ if test -z "$target_list" ; then
+ else
+ target_list=`echo "$target_list" | sed -e 's/,/ /g'`
+ fi
+-if test -z "$target_list" ; then
+- echo "No targets enabled"
+- exit 1
+-fi
+ # see if system emulation was really requested
+ case " $target_list " in
+ *"-softmmu "*) softmmu=yes
+--
+1.7.12.1
+
--- /dev/null
+From 2f56ee52ed70bed32de06ba1c9ef22e4d4d504f0 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Mon, 24 Sep 2012 13:11:07 +0200
+Subject: [PATCH] Refactor inet_connect_opts function
+
+refactor address resolution code to fix nonblocking connect
+remove getnameinfo call
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Orit Wasserman <owasserm@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 05bc1d8a4b2f77df8cc9880a552047e30c16f1f8)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ qemu-sockets.c | 148 +++++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 85 insertions(+), 63 deletions(-)
+
+diff --git a/qemu-sockets.c b/qemu-sockets.c
+index 037775b..22797bf 100644
+--- a/qemu-sockets.c
++++ b/qemu-sockets.c
+@@ -209,95 +209,117 @@ listen:
+ return slisten;
+ }
+
+-int inet_connect_opts(QemuOpts *opts, bool *in_progress, Error **errp)
++#ifdef _WIN32
++#define QEMU_SOCKET_RC_INPROGRESS(rc) \
++ ((rc) == -EINPROGRESS || (rc) == -EWOULDBLOCK || (rc) == -WSAEALREADY)
++#else
++#define QEMU_SOCKET_RC_INPROGRESS(rc) \
++ ((rc) == -EINPROGRESS)
++#endif
++
++static int inet_connect_addr(struct addrinfo *addr, bool block,
++ bool *in_progress)
+ {
+- struct addrinfo ai,*res,*e;
++ int sock, rc;
++
++ if (in_progress) {
++ *in_progress = false;
++ }
++
++ sock = qemu_socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
++ if (sock < 0) {
++ fprintf(stderr, "%s: socket(%s): %s\n", __func__,
++ inet_strfamily(addr->ai_family), strerror(errno));
++ return -1;
++ }
++ setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
++ if (!block) {
++ socket_set_nonblock(sock);
++ }
++ /* connect to peer */
++ do {
++ rc = 0;
++ if (connect(sock, addr->ai_addr, addr->ai_addrlen) < 0) {
++ rc = -socket_error();
++ }
++ } while (rc == -EINTR);
++
++ if (!block && QEMU_SOCKET_RC_INPROGRESS(rc)) {
++ if (in_progress) {
++ *in_progress = true;
++ }
++ } else if (rc < 0) {
++ closesocket(sock);
++ return -1;
++ }
++ return sock;
++}
++
++static struct addrinfo *inet_parse_connect_opts(QemuOpts *opts, Error **errp)
++{
++ struct addrinfo ai, *res;
++ int rc;
+ const char *addr;
+ const char *port;
+- char uaddr[INET6_ADDRSTRLEN+1];
+- char uport[33];
+- int sock,rc;
+- bool block;
+
+- memset(&ai,0, sizeof(ai));
++ memset(&ai, 0, sizeof(ai));
+ ai.ai_flags = AI_CANONNAME | AI_ADDRCONFIG;
+ ai.ai_family = PF_UNSPEC;
+ ai.ai_socktype = SOCK_STREAM;
+
+- if (in_progress) {
+- *in_progress = false;
+- }
+-
+ addr = qemu_opt_get(opts, "host");
+ port = qemu_opt_get(opts, "port");
+- block = qemu_opt_get_bool(opts, "block", 0);
+ if (addr == NULL || port == NULL) {
+- fprintf(stderr, "inet_connect: host and/or port not specified\n");
++ fprintf(stderr,
++ "inet_parse_connect_opts: host and/or port not specified\n");
+ error_set(errp, QERR_SOCKET_CREATE_FAILED);
+- return -1;
++ return NULL;
+ }
+
+- if (qemu_opt_get_bool(opts, "ipv4", 0))
++ if (qemu_opt_get_bool(opts, "ipv4", 0)) {
+ ai.ai_family = PF_INET;
+- if (qemu_opt_get_bool(opts, "ipv6", 0))
++ }
++ if (qemu_opt_get_bool(opts, "ipv6", 0)) {
+ ai.ai_family = PF_INET6;
++ }
+
+ /* lookup */
+- if (0 != (rc = getaddrinfo(addr, port, &ai, &res))) {
+- fprintf(stderr,"getaddrinfo(%s,%s): %s\n", addr, port,
++ rc = getaddrinfo(addr, port, &ai, &res);
++ if (rc != 0) {
++ fprintf(stderr, "getaddrinfo(%s,%s): %s\n", addr, port,
+ gai_strerror(rc));
+ error_set(errp, QERR_SOCKET_CREATE_FAILED);
+- return -1;
++ return NULL;
++ }
++ return res;
++}
++
++int inet_connect_opts(QemuOpts *opts, bool *in_progress, Error **errp)
++{
++ struct addrinfo *res, *e;
++ int sock = -1;
++ bool block = qemu_opt_get_bool(opts, "block", 0);
++
++ res = inet_parse_connect_opts(opts, errp);
++ if (!res) {
++ return -1;
++ }
++
++ if (in_progress) {
++ *in_progress = false;
+ }
+
+ for (e = res; e != NULL; e = e->ai_next) {
+- if (getnameinfo((struct sockaddr*)e->ai_addr,e->ai_addrlen,
+- uaddr,INET6_ADDRSTRLEN,uport,32,
+- NI_NUMERICHOST | NI_NUMERICSERV) != 0) {
+- fprintf(stderr,"%s: getnameinfo: oops\n", __FUNCTION__);
+- continue;
+- }
+- sock = qemu_socket(e->ai_family, e->ai_socktype, e->ai_protocol);
+- if (sock < 0) {
+- fprintf(stderr,"%s: socket(%s): %s\n", __FUNCTION__,
+- inet_strfamily(e->ai_family), strerror(errno));
+- continue;
+- }
+- setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(void*)&on,sizeof(on));
+- if (!block) {
+- socket_set_nonblock(sock);
+- }
+- /* connect to peer */
+- do {
+- rc = 0;
+- if (connect(sock, e->ai_addr, e->ai_addrlen) < 0) {
+- rc = -socket_error();
+- }
+- } while (rc == -EINTR);
+-
+- #ifdef _WIN32
+- if (!block && (rc == -EINPROGRESS || rc == -EWOULDBLOCK
+- || rc == -WSAEALREADY)) {
+- #else
+- if (!block && (rc == -EINPROGRESS)) {
+- #endif
+- if (in_progress) {
+- *in_progress = true;
+- }
+- } else if (rc < 0) {
+- if (NULL == e->ai_next)
+- fprintf(stderr, "%s: connect(%s,%s,%s,%s): %s\n", __FUNCTION__,
+- inet_strfamily(e->ai_family),
+- e->ai_canonname, uaddr, uport, strerror(errno));
+- closesocket(sock);
+- continue;
++ sock = inet_connect_addr(e, block, in_progress);
++ if (sock >= 0) {
++ break;
+ }
+- freeaddrinfo(res);
+- return sock;
+ }
+- error_set(errp, QERR_SOCKET_CONNECT_FAILED);
++ if (sock < 0) {
++ error_set(errp, QERR_SOCKET_CONNECT_FAILED);
++ }
+ freeaddrinfo(res);
+- return -1;
++ return sock;
+ }
+
+ int inet_dgram_opts(QemuOpts *opts)
+--
+1.7.12.1
+
--- /dev/null
+From 36f7af3f8bfd2c16f2e6c4b61d9564d5cfdd2394 Mon Sep 17 00:00:00 2001
+From: Orit Wasserman <owasserm@redhat.com>
+Date: Mon, 24 Sep 2012 13:11:08 +0200
+Subject: [PATCH] Separate inet_connect into inet_connect (blocking) and
+ inet_nonblocking_connect
+
+No need to add non blocking parameters to the blocking inet_connect
+add block parameter for inet_connect_opts instead of using QemuOpt "block".
+
+Signed-off-by: Orit Wasserman <owasserm@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 5db5f44cb4b7f24b9e0efdefc9015e36b7c34881)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ migration-tcp.c | 2 +-
+ nbd.c | 2 +-
+ qemu-char.c | 2 +-
+ qemu-sockets.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++----------
+ qemu_socket.h | 7 +++++--
+ ui/vnc.c | 2 +-
+ 6 files changed, 57 insertions(+), 16 deletions(-)
+
+diff --git a/migration-tcp.c b/migration-tcp.c
+index ac891c3..7f6ad98 100644
+--- a/migration-tcp.c
++++ b/migration-tcp.c
+@@ -88,7 +88,7 @@ int tcp_start_outgoing_migration(MigrationState *s, const char *host_port,
+ s->write = socket_write;
+ s->close = tcp_close;
+
+- s->fd = inet_connect(host_port, false, &in_progress, errp);
++ s->fd = inet_nonblocking_connect(host_port, &in_progress, errp);
+ if (error_is_set(errp)) {
+ migrate_fd_error(s);
+ return -1;
+diff --git a/nbd.c b/nbd.c
+index 0dd60c5..206f75c 100644
+--- a/nbd.c
++++ b/nbd.c
+@@ -162,7 +162,7 @@ int tcp_socket_outgoing(const char *address, uint16_t port)
+
+ int tcp_socket_outgoing_spec(const char *address_and_port)
+ {
+- return inet_connect(address_and_port, true, NULL, NULL);
++ return inet_connect(address_and_port, NULL);
+ }
+
+ int tcp_socket_incoming(const char *address, uint16_t port)
+diff --git a/qemu-char.c b/qemu-char.c
+index 7f0f895..13b87b5 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2456,7 +2456,7 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
+ if (is_listen) {
+ fd = inet_listen_opts(opts, 0, NULL);
+ } else {
+- fd = inet_connect_opts(opts, NULL, NULL);
++ fd = inet_connect_opts(opts, true, NULL, NULL);
+ }
+ }
+ if (fd < 0) {
+diff --git a/qemu-sockets.c b/qemu-sockets.c
+index 22797bf..0883a66 100644
+--- a/qemu-sockets.c
++++ b/qemu-sockets.c
+@@ -54,9 +54,6 @@ static QemuOptsList dummy_opts = {
+ },{
+ .name = "ipv6",
+ .type = QEMU_OPT_BOOL,
+- },{
+- .name = "block",
+- .type = QEMU_OPT_BOOL,
+ },
+ { /* end if list */ }
+ },
+@@ -294,11 +291,22 @@ static struct addrinfo *inet_parse_connect_opts(QemuOpts *opts, Error **errp)
+ return res;
+ }
+
+-int inet_connect_opts(QemuOpts *opts, bool *in_progress, Error **errp)
++/**
++ * Create a socket and connect it to an address.
++ *
++ * @opts: QEMU options, recognized parameters strings "host" and "port",
++ * bools "ipv4" and "ipv6".
++ * @block: set true for blocking socket
++ * @in_progress: set to true in case of ongoing connect
++ * @errp: set on error
++ *
++ * Returns: -1 on error, file descriptor on success.
++ */
++int inet_connect_opts(QemuOpts *opts, bool block, bool *in_progress,
++ Error **errp)
+ {
+ struct addrinfo *res, *e;
+ int sock = -1;
+- bool block = qemu_opt_get_bool(opts, "block", 0);
+
+ res = inet_parse_connect_opts(opts, errp);
+ if (!res) {
+@@ -515,17 +523,47 @@ int inet_listen(const char *str, char *ostr, int olen,
+ return sock;
+ }
+
+-int inet_connect(const char *str, bool block, bool *in_progress, Error **errp)
++/**
++ * Create a blocking socket and connect it to an address.
++ *
++ * @str: address string
++ * @errp: set in case of an error
++ *
++ * Returns -1 in case of error, file descriptor on success
++ **/
++int inet_connect(const char *str, Error **errp)
+ {
+ QemuOpts *opts;
+ int sock = -1;
+
+ opts = qemu_opts_create(&dummy_opts, NULL, 0, NULL);
+ if (inet_parse(opts, str) == 0) {
+- if (block) {
+- qemu_opt_set(opts, "block", "on");
+- }
+- sock = inet_connect_opts(opts, in_progress, errp);
++ sock = inet_connect_opts(opts, true, NULL, errp);
++ } else {
++ error_set(errp, QERR_SOCKET_CREATE_FAILED);
++ }
++ qemu_opts_del(opts);
++ return sock;
++}
++
++/**
++ * Create a non-blocking socket and connect it to an address.
++ *
++ * @str: address string
++ * @in_progress: set to true in case of ongoing connect
++ * @errp: set in case of an error
++ *
++ * Returns: -1 on error, file descriptor on success.
++ **/
++int inet_nonblocking_connect(const char *str, bool *in_progress,
++ Error **errp)
++{
++ QemuOpts *opts;
++ int sock = -1;
++
++ opts = qemu_opts_create(&dummy_opts, NULL, 0, NULL);
++ if (inet_parse(opts, str) == 0) {
++ sock = inet_connect_opts(opts, false, in_progress, errp);
+ } else {
+ error_set(errp, QERR_SOCKET_CREATE_FAILED);
+ }
+diff --git a/qemu_socket.h b/qemu_socket.h
+index 30ae6af..80696aa 100644
+--- a/qemu_socket.h
++++ b/qemu_socket.h
+@@ -42,8 +42,11 @@ int send_all(int fd, const void *buf, int len1);
+ int inet_listen_opts(QemuOpts *opts, int port_offset, Error **errp);
+ int inet_listen(const char *str, char *ostr, int olen,
+ int socktype, int port_offset, Error **errp);
+-int inet_connect_opts(QemuOpts *opts, bool *in_progress, Error **errp);
+-int inet_connect(const char *str, bool block, bool *in_progress, Error **errp);
++int inet_connect_opts(QemuOpts *opts, bool block, bool *in_progress,
++ Error **errp);
++int inet_connect(const char *str, Error **errp);
++int inet_nonblocking_connect(const char *str, bool *in_progress,
++ Error **errp);
+ int inet_dgram_opts(QemuOpts *opts);
+ const char *inet_strfamily(int family);
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index 385e345..01b2daf 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -3061,7 +3061,7 @@ int vnc_display_open(DisplayState *ds, const char *display)
+ if (strncmp(display, "unix:", 5) == 0)
+ vs->lsock = unix_connect(display+5);
+ else
+- vs->lsock = inet_connect(display, true, NULL, NULL);
++ vs->lsock = inet_connect(display, NULL);
+ if (-1 == vs->lsock) {
+ g_free(vs->display);
+ vs->display = NULL;
+--
+1.7.12.1
+
--- /dev/null
+From b3db72271ead92daae43b1534fdfdbe750555b0a Mon Sep 17 00:00:00 2001
+From: Orit Wasserman <owasserm@redhat.com>
+Date: Mon, 24 Sep 2012 13:11:09 +0200
+Subject: [PATCH] Fix address handling in inet_nonblocking_connect
+
+getaddrinfo can give us a list of addresses, but we only try to
+connect to the first one. If that fails we never proceed to
+the next one. This is common on desktop setups that often have ipv6
+configured but not actually working.
+
+To fix this make inet_connect_nonblocking retry connection with a different
+address.
+callers on inet_nonblocking_connect register a callback function that will
+be called when connect opertion completes, in case of failure the fd will have
+a negative value
+
+Signed-off-by: Orit Wasserman <owasserm@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 233aa5c2d1cf4655ffe335025a68cf5454f87dad)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ migration-tcp.c | 37 ++++------------
+ qemu-char.c | 2 +-
+ qemu-sockets.c | 129 +++++++++++++++++++++++++++++++++++++++++++++-----------
+ qemu_socket.h | 16 ++++---
+ 4 files changed, 126 insertions(+), 58 deletions(-)
+
+diff --git a/migration-tcp.c b/migration-tcp.c
+index 7f6ad98..a15c2b8 100644
+--- a/migration-tcp.c
++++ b/migration-tcp.c
+@@ -53,54 +53,35 @@ static int tcp_close(MigrationState *s)
+ return r;
+ }
+
+-static void tcp_wait_for_connect(void *opaque)
++static void tcp_wait_for_connect(int fd, void *opaque)
+ {
+ MigrationState *s = opaque;
+- int val, ret;
+- socklen_t valsize = sizeof(val);
+
+- DPRINTF("connect completed\n");
+- do {
+- ret = getsockopt(s->fd, SOL_SOCKET, SO_ERROR, (void *) &val, &valsize);
+- } while (ret == -1 && (socket_error()) == EINTR);
+-
+- if (ret < 0) {
++ if (fd < 0) {
++ DPRINTF("migrate connect error\n");
++ s->fd = -1;
+ migrate_fd_error(s);
+- return;
+- }
+-
+- qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
+-
+- if (val == 0)
++ } else {
++ DPRINTF("migrate connect success\n");
++ s->fd = fd;
+ migrate_fd_connect(s);
+- else {
+- DPRINTF("error connecting %d\n", val);
+- migrate_fd_error(s);
+ }
+ }
+
+ int tcp_start_outgoing_migration(MigrationState *s, const char *host_port,
+ Error **errp)
+ {
+- bool in_progress;
+-
+ s->get_error = socket_errno;
+ s->write = socket_write;
+ s->close = tcp_close;
+
+- s->fd = inet_nonblocking_connect(host_port, &in_progress, errp);
++ s->fd = inet_nonblocking_connect(host_port, tcp_wait_for_connect, s,
++ errp);
+ if (error_is_set(errp)) {
+ migrate_fd_error(s);
+ return -1;
+ }
+
+- if (in_progress) {
+- DPRINTF("connect in progress\n");
+- qemu_set_fd_handler2(s->fd, NULL, NULL, tcp_wait_for_connect, s);
+- } else {
+- migrate_fd_connect(s);
+- }
+-
+ return 0;
+ }
+
+diff --git a/qemu-char.c b/qemu-char.c
+index 13b87b5..b082bae 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2456,7 +2456,7 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
+ if (is_listen) {
+ fd = inet_listen_opts(opts, 0, NULL);
+ } else {
+- fd = inet_connect_opts(opts, true, NULL, NULL);
++ fd = inet_connect_opts(opts, NULL, NULL, NULL);
+ }
+ }
+ if (fd < 0) {
+diff --git a/qemu-sockets.c b/qemu-sockets.c
+index 0883a66..1f14e8b 100644
+--- a/qemu-sockets.c
++++ b/qemu-sockets.c
+@@ -24,6 +24,7 @@
+
+ #include "qemu_socket.h"
+ #include "qemu-common.h" /* for qemu_isdigit */
++#include "main-loop.h"
+
+ #ifndef AI_ADDRCONFIG
+ # define AI_ADDRCONFIG 0
+@@ -214,14 +215,66 @@ listen:
+ ((rc) == -EINPROGRESS)
+ #endif
+
+-static int inet_connect_addr(struct addrinfo *addr, bool block,
+- bool *in_progress)
++/* Struct to store connect state for non blocking connect */
++typedef struct ConnectState {
++ int fd;
++ struct addrinfo *addr_list;
++ struct addrinfo *current_addr;
++ NonBlockingConnectHandler *callback;
++ void *opaque;
++} ConnectState;
++
++static int inet_connect_addr(struct addrinfo *addr, bool *in_progress,
++ ConnectState *connect_state);
++
++static void wait_for_connect(void *opaque)
+ {
+- int sock, rc;
++ ConnectState *s = opaque;
++ int val = 0, rc = 0;
++ socklen_t valsize = sizeof(val);
++ bool in_progress;
++
++ qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
++
++ do {
++ rc = getsockopt(s->fd, SOL_SOCKET, SO_ERROR, (void *) &val, &valsize);
++ } while (rc == -1 && socket_error() == EINTR);
++
++ /* update rc to contain error */
++ if (!rc && val) {
++ rc = -1;
++ }
++
++ /* connect error */
++ if (rc < 0) {
++ closesocket(s->fd);
++ s->fd = rc;
++ }
++
++ /* try to connect to the next address on the list */
++ while (s->current_addr->ai_next != NULL && s->fd < 0) {
++ s->current_addr = s->current_addr->ai_next;
++ s->fd = inet_connect_addr(s->current_addr, &in_progress, s);
++ /* connect in progress */
++ if (in_progress) {
++ return;
++ }
++ }
+
+- if (in_progress) {
+- *in_progress = false;
++ freeaddrinfo(s->addr_list);
++ if (s->callback) {
++ s->callback(s->fd, s->opaque);
+ }
++ g_free(s);
++ return;
++}
++
++static int inet_connect_addr(struct addrinfo *addr, bool *in_progress,
++ ConnectState *connect_state)
++{
++ int sock, rc;
++
++ *in_progress = false;
+
+ sock = qemu_socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
+ if (sock < 0) {
+@@ -230,7 +283,7 @@ static int inet_connect_addr(struct addrinfo *addr, bool block,
+ return -1;
+ }
+ setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+- if (!block) {
++ if (connect_state != NULL) {
+ socket_set_nonblock(sock);
+ }
+ /* connect to peer */
+@@ -241,10 +294,11 @@ static int inet_connect_addr(struct addrinfo *addr, bool block,
+ }
+ } while (rc == -EINTR);
+
+- if (!block && QEMU_SOCKET_RC_INPROGRESS(rc)) {
+- if (in_progress) {
+- *in_progress = true;
+- }
++ if (connect_state != NULL && QEMU_SOCKET_RC_INPROGRESS(rc)) {
++ connect_state->fd = sock;
++ qemu_set_fd_handler2(sock, NULL, NULL, wait_for_connect,
++ connect_state);
++ *in_progress = true;
+ } else if (rc < 0) {
+ closesocket(sock);
+ return -1;
+@@ -260,6 +314,7 @@ static struct addrinfo *inet_parse_connect_opts(QemuOpts *opts, Error **errp)
+ const char *port;
+
+ memset(&ai, 0, sizeof(ai));
++
+ ai.ai_flags = AI_CANONNAME | AI_ADDRCONFIG;
+ ai.ai_family = PF_UNSPEC;
+ ai.ai_socktype = SOCK_STREAM;
+@@ -296,36 +351,55 @@ static struct addrinfo *inet_parse_connect_opts(QemuOpts *opts, Error **errp)
+ *
+ * @opts: QEMU options, recognized parameters strings "host" and "port",
+ * bools "ipv4" and "ipv6".
+- * @block: set true for blocking socket
+- * @in_progress: set to true in case of ongoing connect
+ * @errp: set on error
++ * @callback: callback function for non-blocking connect
++ * @opaque: opaque for callback function
+ *
+ * Returns: -1 on error, file descriptor on success.
++ *
++ * If @callback is non-null, the connect is non-blocking. If this
++ * function succeeds, callback will be called when the connection
++ * completes, with the file descriptor on success, or -1 on error.
+ */
+-int inet_connect_opts(QemuOpts *opts, bool block, bool *in_progress,
+- Error **errp)
++int inet_connect_opts(QemuOpts *opts, Error **errp,
++ NonBlockingConnectHandler *callback, void *opaque)
+ {
+ struct addrinfo *res, *e;
+ int sock = -1;
++ bool in_progress;
++ ConnectState *connect_state = NULL;
+
+ res = inet_parse_connect_opts(opts, errp);
+ if (!res) {
+ return -1;
+ }
+
+- if (in_progress) {
+- *in_progress = false;
++ if (callback != NULL) {
++ connect_state = g_malloc0(sizeof(*connect_state));
++ connect_state->addr_list = res;
++ connect_state->callback = callback;
++ connect_state->opaque = opaque;
+ }
+
+ for (e = res; e != NULL; e = e->ai_next) {
+- sock = inet_connect_addr(e, block, in_progress);
+- if (sock >= 0) {
++ if (connect_state != NULL) {
++ connect_state->current_addr = e;
++ }
++ sock = inet_connect_addr(e, &in_progress, connect_state);
++ if (in_progress) {
++ return sock;
++ } else if (sock >= 0) {
++ /* non blocking socket immediate success, call callback */
++ if (callback != NULL) {
++ callback(sock, opaque);
++ }
+ break;
+ }
+ }
+ if (sock < 0) {
+ error_set(errp, QERR_SOCKET_CONNECT_FAILED);
+ }
++ g_free(connect_state);
+ freeaddrinfo(res);
+ return sock;
+ }
+@@ -538,7 +612,7 @@ int inet_connect(const char *str, Error **errp)
+
+ opts = qemu_opts_create(&dummy_opts, NULL, 0, NULL);
+ if (inet_parse(opts, str) == 0) {
+- sock = inet_connect_opts(opts, true, NULL, errp);
++ sock = inet_connect_opts(opts, errp, NULL, NULL);
+ } else {
+ error_set(errp, QERR_SOCKET_CREATE_FAILED);
+ }
+@@ -548,22 +622,29 @@ int inet_connect(const char *str, Error **errp)
+
+ /**
+ * Create a non-blocking socket and connect it to an address.
++ * Calls the callback function with fd in case of success or -1 in case of
++ * error.
+ *
+ * @str: address string
+- * @in_progress: set to true in case of ongoing connect
++ * @callback: callback function that is called when connect completes,
++ * cannot be NULL.
++ * @opaque: opaque for callback function
+ * @errp: set in case of an error
+ *
+- * Returns: -1 on error, file descriptor on success.
++ * Returns: -1 on immediate error, file descriptor on success.
+ **/
+-int inet_nonblocking_connect(const char *str, bool *in_progress,
+- Error **errp)
++int inet_nonblocking_connect(const char *str,
++ NonBlockingConnectHandler *callback,
++ void *opaque, Error **errp)
+ {
+ QemuOpts *opts;
+ int sock = -1;
+
++ g_assert(callback != NULL);
++
+ opts = qemu_opts_create(&dummy_opts, NULL, 0, NULL);
+ if (inet_parse(opts, str) == 0) {
+- sock = inet_connect_opts(opts, false, in_progress, errp);
++ sock = inet_connect_opts(opts, errp, callback, opaque);
+ } else {
+ error_set(errp, QERR_SOCKET_CREATE_FAILED);
+ }
+diff --git a/qemu_socket.h b/qemu_socket.h
+index 80696aa..3e8aee9 100644
+--- a/qemu_socket.h
++++ b/qemu_socket.h
+@@ -38,15 +38,21 @@ void socket_set_block(int fd);
+ void socket_set_nonblock(int fd);
+ int send_all(int fd, const void *buf, int len1);
+
+-/* New, ipv6-ready socket helper functions, see qemu-sockets.c */
++/* callback function for nonblocking connect
++ * valid fd on success, negative error code on failure
++ */
++typedef void NonBlockingConnectHandler(int fd, void *opaque);
++
+ int inet_listen_opts(QemuOpts *opts, int port_offset, Error **errp);
+ int inet_listen(const char *str, char *ostr, int olen,
+ int socktype, int port_offset, Error **errp);
+-int inet_connect_opts(QemuOpts *opts, bool block, bool *in_progress,
+- Error **errp);
++int inet_connect_opts(QemuOpts *opts, Error **errp,
++ NonBlockingConnectHandler *callback, void *opaque);
+ int inet_connect(const char *str, Error **errp);
+-int inet_nonblocking_connect(const char *str, bool *in_progress,
+- Error **errp);
++int inet_nonblocking_connect(const char *str,
++ NonBlockingConnectHandler *callback,
++ void *opaque, Error **errp);
++
+ int inet_dgram_opts(QemuOpts *opts);
+ const char *inet_strfamily(int family);
+
+--
+1.7.12.1
+
--- /dev/null
+From b7b94b6016b89bf698d661ce4fd22139e771a835 Mon Sep 17 00:00:00 2001
+From: Orit Wasserman <owasserm@redhat.com>
+Date: Mon, 24 Sep 2012 13:11:10 +0200
+Subject: [PATCH] Clear handler only for valid fd
+
+Signed-off-by: Orit Wasserman <owasserm@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit 3202becaa2b805497ce9e6faa6edfb83665f91b1)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ migration.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/migration.c b/migration.c
+index 1edeec5..22a05c4 100644
+--- a/migration.c
++++ b/migration.c
+@@ -240,7 +240,9 @@ static int migrate_fd_cleanup(MigrationState *s)
+ {
+ int ret = 0;
+
+- qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
++ if (s->fd != -1) {
++ qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
++ }
+
+ if (s->file) {
+ DPRINTF("closing file\n");
+--
+1.7.12.1
+
--- /dev/null
+From 12d4393d0830a2a63828d302f177a9b8e31f433a Mon Sep 17 00:00:00 2001
+From: Brendan Fennell <bfennell@skynet.ie>
+Date: Wed, 26 Sep 2012 16:46:28 +0100
+Subject: [PATCH] pl190: fix read of VECTADDR
+
+Reading VECTADDR was causing us to set the current priority to
+the wrong value, the most obvious effect of which was that we
+would return the vector for the wrong interrupt as the result
+of the read.
+
+Signed-off-by: Brendan Fennell <bfennell@skynet.ie>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit 14c126baf1c38607c5bd988878de85a06cefd8cf)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/pl190.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/hw/pl190.c b/hw/pl190.c
+index cb50afb..7332f4d 100644
+--- a/hw/pl190.c
++++ b/hw/pl190.c
+@@ -117,12 +117,18 @@ static uint64_t pl190_read(void *opaque, target_phys_addr_t offset,
+ return s->protected;
+ case 12: /* VECTADDR */
+ /* Read vector address at the start of an ISR. Increases the
+- current priority level to that of the current interrupt. */
+- for (i = 0; i < s->priority; i++)
+- {
+- if ((s->level | s->soft_level) & s->prio_mask[i])
+- break;
+- }
++ * current priority level to that of the current interrupt.
++ *
++ * Since an enabled interrupt X at priority P causes prio_mask[Y]
++ * to have bit X set for all Y > P, this loop will stop with
++ * i == the priority of the highest priority set interrupt.
++ */
++ for (i = 0; i < s->priority; i++) {
++ if ((s->level | s->soft_level) & s->prio_mask[i + 1]) {
++ break;
++ }
++ }
++
+ /* Reading this value with no pending interrupts is undefined.
+ We return the default address. */
+ if (i == PL190_NUM_PRIO)
+--
+1.7.12.1
+
--- /dev/null
+From f4a5b8185d067430cd605a740af654cd1cd2e2aa Mon Sep 17 00:00:00 2001
+From: Meador Inge <meadori@codesourcery.com>
+Date: Wed, 26 Sep 2012 16:46:28 +0100
+Subject: [PATCH] hw/armv7m_nvic: Correctly register GIC region when setting
+ up NVIC
+
+When setting up the NVIC memory regions the memory range
+0x100..0xcff is aliased to an IO memory region that belongs
+to the ARM GIC. This aliased region should be added to the
+NVIC memory container, but the actual GIC IO memory region
+was being added instead. This mixup was causing the wrong
+IO memory access functions to be called when accessing parts
+of the NVIC memory.
+
+Signed-off-by: Meador Inge <meadori@codesourcery.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit 9892cae39562d2e6c00ccc5966302c00f23be6d4)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/armv7m_nvic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/armv7m_nvic.c b/hw/armv7m_nvic.c
+index 6a0832e..5c09116 100644
+--- a/hw/armv7m_nvic.c
++++ b/hw/armv7m_nvic.c
+@@ -489,7 +489,8 @@ static int armv7m_nvic_init(SysBusDevice *dev)
+ */
+ memory_region_init_alias(&s->gic_iomem_alias, "nvic-gic", &s->gic.iomem,
+ 0x100, 0xc00);
+- memory_region_add_subregion_overlap(&s->container, 0x100, &s->gic.iomem, 1);
++ memory_region_add_subregion_overlap(&s->container, 0x100,
++ &s->gic_iomem_alias, 1);
+ /* Map the whole thing into system memory at the location required
+ * by the v7M architecture.
+ */
+--
+1.7.12.1
+
--- /dev/null
+From cb97f34eca351d150574c724047709b76d00d08a Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <francescolavra.fl@gmail.com>
+Date: Wed, 19 Sep 2012 05:51:58 +0000
+Subject: [PATCH] Versatile Express: Fix NOR flash 0 address and remove flash
+ alias
+
+In the A series memory map (implemented in the Cortex A15 CoreTile), the
+first NOR flash bank (flash 0) is mapped to address 0x08000000, while
+address 0x00000000 can be configured as alias to either the first or the
+second flash bank. This patch fixes the definition of flash 0 address,
+and for simplicity removes the alias definition.
+
+Signed-off-by: Francesco Lavra <francescolavra.fl@gmail.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit 661bafb3e14bfffcb0a7c7910534c7944608ca45)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/vexpress.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/hw/vexpress.c b/hw/vexpress.c
+index b615844..454c2bb 100644
+--- a/hw/vexpress.c
++++ b/hw/vexpress.c
+@@ -62,7 +62,6 @@ enum {
+ VE_COMPACTFLASH,
+ VE_CLCD,
+ VE_NORFLASH0,
+- VE_NORFLASH0ALIAS,
+ VE_NORFLASH1,
+ VE_SRAM,
+ VE_VIDEORAM,
+@@ -104,9 +103,8 @@ static target_phys_addr_t motherboard_legacy_map[] = {
+ };
+
+ static target_phys_addr_t motherboard_aseries_map[] = {
+- /* CS0: 0x00000000 .. 0x0c000000 */
+- [VE_NORFLASH0] = 0x00000000,
+- [VE_NORFLASH0ALIAS] = 0x08000000,
++ /* CS0: 0x08000000 .. 0x0c000000 */
++ [VE_NORFLASH0] = 0x08000000,
+ /* CS4: 0x0c000000 .. 0x10000000 */
+ [VE_NORFLASH1] = 0x0c000000,
+ /* CS5: 0x10000000 .. 0x14000000 */
+@@ -413,7 +411,6 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
+ sysbus_create_simple("pl111", map[VE_CLCD], pic[14]);
+
+ /* VE_NORFLASH0: not modelled */
+- /* VE_NORFLASH0ALIAS: not modelled */
+ /* VE_NORFLASH1: not modelled */
+
+ sram_size = 0x2000000;
+--
+1.7.12.1
+
--- /dev/null
+From b82c558c781a79e6facf06e7cddf4771b8abf962 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Thu, 6 Sep 2012 10:05:35 +0000
+Subject: [PATCH] i386: kvm: bit 10 of CPUID[8000_0001].EDX is reserved
+
+Bit 10 of CPUID[8000_0001].EDX is not defined as an alias of
+CPUID[1].EDX[10], so do not duplicate it on
+kvm_arch_get_supported_cpuid().
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-By: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Don Slutz <Don@CloudSwitch.com>
+Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
+(cherry picked from commit b1f4679392a03f2b26a37bfa52e95d6cc4f73d82)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ target-i386/kvm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target-i386/kvm.c b/target-i386/kvm.c
+index 6790180..acb9369 100644
+--- a/target-i386/kvm.c
++++ b/target-i386/kvm.c
+@@ -165,7 +165,7 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
+ * so add missing bits according to the AMD spec:
+ */
+ cpuid_1_edx = kvm_arch_get_supported_cpuid(s, 1, 0, R_EDX);
+- ret |= cpuid_1_edx & 0x183f7ff;
++ ret |= cpuid_1_edx & 0x183f3ff;
+ break;
+ }
+ break;
+--
+1.7.12.1
+
--- /dev/null
+From 41e7a1710ee9787900713a769b7d07677857260a Mon Sep 17 00:00:00 2001
+From: Peter Maydell <peter.maydell@linaro.org>
+Date: Fri, 28 Sep 2012 16:17:03 +0100
+Subject: [PATCH] fpu/softfloat.c: Return correctly signed values from
+ uint64_to_float32
+
+The uint64_to_float32() conversion function was incorrectly always
+returning numbers with the sign bit set (ie negative numbers). Correct
+this so we return positive numbers instead.
+
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+(cherry picked from commit e744c06fca438dc08271e626034e632a270c91c8)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ fpu/softfloat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index b29256a..91497e8 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -1238,7 +1238,7 @@ float32 uint64_to_float32( uint64 a STATUS_PARAM )
+ if ( a == 0 ) return float32_zero;
+ shiftCount = countLeadingZeros64( a ) - 40;
+ if ( 0 <= shiftCount ) {
+- return packFloat32( 1 > 0, 0x95 - shiftCount, a<<shiftCount );
++ return packFloat32(0, 0x95 - shiftCount, a<<shiftCount);
+ }
+ else {
+ shiftCount += 7;
+@@ -1248,7 +1248,7 @@ float32 uint64_to_float32( uint64 a STATUS_PARAM )
+ else {
+ a <<= shiftCount;
+ }
+- return roundAndPackFloat32( 1 > 0, 0x9C - shiftCount, a STATUS_VAR );
++ return roundAndPackFloat32(0, 0x9C - shiftCount, a STATUS_VAR);
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 45af32e160bf339974a74bb8a38384b95aa2f555 Mon Sep 17 00:00:00 2001
+From: David Gibson <david@gibson.dropbear.id.au>
+Date: Tue, 25 Sep 2012 17:12:20 +0000
+Subject: [PATCH] pseries: Don't test for MSR_PR for hypercalls under KVM
+
+PAPR hypercalls should only be invoked from the guest kernel, not guest
+user programs, that is, with MSR[PR]=0. Currently we check this in
+spapr_hypercall, returning H_PRIVILEGE if MSR[PR]=1.
+
+However, under KVM the state of MSR[PR] is already checked by the host
+kernel before passing the hypercall to qemu, making this check redundant.
+Worse, however, we don't generally synchronize KVM and qemu state on the
+hypercall path, meaning that qemu could incorrectly reject a hypercall
+because it has a stale MSR value.
+
+This patch fixes the problem by moving the privilege test exclusively to
+the TCG hypercall path.
+
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+CC: qemu-stable@nongnu.org
+Signed-off-by: Alexander Graf <agraf@suse.de>
+(cherry picked from commit efcb9383b974114e5f682e531346006f8f2466c0)
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ hw/spapr.c | 7 ++++++-
+ hw/spapr_hcall.c | 5 -----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hw/spapr.c b/hw/spapr.c
+index c34b767..5e55430 100644
+--- a/hw/spapr.c
++++ b/hw/spapr.c
+@@ -556,7 +556,12 @@ static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
+
+ static void emulate_spapr_hypercall(CPUPPCState *env)
+ {
+- env->gpr[3] = spapr_hypercall(env, env->gpr[3], &env->gpr[4]);
++ if (msr_pr) {
++ hcall_dprintf("Hypercall made with MSR[PR]=1\n");
++ env->gpr[3] = H_PRIVILEGE;
++ } else {
++ env->gpr[3] = spapr_hypercall(env, env->gpr[3], &env->gpr[4]);
++ }
+ }
+
+ static void spapr_reset(void *opaque)
+diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
+index abd847f..38098f7 100644
+--- a/hw/spapr_hcall.c
++++ b/hw/spapr_hcall.c
+@@ -713,11 +713,6 @@ void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
+ target_ulong spapr_hypercall(CPUPPCState *env, target_ulong opcode,
+ target_ulong *args)
+ {
+- if (msr_pr) {
+- hcall_dprintf("Hypercall made with MSR[PR]=1\n");
+- return H_PRIVILEGE;
+- }
+-
+ if ((opcode <= MAX_HCALL_OPCODE)
+ && ((opcode & 0x3) == 0)) {
+ spapr_hcall_fn fn = papr_hypercall_table[opcode / 4];
+--
+1.7.12.1
+
--- /dev/null
+From 8a0e0b51b5df80c891d264f0492697f26a790cab Mon Sep 17 00:00:00 2001
+From: Michael Roth <mdroth@linux.vnet.ibm.com>
+Date: Thu, 11 Oct 2012 21:46:55 -0500
+Subject: [PATCH] update VERSION for v1.2.1
+
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+---
+ VERSION | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/VERSION b/VERSION
+index 26aaba0..6085e94 100644
+--- a/VERSION
++++ b/VERSION
+@@ -1 +1 @@
+-1.2.0
++1.2.1
+--
+1.7.12.1
+
--- /dev/null
+From e999fe6e315c5d6f6e8b5d4c689787fc46f10575 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 21:57:47 +0100
+Subject: [PATCH] char: Split out tcp socket close code in a separate function
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index b082bae..a1fdf88 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -2141,6 +2141,21 @@ typedef struct {
+
+ static void tcp_chr_accept(void *opaque);
+
++static void tcp_closed(void *opaque)
++{
++ CharDriverState *chr = opaque;
++ TCPCharDriver *s = chr->opaque;
++
++ s->connected = 0;
++ if (s->listen_fd >= 0) {
++ qemu_set_fd_handler2(s->listen_fd, NULL, tcp_chr_accept, NULL, chr);
++ }
++ qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
++ closesocket(s->fd);
++ s->fd = -1;
++ qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
++}
++
+ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ {
+ TCPCharDriver *s = chr->opaque;
+@@ -2299,15 +2314,7 @@ static void tcp_chr_read(void *opaque)
+ len = s->max_size;
+ size = tcp_chr_recv(chr, (void *)buf, len);
+ if (size == 0) {
+- /* connection closed */
+- s->connected = 0;
+- if (s->listen_fd >= 0) {
+- qemu_set_fd_handler2(s->listen_fd, NULL, tcp_chr_accept, NULL, chr);
+- }
+- qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
+- closesocket(s->fd);
+- s->fd = -1;
+- qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
++ tcp_closed(chr);
+ } else if (size > 0) {
+ if (s->do_telnetopt)
+ tcp_chr_process_IAC_bytes(chr, s, buf, &size);
+--
+1.7.12.1
+
--- /dev/null
+From 5f3ba69a09688b40a4648e8818e4878ae20fc2f6 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 20:31:45 +0100
+Subject: [PATCH] char: Add a QemuChrHandlers struct to initialise chardev
+ handlers
+
+Instead of passing each handler in the qemu_add_handlers() function,
+create a struct of handlers that can be passed to the function instead.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ gdbstub.c | 9 +++++++--
+ hw/cadence_uart.c | 9 +++++++--
+ hw/ccid-card-passthru.c | 11 +++++++----
+ hw/debugcon.c | 2 +-
+ hw/escc.c | 9 +++++++--
+ hw/etraxfs_ser.c | 13 +++++++++----
+ hw/exynos4210_uart.c | 9 +++++++--
+ hw/grlib_apbuart.c | 12 +++++++-----
+ hw/imx_serial.c | 9 +++++++--
+ hw/ivshmem.c | 28 ++++++++++++++++++++++------
+ hw/lm32_juart.c | 8 +++++++-
+ hw/lm32_uart.c | 8 +++++++-
+ hw/mcf_uart.c | 9 +++++++--
+ hw/milkymist-uart.c | 8 +++++++-
+ hw/pl011.c | 9 +++++++--
+ hw/pxa2xx.c | 13 +++++++++----
+ hw/qdev-properties.c | 2 +-
+ hw/serial.c | 9 +++++++--
+ hw/sh_serial.c | 12 +++++++++---
+ hw/spapr_vty.c | 8 ++++++--
+ hw/strongarm.c | 12 +++++++-----
+ hw/usb/dev-serial.c | 9 +++++++--
+ hw/usb/redirect.c | 9 +++++++--
+ hw/virtio-console.c | 9 +++++++--
+ hw/xen_console.c | 16 +++++++++++-----
+ hw/xilinx_uartlite.c | 11 +++++++++--
+ monitor.c | 18 ++++++++++++++----
+ net/slirp.c | 8 ++++++--
+ qemu-char.c | 32 ++++++++++++++++++++++----------
+ qemu-char.h | 13 +++++++++----
+ qtest.c | 9 ++++++++-
+ 31 files changed, 255 insertions(+), 88 deletions(-)
+
+diff --git a/gdbstub.c b/gdbstub.c
+index a91709f..b905c15 100644
+--- a/gdbstub.c
++++ b/gdbstub.c
+@@ -2965,6 +2965,12 @@ static void gdb_sigterm_handler(int signal)
+ }
+ #endif
+
++static const QemuChrHandlers gdb_handlers = {
++ .fd_can_read = gdb_chr_can_receive,
++ .fd_read = gdb_chr_receive,
++ .fd_event = gdb_chr_event,
++};
++
+ int gdbserver_start(const char *device)
+ {
+ GDBState *s;
+@@ -2994,8 +3000,7 @@ int gdbserver_start(const char *device)
+ if (!chr)
+ return -1;
+
+- qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
+- gdb_chr_event, NULL);
++ qemu_chr_add_handlers(chr, &gdb_handlers, NULL);
+ }
+
+ s = gdbserver_state;
+diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
+index f8afc4e..c9d3b21 100644
+--- a/hw/cadence_uart.c
++++ b/hw/cadence_uart.c
+@@ -435,6 +435,12 @@ static void cadence_uart_reset(UartState *s)
+ s->rx_wpos = 0;
+ }
+
++static const QemuChrHandlers cadence_uart_handlers = {
++ .fd_can_read = uart_can_receive,
++ .fd_read = uart_receive,
++ .fd_event = uart_event,
++};
++
+ static int cadence_uart_init(SysBusDevice *dev)
+ {
+ UartState *s = FROM_SYSBUS(UartState, dev);
+@@ -456,8 +462,7 @@ static int cadence_uart_init(SysBusDevice *dev)
+ cadence_uart_reset(s);
+
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, uart_can_receive, uart_receive,
+- uart_event, s);
++ qemu_chr_add_handlers(s->chr, &cadence_uart_handlers, s);
+ }
+
+ return 0;
+diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
+index bd6c777..fb32107 100644
+--- a/hw/ccid-card-passthru.c
++++ b/hw/ccid-card-passthru.c
+@@ -274,6 +274,12 @@ static const uint8_t *passthru_get_atr(CCIDCardState *base, uint32_t *len)
+ return card->atr;
+ }
+
++static const QemuChrHandlers passthru_handlers = {
++ .fd_can_read = ccid_card_vscard_can_read,
++ .fd_read = ccid_card_vscard_read,
++ .fd_event = ccid_card_vscard_event,
++};
++
+ static int passthru_initfn(CCIDCardState *base)
+ {
+ PassthruState *card = DO_UPCAST(PassthruState, base, base);
+@@ -282,10 +288,7 @@ static int passthru_initfn(CCIDCardState *base)
+ card->vscard_in_hdr = 0;
+ if (card->cs) {
+ DPRINTF(card, D_INFO, "initing chardev\n");
+- qemu_chr_add_handlers(card->cs,
+- ccid_card_vscard_can_read,
+- ccid_card_vscard_read,
+- ccid_card_vscard_event, card);
++ qemu_chr_add_handlers(card->cs, &passthru_handlers, card);
+ ccid_card_vscard_send_init(card);
+ } else {
+ error_report("missing chardev");
+diff --git a/hw/debugcon.c b/hw/debugcon.c
+index 14ab326..7887fd2 100644
+--- a/hw/debugcon.c
++++ b/hw/debugcon.c
+@@ -73,7 +73,7 @@ static void debugcon_init_core(DebugconState *s)
+ exit(1);
+ }
+
+- qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, s);
++ qemu_chr_add_handlers(s->chr, NULL, s);
+ }
+
+ static int debugcon_isa_initfn(ISADevice *dev)
+diff --git a/hw/escc.c b/hw/escc.c
+index e1f5e73..ff9d8b1 100644
+--- a/hw/escc.c
++++ b/hw/escc.c
+@@ -867,6 +867,12 @@ void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq,
+ sysbus_mmio_map(s, 0, base);
+ }
+
++static const QemuChrHandlers serial_handlers = {
++ .fd_can_read = serial_can_receive,
++ .fd_read = serial_receive1,
++ .fd_event = serial_event,
++};
++
+ static int escc_init1(SysBusDevice *dev)
+ {
+ SerialState *s = FROM_SYSBUS(SerialState, dev);
+@@ -879,8 +885,7 @@ static int escc_init1(SysBusDevice *dev)
+ s->chn[i].chn = 1 - i;
+ s->chn[i].clock = s->frequency / 2;
+ if (s->chn[i].chr) {
+- qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,
+- serial_receive1, serial_event, &s->chn[i]);
++ qemu_chr_add_handlers(s->chn[i].chr, &serial_handlers, &s->chn[i]);
+ }
+ }
+ s->chn[0].otherchn = &s->chn[1];
+diff --git a/hw/etraxfs_ser.c b/hw/etraxfs_ser.c
+index 5f16b17..f2571c2 100644
+--- a/hw/etraxfs_ser.c
++++ b/hw/etraxfs_ser.c
+@@ -208,6 +208,12 @@ static void etraxfs_ser_reset(DeviceState *d)
+
+ }
+
++static const QemuChrHandlers serial_handlers = {
++ .fd_can_read = serial_can_receive,
++ .fd_read = serial_receive,
++ .fd_event = serial_event,
++};
++
+ static int etraxfs_ser_init(SysBusDevice *dev)
+ {
+ struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
+@@ -217,10 +223,9 @@ static int etraxfs_ser_init(SysBusDevice *dev)
+ sysbus_init_mmio(dev, &s->mmio);
+
+ s->chr = qemu_char_get_next_serial();
+- if (s->chr)
+- qemu_chr_add_handlers(s->chr,
+- serial_can_receive, serial_receive,
+- serial_event, s);
++ if (s->chr) {
++ qemu_chr_add_handlers(s->chr, &serial_handlers, s);
++ }
+ return 0;
+ }
+
+diff --git a/hw/exynos4210_uart.c b/hw/exynos4210_uart.c
+index ccc4780..fefe400 100644
+--- a/hw/exynos4210_uart.c
++++ b/hw/exynos4210_uart.c
+@@ -625,6 +625,12 @@ DeviceState *exynos4210_uart_create(target_phys_addr_t addr,
+ return dev;
+ }
+
++static const QemuChrHandlers exynos4210_handlers = {
++ .fd_can_read = exynos4210_uart_can_receive,
++ .fd_read = exynos4210_uart_receive,
++ .fd_event = exynos4210_uart_event,
++};
++
+ static int exynos4210_uart_init(SysBusDevice *dev)
+ {
+ Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
+@@ -636,8 +642,7 @@ static int exynos4210_uart_init(SysBusDevice *dev)
+
+ sysbus_init_irq(dev, &s->irq);
+
+- qemu_chr_add_handlers(s->chr, exynos4210_uart_can_receive,
+- exynos4210_uart_receive, exynos4210_uart_event, s);
++ qemu_chr_add_handlers(s->chr, &exynos4210_handlers, s);
+
+ return 0;
+ }
+diff --git a/hw/grlib_apbuart.c b/hw/grlib_apbuart.c
+index 73fc989..fd77d52 100644
+--- a/hw/grlib_apbuart.c
++++ b/hw/grlib_apbuart.c
+@@ -222,15 +222,17 @@ static const MemoryRegionOps grlib_apbuart_ops = {
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ };
+
++static const QemuChrHandlers grlib_handlers = {
++ .fd_can_read = grlib_apbuart_can_receive,
++ .fd_read = grlib_apbuart_receive,
++ .fd_event = grlib_apbuart_event,
++};
++
+ static int grlib_apbuart_init(SysBusDevice *dev)
+ {
+ UART *uart = FROM_SYSBUS(typeof(*uart), dev);
+
+- qemu_chr_add_handlers(uart->chr,
+- grlib_apbuart_can_receive,
+- grlib_apbuart_receive,
+- grlib_apbuart_event,
+- uart);
++ qemu_chr_add_handlers(uart->chr, &grlib_handlers, uart);
+
+ sysbus_init_irq(dev, &uart->irq);
+
+diff --git a/hw/imx_serial.c b/hw/imx_serial.c
+index d4eae43..f2304d2 100644
+--- a/hw/imx_serial.c
++++ b/hw/imx_serial.c
+@@ -381,6 +381,12 @@ static const struct MemoryRegionOps imx_serial_ops = {
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ };
+
++static const QemuChrHandlers imx_handlers = {
++ .fd_can_read = imx_can_receive,
++ .fd_read = imx_receive,
++ .fd_event = imx_event,
++};
++
+ static int imx_serial_init(SysBusDevice *dev)
+ {
+ IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
+@@ -391,8 +397,7 @@ static int imx_serial_init(SysBusDevice *dev)
+ sysbus_init_irq(dev, &s->irq);
+
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, imx_can_receive, imx_receive,
+- imx_event, s);
++ qemu_chr_add_handlers(s->chr, &imx_handlers, s);
+ } else {
+ DPRINTF("No char dev for uart at 0x%lx\n",
+ (unsigned long)s->iomem.ram_addr);
+diff --git a/hw/ivshmem.c b/hw/ivshmem.c
+index 62fe53a..e90f691 100644
+--- a/hw/ivshmem.c
++++ b/hw/ivshmem.c
+@@ -273,6 +273,18 @@ static void fake_irqfd(void *opaque, const uint8_t *buf, int size) {
+ msix_notify(pdev, entry->vector);
+ }
+
++static const QemuChrHandlers ivshmem_handlers = {
++ .fd_can_read = ivshmem_can_receive,
++ .fd_read = ivshmem_receive,
++ .fd_event = ivshmem_event,
++};
++
++static const QemuChrHandlers ivshmem_msi_handlers = {
++ .fd_can_read = ivshmem_can_receive,
++ .fd_read = fake_irqfd,
++ .fd_event = ivshmem_event,
++};
++
+ static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *n,
+ int vector)
+ {
+@@ -293,11 +305,10 @@ static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *
+ s->eventfd_table[vector].pdev = &s->dev;
+ s->eventfd_table[vector].vector = vector;
+
+- qemu_chr_add_handlers(chr, ivshmem_can_receive, fake_irqfd,
+- ivshmem_event, &s->eventfd_table[vector]);
++ qemu_chr_add_handlers(chr, &ivshmem_msi_handlers,
++ &s->eventfd_table[vector]);
+ } else {
+- qemu_chr_add_handlers(chr, ivshmem_can_receive, ivshmem_receive,
+- ivshmem_event, s);
++ qemu_chr_add_handlers(chr, &ivshmem_handlers, s);
+ }
+
+ return chr;
+@@ -634,6 +645,12 @@ static void ivshmem_write_config(PCIDevice *pci_dev, uint32_t address,
+ msix_write_config(pci_dev, address, val, len);
+ }
+
++static const QemuChrHandlers ivshmem_server_handlers = {
++ .fd_can_read = ivshmem_can_receive,
++ .fd_read = ivshmem_read,
++ .fd_event = ivshmem_event,
++};
++
+ static int pci_ivshmem_init(PCIDevice *dev)
+ {
+ IVShmemState *s = DO_UPCAST(IVShmemState, dev, dev);
+@@ -720,8 +737,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
+
+ s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
+
+- qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
+- ivshmem_event, s);
++ qemu_chr_add_handlers(s->server_chr, &ivshmem_server_handlers, s);
+ } else {
+ /* just map the file immediately, we're not using a server */
+ int fd;
+diff --git a/hw/lm32_juart.c b/hw/lm32_juart.c
+index f07ed39..d4daeb8 100644
+--- a/hw/lm32_juart.c
++++ b/hw/lm32_juart.c
+@@ -110,13 +110,19 @@ static void juart_reset(DeviceState *d)
+ s->jrx = 0;
+ }
+
++static const QemuChrHandlers juart_handlers = {
++ .fd_can_read = juart_can_rx,
++ .fd_read = juart_rx,
++ .fd_event = juart_event,
++};
++
+ static int lm32_juart_init(SysBusDevice *dev)
+ {
+ LM32JuartState *s = FROM_SYSBUS(typeof(*s), dev);
+
+ s->chr = qemu_char_get_next_serial();
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, juart_can_rx, juart_rx, juart_event, s);
++ qemu_chr_add_handlers(s->chr, &juart_handlers, s);
+ }
+
+ return 0;
+diff --git a/hw/lm32_uart.c b/hw/lm32_uart.c
+index 57066e2..4ea130b 100644
+--- a/hw/lm32_uart.c
++++ b/hw/lm32_uart.c
+@@ -243,6 +243,12 @@ static void uart_reset(DeviceState *d)
+ s->regs[R_LSR] = LSR_THRE | LSR_TEMT;
+ }
+
++static const QemuChrHandlers uart_handlers = {
++ .fd_can_read = uart_can_rx,
++ .fd_read = uart_rx,
++ .fd_event = uart_event,
++};
++
+ static int lm32_uart_init(SysBusDevice *dev)
+ {
+ LM32UartState *s = FROM_SYSBUS(typeof(*s), dev);
+@@ -254,7 +260,7 @@ static int lm32_uart_init(SysBusDevice *dev)
+
+ s->chr = qemu_char_get_next_serial();
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
++ qemu_chr_add_handlers(s->chr, &uart_handlers, s);
+ }
+
+ return 0;
+diff --git a/hw/mcf_uart.c b/hw/mcf_uart.c
+index ec6a87f..f52fb96 100644
+--- a/hw/mcf_uart.c
++++ b/hw/mcf_uart.c
+@@ -272,6 +272,12 @@ static void mcf_uart_receive(void *opaque, const uint8_t *buf, int size)
+ mcf_uart_push_byte(s, buf[0]);
+ }
+
++static const QemuChrHandlers mcf_uart_handlers = {
++ .fd_can_read = mcf_uart_can_receive,
++ .fd_read = mcf_uart_receive,
++ .fd_event = mcf_uart_event,
++};
++
+ void *mcf_uart_init(qemu_irq irq, CharDriverState *chr)
+ {
+ mcf_uart_state *s;
+@@ -280,8 +286,7 @@ void *mcf_uart_init(qemu_irq irq, CharDriverState *chr)
+ s->chr = chr;
+ s->irq = irq;
+ if (chr) {
+- qemu_chr_add_handlers(chr, mcf_uart_can_receive, mcf_uart_receive,
+- mcf_uart_event, s);
++ qemu_chr_add_handlers(chr, &mcf_uart_handlers, s);
+ }
+ mcf_uart_reset(s);
+ return s;
+diff --git a/hw/milkymist-uart.c b/hw/milkymist-uart.c
+index 291fe3c..2dcb41c 100644
+--- a/hw/milkymist-uart.c
++++ b/hw/milkymist-uart.c
+@@ -189,6 +189,12 @@ static void milkymist_uart_reset(DeviceState *d)
+ s->regs[R_STAT] = STAT_THRE;
+ }
+
++static const QemuChrHandlers uart_handlers = {
++ .fd_can_read = uart_can_rx,
++ .fd_read = uart_rx,
++ .fd_event = uart_event,
++};
++
+ static int milkymist_uart_init(SysBusDevice *dev)
+ {
+ MilkymistUartState *s = FROM_SYSBUS(typeof(*s), dev);
+@@ -201,7 +207,7 @@ static int milkymist_uart_init(SysBusDevice *dev)
+
+ s->chr = qemu_char_get_next_serial();
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
++ qemu_chr_add_handlers(s->chr, &uart_handlers, s);
+ }
+
+ return 0;
+diff --git a/hw/pl011.c b/hw/pl011.c
+index 3245702..0d620f8 100644
+--- a/hw/pl011.c
++++ b/hw/pl011.c
+@@ -258,6 +258,12 @@ static const VMStateDescription vmstate_pl011 = {
+ }
+ };
+
++static const QemuChrHandlers pl011_handlers = {
++ .fd_can_read = pl011_can_receive,
++ .fd_read = pl011_receive,
++ .fd_event = pl011_event,
++};
++
+ static int pl011_init(SysBusDevice *dev, const unsigned char *id)
+ {
+ pl011_state *s = FROM_SYSBUS(pl011_state, dev);
+@@ -273,8 +279,7 @@ static int pl011_init(SysBusDevice *dev, const unsigned char *id)
+ s->cr = 0x300;
+ s->flags = 0x90;
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
+- pl011_event, s);
++ qemu_chr_add_handlers(s->chr, &pl011_handlers, s);
+ }
+ vmstate_register(&dev->qdev, -1, &vmstate_pl011, s);
+ return 0;
+diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
+index d5f1420..0b308cf 100644
+--- a/hw/pxa2xx.c
++++ b/hw/pxa2xx.c
+@@ -1962,6 +1962,12 @@ static int pxa2xx_fir_load(QEMUFile *f, void *opaque, int version_id)
+ return 0;
+ }
+
++static const QemuChrHandlers pxa2xx_handlers = {
++ .fd_can_read = pxa2xx_fir_is_empty,
++ .fd_read = pxa2xx_fir_rx,
++ .fd_event = pxa2xx_fir_event,
++};
++
+ static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
+ target_phys_addr_t base,
+ qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma,
+@@ -1980,10 +1986,9 @@ static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
+ memory_region_init_io(&s->iomem, &pxa2xx_fir_ops, s, "pxa2xx-fir", 0x1000);
+ memory_region_add_subregion(sysmem, base, &s->iomem);
+
+- if (chr)
+- qemu_chr_add_handlers(chr, pxa2xx_fir_is_empty,
+- pxa2xx_fir_rx, pxa2xx_fir_event, s);
+-
++ if (chr) {
++ qemu_chr_add_handlers(chr, &pxa2xx_handlers, s);
++ }
+ register_savevm(NULL, "pxa2xx_fir", 0, 0, pxa2xx_fir_save,
+ pxa2xx_fir_load, s);
+
+diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c
+index 8aca0d4..677c665 100644
+--- a/hw/qdev-properties.c
++++ b/hw/qdev-properties.c
+@@ -549,7 +549,7 @@ static void release_chr(Object *obj, const char *name, void *opaque)
+ CharDriverState **ptr = qdev_get_prop_ptr(dev, prop);
+
+ if (*ptr) {
+- qemu_chr_add_handlers(*ptr, NULL, NULL, NULL, NULL);
++ qemu_chr_add_handlers(*ptr, NULL, NULL);
+ }
+ }
+
+diff --git a/hw/serial.c b/hw/serial.c
+index a421d1e..056d823 100644
+--- a/hw/serial.c
++++ b/hw/serial.c
+@@ -736,6 +736,12 @@ static void serial_reset(void *opaque)
+ qemu_irq_lower(s->irq);
+ }
+
++static const QemuChrHandlers serial_handlers = {
++ .fd_can_read = serial_can_receive1,
++ .fd_read = serial_receive1,
++ .fd_event = serial_event,
++};
++
+ static void serial_init_core(SerialState *s)
+ {
+ if (!s->chr) {
+@@ -750,8 +756,7 @@ static void serial_init_core(SerialState *s)
+
+ qemu_register_reset(serial_reset, s);
+
+- qemu_chr_add_handlers(s->chr, serial_can_receive1, serial_receive1,
+- serial_event, s);
++ qemu_chr_add_handlers(s->chr, &serial_handlers, s);
+ }
+
+ /* Change the main reference oscillator frequency. */
+diff --git a/hw/sh_serial.c b/hw/sh_serial.c
+index 1d1883d..ce1c765 100644
+--- a/hw/sh_serial.c
++++ b/hw/sh_serial.c
+@@ -352,6 +352,12 @@ static const MemoryRegionOps sh_serial_ops = {
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ };
+
++static const QemuChrHandlers sh_serial_handlers = {
++ .fd_can_read = sh_serial_can_receive1,
++ .fd_read = sh_serial_receive1,
++ .fd_event = sh_serial_event,
++};
++
+ void sh_serial_init(MemoryRegion *sysmem,
+ target_phys_addr_t base, int feat,
+ uint32_t freq, CharDriverState *chr,
+@@ -396,9 +402,9 @@ void sh_serial_init(MemoryRegion *sysmem,
+
+ s->chr = chr;
+
+- if (chr)
+- qemu_chr_add_handlers(chr, sh_serial_can_receive1, sh_serial_receive1,
+- sh_serial_event, s);
++ if (chr) {
++ qemu_chr_add_handlers(chr, &sh_serial_handlers, s);
++ }
+
+ s->eri = eri_source;
+ s->rxi = rxi_source;
+diff --git a/hw/spapr_vty.c b/hw/spapr_vty.c
+index 5da17a3..6c2ada1 100644
+--- a/hw/spapr_vty.c
++++ b/hw/spapr_vty.c
+@@ -54,6 +54,11 @@ void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len)
+ qemu_chr_fe_write(dev->chardev, buf, len);
+ }
+
++static const QemuChrHandlers vty_handlers = {
++ .fd_can_read = vty_can_receive,
++ .fd_read = vty_receive,
++};
++
+ static int spapr_vty_init(VIOsPAPRDevice *sdev)
+ {
+ VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)sdev;
+@@ -63,8 +68,7 @@ static int spapr_vty_init(VIOsPAPRDevice *sdev)
+ exit(1);
+ }
+
+- qemu_chr_add_handlers(dev->chardev, vty_can_receive,
+- vty_receive, NULL, dev);
++ qemu_chr_add_handlers(dev->chardev, &vty_handlers, dev);
+
+ return 0;
+ }
+diff --git a/hw/strongarm.c b/hw/strongarm.c
+index 7150eeb..594cf31 100644
+--- a/hw/strongarm.c
++++ b/hw/strongarm.c
+@@ -1199,6 +1199,12 @@ static const MemoryRegionOps strongarm_uart_ops = {
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ };
+
++static const QemuChrHandlers strongarm_uart_handlers = {
++ .fd_can_read = strongarm_uart_can_receive,
++ .fd_read = strongarm_uart_receive,
++ .fd_event = strongarm_uart_event,
++};
++
+ static int strongarm_uart_init(SysBusDevice *dev)
+ {
+ StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
+@@ -1211,11 +1217,7 @@ static int strongarm_uart_init(SysBusDevice *dev)
+ s->tx_timer = qemu_new_timer_ns(vm_clock, strongarm_uart_tx, s);
+
+ if (s->chr) {
+- qemu_chr_add_handlers(s->chr,
+- strongarm_uart_can_receive,
+- strongarm_uart_receive,
+- strongarm_uart_event,
+- s);
++ qemu_chr_add_handlers(s->chr, &strongarm_uart_handlers, s);
+ }
+
+ return 0;
+diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
+index 69b6e48..0ddfab6 100644
+--- a/hw/usb/dev-serial.c
++++ b/hw/usb/dev-serial.c
+@@ -475,6 +475,12 @@ static void usb_serial_event(void *opaque, int event)
+ }
+ }
+
++static const QemuChrHandlers usb_serial_handlers = {
++ .fd_can_read = usb_serial_can_read,
++ .fd_read = usb_serial_read,
++ .fd_event = usb_serial_event,
++};
++
+ static int usb_serial_initfn(USBDevice *dev)
+ {
+ USBSerialState *s = DO_UPCAST(USBSerialState, dev, dev);
+@@ -487,8 +493,7 @@ static int usb_serial_initfn(USBDevice *dev)
+ return -1;
+ }
+
+- qemu_chr_add_handlers(s->cs, usb_serial_can_read, usb_serial_read,
+- usb_serial_event, s);
++ qemu_chr_add_handlers(s->cs, &usb_serial_handlers, s);
+ usb_serial_handle_reset(dev);
+ return 0;
+ }
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index ab8d79a..8b22c80 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -867,6 +867,12 @@ static void usbredir_chardev_event(void *opaque, int event)
+ }
+ }
+
++static const QemuChrHandlers usbredir_chr_handlers = {
++ .fd_can_read = usbredir_chardev_can_read,
++ .fd_read = usbredir_chardev_read,
++ .fd_event = usbredir_chardev_event,
++};
++
+ /*
+ * init + destroy
+ */
+@@ -905,8 +911,7 @@ static int usbredir_initfn(USBDevice *udev)
+
+ /* Let the backend know we are ready */
+ qemu_chr_fe_open(dev->cs);
+- qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read,
+- usbredir_chardev_read, usbredir_chardev_event, dev);
++ qemu_chr_add_handlers(dev->cs, &usbredir_chr_handlers, dev);
+
+ add_boot_device_path(dev->bootindex, &udev->qdev, NULL);
+ return 0;
+diff --git a/hw/virtio-console.c b/hw/virtio-console.c
+index cffee3d..066590c 100644
+--- a/hw/virtio-console.c
++++ b/hw/virtio-console.c
+@@ -106,6 +106,12 @@ static void chr_event(void *opaque, int event)
+ }
+ }
+
++static const QemuChrHandlers chr_handlers = {
++ .fd_can_read = chr_can_read,
++ .fd_read = chr_read,
++ .fd_event = chr_event,
++};
++
+ static int virtconsole_initfn(VirtIOSerialPort *port)
+ {
+ VirtConsole *vcon = DO_UPCAST(VirtConsole, port, port);
+@@ -117,8 +123,7 @@ static int virtconsole_initfn(VirtIOSerialPort *port)
+ }
+
+ if (vcon->chr) {
+- qemu_chr_add_handlers(vcon->chr, chr_can_read, chr_read, chr_event,
+- vcon);
++ qemu_chr_add_handlers(vcon->chr, &chr_handlers, vcon);
+ }
+
+ return 0;
+diff --git a/hw/xen_console.c b/hw/xen_console.c
+index 9426d73..e9fcadc 100644
+--- a/hw/xen_console.c
++++ b/hw/xen_console.c
+@@ -211,6 +211,11 @@ out:
+ return ret;
+ }
+
++static const QemuChrHandlers xencons_handlers = {
++ .fd_can_read = xencons_can_receive,
++ .fd_read = xencons_receive,
++};
++
+ static int con_initialise(struct XenDevice *xendev)
+ {
+ struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);
+@@ -231,9 +236,9 @@ static int con_initialise(struct XenDevice *xendev)
+ return -1;
+
+ xen_be_bind_evtchn(&con->xendev);
+- if (con->chr)
+- qemu_chr_add_handlers(con->chr, xencons_can_receive, xencons_receive,
+- NULL, con);
++ if (con->chr) {
++ qemu_chr_add_handlers(con->chr, &xencons_handlers, con);
++ }
+
+ xen_be_printf(xendev, 1, "ring mfn %d, remote port %d, local port %d, limit %zd\n",
+ con->ring_ref,
+@@ -250,8 +255,9 @@ static void con_disconnect(struct XenDevice *xendev)
+ if (!xendev->dev) {
+ return;
+ }
+- if (con->chr)
+- qemu_chr_add_handlers(con->chr, NULL, NULL, NULL, NULL);
++ if (con->chr) {
++ qemu_chr_add_handlers(con->chr, NULL, NULL);
++ }
+ xen_be_unbind_evtchn(&con->xendev);
+
+ if (con->sring) {
+diff --git a/hw/xilinx_uartlite.c b/hw/xilinx_uartlite.c
+index d0f32db..33f0cd5 100644
+--- a/hw/xilinx_uartlite.c
++++ b/hw/xilinx_uartlite.c
+@@ -195,6 +195,12 @@ static void uart_event(void *opaque, int event)
+
+ }
+
++static const QemuChrHandlers uart_handlers = {
++ .fd_can_read = uart_can_rx,
++ .fd_read = uart_rx,
++ .fd_event = uart_event,
++};
++
+ static int xilinx_uartlite_init(SysBusDevice *dev)
+ {
+ struct xlx_uartlite *s = FROM_SYSBUS(typeof (*s), dev);
+@@ -207,8 +213,9 @@ static int xilinx_uartlite_init(SysBusDevice *dev)
+ sysbus_init_mmio(dev, &s->mmio);
+
+ s->chr = qemu_char_get_next_serial();
+- if (s->chr)
+- qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
++ if (s->chr) {
++ qemu_chr_add_handlers(s->chr, &uart_handlers, s);
++ }
+ return 0;
+ }
+
+diff --git a/monitor.c b/monitor.c
+index f45cf92..99eee98 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -4942,6 +4942,18 @@ static void sortcmdlist(void)
+ * End:
+ */
+
++static const QemuChrHandlers monitor_handlers = {
++ .fd_can_read = monitor_can_read,
++ .fd_read = monitor_read,
++ .fd_event = monitor_event,
++};
++
++static const QemuChrHandlers monitor_control_handlers = {
++ .fd_can_read = monitor_can_read,
++ .fd_read = monitor_control_read,
++ .fd_event = monitor_control_event,
++};
++
+ void monitor_init(CharDriverState *chr, int flags)
+ {
+ static int is_first_init = 1;
+@@ -4965,14 +4977,12 @@ void monitor_init(CharDriverState *chr, int flags)
+ if (monitor_ctrl_mode(mon)) {
+ mon->mc = g_malloc0(sizeof(MonitorControl));
+ /* Control mode requires special handlers */
+- qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
+- monitor_control_event, mon);
++ qemu_chr_add_handlers(chr, &monitor_control_handlers, mon);
+ qemu_chr_fe_set_echo(chr, true);
+
+ json_message_parser_init(&mon->mc->parser, handle_qmp_command);
+ } else {
+- qemu_chr_add_handlers(chr, monitor_can_read, monitor_read,
+- monitor_event, mon);
++ qemu_chr_add_handlers(chr, &monitor_handlers, mon);
+ }
+
+ QLIST_INSERT_HEAD(&mon_list, mon, entry);
+diff --git a/net/slirp.c b/net/slirp.c
+index 8db66ea..63542cb 100644
+--- a/net/slirp.c
++++ b/net/slirp.c
+@@ -593,6 +593,11 @@ static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
+ slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
+ }
+
++static const QemuChrHandlers guestfwd_handlers = {
++ .fd_can_read = guestfwd_can_read,
++ .fd_read = guestfwd_read,
++};
++
+ static int slirp_guestfwd(SlirpState *s, const char *config_str,
+ int legacy_format)
+ {
+@@ -658,8 +663,7 @@ static int slirp_guestfwd(SlirpState *s, const char *config_str,
+ fwd->port = port;
+ fwd->slirp = s->slirp;
+
+- qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
+- NULL, fwd);
++ qemu_chr_add_handlers(fwd->hd, &guestfwd_handlers, fwd);
+ }
+ return 0;
+
+diff --git a/qemu-char.c b/qemu-char.c
+index a1fdf88..bd443db 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -192,19 +192,26 @@ void qemu_chr_fe_printf(CharDriverState *s, const char *fmt, ...)
+ va_end(ap);
+ }
+
++static const QemuChrHandlers null_handlers = {
++ /* All handlers are initialised to NULL */
++};
++
+ void qemu_chr_add_handlers(CharDriverState *s,
+- IOCanReadHandler *fd_can_read,
+- IOReadHandler *fd_read,
+- IOEventHandler *fd_event,
+- void *opaque)
++ const QemuChrHandlers *handlers, void *opaque)
+ {
+- if (!opaque && !fd_can_read && !fd_read && !fd_event) {
++ if (!s) {
++ return;
++ }
++ if (!opaque && !handlers) {
+ /* chr driver being released. */
+ ++s->avail_connections;
+ }
+- s->chr_can_read = fd_can_read;
+- s->chr_read = fd_read;
+- s->chr_event = fd_event;
++ if (!handlers) {
++ handlers = &null_handlers;
++ }
++ s->chr_can_read = handlers->fd_can_read;
++ s->chr_read = handlers->fd_read;
++ s->chr_event = handlers->fd_event;
+ s->handler_opaque = opaque;
+ if (s->chr_update_read_handler)
+ s->chr_update_read_handler(s);
+@@ -442,6 +449,12 @@ static void mux_chr_event(void *opaque, int event)
+ mux_chr_send_event(d, i, event);
+ }
+
++static const QemuChrHandlers mux_chr_handlers = {
++ .fd_can_read = mux_chr_can_read,
++ .fd_read = mux_chr_read,
++ .fd_event = mux_chr_event,
++};
++
+ static void mux_chr_update_read_handler(CharDriverState *chr)
+ {
+ MuxDriver *d = chr->opaque;
+@@ -456,8 +469,7 @@ static void mux_chr_update_read_handler(CharDriverState *chr)
+ d->chr_event[d->mux_cnt] = chr->chr_event;
+ /* Fix up the real driver with mux routines */
+ if (d->mux_cnt == 0) {
+- qemu_chr_add_handlers(d->drv, mux_chr_can_read, mux_chr_read,
+- mux_chr_event, chr);
++ qemu_chr_add_handlers(d->drv, &mux_chr_handlers, chr);
+ }
+ if (d->focus != -1) {
+ mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_OUT);
+diff --git a/qemu-char.h b/qemu-char.h
+index 486644b..dfa8c2d 100644
+--- a/qemu-char.h
++++ b/qemu-char.h
+@@ -222,10 +222,15 @@ void qemu_chr_be_write(CharDriverState *s, uint8_t *buf, int len);
+ */
+ void qemu_chr_be_event(CharDriverState *s, int event);
+
+-void qemu_chr_add_handlers(CharDriverState *s,
+- IOCanReadHandler *fd_can_read,
+- IOReadHandler *fd_read,
+- IOEventHandler *fd_event,
++
++typedef struct QemuChrHandlers {
++ IOCanReadHandler *fd_can_read;
++ IOReadHandler *fd_read;
++ IOHandler *fd_write_unblocked;
++ IOEventHandler *fd_event;
++} QemuChrHandlers;
++
++void qemu_chr_add_handlers(CharDriverState *s, const QemuChrHandlers *handlers,
+ void *opaque);
+
+ void qemu_chr_generic_open(CharDriverState *s);
+diff --git a/qtest.c b/qtest.c
+index fbfab4e..4ab5b69 100644
+--- a/qtest.c
++++ b/qtest.c
+@@ -416,6 +416,13 @@ static void qtest_event(void *opaque, int event)
+ }
+ }
+
++static const QemuChrHandlers test_handlers = {
++ .fd_can_read = qtest_can_read,
++ .fd_read = qtest_read,
++ .fd_event = qtest_event,
++};
++
++
+ int qtest_init(void)
+ {
+ CharDriverState *chr;
+@@ -425,7 +432,7 @@ int qtest_init(void)
+ configure_icount("0");
+ chr = qemu_chr_new("qtest", qtest_chrdev, NULL);
+
+- qemu_chr_add_handlers(chr, qtest_can_read, qtest_read, qtest_event, chr);
++ qemu_chr_add_handlers(chr, &test_handlers, chr);
+ qemu_chr_fe_set_echo(chr, true);
+
+ inbuf = g_string_new("");
+--
+1.7.12.1
+
--- /dev/null
+From 2ac23d2134611b4e5b0fb389911bd03baa685df3 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 20:32:58 +0100
+Subject: [PATCH] iohandlers: Add enable/disable_write_fd_handler() functions
+
+These will be used to provide a cleaner API for the nonblocking case.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ iohandler.c | 35 +++++++++++++++++++++++++++++++++++
+ main-loop.h | 3 +++
+ 2 files changed, 38 insertions(+)
+
+diff --git a/iohandler.c b/iohandler.c
+index a2d871b..c00fecd 100644
+--- a/iohandler.c
++++ b/iohandler.c
+@@ -45,6 +45,41 @@ typedef struct IOHandlerRecord {
+ static QLIST_HEAD(, IOHandlerRecord) io_handlers =
+ QLIST_HEAD_INITIALIZER(io_handlers);
+
++static IOHandlerRecord *find_iohandler(int fd)
++{
++ IOHandlerRecord *ioh;
++
++ QLIST_FOREACH(ioh, &io_handlers, next) {
++ if (ioh->fd == fd) {
++ return ioh;
++ }
++ }
++ return NULL;
++}
++
++void enable_write_fd_handler(int fd, IOHandler *fd_write)
++{
++ IOHandlerRecord *ioh;
++
++ ioh = find_iohandler(fd);
++ if (!ioh) {
++ return;
++ }
++
++ ioh->fd_write = fd_write;
++}
++
++void disable_write_fd_handler(int fd)
++{
++ IOHandlerRecord *ioh;
++
++ ioh = find_iohandler(fd);
++ if (!ioh) {
++ return;
++ }
++
++ ioh->fd_write = NULL;
++}
+
+ /* XXX: fd_read_poll should be suppressed, but an API change is
+ necessary in the character devices to suppress fd_can_read(). */
+diff --git a/main-loop.h b/main-loop.h
+index dce1cd9..eb31273 100644
+--- a/main-loop.h
++++ b/main-loop.h
+@@ -175,6 +175,9 @@ typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
+ typedef int IOCanReadHandler(void *opaque);
+ typedef void IOHandler(void *opaque);
+
++void enable_write_fd_handler(int fd, IOHandler *fd_write);
++void disable_write_fd_handler(int fd);
++
+ /**
+ * qemu_set_fd_handler2: Register a file descriptor with the main loop
+ *
+--
+1.7.12.1
+
--- /dev/null
+From 8ca97117074b5eb12bf9cb0b25548116174601a8 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 21:41:42 +0100
+Subject: [PATCH] char: Add framework for a 'write unblocked' callback
+
+The char layer can let users know that the driver will block on further
+input. For users interested in not blocking, they can assign a function
+pointer that will be called back when the driver becomes writable. This
+patch just adds the function pointers to the CharDriverState structure,
+future patches will enable the nonblocking and callback functionality.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 3 +++
+ qemu-char.h | 4 ++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index bd443db..b5266d1 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -211,11 +211,14 @@ void qemu_chr_add_handlers(CharDriverState *s,
+ }
+ s->chr_can_read = handlers->fd_can_read;
+ s->chr_read = handlers->fd_read;
++ s->chr_write_unblocked = handlers->fd_write_unblocked;
+ s->chr_event = handlers->fd_event;
+ s->handler_opaque = opaque;
+ if (s->chr_update_read_handler)
+ s->chr_update_read_handler(s);
+
++ s->write_blocked = false;
++
+ /* We're connecting to an already opened device, so let's make sure we
+ also get the open event */
+ if (s->opened) {
+diff --git a/qemu-char.h b/qemu-char.h
+index dfa8c2d..b5e23a4 100644
+--- a/qemu-char.h
++++ b/qemu-char.h
+@@ -62,6 +62,9 @@ struct CharDriverState {
+ IOEventHandler *chr_event;
+ IOCanReadHandler *chr_can_read;
+ IOReadHandler *chr_read;
++ IOHandler *chr_write_unblocked;
++ void (*chr_enable_write_fd_handler)(struct CharDriverState *chr);
++ void (*chr_disable_write_fd_handler)(struct CharDriverState *chr);
+ void *handler_opaque;
+ void (*chr_close)(struct CharDriverState *chr);
+ void (*chr_accept_input)(struct CharDriverState *chr);
+@@ -74,6 +77,7 @@ struct CharDriverState {
+ char *filename;
+ int opened;
+ int avail_connections;
++ bool write_blocked; /* Are we in a blocked state? */
+ QTAILQ_ENTRY(CharDriverState) next;
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From dd7b138971deb72c7e37c4b79665df6ff5c1130b Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 22:00:27 +0100
+Subject: [PATCH] char: Update send_all() to handle nonblocking chardev write
+ requests
+
+The send_all function is modified to return to the caller in case the
+driver cannot handle any more data. It returns -EAGAIN or
+WSAEWOULDBLOCK on non-Windows and Windows platforms respectively. This
+is only done when the caller sets a callback function handler indicating
+it's not interested in blocking till the driver has written out all the
+data.
+
+Currently there's no driver or caller that supports this. Future
+commits will add such capability.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++------
+ qemu_socket.h | 2 +-
+ 2 files changed, 64 insertions(+), 7 deletions(-)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index b5266d1..b46cc97 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -508,7 +508,7 @@ static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
+
+
+ #ifdef _WIN32
+-int send_all(int fd, const void *buf, int len1)
++static int do_send(int fd, const void *buf, int len1, bool nonblock)
+ {
+ int ret, len;
+
+@@ -516,9 +516,14 @@ int send_all(int fd, const void *buf, int len1)
+ while (len > 0) {
+ ret = send(fd, buf, len, 0);
+ if (ret < 0) {
++ if (nonblock && len1 - len) {
++ return len1 - len;
++ }
+ errno = WSAGetLastError();
+ if (errno != WSAEWOULDBLOCK) {
+ return -1;
++ } else if (errno == WSAEWOULDBLOCK && nonblock) {
++ return WSAEWOULDBLOCK;
+ }
+ } else if (ret == 0) {
+ break;
+@@ -532,7 +537,7 @@ int send_all(int fd, const void *buf, int len1)
+
+ #else
+
+-int send_all(int fd, const void *_buf, int len1)
++static int do_send(int fd, const void *_buf, int len1, bool nonblock)
+ {
+ int ret, len;
+ const uint8_t *buf = _buf;
+@@ -541,8 +546,15 @@ int send_all(int fd, const void *_buf, int len1)
+ while (len > 0) {
+ ret = write(fd, buf, len);
+ if (ret < 0) {
+- if (errno != EINTR && errno != EAGAIN)
++ if (nonblock && len1 - len) {
++ return len1 - len;
++ }
++ if (errno == EAGAIN && nonblock) {
++ return -EAGAIN;
++ }
++ if (errno != EINTR && errno != EAGAIN) {
+ return -1;
++ }
+ } else if (ret == 0) {
+ break;
+ } else {
+@@ -557,6 +569,44 @@ int send_all(int fd, const void *_buf, int len1)
+ #define STDIO_MAX_CLIENTS 1
+ static int stdio_nb_clients;
+
++int send_all(CharDriverState *chr, int fd, const void *_buf, int len1)
++{
++ int ret, eagain_errno;
++ bool nonblock;
++
++ if (chr && chr->write_blocked) {
++ /*
++ * The caller should not send us data while we're blocked,
++ * but this can happen when multiple writers are woken at once,
++ * so simply return -EAGAIN.
++ */
++ return -EAGAIN;
++ }
++
++ nonblock = false;
++ /*
++ * Ensure the char backend is able to receive and handle the
++ * 'write unblocked' event before we turn on nonblock support.
++ */
++ if (chr && chr->chr_enable_write_fd_handler && chr->chr_write_unblocked) {
++ nonblock = true;
++ }
++ ret = do_send(fd, _buf, len1, nonblock);
++
++#ifdef _WIN32
++ eagain_errno = WSAEWOULDBLOCK;
++#else
++ eagain_errno = -EAGAIN;
++#endif
++
++ if (nonblock && (ret == eagain_errno || (ret >= 0 && ret < len1))) {
++ /* Update fd handler to wake up when chr becomes writable */
++ chr->chr_enable_write_fd_handler(chr);
++ chr->write_blocked = true;
++ }
++ return ret;
++}
++
+ #ifndef _WIN32
+
+ typedef struct {
+@@ -568,7 +618,7 @@ typedef struct {
+ static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ {
+ FDCharDriver *s = chr->opaque;
+- return send_all(s->fd_out, buf, len);
++ return send_all(chr, s->fd_out, buf, len);
+ }
+
+ static int fd_chr_read_poll(void *opaque)
+@@ -887,7 +937,7 @@ static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ pty_chr_update_read_handler(chr);
+ return 0;
+ }
+- return send_all(s->fd, buf, len);
++ return send_all(chr, s->fd, buf, len);
+ }
+
+ static int pty_chr_read_poll(void *opaque)
+@@ -2174,8 +2224,15 @@ static void tcp_closed(void *opaque)
+ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ {
+ TCPCharDriver *s = chr->opaque;
++
+ if (s->connected) {
+- return send_all(s->fd, buf, len);
++ int ret;
++
++ ret = send_all(chr, s->fd, buf, len);
++ if (ret == -1 && errno == EPIPE) {
++ tcp_closed(chr);
++ }
++ return ret;
+ } else {
+ /* XXX: indicate an error ? */
+ return len;
+diff --git a/qemu_socket.h b/qemu_socket.h
+index 3e8aee9..a537d86 100644
+--- a/qemu_socket.h
++++ b/qemu_socket.h
+@@ -36,7 +36,7 @@ int qemu_accept(int s, struct sockaddr *addr, socklen_t *addrlen);
+ int socket_set_cork(int fd, int v);
+ void socket_set_block(int fd);
+ void socket_set_nonblock(int fd);
+-int send_all(int fd, const void *buf, int len1);
++int send_all(CharDriverState *chr, int fd, const void *buf, int len1);
+
+ /* callback function for nonblocking connect
+ * valid fd on success, negative error code on failure
+--
+1.7.12.1
+
--- /dev/null
+From 625915146f56f77c275be1aee160f40183008b8d Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 22:02:47 +0100
+Subject: [PATCH] char: Equip the unix/tcp backend to handle nonblocking
+ writes#
+
+Now that the infrastructure is in place to return -EAGAIN to callers,
+individual char drivers can set their update_fd_handlers() function to
+set or remove an fd's write handler. This handler checks if the driver
+became writable.
+
+A generic callback routine is used for unblocking writes and letting
+users of chardevs know that a driver became writable again.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index b46cc97..9f8608a 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -106,6 +106,19 @@
+ static QTAILQ_HEAD(CharDriverStateHead, CharDriverState) chardevs =
+ QTAILQ_HEAD_INITIALIZER(chardevs);
+
++/*
++ * Generic routine that gets called when chardev becomes writable.
++ * Lets chardev user know it's OK to send more data.
++ */
++static void char_write_unblocked(void *opaque)
++{
++ CharDriverState *chr = opaque;
++
++ chr->write_blocked = false;
++ chr->chr_disable_write_fd_handler(chr);
++ chr->chr_write_unblocked(chr->handler_opaque);
++}
++
+ void qemu_chr_be_event(CharDriverState *s, int event)
+ {
+ /* Keep track if the char device is open */
+@@ -2503,6 +2516,25 @@ static void tcp_chr_close(CharDriverState *chr)
+ qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
+ }
+
++static void tcp_enable_write_fd_handler(CharDriverState *chr)
++{
++ TCPCharDriver *s = chr->opaque;
++
++ /*
++ * This function is called only after tcp_chr_connect() is called
++ * (either in 'server' mode or client mode. So we're sure of
++ * s->fd being initialised.
++ */
++ enable_write_fd_handler(s->fd, char_write_unblocked);
++}
++
++static void tcp_disable_write_fd_handler(CharDriverState *chr)
++{
++ TCPCharDriver *s = chr->opaque;
++
++ disable_write_fd_handler(s->fd);
++}
++
+ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
+ {
+ CharDriverState *chr = NULL;
+@@ -2557,6 +2589,8 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
+ chr->chr_close = tcp_chr_close;
+ chr->get_msgfd = tcp_get_msgfd;
+ chr->chr_add_client = tcp_chr_add_client;
++ chr->chr_enable_write_fd_handler = tcp_enable_write_fd_handler;
++ chr->chr_disable_write_fd_handler = tcp_disable_write_fd_handler;
+
+ if (is_listen) {
+ s->listen_fd = fd;
+--
+1.7.12.1
+
--- /dev/null
+From 542fa14530022044ab577c543fba83202d52b703 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 22:05:10 +0100
+Subject: [PATCH] char: Throttle when host connection is down#
+
+When the host-side connection goes down, throttle the virtio-serial bus
+and later unthrottle when a connection gets established. This helps
+prevent any lost IO (guest->host) while the host connection was down.
+
+Bugzilla: 621484
+
+This commit actually helps the bug mentioned above as no writes will now
+get lost because of the throttling done here. With just the patches
+sent earlier for that bug, one write will end up getting lost in the
+worst case (host d/c, guest write, host connect).
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index 9f8608a..bfc94a5 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -140,6 +140,9 @@ static void qemu_chr_generic_open_bh(void *opaque)
+ {
+ CharDriverState *s = opaque;
+ qemu_chr_be_event(s, CHR_EVENT_OPENED);
++ if (s->write_blocked) {
++ char_write_unblocked(s);
++ }
+ qemu_bh_delete(s->bh);
+ s->bh = NULL;
+ }
+@@ -2244,6 +2247,17 @@ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ ret = send_all(chr, s->fd, buf, len);
+ if (ret == -1 && errno == EPIPE) {
+ tcp_closed(chr);
++
++ if (chr->chr_enable_write_fd_handler && chr->chr_write_unblocked) {
++ /*
++ * Since we haven't written out anything, let's say
++ * we're throttled. This will prevent any output from
++ * the guest getting lost if host-side chardev goes
++ * down. Unthrottle when we re-connect.
++ */
++ chr->write_blocked = true;
++ return 0;
++ }
+ }
+ return ret;
+ } else {
+--
+1.7.12.1
+
--- /dev/null
+From feeea13d5eac9c0dd5da1ee7639a57ca519f4c91 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 21 Mar 2011 22:06:41 +0100
+Subject: [PATCH] virtio-console: Enable port throttling when chardev is slow
+ to consume data
+
+When a chardev indicates it can't accept more data, we tell the
+virtio-serial code to stop sending us any more data till we tell
+otherwise. This helps in guests continuing to run normally while the vq
+keeps getting full and eventually the guest stops queueing more data.
+As soon as the chardev indicates it can accept more data, start pushing!
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ hw/virtio-console.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/virtio-console.c b/hw/virtio-console.c
+index 066590c..2b5e515 100644
+--- a/hw/virtio-console.c
++++ b/hw/virtio-console.c
+@@ -20,6 +20,16 @@ typedef struct VirtConsole {
+ CharDriverState *chr;
+ } VirtConsole;
+
++/*
++ * Callback function that's called from chardevs when backend becomes
++ * writable.
++ */
++static void chr_write_unblocked(void *opaque)
++{
++ VirtConsole *vcon = opaque;
++
++ virtio_serial_throttle_port(&vcon->port, false);
++}
+
+ /* Callback function that's called when the guest sends us data */
+ static ssize_t flush_buf(VirtIOSerialPort *port, const uint8_t *buf, size_t len)
+@@ -110,6 +120,7 @@ static const QemuChrHandlers chr_handlers = {
+ .fd_can_read = chr_can_read,
+ .fd_read = chr_read,
+ .fd_event = chr_event,
++ .fd_write_unblocked = chr_write_unblocked,
+ };
+
+ static int virtconsole_initfn(VirtIOSerialPort *port)
+--
+1.7.12.1
+
--- /dev/null
+From 2d1cf5b1be8cbd9c5a8c5f96ca699676fc1b23a7 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 22 Mar 2011 12:27:59 +0200
+Subject: [PATCH] spice-qemu-char.c: add throttling
+
+BZ: 672191
+
+upstream: not submitted (explained below)
+
+Adds throttling support to spicevmc chardev. Uses a timer to avoid recursing:
+1. spice-server: reds.c: read_from_vdi_port
+2. qemu: spice-qemu-char.c: vmc_read
+3. chr_write_unblocked
+ (calls virtio_serial_throttle_port(port, false))
+4. qemu: virtio ...
+5. qemu: spice-qemu-char.c: spice_chr_write
+6. qemu: spice-qemu-char.c: wakeup (calls into spice-server)
+7. spice-server: ...
+8. qemu: spice-qemu-char.c: vmc_read
+
+Instead, in vmc_read if we were throttled and we are just about to return
+all the bytes we will set a timer to be triggered immediately to call
+chr_write_unblocked. Then we return after 2 above, and 3 is called from the
+timer callback. This also means we can later remove some ugly recursion protection
+from spice-server.
+
+The other tricky point in this patch is not returning the leftover chunk twice.
+When we throttle, by definition we have data that spice server didn't consume.
+It is being kept by virtio-serial, and by us. The next vmc_read callback needs
+to not return it, but just do unthrottling. Then virtio will give us the remaining
+chunk as usual in spice_chr_write, and we will pass it to spice server in the
+next vmc_read.
+
+This patch relies on Amit's series to expose throttling to chardev's, which
+was not accepted upstream, and will not be accepted upstream until the mainloop
+is reworked to use glib.
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ spice-qemu-char.c | 39 +++++++++++++++++++++++++++++++++++----
+ 1 file changed, 35 insertions(+), 4 deletions(-)
+
+diff --git a/spice-qemu-char.c b/spice-qemu-char.c
+index 09aa22d..fba2bfb 100644
+--- a/spice-qemu-char.c
++++ b/spice-qemu-char.c
+@@ -1,4 +1,6 @@
+ #include "config-host.h"
++#include "qemu-common.h"
++#include "qemu-timer.h"
+ #include "trace.h"
+ #include "ui/qemu-spice.h"
+ #include <spice.h>
+@@ -25,6 +27,7 @@ typedef struct SpiceCharDriver {
+ uint8_t *datapos;
+ ssize_t bufsize, datalen;
+ uint32_t debug;
++ QEMUTimer *unblock_timer;
+ } SpiceCharDriver;
+
+ static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
+@@ -50,6 +53,17 @@ static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
+ return out;
+ }
+
++static void spice_chr_unblock(void *opaque)
++{
++ SpiceCharDriver *scd = opaque;
++
++ if (scd->chr->chr_write_unblocked == NULL) {
++ dprintf(scd, 1, "%s: backend doesn't support unthrottling.\n", __func__);
++ return;
++ }
++ scd->chr->chr_write_unblocked(scd->chr->handler_opaque);
++}
++
+ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
+ {
+ SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
+@@ -61,9 +75,16 @@ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
+ scd->datapos += bytes;
+ scd->datalen -= bytes;
+ assert(scd->datalen >= 0);
+- if (scd->datalen == 0) {
+- scd->datapos = 0;
+- }
++ }
++ if (scd->datalen == 0 && scd->chr->write_blocked) {
++ dprintf(scd, 1, "%s: unthrottling (%d)\n", __func__, bytes);
++ scd->chr->write_blocked = false;
++ /*
++ * set a timer instead of calling scd->chr->chr_write_unblocked directly,
++ * because that will call back into spice_chr_write (see
++ * virtio-console.c:chr_write_unblocked), which is unwanted.
++ */
++ qemu_mod_timer(scd->unblock_timer, 0);
+ }
+ trace_spice_vmc_read(bytes, len);
+ return bytes;
+@@ -135,6 +156,7 @@ static void vmc_unregister_interface(SpiceCharDriver *scd)
+ static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ {
+ SpiceCharDriver *s = chr->opaque;
++ int read_bytes;
+
+ dprintf(s, 2, "%s: %d\n", __func__, len);
+ vmc_register_interface(s);
+@@ -147,7 +169,15 @@ static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ s->datapos = s->buffer;
+ s->datalen = len;
+ spice_server_char_device_wakeup(&s->sin);
+- return len;
++ read_bytes = len - s->datalen;
++ if (read_bytes != len) {
++ dprintf(s, 1, "%s: throttling: %d < %d (%zd)\n", __func__,
++ read_bytes, len, s->bufsize);
++ s->chr->write_blocked = true;
++ /* We'll get passed in the unconsumed data with the next call */
++ s->datalen = 0;
++ }
++ return read_bytes;
+ }
+
+ static void spice_chr_close(struct CharDriverState *chr)
+@@ -225,6 +255,7 @@ CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
+ chr->chr_close = spice_chr_close;
+ chr->chr_guest_open = spice_chr_guest_open;
+ chr->chr_guest_close = spice_chr_guest_close;
++ s->unblock_timer = qemu_new_timer_ms(vm_clock, spice_chr_unblock, s);
+
+ #if SPICE_SERVER_VERSION < 0x000901
+ /* See comment in vmc_state() */
+--
+1.7.12.1
+
--- /dev/null
+From fb481324641fc36e6f58aca8d8e5ada0536332f2 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 22 Mar 2011 12:28:00 +0200
+Subject: [PATCH] spice-qemu-char.c: remove intermediate buffer
+
+BZ: 672191
+upstream: not submitted (explained below)
+
+virtio-serial's buffer is valid when it calls us, and we don't
+access it otherwise: vmc_read is only called in response to wakeup,
+or else we set datalen=0 and throttle. Then vmc_read is called back,
+we return 0 (not accessing the buffer) and set the timer to unthrottle.
+
+Also make datalen int and not ssize_t (to fit spice_chr_write signature).
+
+This relied on the previous patch that introduces throttling, which
+can't go upstream right now as explained in that patch.
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ spice-qemu-char.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/spice-qemu-char.c b/spice-qemu-char.c
+index fba2bfb..ef44bc0 100644
+--- a/spice-qemu-char.c
++++ b/spice-qemu-char.c
+@@ -23,9 +23,8 @@ typedef struct SpiceCharDriver {
+ SpiceCharDeviceInstance sin;
+ char *subtype;
+ bool active;
+- uint8_t *buffer;
+- uint8_t *datapos;
+- ssize_t bufsize, datalen;
++ const uint8_t *datapos;
++ int datalen;
+ uint32_t debug;
+ QEMUTimer *unblock_timer;
+ } SpiceCharDriver;
+@@ -69,7 +68,7 @@ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
+ SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
+ int bytes = MIN(len, scd->datalen);
+
+- dprintf(scd, 2, "%s: %p %d/%d/%zd\n", __func__, scd->datapos, len, bytes, scd->datalen);
++ dprintf(scd, 2, "%s: %p %d/%d/%d\n", __func__, scd->datapos, len, bytes, scd->datalen);
+ if (bytes > 0) {
+ memcpy(buf, scd->datapos, bytes);
+ scd->datapos += bytes;
+@@ -161,18 +160,13 @@ static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+ dprintf(s, 2, "%s: %d\n", __func__, len);
+ vmc_register_interface(s);
+ assert(s->datalen == 0);
+- if (s->bufsize < len) {
+- s->bufsize = len;
+- s->buffer = g_realloc(s->buffer, s->bufsize);
+- }
+- memcpy(s->buffer, buf, len);
+- s->datapos = s->buffer;
++ s->datapos = buf;
+ s->datalen = len;
+ spice_server_char_device_wakeup(&s->sin);
+ read_bytes = len - s->datalen;
+ if (read_bytes != len) {
+- dprintf(s, 1, "%s: throttling: %d < %d (%zd)\n", __func__,
+- read_bytes, len, s->bufsize);
++ dprintf(s, 1, "%s: throttling: %d < %d\n", __func__,
++ read_bytes, len);
+ s->chr->write_blocked = true;
+ /* We'll get passed in the unconsumed data with the next call */
+ s->datalen = 0;
+--
+1.7.12.1
+
--- /dev/null
+From 539b42dbeefbf2fc7dc40ab7c1b5d9592a87d9b8 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 19 Jul 2011 10:56:19 +0200
+Subject: [PATCH] usb-redir: Add flow control support
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ hw/usb/redirect.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 8b22c80..b7c7f1e 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -229,12 +229,22 @@ static int usbredir_read(void *priv, uint8_t *data, int count)
+ static int usbredir_write(void *priv, uint8_t *data, int count)
+ {
+ USBRedirDevice *dev = priv;
++ int r;
+
+- if (!dev->cs->opened) {
++ if (!dev->cs->opened || dev->cs->write_blocked) {
+ return 0;
+ }
+
+- return qemu_chr_fe_write(dev->cs, data, count);
++ r = qemu_chr_fe_write(dev->cs, data, count);
++
++ if (r < 0) {
++ if (dev->cs->write_blocked) {
++ return 0;
++ }
++ return -1;
++ }
++
++ return r;
+ }
+
+ /*
+@@ -867,10 +877,18 @@ static void usbredir_chardev_event(void *opaque, int event)
+ }
+ }
+
++static void usbredir_chardev_write_unblocked(void *opaque)
++{
++ USBRedirDevice *dev = opaque;
++
++ usbredirparser_do_write(dev->parser);
++}
++
+ static const QemuChrHandlers usbredir_chr_handlers = {
+ .fd_can_read = usbredir_chardev_can_read,
+ .fd_read = usbredir_chardev_read,
+ .fd_event = usbredir_chardev_event,
++ .fd_write_unblocked = usbredir_chardev_write_unblocked,
+ };
+
+ /*
+--
+1.7.12.1
+
--- /dev/null
+From f3551d3640f3436b0e5505fd208cbd7bbfef411f Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Fri, 2 Dec 2011 15:42:55 +0530
+Subject: [PATCH] char: Disable write callback if throttled chardev is
+ detached
+
+If a throttled chardev is detached from the frontend device, all future
+callbacks should be suppressed. Not doing this results in a segfault.
+
+Bugzilla: 745758
+Upstream: Not applicable, since throttling is a RHEL6-only feature.
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ qemu-char.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/qemu-char.c b/qemu-char.c
+index bfc94a5..67a6d73 100644
+--- a/qemu-char.c
++++ b/qemu-char.c
+@@ -223,6 +223,11 @@ void qemu_chr_add_handlers(CharDriverState *s,
+ ++s->avail_connections;
+ }
+ if (!handlers) {
++ if (s->write_blocked) {
++ /* Ensure we disable the callback if we were throttled */
++ s->chr_disable_write_fd_handler(s);
++ /* s->write_blocked is cleared below */
++ }
+ handlers = &null_handlers;
+ }
+ s->chr_can_read = handlers->fd_can_read;
+--
+1.7.12.1
+
--- /dev/null
+From 9903053345528aa8eebb16365b2ece77c58c0cf6 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 14 Nov 2012 15:06:35 +0200
+Subject: [PATCH 1/2] hw/virtio-serial-bus: post_load send_event when vm is
+ running
+
+Add a new timer based on vm_clock for 1 ns in the future from post_load
+to do the event send in case host_connected differs between migration
+source and target.
+
+RHBZ: 867366
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+---
+ hw/virtio-serial-bus.c | 54 ++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 44 insertions(+), 10 deletions(-)
+
+diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
+index d20bd8b..a028877 100644
+--- a/hw/virtio-serial-bus.c
++++ b/hw/virtio-serial-bus.c
+@@ -53,6 +53,15 @@ struct VirtIOSerial {
+ uint32_t *ports_map;
+
+ struct virtio_console_config config;
++
++ struct VirtIOSerialPostLoad {
++ QEMUTimer *timer;
++ int nr_active_ports;
++ struct VirtIOSerialPostLoadPort {
++ VirtIOSerialPort *port;
++ uint8_t host_connected;
++ } *connected;
++ } post_load;
+ };
+
+ static VirtIOSerialPort *find_port_by_id(VirtIOSerial *vser, uint32_t id)
+@@ -626,6 +635,29 @@ static void virtio_serial_save(QEMUFile *f, void *opaque)
+ }
+ }
+
++static void virtio_serial_post_load_timer_cb(void *opaque)
++{
++ int i;
++ VirtIOSerial *s = opaque;
++ VirtIOSerialPort *port;
++ uint8_t host_connected;
++
++ for (i = 0 ; i < s->post_load.nr_active_ports; ++i) {
++ port = s->post_load.connected[i].port;
++ host_connected = s->post_load.connected[i].host_connected;
++ if (host_connected != port->host_connected) {
++ /*
++ * We have to let the guest know of the host connection
++ * status change
++ */
++ send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN,
++ port->host_connected);
++ }
++ }
++ g_free(s->post_load.connected);
++ s->post_load.connected = NULL;
++}
++
+ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
+ {
+ VirtIOSerial *s = opaque;
+@@ -673,10 +705,13 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
+
+ qemu_get_be32s(f, &nr_active_ports);
+
++ s->post_load.nr_active_ports = nr_active_ports;
++ s->post_load.connected =
++ g_malloc0(sizeof(*s->post_load.connected) * nr_active_ports);
++
+ /* Items in struct VirtIOSerialPort */
+ for (i = 0; i < nr_active_ports; i++) {
+ uint32_t id;
+- bool host_connected;
+
+ id = qemu_get_be32(f);
+ port = find_port_by_id(s, id);
+@@ -685,15 +720,8 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
+ }
+
+ port->guest_connected = qemu_get_byte(f);
+- host_connected = qemu_get_byte(f);
+- if (host_connected != port->host_connected) {
+- /*
+- * We have to let the guest know of the host connection
+- * status change
+- */
+- send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN,
+- port->host_connected);
+- }
++ s->post_load.connected[i].port = port;
++ s->post_load.connected[i].host_connected = qemu_get_byte(f);
+
+ if (version_id > 2) {
+ uint32_t elem_popped;
+@@ -718,6 +746,7 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
+ }
+ }
+ }
++ qemu_mod_timer(s->post_load.timer, 1);
+ return 0;
+ }
+
+@@ -967,6 +996,9 @@ VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf)
+ register_savevm(dev, "virtio-console", -1, 3, virtio_serial_save,
+ virtio_serial_load, vser);
+
++ vser->post_load.timer = qemu_new_timer_ns(vm_clock,
++ virtio_serial_post_load_timer_cb, vser);
++
+ return vdev;
+ }
+
+@@ -979,6 +1011,8 @@ void virtio_serial_exit(VirtIODevice *vdev)
+ g_free(vser->ivqs);
+ g_free(vser->ovqs);
+ g_free(vser->ports_map);
++ g_free(vser->post_load.connected);
++ qemu_free_timer(vser->post_load.timer);
+
+ virtio_cleanup(vdev);
+ }
+--
+1.8.0
+
--- /dev/null
+From 5b6831175b21aa5a3405a21dd79e1ef0a81bbdb3 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Fri, 16 Nov 2012 16:24:47 +0200
+Subject: [PATCH 2/2] hw/virtio-serial-bus: replay guest open on destination
+
+This is rewrite of a patch carried in Fedora previously based
+on new code upstream, here is the original message, it still applies:
+(the original fedora patch was commit id
+a9bc20afc1f0604ee81c23b7c67d627e51d2e8d4, this is useful for grepping in
+logs, it isn't in upstream)
+
+When migrating a host with with a spice agent running the mouse becomes
+non operational after the migration. This is rhbz #725965.
+
+The problem is that after migration spice doesn't know the guest agent
+is open. Spice is just a char dev here. And a chardev cannot query it's
+device, the device has to let the chardev know when it is open. Right
+now after migration the chardev which is recreated is in it's default
+state, which assumes the guest is disconnected.
+
+Char devices carry no information across migration, but the
+virtio-serial does already carry the guest_connected state. This patch
+passes that bit to the chardev.
+---
+ hw/virtio-serial-bus.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
+index a028877..a6ec2df 100644
+--- a/hw/virtio-serial-bus.c
++++ b/hw/virtio-serial-bus.c
+@@ -641,6 +641,7 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
+ VirtIOSerial *s = opaque;
+ VirtIOSerialPort *port;
+ uint8_t host_connected;
++ VirtIOSerialPortClass *vsc;
+
+ for (i = 0 ; i < s->post_load.nr_active_ports; ++i) {
+ port = s->post_load.connected[i].port;
+@@ -653,6 +654,11 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
+ send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN,
+ port->host_connected);
+ }
++ vsc = VIRTIO_SERIAL_PORT_GET_CLASS(port);
++ if (port->guest_connected && vsc->guest_open) {
++ /* replay guest open */
++ vsc->guest_open(port);
++ }
+ }
+ g_free(s->post_load.connected);
+ s->post_load.connected = NULL;
+--
+1.8.0
+
--- /dev/null
+From 4b9d4103e5ff91b022ee8e9522040829f009543a Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 21 Aug 2012 13:51:32 +0300
+Subject: [PATCH] qxl: disallow unknown revisions
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 59bf822..71879fe 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1873,9 +1873,9 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+ break;
+ #endif
+ default:
+- pci_device_rev = QXL_DEFAULT_REVISION;
+- io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
+- break;
++ error_report("Invalid revision %d for qxl device (max %d)",
++ qxl->revision, QXL_DEFAULT_REVISION);
++ return -1;
+ }
+
+ pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
+--
+1.7.12.1
+
--- /dev/null
+From 1c74b60fa972c9489f9cf8fa59165dedd0c23de2 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 4 Sep 2012 11:39:41 +0200
+Subject: [PATCH] spice: make number of surfaces runtime-configurable.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 31 +++++++++++++++++--------------
+ hw/qxl.h | 3 +--
+ ui/spice-display.c | 5 ++++-
+ ui/spice-display.h | 3 +--
+ 4 files changed, 23 insertions(+), 19 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 71879fe..83df499 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -238,7 +238,8 @@ static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice *qxl)
+ {
+ trace_qxl_spice_destroy_surfaces_complete(qxl->id);
+ qemu_mutex_lock(&qxl->track_lock);
+- memset(&qxl->guest_surfaces.cmds, 0, sizeof(qxl->guest_surfaces.cmds));
++ memset(qxl->guest_surfaces.cmds, 0,
++ sizeof(qxl->guest_surfaces.cmds) * qxl->ssd.num_surfaces);
+ qxl->guest_surfaces.count = 0;
+ qemu_mutex_unlock(&qxl->track_lock);
+ }
+@@ -347,7 +348,7 @@ static void init_qxl_rom(PCIQXLDevice *d)
+ rom->slot_id_bits = MEMSLOT_SLOT_BITS;
+ rom->slots_start = 1;
+ rom->slots_end = NUM_MEMSLOTS - 1;
+- rom->n_surfaces = cpu_to_le32(NUM_SURFACES);
++ rom->n_surfaces = cpu_to_le32(d->ssd.num_surfaces);
+
+ for (i = 0, n = 0; i < ARRAY_SIZE(qxl_modes); i++) {
+ fb = qxl_modes[i].y_res * qxl_modes[i].stride;
+@@ -451,9 +452,9 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext)
+ }
+ uint32_t id = le32_to_cpu(cmd->surface_id);
+
+- if (id >= NUM_SURFACES) {
++ if (id >= qxl->ssd.num_surfaces) {
+ qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
+- NUM_SURFACES);
++ qxl->ssd.num_surfaces);
+ return 1;
+ }
+ qemu_mutex_lock(&qxl->track_lock);
+@@ -529,7 +530,7 @@ static void interface_get_init_info(QXLInstance *sin, QXLDevInitInfo *info)
+ info->num_memslots_groups = NUM_MEMSLOTS_GROUPS;
+ info->internal_groupslot_id = 0;
+ info->qxl_ram_size = le32_to_cpu(qxl->shadow_rom.num_pages) << TARGET_PAGE_BITS;
+- info->n_surfaces = NUM_SURFACES;
++ info->n_surfaces = qxl->ssd.num_surfaces;
+ }
+
+ static const char *qxl_mode_to_string(int mode)
+@@ -1438,7 +1439,7 @@ async_common:
+ QXLCookie *cookie = NULL;
+ QXLRect update = d->ram->update_area;
+
+- if (d->ram->update_surface > NUM_SURFACES) {
++ if (d->ram->update_surface > d->ssd.num_surfaces) {
+ qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+ d->ram->update_surface);
+ return;
+@@ -1538,7 +1539,7 @@ async_common:
+ }
+ break;
+ case QXL_IO_DESTROY_SURFACE_WAIT:
+- if (val >= NUM_SURFACES) {
++ if (val >= d->ssd.num_surfaces) {
+ qxl_set_guest_bug(d, "QXL_IO_DESTROY_SURFACE (async=%d):"
+ "%" PRIu64 " >= NUM_SURFACES", async, val);
+ goto cancel_async;
+@@ -1717,7 +1718,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
+ vram_start = (intptr_t)memory_region_get_ram_ptr(&qxl->vram_bar);
+
+ /* dirty the off-screen surfaces */
+- for (i = 0; i < NUM_SURFACES; i++) {
++ for (i = 0; i < qxl->ssd.num_surfaces; i++) {
+ QXLSurfaceCmd *cmd;
+ intptr_t surface_offset;
+ int surface_size;
+@@ -1845,7 +1846,6 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+ qxl->mode = QXL_MODE_UNDEFINED;
+ qxl->generation = 1;
+ qxl->num_memslots = NUM_MEMSLOTS;
+- qxl->num_surfaces = NUM_SURFACES;
+ qemu_mutex_init(&qxl->track_lock);
+ qemu_mutex_init(&qxl->async_lock);
+ qxl->current_async = QXL_UNDEFINED_IO;
+@@ -1887,6 +1887,7 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+ init_qxl_rom(qxl);
+ init_qxl_ram(qxl);
+
++ qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
+ memory_region_init_ram(&qxl->vram_bar, "qxl.vram", qxl->vram_size);
+ vmstate_register_ram(&qxl->vram_bar, &qxl->pci.qdev);
+ memory_region_init_alias(&qxl->vram32_bar, "qxl.vram32", &qxl->vram_bar,
+@@ -2052,8 +2053,8 @@ static int qxl_post_load(void *opaque, int version)
+ qxl_create_guest_primary(d, 1, QXL_SYNC);
+
+ /* replay surface-create and cursor-set commands */
+- cmds = g_malloc0(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
+- for (in = 0, out = 0; in < NUM_SURFACES; in++) {
++ cmds = g_malloc0(sizeof(QXLCommandExt) * (d->ssd.num_surfaces + 1));
++ for (in = 0, out = 0; in < d->ssd.num_surfaces; in++) {
+ if (d->guest_surfaces.cmds[in] == 0) {
+ continue;
+ }
+@@ -2153,9 +2154,10 @@ static VMStateDescription qxl_vmstate = {
+ qxl_memslot, struct guest_slots),
+ VMSTATE_STRUCT(guest_primary.surface, PCIQXLDevice, 0,
+ qxl_surface, QXLSurfaceCreate),
+- VMSTATE_INT32_EQUAL(num_surfaces, PCIQXLDevice),
+- VMSTATE_ARRAY(guest_surfaces.cmds, PCIQXLDevice, NUM_SURFACES, 0,
+- vmstate_info_uint64, uint64_t),
++ VMSTATE_INT32_EQUAL(ssd.num_surfaces, PCIQXLDevice),
++ VMSTATE_VARRAY_INT32(guest_surfaces.cmds, PCIQXLDevice,
++ ssd.num_surfaces, 0,
++ vmstate_info_uint64, uint64_t),
+ VMSTATE_UINT64(guest_cursor, PCIQXLDevice),
+ VMSTATE_END_OF_LIST()
+ },
+@@ -2183,6 +2185,7 @@ static Property qxl_properties[] = {
+ DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice, vram32_size_mb, -1),
+ DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
+ DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
++ DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
+ DEFINE_PROP_END_OF_LIST(),
+ };
+
+diff --git a/hw/qxl.h b/hw/qxl.h
+index 9cfedb7..5553824 100644
+--- a/hw/qxl.h
++++ b/hw/qxl.h
+@@ -40,7 +40,6 @@ typedef struct PCIQXLDevice {
+ uint32_t revision;
+
+ int32_t num_memslots;
+- int32_t num_surfaces;
+
+ uint32_t current_async;
+ QemuMutex async_lock;
+@@ -65,7 +64,7 @@ typedef struct PCIQXLDevice {
+ } guest_primary;
+
+ struct surfaces {
+- QXLPHYSICAL cmds[NUM_SURFACES];
++ QXLPHYSICAL *cmds;
+ uint32_t count;
+ uint32_t max;
+ } guest_surfaces;
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 1c31418..99bc665 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -317,6 +317,9 @@ void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd, DisplayState *ds)
+ qemu_mutex_init(&ssd->lock);
+ ssd->mouse_x = -1;
+ ssd->mouse_y = -1;
++ if (ssd->num_surfaces == 0) {
++ ssd->num_surfaces = 1024;
++ }
+ ssd->bufsize = (16 * 1024 * 1024);
+ ssd->buf = g_malloc(ssd->bufsize);
+ }
+@@ -427,7 +430,7 @@ static void interface_get_init_info(QXLInstance *sin, QXLDevInitInfo *info)
+ info->num_memslots_groups = NUM_MEMSLOTS_GROUPS;
+ info->internal_groupslot_id = 0;
+ info->qxl_ram_size = ssd->bufsize;
+- info->n_surfaces = NUM_SURFACES;
++ info->n_surfaces = ssd->num_surfaces;
+ }
+
+ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index bcff114..512ab78 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -32,8 +32,6 @@
+ #define MEMSLOT_GROUP_GUEST 1
+ #define NUM_MEMSLOTS_GROUPS 2
+
+-#define NUM_SURFACES 1024
+-
+ /*
+ * Internal enum to differenciate between options for
+ * io calls that have a sync (old) version and an _async (new)
+@@ -80,6 +78,7 @@ struct SimpleSpiceDisplay {
+ QXLInstance qxl;
+ uint32_t unique;
+ QemuPfConv *conv;
++ int32_t num_surfaces;
+
+ QXLRect dirty;
+ int notify;
+--
+1.7.12.1
+
--- /dev/null
+From 0fe78ffd13555bed86a41acf96cdc15ece961b0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=B8ren=20Sandmann=20Pedersen?= <ssp@redhat.com>
+Date: Tue, 4 Sep 2012 10:14:48 -0400
+Subject: [PATCH] qxl: Add set_client_capabilities() interface to QXLInterface
+
+This new interface lets spice server inform the guest whether
+
+(a) a client is connected
+(b) what capabilities the client has
+
+There is a fixed number (464) of bits reserved for capabilities, and
+when the capabilities bits change, the QXL_INTERRUPT_CLIENT interrupt
+is generated.
+
+Signed-off-by: Soren Sandmann <ssp@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 83df499..d8b67b2 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -946,6 +946,26 @@ static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
+ }
+ }
+
++#if SPICE_SERVER_VERSION >= 0x000b04
++
++/* called from spice server thread context only */
++static void interface_set_client_capabilities(QXLInstance *sin,
++ uint8_t client_present,
++ uint8_t caps[58])
++{
++ PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
++
++ qxl->shadow_rom.client_present = client_present;
++ memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
++ qxl->rom->client_present = client_present;
++ memcpy(qxl->rom->client_capabilities, caps, sizeof(caps));
++ qxl_rom_set_dirty(qxl);
++
++ qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
++}
++
++#endif
++
+ static const QXLInterface qxl_interface = {
+ .base.type = SPICE_INTERFACE_QXL,
+ .base.description = "qxl gpu",
+@@ -967,6 +987,9 @@ static const QXLInterface qxl_interface = {
+ .flush_resources = interface_flush_resources,
+ .async_complete = interface_async_complete,
+ .update_area_complete = interface_update_area_complete,
++#if SPICE_SERVER_VERSION >= 0x000b04
++ .set_client_capabilities = interface_set_client_capabilities,
++#endif
+ };
+
+ static void qxl_enter_vga_mode(PCIQXLDevice *d)
+--
+1.7.12.1
+
--- /dev/null
+From 0dcef831a875505fdaffb824de9e4450273ea53d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=B8ren=20Sandmann=20Pedersen?= <ssp@redhat.com>
+Date: Tue, 4 Sep 2012 10:14:49 -0400
+Subject: [PATCH] Remove #ifdef QXL_COMMAND_FLAG_COMPAT_16BPP
+
+We require spice >= 0.8 now, so this flag is always present.
+
+Signed-off-by: Soren Sandmann <ssp@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index d8b67b2..a6e6cf1 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1361,11 +1361,9 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
+
+ d->mode = QXL_MODE_COMPAT;
+ d->cmdflags = QXL_COMMAND_FLAG_COMPAT;
+-#ifdef QXL_COMMAND_FLAG_COMPAT_16BPP /* new in spice 0.6.1 */
+ if (mode->bits == 16) {
+ d->cmdflags |= QXL_COMMAND_FLAG_COMPAT_16BPP;
+ }
+-#endif
+ d->shadow_rom.mode = cpu_to_le32(modenr);
+ d->rom->mode = cpu_to_le32(modenr);
+ qxl_rom_set_dirty(d);
+--
+1.7.12.1
+
--- /dev/null
+From 244ff52221b4c4181422861a930d8f755a1a5c08 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 5 Sep 2012 08:25:08 +0200
+Subject: [PATCH] spice: switch to queue for vga mode updates
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 6 +++---
+ ui/spice-display.c | 25 ++++++++++++++-----------
+ ui/spice-display.h | 3 ++-
+ 3 files changed, 19 insertions(+), 15 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index a6e6cf1..2ec4341 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -599,9 +599,9 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
+ case QXL_MODE_VGA:
+ ret = false;
+ qemu_mutex_lock(&qxl->ssd.lock);
+- if (qxl->ssd.update != NULL) {
+- update = qxl->ssd.update;
+- qxl->ssd.update = NULL;
++ update = QTAILQ_FIRST(&qxl->ssd.updates);
++ if (update != NULL) {
++ QTAILQ_REMOVE(&qxl->ssd.updates, update, next);
+ *ext = update->ext;
+ ret = true;
+ }
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 99bc665..59c5fd7 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -164,7 +164,7 @@ int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd)
+ #endif
+ }
+
+-static SimpleSpiceUpdate *qemu_spice_create_update(SimpleSpiceDisplay *ssd)
++static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ {
+ SimpleSpiceUpdate *update;
+ QXLDrawable *drawable;
+@@ -175,7 +175,7 @@ static SimpleSpiceUpdate *qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ struct timespec time_space;
+
+ if (qemu_spice_rect_is_empty(&ssd->dirty)) {
+- return NULL;
++ return;
+ };
+
+ trace_qemu_spice_create_update(
+@@ -239,7 +239,7 @@ static SimpleSpiceUpdate *qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ cmd->data = (uintptr_t)drawable;
+
+ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+- return update;
++ QTAILQ_INSERT_TAIL(&ssd->updates, update, next);
+ }
+
+ /*
+@@ -315,6 +315,7 @@ void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd, DisplayState *ds)
+ {
+ ssd->ds = ds;
+ qemu_mutex_init(&ssd->lock);
++ QTAILQ_INIT(&ssd->updates);
+ ssd->mouse_x = -1;
+ ssd->mouse_y = -1;
+ if (ssd->num_surfaces == 0) {
+@@ -345,6 +346,8 @@ void qemu_spice_display_update(SimpleSpiceDisplay *ssd,
+
+ void qemu_spice_display_resize(SimpleSpiceDisplay *ssd)
+ {
++ SimpleSpiceUpdate *update;
++
+ dprint(1, "%s:\n", __FUNCTION__);
+
+ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+@@ -352,9 +355,9 @@ void qemu_spice_display_resize(SimpleSpiceDisplay *ssd)
+ ssd->conv = NULL;
+
+ qemu_mutex_lock(&ssd->lock);
+- if (ssd->update != NULL) {
+- qemu_spice_destroy_update(ssd, ssd->update);
+- ssd->update = NULL;
++ while ((update = QTAILQ_FIRST(&ssd->updates)) != NULL) {
++ QTAILQ_REMOVE(&ssd->updates, update, next);
++ qemu_spice_destroy_update(ssd, update);
+ }
+ qemu_mutex_unlock(&ssd->lock);
+ qemu_spice_destroy_host_primary(ssd);
+@@ -384,8 +387,8 @@ void qemu_spice_display_refresh(SimpleSpiceDisplay *ssd)
+ vga_hw_update();
+
+ qemu_mutex_lock(&ssd->lock);
+- if (ssd->update == NULL) {
+- ssd->update = qemu_spice_create_update(ssd);
++ if (QTAILQ_EMPTY(&ssd->updates)) {
++ qemu_spice_create_update(ssd);
+ ssd->notify++;
+ }
+ qemu_spice_cursor_refresh_unlocked(ssd);
+@@ -442,9 +445,9 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
+ dprint(3, "%s:\n", __FUNCTION__);
+
+ qemu_mutex_lock(&ssd->lock);
+- if (ssd->update != NULL) {
+- update = ssd->update;
+- ssd->update = NULL;
++ update = QTAILQ_FIRST(&ssd->updates);
++ if (update != NULL) {
++ QTAILQ_REMOVE(&ssd->updates, update, next);
+ *ext = update->ext;
+ ret = true;
+ }
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index 512ab78..3fcb6fe 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -92,7 +92,7 @@ struct SimpleSpiceDisplay {
+ * to them must be protected by the lock.
+ */
+ QemuMutex lock;
+- SimpleSpiceUpdate *update;
++ QTAILQ_HEAD(, SimpleSpiceUpdate) updates;
+ QEMUCursor *cursor;
+ int mouse_x, mouse_y;
+ };
+@@ -102,6 +102,7 @@ struct SimpleSpiceUpdate {
+ QXLImage image;
+ QXLCommandExt ext;
+ uint8_t *bitmap;
++ QTAILQ_ENTRY(SimpleSpiceUpdate) next;
+ };
+
+ int qemu_spice_rect_is_empty(const QXLRect* r);
+--
+1.7.12.1
+
--- /dev/null
+From 6d196973a9adba583cf9bbc5a4196a58f2cb0eb3 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 5 Sep 2012 08:52:23 +0200
+Subject: [PATCH] spice: split qemu_spice_create_update
+
+Creating one function which creates a single update for a given
+rectangle. And one (for now) pretty simple wrapper around it to
+queue up screen updates for the dirty region.
+
+[ v2: also update bounding box ]
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ ui/spice-display.c | 31 ++++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 59c5fd7..6f68f28 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -164,7 +164,8 @@ int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd)
+ #endif
+ }
+
+-static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
++static void qemu_spice_create_one_update(SimpleSpiceDisplay *ssd,
++ QXLRect *rect)
+ {
+ SimpleSpiceUpdate *update;
+ QXLDrawable *drawable;
+@@ -174,24 +175,20 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ int by, bw, bh;
+ struct timespec time_space;
+
+- if (qemu_spice_rect_is_empty(&ssd->dirty)) {
+- return;
+- };
+-
+ trace_qemu_spice_create_update(
+- ssd->dirty.left, ssd->dirty.right,
+- ssd->dirty.top, ssd->dirty.bottom);
++ rect->left, rect->right,
++ rect->top, rect->bottom);
+
+ update = g_malloc0(sizeof(*update));
+ drawable = &update->drawable;
+ image = &update->image;
+ cmd = &update->ext.cmd;
+
+- bw = ssd->dirty.right - ssd->dirty.left;
+- bh = ssd->dirty.bottom - ssd->dirty.top;
++ bw = rect->right - rect->left;
++ bh = rect->bottom - rect->top;
+ update->bitmap = g_malloc(bw * bh * 4);
+
+- drawable->bbox = ssd->dirty;
++ drawable->bbox = *rect;
+ drawable->clip.type = SPICE_CLIP_TYPE_NONE;
+ drawable->effect = QXL_EFFECT_OPAQUE;
+ drawable->release_info.id = (uintptr_t)update;
+@@ -226,8 +223,8 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ }
+
+ src = ds_get_data(ssd->ds) +
+- ssd->dirty.top * ds_get_linesize(ssd->ds) +
+- ssd->dirty.left * ds_get_bytes_per_pixel(ssd->ds);
++ rect->top * ds_get_linesize(ssd->ds) +
++ rect->left * ds_get_bytes_per_pixel(ssd->ds);
+ dst = update->bitmap;
+ for (by = 0; by < bh; by++) {
+ qemu_pf_conv_run(ssd->conv, dst, src, bw);
+@@ -238,10 +235,18 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ cmd->type = QXL_CMD_DRAW;
+ cmd->data = (uintptr_t)drawable;
+
+- memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+ QTAILQ_INSERT_TAIL(&ssd->updates, update, next);
+ }
+
++static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
++{
++ if (qemu_spice_rect_is_empty(&ssd->dirty)) {
++ return;
++ };
++ qemu_spice_create_one_update(ssd, &ssd->dirty);
++ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
++}
++
+ /*
+ * Called from spice server thread context (via interface_release_ressource)
+ * We do *not* hold the global qemu mutex here, so extra care is needed
+--
+1.7.12.1
+
--- /dev/null
+From 9f4c601032d7a27e8856517a1a020c9988667ed3 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 5 Sep 2012 09:35:57 +0200
+Subject: [PATCH] spice: add screen mirror
+
+Create a screen mirror, keep there a copy of the most recent update
+passed on to spice-server.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ ui/spice-display.c | 32 ++++++++++++++++++++++----------
+ ui/spice-display.h | 1 +
+ 2 files changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 6f68f28..973cd53 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -171,8 +171,8 @@ static void qemu_spice_create_one_update(SimpleSpiceDisplay *ssd,
+ QXLDrawable *drawable;
+ QXLImage *image;
+ QXLCommand *cmd;
+- uint8_t *src, *dst;
+- int by, bw, bh;
++ uint8_t *src, *mirror, *dst;
++ int by, bw, bh, offset, bytes;
+ struct timespec time_space;
+
+ trace_qemu_spice_create_update(
+@@ -216,19 +216,18 @@ static void qemu_spice_create_one_update(SimpleSpiceDisplay *ssd,
+ image->bitmap.palette = 0;
+ image->bitmap.format = SPICE_BITMAP_FMT_32BIT;
+
+- if (ssd->conv == NULL) {
+- PixelFormat dst = qemu_default_pixelformat(32);
+- ssd->conv = qemu_pf_conv_get(&dst, &ssd->ds->surface->pf);
+- assert(ssd->conv);
+- }
+-
+- src = ds_get_data(ssd->ds) +
++ offset =
+ rect->top * ds_get_linesize(ssd->ds) +
+ rect->left * ds_get_bytes_per_pixel(ssd->ds);
++ bytes = ds_get_bytes_per_pixel(ssd->ds) * bw;
++ src = ds_get_data(ssd->ds) + offset;
++ mirror = ssd->ds_mirror + offset;
+ dst = update->bitmap;
+ for (by = 0; by < bh; by++) {
+- qemu_pf_conv_run(ssd->conv, dst, src, bw);
++ memcpy(mirror, src, bytes);
++ qemu_pf_conv_run(ssd->conv, dst, mirror, bw);
+ src += ds_get_linesize(ssd->ds);
++ mirror += ds_get_linesize(ssd->ds);
+ dst += image->bitmap.stride;
+ }
+
+@@ -243,6 +242,17 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ if (qemu_spice_rect_is_empty(&ssd->dirty)) {
+ return;
+ };
++
++ if (ssd->conv == NULL) {
++ PixelFormat dst = qemu_default_pixelformat(32);
++ ssd->conv = qemu_pf_conv_get(&dst, &ssd->ds->surface->pf);
++ assert(ssd->conv);
++ }
++ if (ssd->ds_mirror == NULL) {
++ int size = ds_get_height(ssd->ds) * ds_get_linesize(ssd->ds);
++ ssd->ds_mirror = g_malloc0(size);
++ }
++
+ qemu_spice_create_one_update(ssd, &ssd->dirty);
+ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+ }
+@@ -358,6 +368,8 @@ void qemu_spice_display_resize(SimpleSpiceDisplay *ssd)
+ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+ qemu_pf_conv_put(ssd->conv);
+ ssd->conv = NULL;
++ g_free(ssd->ds_mirror);
++ ssd->ds_mirror = NULL;
+
+ qemu_mutex_lock(&ssd->lock);
+ while ((update = QTAILQ_FIRST(&ssd->updates)) != NULL) {
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index 3fcb6fe..dea41c1 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -72,6 +72,7 @@ typedef struct SimpleSpiceUpdate SimpleSpiceUpdate;
+
+ struct SimpleSpiceDisplay {
+ DisplayState *ds;
++ uint8_t *ds_mirror;
+ void *buf;
+ int bufsize;
+ QXLWorker *worker;
+--
+1.7.12.1
+
--- /dev/null
+From e2da4b3f683ae63a55b8e50903a164f704be9e1d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 5 Sep 2012 10:41:42 +0200
+Subject: [PATCH] spice: send updates only for changed screen content
+
+when creating screen updates go compare the current guest screen
+against the mirror (which holds the most recent update sent), then
+only create updates for the screen areas which did actually change.
+
+[ v2: drop redundant qemu_spice_create_one_update call ]
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ ui/spice-display.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 1 deletion(-)
+
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index 973cd53..d062765 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -239,6 +239,13 @@ static void qemu_spice_create_one_update(SimpleSpiceDisplay *ssd,
+
+ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ {
++ static const int blksize = 32;
++ int blocks = (ds_get_width(ssd->ds) + blksize - 1) / blksize;
++ int dirty_top[blocks];
++ int y, yoff, x, xoff, blk, bw;
++ int bpp = ds_get_bytes_per_pixel(ssd->ds);
++ uint8_t *guest, *mirror;
++
+ if (qemu_spice_rect_is_empty(&ssd->dirty)) {
+ return;
+ };
+@@ -253,7 +260,54 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd)
+ ssd->ds_mirror = g_malloc0(size);
+ }
+
+- qemu_spice_create_one_update(ssd, &ssd->dirty);
++ for (blk = 0; blk < blocks; blk++) {
++ dirty_top[blk] = -1;
++ }
++
++ guest = ds_get_data(ssd->ds);
++ mirror = ssd->ds_mirror;
++ for (y = ssd->dirty.top; y < ssd->dirty.bottom; y++) {
++ yoff = y * ds_get_linesize(ssd->ds);
++ for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) {
++ xoff = x * bpp;
++ blk = x / blksize;
++ bw = MIN(blksize, ssd->dirty.right - x);
++ if (memcmp(guest + yoff + xoff,
++ mirror + yoff + xoff,
++ bw * bpp) == 0) {
++ if (dirty_top[blk] != -1) {
++ QXLRect update = {
++ .top = dirty_top[blk],
++ .bottom = y,
++ .left = x,
++ .right = x + bw,
++ };
++ qemu_spice_create_one_update(ssd, &update);
++ dirty_top[blk] = -1;
++ }
++ } else {
++ if (dirty_top[blk] == -1) {
++ dirty_top[blk] = y;
++ }
++ }
++ }
++ }
++
++ for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) {
++ blk = x / blksize;
++ bw = MIN(blksize, ssd->dirty.right - x);
++ if (dirty_top[blk] != -1) {
++ QXLRect update = {
++ .top = dirty_top[blk],
++ .bottom = ssd->dirty.bottom,
++ .left = x,
++ .right = x + bw,
++ };
++ qemu_spice_create_one_update(ssd, &update);
++ dirty_top[blk] = -1;
++ }
++ }
++
+ memset(&ssd->dirty, 0, sizeof(ssd->dirty));
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 984e5c7aee378a8de44ff54891695115b92fe585 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 7 Sep 2012 21:29:22 +0200
+Subject: [PATCH] qxl: Ignore set_client_capabilities pre/post migrate
+
+The recent introduction of set_client_capabilities has broken
+(seamless) migration by trying to call qxl_send_events pre (seamless
+incoming) and post (*) migration, triggering the following assert:
+qxl_send_events: Assertion `qemu_spice_display_is_running(&d->ssd)' failed.
+
+The solution is easy, pre migration the guest will have already received
+the client caps on the migration source side, and post migration there no
+longer is a guest, so we can simply ignore the set_client_capabilities call
+in both those scenarios.
+
+*) Post migration, so not fatal for to the migration itself, but still a crash
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/qxl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 2ec4341..360f4f6 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -955,6 +955,11 @@ static void interface_set_client_capabilities(QXLInstance *sin,
+ {
+ PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
+
++ if (runstate_check(RUN_STATE_INMIGRATE) ||
++ runstate_check(RUN_STATE_POSTMIGRATE)) {
++ return;
++ }
++
+ qxl->shadow_rom.client_present = client_present;
+ memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
+ qxl->rom->client_present = client_present;
+--
+1.7.12.1
+
--- /dev/null
+From 720192d056402f47a8f71d9ac9bc4b0cf37902ed Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 12 Sep 2012 16:13:27 +0300
+Subject: [PATCH] qxl: add trace-event for QXL_IO_LOG
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 1 +
+ trace-events | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 360f4f6..1ef117a 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1515,6 +1515,7 @@ async_common:
+ qxl_set_mode(d, val, 0);
+ break;
+ case QXL_IO_LOG:
++ trace_qxl_io_log(d->id, d->ram->log_buf);
+ if (d->guestdebug) {
+ fprintf(stderr, "qxl/guest-%d: %" PRId64 ": %s", d->id,
+ qemu_get_clock_ns(vm_clock), d->ram->log_buf);
+diff --git a/trace-events b/trace-events
+index aa79836..80a52d9 100644
+--- a/trace-events
++++ b/trace-events
+@@ -930,6 +930,7 @@ qxl_interface_update_area_complete_rest(int qid, uint32_t num_updated_rects) "%d
+ qxl_interface_update_area_complete_overflow(int qid, int max) "%d max=%d"
+ qxl_interface_update_area_complete_schedule_bh(int qid, uint32_t num_dirty) "%d #dirty=%d"
+ qxl_io_destroy_primary_ignored(int qid, const char *mode) "%d %s"
++qxl_io_log(int qid, const uint8_t *str) "%d %s"
+ qxl_io_read_unexpected(int qid) "%d"
+ qxl_io_unexpected_vga_mode(int qid, uint64_t addr, uint64_t val, const char *desc) "%d 0x%"PRIx64"=%"PRIu64" (%s)"
+ qxl_io_write(int qid, const char *mode, uint64_t addr, uint64_t val, unsigned size, int async) "%d %s addr=%"PRIu64 " val=%"PRIu64" size=%u async=%d"
+--
+1.7.12.1
+
--- /dev/null
+From f5c2bd00890dc32e940e8b2fae09f62f758317eb Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 12 Sep 2012 16:13:28 +0300
+Subject: [PATCH] hw/qxl: support client monitor configuration via device
+
+Until now we used only the agent to change the monitor count and each
+monitor resolution. This patch introduces the qemu part of using the
+device as the mediator instead of the agent via virtio-serial.
+
+Spice (>=0.11.5) calls the new QXLInterface::client_monitors_config,
+which returns wether the interrupt is enabled, and if so and given a non
+NULL monitors config will
+generate an interrupt QXL_INTERRUPT_CLIENT_MONITORS_CONFIG with crc
+checksum for the guest to verify a second call hasn't interfered.
+
+The maximal number of monitors is limited on the QXLRom to 64.
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ configure | 7 ++++++
+ hw/qxl.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ trace-events | 6 ++++-
+ 3 files changed, 91 insertions(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index f528146..83c478c 100755
+--- a/configure
++++ b/configure
+@@ -2706,6 +2706,9 @@ EOF
+ if $pkg_config --atleast-version=0.12.0 spice-protocol >/dev/null 2>&1; then
+ spice_qxl_io_monitors_config_async="yes"
+ fi
++ if $pkg_config --atleast-version=0.12.2 spice-protocol > /dev/null 2>&1; then
++ spice_qxl_client_monitors_config="yes"
++ fi
+ else
+ if test "$spice" = "yes" ; then
+ feature_not_found "spice"
+@@ -3453,6 +3456,10 @@ if test "$spice_qxl_io_monitors_config_async" = "yes" ; then
+ echo "CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC=y" >> $config_host_mak
+ fi
+
++if test "$spice_qxl_client_monitors_config" = "yes" ; then
++ echo "CONFIG_QXL_CLIENT_MONITORS_CONFIG=y" >> $config_host_mak
++fi
++
+ if test "$smartcard" = "yes" ; then
+ echo "CONFIG_SMARTCARD=y" >> $config_host_mak
+ fi
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 1ef117a..0695872 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -18,6 +18,8 @@
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <zlib.h>
++
+ #include "qemu-common.h"
+ #include "qemu-timer.h"
+ #include "qemu-queue.h"
+@@ -971,6 +973,79 @@ static void interface_set_client_capabilities(QXLInstance *sin,
+
+ #endif
+
++#if defined(CONFIG_QXL_CLIENT_MONITORS_CONFIG) \
++ && SPICE_SERVER_VERSION >= 0x000b05
++
++static uint32_t qxl_crc32(const uint8_t *p, unsigned len)
++{
++ /*
++ * zlib xors the seed with 0xffffffff, and xors the result
++ * again with 0xffffffff; Both are not done with linux's crc32,
++ * which we want to be compatible with, so undo that.
++ */
++ return crc32(0xffffffff, p, len) ^ 0xffffffff;
++}
++
++/* called from main context only */
++static int interface_client_monitors_config(QXLInstance *sin,
++ VDAgentMonitorsConfig *monitors_config)
++{
++ PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
++ QXLRom *rom = memory_region_get_ram_ptr(&qxl->rom_bar);
++ int i;
++
++ /*
++ * Older windows drivers set int_mask to 0 when their ISR is called,
++ * then later set it to ~0. So it doesn't relate to the actual interrupts
++ * handled. However, they are old, so clearly they don't support this
++ * interrupt
++ */
++ if (qxl->ram->int_mask == 0 || qxl->ram->int_mask == ~0 ||
++ !(qxl->ram->int_mask & QXL_INTERRUPT_CLIENT_MONITORS_CONFIG)) {
++ trace_qxl_client_monitors_config_unsupported_by_guest(qxl->id,
++ qxl->ram->int_mask,
++ monitors_config);
++ return 0;
++ }
++ if (!monitors_config) {
++ return 1;
++ }
++ memset(&rom->client_monitors_config, 0,
++ sizeof(rom->client_monitors_config));
++ rom->client_monitors_config.count = monitors_config->num_of_monitors;
++ /* monitors_config->flags ignored */
++ if (rom->client_monitors_config.count >=
++ ARRAY_SIZE(rom->client_monitors_config.heads)) {
++ trace_qxl_client_monitors_config_capped(qxl->id,
++ monitors_config->num_of_monitors,
++ ARRAY_SIZE(rom->client_monitors_config.heads));
++ rom->client_monitors_config.count =
++ ARRAY_SIZE(rom->client_monitors_config.heads);
++ }
++ for (i = 0 ; i < rom->client_monitors_config.count ; ++i) {
++ VDAgentMonConfig *monitor = &monitors_config->monitors[i];
++ QXLURect *rect = &rom->client_monitors_config.heads[i];
++ /* monitor->depth ignored */
++ rect->left = monitor->x;
++ rect->top = monitor->y;
++ rect->right = monitor->x + monitor->width;
++ rect->bottom = monitor->y + monitor->height;
++ }
++ rom->client_monitors_config_crc = qxl_crc32(
++ (const uint8_t *)&rom->client_monitors_config,
++ sizeof(rom->client_monitors_config));
++ trace_qxl_client_monitors_config_crc(qxl->id,
++ sizeof(rom->client_monitors_config),
++ rom->client_monitors_config_crc);
++
++ trace_qxl_interrupt_client_monitors_config(qxl->id,
++ rom->client_monitors_config.count,
++ rom->client_monitors_config.heads);
++ qxl_send_events(qxl, QXL_INTERRUPT_CLIENT_MONITORS_CONFIG);
++ return 1;
++}
++#endif
++
+ static const QXLInterface qxl_interface = {
+ .base.type = SPICE_INTERFACE_QXL,
+ .base.description = "qxl gpu",
+@@ -995,6 +1070,10 @@ static const QXLInterface qxl_interface = {
+ #if SPICE_SERVER_VERSION >= 0x000b04
+ .set_client_capabilities = interface_set_client_capabilities,
+ #endif
++#if SPICE_SERVER_VERSION >= 0x000b05 && \
++ defined(CONFIG_QXL_CLIENT_MONITORS_CONFIG)
++ .client_monitors_config = interface_client_monitors_config,
++#endif
+ };
+
+ static void qxl_enter_vga_mode(PCIQXLDevice *d)
+diff --git a/trace-events b/trace-events
+index 80a52d9..07b63f1 100644
+--- a/trace-events
++++ b/trace-events
+@@ -930,7 +930,7 @@ qxl_interface_update_area_complete_rest(int qid, uint32_t num_updated_rects) "%d
+ qxl_interface_update_area_complete_overflow(int qid, int max) "%d max=%d"
+ qxl_interface_update_area_complete_schedule_bh(int qid, uint32_t num_dirty) "%d #dirty=%d"
+ qxl_io_destroy_primary_ignored(int qid, const char *mode) "%d %s"
+-qxl_io_log(int qid, const uint8_t *str) "%d %s"
++qxl_io_log(int qid, const uint8_t *log_buf) "%d %s"
+ qxl_io_read_unexpected(int qid) "%d"
+ qxl_io_unexpected_vga_mode(int qid, uint64_t addr, uint64_t val, const char *desc) "%d 0x%"PRIx64"=%"PRIu64" (%s)"
+ qxl_io_write(int qid, const char *mode, uint64_t addr, uint64_t val, unsigned size, int async) "%d %s addr=%"PRIu64 " val=%"PRIu64" size=%u async=%d"
+@@ -974,6 +974,10 @@ qxl_spice_update_area_rest(int qid, uint32_t num_dirty_rects, uint32_t clear_dir
+ qxl_surfaces_dirty(int qid, int surface, int offset, int size) "%d surface=%d offset=%d size=%d"
+ qxl_send_events(int qid, uint32_t events) "%d %d"
+ qxl_set_guest_bug(int qid) "%d"
++qxl_interrupt_client_monitors_config(int qid, int num_heads, void *heads) "%d %d %p"
++qxl_client_monitors_config_unsupported_by_guest(int qid, uint32_t int_mask, void *client_monitors_config) "%d %X %p"
++qxl_client_monitors_config_capped(int qid, int requested, int limit) "%d %d %d"
++qxl_client_monitors_config_crc(int qid, unsigned size, uint32_t crc32) "%d %u %u"
+
+ # hw/qxl-render.c
+ qxl_render_blit_guest_primary_initialized(void) ""
+--
+1.7.12.1
+
--- /dev/null
+From d0b5c82d532ef14bbbc770b06a6ae68f6ec3c1a8 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 14 Sep 2012 22:09:23 +0200
+Subject: [PATCH] qxl: always update displaysurface on resize
+
+Don't try to be clever and skip displaysurface reinitialization in case
+the size hasn't changed. Other parameters might have changed
+nevertheless, for example depth or stride, resulting in rendering being
+broken then.
+
+Trigger: boot linux guest with vesafb, start X11, make sure both vesafb
+and X11 use the display same resolution. Then watch X11 screen being
+upside down.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl-render.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/hw/qxl-render.c b/hw/qxl-render.c
+index e2e3fe2..b66c168 100644
+--- a/hw/qxl-render.c
++++ b/hw/qxl-render.c
+@@ -99,7 +99,6 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
+ {
+ VGACommonState *vga = &qxl->vga;
+ int i;
+- DisplaySurface *surface = vga->ds->surface;
+
+ if (qxl->guest_primary.resized) {
+ qxl->guest_primary.resized = 0;
+@@ -112,9 +111,6 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
+ qxl->guest_primary.qxl_stride,
+ qxl->guest_primary.bytes_pp,
+ qxl->guest_primary.bits_pp);
+- }
+- if (surface->width != qxl->guest_primary.surface.width ||
+- surface->height != qxl->guest_primary.surface.height) {
+ if (qxl->guest_primary.qxl_stride > 0) {
+ qemu_free_displaysurface(vga->ds);
+ qemu_create_displaysurface_from(qxl->guest_primary.surface.width,
+--
+1.7.12.1
+
--- /dev/null
+From 2bbe4bb8c12976312c9421489f7568a70e5ffae3 Mon Sep 17 00:00:00 2001
+From: Michael Tokarev <mjt@tls.msk.ru>
+Date: Wed, 19 Sep 2012 17:41:26 +0400
+Subject: [PATCH] qxl/update_area_io: cleanup invalid parameters handling
+
+This cleans up two additions of almost the same code in commits
+511b13e2c9 and ccc2960d654. While at it, make error paths
+consistent (always use 'break' instead of 'return').
+
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Dunrong Huang <riegamaths@gmail.com>
+Cc: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 0695872..720363f 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1547,20 +1547,13 @@ async_common:
+ if (d->ram->update_surface > d->ssd.num_surfaces) {
+ qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
+ d->ram->update_surface);
+- return;
++ break;
+ }
+- if (update.left >= update.right || update.top >= update.bottom) {
++ if (update.left >= update.right || update.top >= update.bottom ||
++ update.left < 0 || update.top < 0) {
+ qxl_set_guest_bug(d,
+ "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
+ update.left, update.top, update.right, update.bottom);
+- return;
+- }
+-
+- if (update.left < 0 || update.top < 0 || update.left >= update.right ||
+- update.top >= update.bottom) {
+- qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: "
+- "invalid area(%d,%d,%d,%d)\n", update.left,
+- update.right, update.top, update.bottom);
+ break;
+ }
+ if (async == QXL_ASYNC) {
+--
+1.7.12.1
+
--- /dev/null
+From 0e0d8cfb93813c0d693b14e3d433d36ee9bc6bab Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 25 Sep 2012 13:56:40 +0200
+Subject: [PATCH] qxl: fix range check for rev3 io commands.
+
+Enables QXL_IO_FLUSH_SURFACES_ASYNC and QXL_IO_FLUSH_RELEASE
+which are part of the qxl rev3 feature set.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 720363f..9389752 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1466,7 +1466,7 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ }
+
+ if (d->revision <= QXL_REVISION_STABLE_V10 &&
+- io_port >= QXL_IO_FLUSH_SURFACES_ASYNC) {
++ io_port > QXL_IO_FLUSH_RELEASE) {
+ qxl_set_guest_bug(d, "unsupported io %d for revision %d\n",
+ io_port, d->revision);
+ return;
+--
+1.7.12.1
+
--- /dev/null
+From a0f199b76debf55933c2b3b917c13c86784e3be0 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Wed, 3 Oct 2012 20:13:58 +0200
+Subject: [PATCH 514/647] hw/qxl: exit on failure to register qxl interface
+
+This prevents a segfault later on when the device reset handler
+tries to access a NULL ssd.worker since interface_attach_worker has
+not been called.
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 9389752..a2dd020 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -2035,7 +2035,11 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+
+ qxl->ssd.qxl.base.sif = &qxl_interface.base;
+ qxl->ssd.qxl.id = qxl->id;
+- qemu_spice_add_interface(&qxl->ssd.qxl.base);
++ if (qemu_spice_add_interface(&qxl->ssd.qxl.base) != 0) {
++ error_report("qxl interface %d.%d not supported by spice-server\n",
++ SPICE_INTERFACE_QXL_MAJOR, SPICE_INTERFACE_QXL_MINOR);
++ return -1;
++ }
+ qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
+
+ init_pipe_signaling(qxl);
+--
+1.7.12.1
+
--- /dev/null
+From 73a691f6799e05afda0be01c1cd5e2f6914e8773 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 2 Oct 2012 11:39:14 +0200
+Subject: [PATCH 515/647] hw/qxl: fix condition for exiting guest_bug
+
+Reported and suggested by Paolo Bonzini, thanks.
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index a2dd020..e3a164a 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1461,7 +1461,7 @@ static void ioport_write(void *opaque, target_phys_addr_t addr,
+ qxl_async_io async = QXL_SYNC;
+ uint32_t orig_io_port = io_port;
+
+- if (d->guest_bug && !io_port == QXL_IO_RESET) {
++ if (d->guest_bug && io_port != QXL_IO_RESET) {
+ return;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From d59685f5667e25d0805bde93c068052afb30efda Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Sun, 7 Oct 2012 17:03:35 +0200
+Subject: [PATCH 516/647] hw/qxl: qxl_dirty_surfaces: use uintptr_t
+
+As suggested by Paolo Bonzini, to avoid possible integer overflow issues.
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index e3a164a..5a9bf1c 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1803,7 +1803,7 @@ static void qxl_hw_text_update(void *opaque, console_ch_t *chardata)
+
+ static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
+ {
+- intptr_t vram_start;
++ uintptr_t vram_start;
+ int i;
+
+ if (qxl->mode != QXL_MODE_NATIVE && qxl->mode != QXL_MODE_COMPAT) {
+@@ -1814,7 +1814,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
+ qxl_set_dirty(&qxl->vga.vram, qxl->shadow_rom.draw_area_offset,
+ qxl->shadow_rom.surface0_area_size);
+
+- vram_start = (intptr_t)memory_region_get_ram_ptr(&qxl->vram_bar);
++ vram_start = (uintptr_t)memory_region_get_ram_ptr(&qxl->vram_bar);
+
+ /* dirty the off-screen surfaces */
+ for (i = 0; i < qxl->ssd.num_surfaces; i++) {
+--
+1.7.12.1
+
--- /dev/null
+From be955ad2a04cb7be9b5f34cd0e43d29f34113c6e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 24 Sep 2012 10:23:40 +0200
+Subject: [PATCH 517/647] spice: raise requirement to 0.12
+
+With the next qemu version (1.3) we are going to bump the qxl device
+revision to 4. The new features available require a recent spice-server
+version, so raise up the bar. Otherwise we would end up with different
+qxl revisions depending on the spice-server version installed, which
+would be a major PITA when it comes to compat properties.
+
+Clear out a big bunch of #ifdefs which are not needed any more.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ configure | 18 ++----------------
+ hw/qxl.c | 30 ------------------------------
+ ui/spice-core.c | 51 ++-------------------------------------------------
+ ui/spice-display.c | 38 --------------------------------------
+ ui/spice-display.h | 5 -----
+ 5 files changed, 4 insertions(+), 138 deletions(-)
+
+diff --git a/configure b/configure
+index ebe8b1c..b843d20 100755
+--- a/configure
++++ b/configure
+@@ -2705,20 +2705,14 @@ int main(void) { spice_server_new(); return 0; }
+ EOF
+ spice_cflags=$($pkg_config --cflags spice-protocol spice-server 2>/dev/null)
+ spice_libs=$($pkg_config --libs spice-protocol spice-server 2>/dev/null)
+- if $pkg_config --atleast-version=0.8.2 spice-server >/dev/null 2>&1 && \
+- $pkg_config --atleast-version=0.8.1 spice-protocol > /dev/null 2>&1 && \
++ if $pkg_config --atleast-version=0.12.0 spice-server >/dev/null 2>&1 && \
++ $pkg_config --atleast-version=0.12.2 spice-protocol > /dev/null 2>&1 && \
+ compile_prog "$spice_cflags" "$spice_libs" ; then
+ spice="yes"
+ libs_softmmu="$libs_softmmu $spice_libs"
+ QEMU_CFLAGS="$QEMU_CFLAGS $spice_cflags"
+ spice_protocol_version=$($pkg_config --modversion spice-protocol)
+ spice_server_version=$($pkg_config --modversion spice-server)
+- if $pkg_config --atleast-version=0.12.0 spice-protocol >/dev/null 2>&1; then
+- spice_qxl_io_monitors_config_async="yes"
+- fi
+- if $pkg_config --atleast-version=0.12.2 spice-protocol > /dev/null 2>&1; then
+- spice_qxl_client_monitors_config="yes"
+- fi
+ else
+ if test "$spice" = "yes" ; then
+ feature_not_found "spice"
+@@ -3456,14 +3450,6 @@ if test "$spice" = "yes" ; then
+ echo "CONFIG_SPICE=y" >> $config_host_mak
+ fi
+
+-if test "$spice_qxl_io_monitors_config_async" = "yes" ; then
+- echo "CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC=y" >> $config_host_mak
+-fi
+-
+-if test "$spice_qxl_client_monitors_config" = "yes" ; then
+- echo "CONFIG_QXL_CLIENT_MONITORS_CONFIG=y" >> $config_host_mak
+-fi
+-
+ if test "$smartcard" = "yes" ; then
+ echo "CONFIG_SMARTCARD=y" >> $config_host_mak
+ fi
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 5a9bf1c..255fdf4 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -29,11 +29,6 @@
+
+ #include "qxl.h"
+
+-#ifndef CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
+-/* spice-protocol is too old, add missing definitions */
+-#define QXL_IO_MONITORS_CONFIG_ASYNC (QXL_IO_FLUSH_RELEASE + 1)
+-#endif
+-
+ /*
+ * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
+ * such can be changed by the guest, so to avoid a guest trigerrable
+@@ -262,9 +257,6 @@ static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
+ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
+ {
+ trace_qxl_spice_monitors_config(qxl->id);
+-/* 0x000b01 == 0.11.1 */
+-#if SPICE_SERVER_VERSION >= 0x000b01 && \
+- defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
+ if (replay) {
+ /*
+ * don't use QXL_COOKIE_TYPE_IO:
+@@ -286,10 +278,6 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
+ (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
+ QXL_IO_MONITORS_CONFIG_ASYNC));
+ }
+-#else
+- fprintf(stderr, "qxl: too old spice-protocol/spice-server for "
+- "QXL_IO_MONITORS_CONFIG_ASYNC\n");
+-#endif
+ }
+
+ void qxl_spice_reset_image_cache(PCIQXLDevice *qxl)
+@@ -948,8 +936,6 @@ static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
+ }
+ }
+
+-#if SPICE_SERVER_VERSION >= 0x000b04
+-
+ /* called from spice server thread context only */
+ static void interface_set_client_capabilities(QXLInstance *sin,
+ uint8_t client_present,
+@@ -971,11 +957,6 @@ static void interface_set_client_capabilities(QXLInstance *sin,
+ qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
+ }
+
+-#endif
+-
+-#if defined(CONFIG_QXL_CLIENT_MONITORS_CONFIG) \
+- && SPICE_SERVER_VERSION >= 0x000b05
+-
+ static uint32_t qxl_crc32(const uint8_t *p, unsigned len)
+ {
+ /*
+@@ -1044,7 +1025,6 @@ static int interface_client_monitors_config(QXLInstance *sin,
+ qxl_send_events(qxl, QXL_INTERRUPT_CLIENT_MONITORS_CONFIG);
+ return 1;
+ }
+-#endif
+
+ static const QXLInterface qxl_interface = {
+ .base.type = SPICE_INTERFACE_QXL,
+@@ -1067,13 +1047,8 @@ static const QXLInterface qxl_interface = {
+ .flush_resources = interface_flush_resources,
+ .async_complete = interface_async_complete,
+ .update_area_complete = interface_update_area_complete,
+-#if SPICE_SERVER_VERSION >= 0x000b04
+ .set_client_capabilities = interface_set_client_capabilities,
+-#endif
+-#if SPICE_SERVER_VERSION >= 0x000b05 && \
+- defined(CONFIG_QXL_CLIENT_MONITORS_CONFIG)
+ .client_monitors_config = interface_client_monitors_config,
+-#endif
+ };
+
+ static void qxl_enter_vga_mode(PCIQXLDevice *d)
+@@ -1846,7 +1821,6 @@ static void qxl_vm_change_state_handler(void *opaque, int running,
+ RunState state)
+ {
+ PCIQXLDevice *qxl = opaque;
+- qemu_spice_vm_change_state_handler(&qxl->ssd, running, state);
+
+ if (running) {
+ /*
+@@ -1963,14 +1937,10 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+ pci_device_rev = QXL_REVISION_STABLE_V10;
+ io_size = 32; /* PCI region size must be pow2 */
+ break;
+-/* 0x000b01 == 0.11.1 */
+-#if SPICE_SERVER_VERSION >= 0x000b01 && \
+- defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
+ case 4: /* qxl-4 */
+ pci_device_rev = QXL_REVISION_STABLE_V12;
+ io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
+ break;
+-#endif
+ default:
+ error_report("Invalid revision %d for qxl device (max %d)",
+ qxl->revision, QXL_DEFAULT_REVISION);
+diff --git a/ui/spice-core.c b/ui/spice-core.c
+index ba0d0bd..5147365 100644
+--- a/ui/spice-core.c
++++ b/ui/spice-core.c
+@@ -223,7 +223,6 @@ static void channel_event(int event, SpiceChannelEventInfo *info)
+ client = qdict_new();
+ server = qdict_new();
+
+-#ifdef SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT
+ if (info->flags & SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT) {
+ add_addr_info(client, (struct sockaddr *)&info->paddr_ext,
+ info->plen_ext);
+@@ -232,12 +231,7 @@ static void channel_event(int event, SpiceChannelEventInfo *info)
+ } else {
+ error_report("spice: %s, extended address is expected",
+ __func__);
+-#endif
+- add_addr_info(client, &info->paddr, info->plen);
+- add_addr_info(server, &info->laddr, info->llen);
+-#ifdef SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT
+ }
+-#endif
+
+ if (event == SPICE_CHANNEL_EVENT_INITIALIZED) {
+ qdict_put(server, "auth", qstring_from_str(auth));
+@@ -276,7 +270,6 @@ static SpiceCoreInterface core_interface = {
+ .channel_event = channel_event,
+ };
+
+-#ifdef SPICE_INTERFACE_MIGRATION
+ typedef struct SpiceMigration {
+ SpiceMigrateInstance sin;
+ struct {
+@@ -313,7 +306,6 @@ static void migrate_end_complete_cb(SpiceMigrateInstance *sin)
+ monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
+ spice_migration_completed = true;
+ }
+-#endif
+
+ /* config string parsing */
+
+@@ -393,17 +385,13 @@ static SpiceChannelList *qmp_query_spice_channels(void)
+ chan = g_malloc0(sizeof(*chan));
+ chan->value = g_malloc0(sizeof(*chan->value));
+
+-#ifdef SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT
+ if (item->info->flags & SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT) {
+ paddr = (struct sockaddr *)&item->info->paddr_ext;
+ plen = item->info->plen_ext;
+ } else {
+-#endif
+ paddr = &item->info->paddr;
+ plen = item->info->plen;
+-#ifdef SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT
+ }
+-#endif
+
+ getnameinfo(paddr, plen,
+ host, sizeof(host), port, sizeof(port),
+@@ -473,13 +461,10 @@ SpiceInfo *qmp_query_spice(Error **errp)
+ info->tls_port = tls_port;
+ }
+
+-#if SPICE_SERVER_VERSION >= 0x000a03 /* 0.10.3 */
+ info->mouse_mode = spice_server_is_server_mouse(spice_server) ?
+ SPICE_QUERY_MOUSE_MODE_SERVER :
+ SPICE_QUERY_MOUSE_MODE_CLIENT;
+-#else
+- info->mouse_mode = SPICE_QUERY_MOUSE_MODE_UNKNOWN;
+-#endif
++
+ /* for compatibility with the original command */
+ info->has_channels = true;
+ info->channels = qmp_query_spice_channels();
+@@ -492,19 +477,11 @@ static void migration_state_notifier(Notifier *notifier, void *data)
+ MigrationState *s = data;
+
+ if (migration_is_active(s)) {
+-#ifdef SPICE_INTERFACE_MIGRATION
+ spice_server_migrate_start(spice_server);
+-#endif
+ } else if (migration_has_finished(s)) {
+-#ifndef SPICE_INTERFACE_MIGRATION
+- spice_server_migrate_switch(spice_server);
+- monitor_protocol_event(QEVENT_SPICE_MIGRATE_COMPLETED, NULL);
+- spice_migration_completed = true;
+-#else
+ spice_server_migrate_end(spice_server, true);
+ } else if (migration_has_failed(s)) {
+ spice_server_migrate_end(spice_server, false);
+-#endif
+ }
+ }
+
+@@ -513,16 +490,11 @@ int qemu_spice_migrate_info(const char *hostname, int port, int tls_port,
+ MonitorCompletion *cb, void *opaque)
+ {
+ int ret;
+-#ifdef SPICE_INTERFACE_MIGRATION
++
+ spice_migrate.connect_complete.cb = cb;
+ spice_migrate.connect_complete.opaque = opaque;
+ ret = spice_server_migrate_connect(spice_server, hostname,
+ port, tls_port, subject);
+-#else
+- ret = spice_server_migrate_info(spice_server, hostname,
+- port, tls_port, subject);
+- cb(opaque, NULL);
+-#endif
+ return ret;
+ }
+
+@@ -561,7 +533,6 @@ static int add_channel(const char *name, const char *value, void *opaque)
+ static void vm_change_state_handler(void *opaque, int running,
+ RunState state)
+ {
+-#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
+ if (running) {
+ qemu_spice_display_start();
+ spice_server_vm_start(spice_server);
+@@ -569,7 +540,6 @@ static void vm_change_state_handler(void *opaque, int running,
+ spice_server_vm_stop(spice_server);
+ qemu_spice_display_stop();
+ }
+-#endif
+ }
+
+ void qemu_spice_init(void)
+@@ -585,9 +555,7 @@ void qemu_spice_init(void)
+ int port, tls_port, len, addr_flags;
+ spice_image_compression_t compression;
+ spice_wan_compression_t wan_compr;
+-#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
+ bool seamless_migration;
+-#endif
+
+ qemu_thread_get_self(&me);
+
+@@ -672,16 +640,11 @@ void qemu_spice_init(void)
+ spice_server_set_ticket(spice_server, password, 0, 0, 0);
+ }
+ if (qemu_opt_get_bool(opts, "sasl", 0)) {
+-#if SPICE_SERVER_VERSION >= 0x000900 /* 0.9.0 */
+ if (spice_server_set_sasl_appname(spice_server, "qemu") == -1 ||
+ spice_server_set_sasl(spice_server, 1) == -1) {
+ error_report("spice: failed to enable sasl");
+ exit(1);
+ }
+-#else
+- error_report("spice: sasl is not available (spice >= 0.9 required)");
+- exit(1);
+-#endif
+ }
+ if (qemu_opt_get_bool(opts, "disable-ticketing", 0)) {
+ auth = "none";
+@@ -726,15 +689,11 @@ void qemu_spice_init(void)
+
+ qemu_opt_foreach(opts, add_channel, &tls_port, 0);
+
+-#if SPICE_SERVER_VERSION >= 0x000a02 /* 0.10.2 */
+ spice_server_set_name(spice_server, qemu_name);
+ spice_server_set_uuid(spice_server, qemu_uuid);
+-#endif
+
+-#if SPICE_SERVER_VERSION >= 0x000b02 /* 0.11.2 */
+ seamless_migration = qemu_opt_get_bool(opts, "seamless-migration", 0);
+ spice_server_set_seamless_migration(spice_server, seamless_migration);
+-#endif
+ if (0 != spice_server_init(spice_server, &core_interface)) {
+ error_report("failed to initialize spice server");
+ exit(1);
+@@ -743,11 +702,9 @@ void qemu_spice_init(void)
+
+ migration_state.notify = migration_state_notifier;
+ add_migration_state_change_notifier(&migration_state);
+-#ifdef SPICE_INTERFACE_MIGRATION
+ spice_migrate.sin.base.sif = &migrate_interface.base;
+ spice_migrate.connect_complete.cb = NULL;
+ qemu_spice_add_interface(&spice_migrate.sin.base);
+-#endif
+
+ qemu_spice_input_init();
+ qemu_spice_audio_init();
+@@ -815,15 +772,11 @@ int qemu_spice_set_pw_expire(time_t expires)
+
+ int qemu_spice_display_add_client(int csock, int skipauth, int tls)
+ {
+-#if SPICE_SERVER_VERSION >= 0x000a01
+ if (tls) {
+ return spice_server_add_ssl_client(spice_server, csock, skipauth);
+ } else {
+ return spice_server_add_client(spice_server, csock, skipauth);
+ }
+-#else
+- return -1;
+-#endif
+ }
+
+ static void spice_register_config(void)
+diff --git a/ui/spice-display.c b/ui/spice-display.c
+index d062765..422e7c4 100644
+--- a/ui/spice-display.c
++++ b/ui/spice-display.c
+@@ -126,21 +126,6 @@ void qemu_spice_wakeup(SimpleSpiceDisplay *ssd)
+ ssd->worker->wakeup(ssd->worker);
+ }
+
+-#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+-static void qemu_spice_start(SimpleSpiceDisplay *ssd)
+-{
+- trace_qemu_spice_start(ssd->qxl.id);
+- ssd->worker->start(ssd->worker);
+-}
+-
+-static void qemu_spice_stop(SimpleSpiceDisplay *ssd)
+-{
+- trace_qemu_spice_stop(ssd->qxl.id);
+- ssd->worker->stop(ssd->worker);
+-}
+-
+-#else
+-
+ static int spice_display_is_running;
+
+ void qemu_spice_display_start(void)
+@@ -153,15 +138,9 @@ void qemu_spice_display_stop(void)
+ spice_display_is_running = false;
+ }
+
+-#endif
+-
+ int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd)
+ {
+-#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+- return ssd->running;
+-#else
+ return spice_display_is_running;
+-#endif
+ }
+
+ static void qemu_spice_create_one_update(SimpleSpiceDisplay *ssd,
+@@ -364,22 +343,6 @@ void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
+ qemu_spice_destroy_primary_surface(ssd, 0, QXL_SYNC);
+ }
+
+-void qemu_spice_vm_change_state_handler(void *opaque, int running,
+- RunState state)
+-{
+-#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+- SimpleSpiceDisplay *ssd = opaque;
+-
+- if (running) {
+- ssd->running = true;
+- qemu_spice_start(ssd);
+- } else {
+- qemu_spice_stop(ssd);
+- ssd->running = false;
+- }
+-#endif
+-}
+-
+ void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd, DisplayState *ds)
+ {
+ ssd->ds = ds;
+@@ -623,7 +586,6 @@ void qemu_spice_display_init(DisplayState *ds)
+ qemu_spice_add_interface(&sdpy.qxl.base);
+ assert(sdpy.worker);
+
+- qemu_add_vm_change_state_handler(qemu_spice_vm_change_state_handler, &sdpy);
+ qemu_spice_create_host_memslot(&sdpy);
+ qemu_spice_create_host_primary(&sdpy);
+ }
+diff --git a/ui/spice-display.h b/ui/spice-display.h
+index dea41c1..d766927 100644
+--- a/ui/spice-display.h
++++ b/ui/spice-display.h
+@@ -83,9 +83,6 @@ struct SimpleSpiceDisplay {
+
+ QXLRect dirty;
+ int notify;
+-#if SPICE_SERVER_VERSION < 0x000b02 /* before 0.11.2 */
+- int running;
+-#endif
+
+ /*
+ * All struct members below this comment can be accessed from
+@@ -133,8 +130,6 @@ void qemu_spice_create_primary_surface(SimpleSpiceDisplay *ssd, uint32_t id,
+ void qemu_spice_destroy_primary_surface(SimpleSpiceDisplay *ssd,
+ uint32_t id, qxl_async_io async);
+ void qemu_spice_wakeup(SimpleSpiceDisplay *ssd);
+-#if SPICE_SERVER_VERSION >= 0x000b02 /* before 0.11.2 */
+ void qemu_spice_display_start(void);
+ void qemu_spice_display_stop(void);
+-#endif
+ int qemu_spice_display_is_running(SimpleSpiceDisplay *ssd);
+--
+1.7.12.1
+
--- /dev/null
+From 7b1c2ac1342371bf43035b2ee1b02d9f554da49d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Nov 2012 11:06:54 +0100
+Subject: [PATCH 518/647] qxl: set default revision to 4
+
+Set qxl pci revision to 4 so guests know spice-server 0.12 features
+are available.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/qxl.h | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/hw/qxl.h b/hw/qxl.h
+index 5553824..e583cfb 100644
+--- a/hw/qxl.h
++++ b/hw/qxl.h
+@@ -129,12 +129,7 @@ typedef struct PCIQXLDevice {
+ } \
+ } while (0)
+
+-#if 0
+-/* spice-server 0.12 is still in development */
+ #define QXL_DEFAULT_REVISION QXL_REVISION_STABLE_V12
+-#else
+-#define QXL_DEFAULT_REVISION QXL_REVISION_STABLE_V10
+-#endif
+
+ /* qxl.c */
+ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id);
+--
+1.7.12.1
+
--- /dev/null
+From a6400ff20f4e32eecce44931e33939cdf04e2a3e Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 31 Aug 2012 13:41:38 +0200
+Subject: [PATCH] usb-redir: Convert to new libusbredirparser 0.5 API
+
+This gives us support for 64 bit ids which is needed for using XHCI with
+the new hcd generated ids.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ configure | 2 +-
+ hw/usb/redirect.c | 62 +++++++++++++++++++++++++++----------------------------
+ 2 files changed, 32 insertions(+), 32 deletions(-)
+
+diff --git a/configure b/configure
+index 83c478c..2c4469f 100755
+--- a/configure
++++ b/configure
+@@ -2758,7 +2758,7 @@ fi
+
+ # check for usbredirparser for usb network redirection support
+ if test "$usb_redir" != "no" ; then
+- if $pkg_config --atleast-version=0.3.4 libusbredirparser >/dev/null 2>&1 ; then
++ if $pkg_config --atleast-version=0.5 libusbredirparser >/dev/null 2>&1 ; then
+ usb_redir="yes"
+ usb_redir_cflags=$($pkg_config --cflags libusbredirparser 2>/dev/null)
+ usb_redir_libs=$($pkg_config --libs libusbredirparser 2>/dev/null)
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index b7c7f1e..321f5be 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -107,27 +107,27 @@ static void usbredir_interface_info(void *priv,
+ struct usb_redir_interface_info_header *interface_info);
+ static void usbredir_ep_info(void *priv,
+ struct usb_redir_ep_info_header *ep_info);
+-static void usbredir_configuration_status(void *priv, uint32_t id,
++static void usbredir_configuration_status(void *priv, uint64_t id,
+ struct usb_redir_configuration_status_header *configuration_status);
+-static void usbredir_alt_setting_status(void *priv, uint32_t id,
++static void usbredir_alt_setting_status(void *priv, uint64_t id,
+ struct usb_redir_alt_setting_status_header *alt_setting_status);
+-static void usbredir_iso_stream_status(void *priv, uint32_t id,
++static void usbredir_iso_stream_status(void *priv, uint64_t id,
+ struct usb_redir_iso_stream_status_header *iso_stream_status);
+-static void usbredir_interrupt_receiving_status(void *priv, uint32_t id,
++static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
+ struct usb_redir_interrupt_receiving_status_header
+ *interrupt_receiving_status);
+-static void usbredir_bulk_streams_status(void *priv, uint32_t id,
++static void usbredir_bulk_streams_status(void *priv, uint64_t id,
+ struct usb_redir_bulk_streams_status_header *bulk_streams_status);
+-static void usbredir_control_packet(void *priv, uint32_t id,
++static void usbredir_control_packet(void *priv, uint64_t id,
+ struct usb_redir_control_packet_header *control_packet,
+ uint8_t *data, int data_len);
+-static void usbredir_bulk_packet(void *priv, uint32_t id,
++static void usbredir_bulk_packet(void *priv, uint64_t id,
+ struct usb_redir_bulk_packet_header *bulk_packet,
+ uint8_t *data, int data_len);
+-static void usbredir_iso_packet(void *priv, uint32_t id,
++static void usbredir_iso_packet(void *priv, uint64_t id,
+ struct usb_redir_iso_packet_header *iso_packet,
+ uint8_t *data, int data_len);
+-static void usbredir_interrupt_packet(void *priv, uint32_t id,
++static void usbredir_interrupt_packet(void *priv, uint64_t id,
+ struct usb_redir_interrupt_packet_header *interrupt_header,
+ uint8_t *data, int data_len);
+
+@@ -814,6 +814,7 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
++ usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
+ usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 0);
+ usbredirparser_do_write(dev->parser);
+ }
+@@ -1204,15 +1205,15 @@ static void usbredir_ep_info(void *priv,
+ }
+ }
+
+-static void usbredir_configuration_status(void *priv, uint32_t id,
++static void usbredir_configuration_status(void *priv, uint64_t id,
+ struct usb_redir_configuration_status_header *config_status)
+ {
+ USBRedirDevice *dev = priv;
+ USBPacket *p;
+ int len = 0;
+
+- DPRINTF("set config status %d config %d id %u\n", config_status->status,
+- config_status->configuration, id);
++ DPRINTF("set config status %d config %d id %"PRIu64"\n",
++ config_status->status, config_status->configuration, id);
+
+ p = usbredir_find_packet_by_id(dev, 0, id);
+ if (p) {
+@@ -1225,16 +1226,15 @@ static void usbredir_configuration_status(void *priv, uint32_t id,
+ }
+ }
+
+-static void usbredir_alt_setting_status(void *priv, uint32_t id,
++static void usbredir_alt_setting_status(void *priv, uint64_t id,
+ struct usb_redir_alt_setting_status_header *alt_setting_status)
+ {
+ USBRedirDevice *dev = priv;
+ USBPacket *p;
+ int len = 0;
+
+- DPRINTF("alt status %d intf %d alt %d id: %u\n",
+- alt_setting_status->status,
+- alt_setting_status->interface,
++ DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
++ alt_setting_status->status, alt_setting_status->interface,
+ alt_setting_status->alt, id);
+
+ p = usbredir_find_packet_by_id(dev, 0, id);
+@@ -1249,13 +1249,13 @@ static void usbredir_alt_setting_status(void *priv, uint32_t id,
+ }
+ }
+
+-static void usbredir_iso_stream_status(void *priv, uint32_t id,
++static void usbredir_iso_stream_status(void *priv, uint64_t id,
+ struct usb_redir_iso_stream_status_header *iso_stream_status)
+ {
+ USBRedirDevice *dev = priv;
+ uint8_t ep = iso_stream_status->endpoint;
+
+- DPRINTF("iso status %d ep %02X id %u\n", iso_stream_status->status,
++ DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
+ ep, id);
+
+ if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
+@@ -1269,14 +1269,14 @@ static void usbredir_iso_stream_status(void *priv, uint32_t id,
+ }
+ }
+
+-static void usbredir_interrupt_receiving_status(void *priv, uint32_t id,
++static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
+ struct usb_redir_interrupt_receiving_status_header
+ *interrupt_receiving_status)
+ {
+ USBRedirDevice *dev = priv;
+ uint8_t ep = interrupt_receiving_status->endpoint;
+
+- DPRINTF("interrupt recv status %d ep %02X id %u\n",
++ DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
+ interrupt_receiving_status->status, ep, id);
+
+ if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
+@@ -1291,12 +1291,12 @@ static void usbredir_interrupt_receiving_status(void *priv, uint32_t id,
+ }
+ }
+
+-static void usbredir_bulk_streams_status(void *priv, uint32_t id,
++static void usbredir_bulk_streams_status(void *priv, uint64_t id,
+ struct usb_redir_bulk_streams_status_header *bulk_streams_status)
+ {
+ }
+
+-static void usbredir_control_packet(void *priv, uint32_t id,
++static void usbredir_control_packet(void *priv, uint64_t id,
+ struct usb_redir_control_packet_header *control_packet,
+ uint8_t *data, int data_len)
+ {
+@@ -1304,7 +1304,7 @@ static void usbredir_control_packet(void *priv, uint32_t id,
+ USBPacket *p;
+ int len = control_packet->length;
+
+- DPRINTF("ctrl-in status %d len %d id %u\n", control_packet->status,
++ DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
+ len, id);
+
+ p = usbredir_find_packet_by_id(dev, 0, id);
+@@ -1326,7 +1326,7 @@ static void usbredir_control_packet(void *priv, uint32_t id,
+ free(data);
+ }
+
+-static void usbredir_bulk_packet(void *priv, uint32_t id,
++static void usbredir_bulk_packet(void *priv, uint64_t id,
+ struct usb_redir_bulk_packet_header *bulk_packet,
+ uint8_t *data, int data_len)
+ {
+@@ -1335,8 +1335,8 @@ static void usbredir_bulk_packet(void *priv, uint32_t id,
+ int len = bulk_packet->length;
+ USBPacket *p;
+
+- DPRINTF("bulk-in status %d ep %02X len %d id %u\n", bulk_packet->status,
+- ep, len, id);
++ DPRINTF("bulk-in status %d ep %02X len %d id %"PRIu64"\n",
++ bulk_packet->status, ep, len, id);
+
+ p = usbredir_find_packet_by_id(dev, ep, id);
+ if (p) {
+@@ -1357,15 +1357,15 @@ static void usbredir_bulk_packet(void *priv, uint32_t id,
+ free(data);
+ }
+
+-static void usbredir_iso_packet(void *priv, uint32_t id,
++static void usbredir_iso_packet(void *priv, uint64_t id,
+ struct usb_redir_iso_packet_header *iso_packet,
+ uint8_t *data, int data_len)
+ {
+ USBRedirDevice *dev = priv;
+ uint8_t ep = iso_packet->endpoint;
+
+- DPRINTF2("iso-in status %d ep %02X len %d id %u\n", iso_packet->status, ep,
+- data_len, id);
++ DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
++ iso_packet->status, ep, data_len, id);
+
+ if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
+ ERROR("received iso packet for non iso endpoint %02X\n", ep);
+@@ -1383,14 +1383,14 @@ static void usbredir_iso_packet(void *priv, uint32_t id,
+ bufp_alloc(dev, data, data_len, iso_packet->status, ep);
+ }
+
+-static void usbredir_interrupt_packet(void *priv, uint32_t id,
++static void usbredir_interrupt_packet(void *priv, uint64_t id,
+ struct usb_redir_interrupt_packet_header *interrupt_packet,
+ uint8_t *data, int data_len)
+ {
+ USBRedirDevice *dev = priv;
+ uint8_t ep = interrupt_packet->endpoint;
+
+- DPRINTF("interrupt-in status %d ep %02X len %d id %u\n",
++ DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
+ interrupt_packet->status, ep, data_len, id);
+
+ if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
+--
+1.7.12.1
+
--- /dev/null
+From 0995eaeb06c4810cd133e710170a7b181caf04cd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 11:49:07 +0200
+Subject: [PATCH] usb-redir: Set ep max_packet_size if available
+
+This is needed for usb-redir to work properly with the xhci emulation.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/redirect.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 321f5be..b9a3633 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -814,6 +814,7 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
++ usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
+ usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 0);
+ usbredirparser_do_write(dev->parser);
+@@ -1202,6 +1203,10 @@ static void usbredir_ep_info(void *priv,
+ i & 0x0f);
+ usb_ep->type = dev->endpoint[i].type;
+ usb_ep->ifnum = dev->endpoint[i].interface;
++ if (usbredirparser_peer_has_cap(dev->parser,
++ usb_redir_cap_ep_info_max_packet_size)) {
++ usb_ep->max_packet_size = ep_info->max_packet_size[i];
++ }
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 596013354fd1d5b102cdb54449b10e11346f9fda Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 11:53:28 +0200
+Subject: [PATCH] usb-redir: Add a usbredir_reject_device helper function
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/redirect.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index b9a3633..a590cb2 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -820,16 +820,21 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+ usbredirparser_do_write(dev->parser);
+ }
+
++static void usbredir_reject_device(USBRedirDevice *dev)
++{
++ usbredir_device_disconnect(dev);
++ if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
++ usbredirparser_send_filter_reject(dev->parser);
++ usbredirparser_do_write(dev->parser);
++ }
++}
++
+ static void usbredir_do_attach(void *opaque)
+ {
+ USBRedirDevice *dev = opaque;
+
+ if (usb_device_attach(&dev->dev) != 0) {
+- usbredir_device_disconnect(dev);
+- if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
+- usbredirparser_send_filter_reject(dev->parser);
+- usbredirparser_do_write(dev->parser);
+- }
++ usbredir_reject_device(dev);
+ }
+ }
+
+@@ -1008,11 +1013,7 @@ static int usbredir_check_filter(USBRedirDevice *dev)
+ return 0;
+
+ error:
+- usbredir_device_disconnect(dev);
+- if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
+- usbredirparser_send_filter_reject(dev->parser);
+- usbredirparser_do_write(dev->parser);
+- }
++ usbredir_reject_device(dev);
+ return -1;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 87317670541ed043a21964c29e0e613aab375224 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 12:04:49 +0200
+Subject: [PATCH] usb-redir: Ensure our peer has the necessary caps when
+ redirecting to XHCI
+
+In order for redirection to work properly when redirecting to an emulated
+XHCI controller, the usb-redir-host must support both
+usb_redir_cap_ep_info_max_packet_size and usb_redir_cap_64bits_ids,
+reject any devices redirected to an XHCI controller when these are not
+supported.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/redirect.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index a590cb2..f1bb692 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -833,6 +833,17 @@ static void usbredir_do_attach(void *opaque)
+ {
+ USBRedirDevice *dev = opaque;
+
++ /* In order to work properly with XHCI controllers we need these caps */
++ if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
++ usbredirparser_peer_has_cap(dev->parser,
++ usb_redir_cap_ep_info_max_packet_size) &&
++ usbredirparser_peer_has_cap(dev->parser,
++ usb_redir_cap_64bits_ids))) {
++ ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
++ usbredir_reject_device(dev);
++ return;
++ }
++
+ if (usb_device_attach(&dev->dev) != 0) {
+ usbredir_reject_device(dev);
+ }
+--
+1.7.12.1
+
--- /dev/null
+From c12ef3d896e426505ea3ca4fb2f1d9017f9cf828 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Sep 2012 13:44:04 +0200
+Subject: [PATCH] usb-redir: Enable pipelining for bulk endpoints
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/redirect.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index f1bb692..f183263 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -1219,6 +1219,9 @@ static void usbredir_ep_info(void *priv,
+ usb_redir_cap_ep_info_max_packet_size)) {
+ usb_ep->max_packet_size = ep_info->max_packet_size[i];
+ }
++ if (ep_info->type[i] == usb_redir_type_bulk) {
++ usb_ep->pipeline = true;
++ }
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 2255facbc338e73aa2442e2a1dc13b3474b35f98 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 24 Aug 2012 14:21:39 +0200
+Subject: [PATCH] xhci: move device lookup into xhci_setup_packet
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 74 ++++++++++++++++++++++++++++---------------------------
+ 1 file changed, 38 insertions(+), 36 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 333df59..316a303 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -1196,13 +1196,38 @@ static void xhci_stall_ep(XHCITransfer *xfer)
+ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer,
+ XHCIEPContext *epctx);
+
+-static int xhci_setup_packet(XHCITransfer *xfer, USBDevice *dev)
++static USBDevice *xhci_find_device(XHCIPort *port, uint8_t addr)
+ {
++ if (!(port->portsc & PORTSC_PED)) {
++ return NULL;
++ }
++ return usb_find_device(&port->port, addr);
++}
++
++static int xhci_setup_packet(XHCITransfer *xfer)
++{
++ XHCIState *xhci = xfer->xhci;
++ XHCIPort *port;
++ USBDevice *dev;
+ USBEndpoint *ep;
+ int dir;
+
+ dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT;
+- ep = usb_ep_get(dev, dir, xfer->epid >> 1);
++
++ if (xfer->packet.ep) {
++ ep = xfer->packet.ep;
++ dev = ep->dev;
++ } else {
++ port = &xhci->ports[xhci->slots[xfer->slotid-1].port-1];
++ dev = xhci_find_device(port, xhci->slots[xfer->slotid-1].devaddr);
++ if (!dev) {
++ fprintf(stderr, "xhci: slot %d port %d has no device\n",
++ xfer->slotid, xhci->slots[xfer->slotid-1].port);
++ return -1;
++ }
++ ep = usb_ep_get(dev, dir, xfer->epid >> 1);
++ }
++
+ usb_packet_setup(&xfer->packet, dir, ep, xfer->trbs[0].addr);
+ xhci_xfer_map(xfer);
+ DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n",
+@@ -1260,20 +1285,10 @@ static int xhci_complete_packet(XHCITransfer *xfer, int ret)
+ return 0;
+ }
+
+-static USBDevice *xhci_find_device(XHCIPort *port, uint8_t addr)
+-{
+- if (!(port->portsc & PORTSC_PED)) {
+- return NULL;
+- }
+- return usb_find_device(&port->port, addr);
+-}
+-
+ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+ {
+ XHCITRB *trb_setup, *trb_status;
+ uint8_t bmRequestType;
+- XHCIPort *port;
+- USBDevice *dev;
+ int ret;
+
+ trb_setup = &xfer->trbs[0];
+@@ -1309,21 +1324,15 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+
+ bmRequestType = trb_setup->parameter;
+
+- port = &xhci->ports[xhci->slots[xfer->slotid-1].port-1];
+- dev = xhci_find_device(port, xhci->slots[xfer->slotid-1].devaddr);
+- if (!dev) {
+- fprintf(stderr, "xhci: slot %d port %d has no device\n", xfer->slotid,
+- xhci->slots[xfer->slotid-1].port);
+- return -1;
+- }
+-
+ xfer->in_xfer = bmRequestType & USB_DIR_IN;
+ xfer->iso_xfer = false;
+
+- xhci_setup_packet(xfer, dev);
++ if (xhci_setup_packet(xfer) < 0) {
++ return -1;
++ }
+ xfer->packet.parameter = trb_setup->parameter;
+
+- ret = usb_handle_packet(dev, &xfer->packet);
++ ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
+
+ xhci_complete_packet(xfer, ret);
+ if (!xfer->running_async && !xfer->running_retry) {
+@@ -1334,8 +1343,6 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+
+ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
+ {
+- XHCIPort *port;
+- USBDevice *dev;
+ int ret;
+
+ DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", xfer->slotid, xfer->epid);
+@@ -1348,16 +1355,6 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+ xfer->pkts = 0;
+ }
+
+- port = &xhci->ports[xhci->slots[xfer->slotid-1].port-1];
+- dev = xhci_find_device(port, xhci->slots[xfer->slotid-1].devaddr);
+- if (!dev) {
+- fprintf(stderr, "xhci: slot %d port %d has no device\n", xfer->slotid,
+- xhci->slots[xfer->slotid-1].port);
+- return -1;
+- }
+-
+- xhci_setup_packet(xfer, dev);
+-
+ switch(epctx->type) {
+ case ET_INTR_OUT:
+ case ET_INTR_IN:
+@@ -1375,7 +1372,10 @@ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx
+ return -1;
+ }
+
+- ret = usb_handle_packet(dev, &xfer->packet);
++ if (xhci_setup_packet(xfer) < 0) {
++ return -1;
++ }
++ ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
+
+ xhci_complete_packet(xfer, ret);
+ if (!xfer->running_async && !xfer->running_retry) {
+@@ -1418,7 +1418,9 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid
+
+ trace_usb_xhci_xfer_retry(xfer);
+ assert(xfer->running_retry);
+- xhci_setup_packet(xfer, xfer->packet.ep->dev);
++ if (xhci_setup_packet(xfer) < 0) {
++ return;
++ }
+ result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
+ if (result == USB_RET_NAK) {
+ return;
+--
+1.7.12.1
+
--- /dev/null
+From 1f98b775c9f02caece1df5813edbb9c0a509bd58 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 21 Aug 2012 12:32:58 +0200
+Subject: [PATCH] xhci: implement mfindex
+
+Implement mfindex register and mfindex wrap event.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 46 insertions(+), 7 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 316a303..f5ba6a4 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -380,8 +380,6 @@ struct XHCIState {
+ XHCISlot slots[MAXSLOTS];
+
+ /* Runtime Registers */
+- uint32_t mfindex;
+- /* note: we only support one interrupter */
+ uint32_t iman;
+ uint32_t imod;
+ uint32_t erstsz;
+@@ -390,6 +388,9 @@ struct XHCIState {
+ uint32_t erdp_low;
+ uint32_t erdp_high;
+
++ int64_t mfindex_start;
++ QEMUTimer *mfwrap_timer;
++
+ dma_addr_t er_start;
+ uint32_t er_size;
+ bool er_pcs;
+@@ -410,6 +411,11 @@ typedef struct XHCIEvRingSeg {
+ uint32_t rsvd;
+ } XHCIEvRingSeg;
+
++static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
++ unsigned int epid);
++static void xhci_event(XHCIState *xhci, XHCIEvent *event);
++static void xhci_write_event(XHCIState *xhci, XHCIEvent *event);
++
+ static const char *TRBType_names[] = {
+ [TRB_RESERVED] = "TRB_RESERVED",
+ [TR_NORMAL] = "TR_NORMAL",
+@@ -462,8 +468,36 @@ static const char *trb_name(XHCITRB *trb)
+ ARRAY_SIZE(TRBType_names));
+ }
+
+-static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
+- unsigned int epid);
++static uint64_t xhci_mfindex_get(XHCIState *xhci)
++{
++ int64_t now = qemu_get_clock_ns(vm_clock);
++ return (now - xhci->mfindex_start) / 125000;
++}
++
++static void xhci_mfwrap_update(XHCIState *xhci)
++{
++ const uint32_t bits = USBCMD_RS | USBCMD_EWE;
++ uint32_t mfindex, left;
++ int64_t now;
++
++ if ((xhci->usbcmd & bits) == bits) {
++ now = qemu_get_clock_ns(vm_clock);
++ mfindex = ((now - xhci->mfindex_start) / 125000) & 0x3fff;
++ left = 0x4000 - mfindex;
++ qemu_mod_timer(xhci->mfwrap_timer, now + left * 125000);
++ } else {
++ qemu_del_timer(xhci->mfwrap_timer);
++ }
++}
++
++static void xhci_mfwrap_timer(void *opaque)
++{
++ XHCIState *xhci = opaque;
++ XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS };
++
++ xhci_event(xhci, &wrap);
++ xhci_mfwrap_update(xhci);
++}
+
+ static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
+ {
+@@ -793,6 +827,7 @@ static void xhci_run(XHCIState *xhci)
+ {
+ trace_usb_xhci_run();
+ xhci->usbsts &= ~USBSTS_HCH;
++ xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
+ }
+
+ static void xhci_stop(XHCIState *xhci)
+@@ -2048,7 +2083,6 @@ static void xhci_reset(DeviceState *dev)
+ xhci_update_port(xhci, xhci->ports + i, 0);
+ }
+
+- xhci->mfindex = 0;
+ xhci->iman = 0;
+ xhci->imod = 0;
+ xhci->erstsz = 0;
+@@ -2062,6 +2096,9 @@ static void xhci_reset(DeviceState *dev)
+ xhci->er_full = 0;
+ xhci->ev_buffer_put = 0;
+ xhci->ev_buffer_get = 0;
++
++ xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
++ xhci_mfwrap_update(xhci);
+ }
+
+ static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
+@@ -2264,6 +2301,7 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ xhci_stop(xhci);
+ }
+ xhci->usbcmd = val & 0xc0f;
++ xhci_mfwrap_update(xhci);
+ if (val & USBCMD_HCRST) {
+ xhci_reset(&xhci->pci_dev.qdev);
+ }
+@@ -2315,8 +2353,7 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+
+ switch (reg) {
+ case 0x00: /* MFINDEX */
+- fprintf(stderr, "xhci_runtime_read: MFINDEX not yet implemented\n");
+- ret = xhci->mfindex;
++ ret = xhci_mfindex_get(xhci) & 0x3fff;
+ break;
+ case 0x20: /* IMAN */
+ ret = xhci->iman;
+@@ -2618,6 +2655,8 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
+
+ usb_xhci_init(xhci, &dev->qdev);
+
++ xhci->mfwrap_timer = qemu_new_timer_ns(vm_clock, xhci_mfwrap_timer, xhci);
++
+ xhci->irq = xhci->pci_dev.irq[0];
+
+ memory_region_init_io(&xhci->mem, &xhci_mem_ops, xhci,
+--
+1.7.12.1
+
--- /dev/null
+From 82508212e19333e527b64fb76cd1bc016afacc8a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 24 Aug 2012 14:13:08 +0200
+Subject: [PATCH] xhci: iso xfer support
+
+Add support for iso transfers.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 117 ++++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 101 insertions(+), 16 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index f5ba6a4..b313330 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -325,9 +325,15 @@ typedef struct XHCITransfer {
+ unsigned int pkts;
+ unsigned int pktsize;
+ unsigned int cur_pkt;
++
++ uint64_t mfindex_kick;
+ } XHCITransfer;
+
+ typedef struct XHCIEPContext {
++ XHCIState *xhci;
++ unsigned int slotid;
++ unsigned int epid;
++
+ XHCIRing ring;
+ unsigned int next_xfer;
+ unsigned int comp_xfer;
+@@ -337,6 +343,11 @@ typedef struct XHCIEPContext {
+ dma_addr_t pctx;
+ unsigned int max_psize;
+ uint32_t state;
++
++ /* iso xfer scheduling */
++ unsigned int interval;
++ int64_t mfindex_last;
++ QEMUTimer *kick_timer;
+ } XHCIEPContext;
+
+ typedef struct XHCISlot {
+@@ -856,6 +867,12 @@ static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
+ epctx->state = state;
+ }
+
++static void xhci_ep_kick_timer(void *opaque)
++{
++ XHCIEPContext *epctx = opaque;
++ xhci_kick_ep(epctx->xhci, epctx->slotid, epctx->epid);
++}
++
+ static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
+ unsigned int epid, dma_addr_t pctx,
+ uint32_t *ctx)
+@@ -877,6 +894,9 @@ static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
+
+ epctx = g_malloc(sizeof(XHCIEPContext));
+ memset(epctx, 0, sizeof(XHCIEPContext));
++ epctx->xhci = xhci;
++ epctx->slotid = slotid;
++ epctx->epid = epid;
+
+ slot->eps[epid-1] = epctx;
+
+@@ -895,6 +915,10 @@ static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
+ usb_packet_init(&epctx->transfers[i].packet);
+ }
+
++ epctx->interval = 1 << (ctx[0] >> 16) & 0xff;
++ epctx->mfindex_last = 0;
++ epctx->kick_timer = qemu_new_timer_ns(vm_clock, xhci_ep_kick_timer, epctx);
++
+ epctx->state = EP_RUNNING;
+ ctx[0] &= ~EP_STATE_MASK;
+ ctx[0] |= EP_RUNNING;
+@@ -934,6 +958,7 @@ static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
+ if (t->running_retry) {
+ t->running_retry = 0;
+ epctx->retry = NULL;
++ qemu_del_timer(epctx->kick_timer);
+ }
+ if (t->trbs) {
+ g_free(t->trbs);
+@@ -969,6 +994,7 @@ static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
+
+ xhci_set_ep_state(xhci, epctx, EP_DISABLED);
+
++ qemu_free_timer(epctx->kick_timer);
+ g_free(epctx);
+ slot->eps[epid-1] = NULL;
+
+@@ -1376,29 +1402,70 @@ static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
+ return 0;
+ }
+
++static void xhci_calc_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
++ XHCIEPContext *epctx, uint64_t mfindex)
++{
++ if (xfer->trbs[0].control & TRB_TR_SIA) {
++ uint64_t asap = ((mfindex + epctx->interval - 1) &
++ ~(epctx->interval-1));
++ if (asap >= epctx->mfindex_last &&
++ asap <= epctx->mfindex_last + epctx->interval * 4) {
++ xfer->mfindex_kick = epctx->mfindex_last + epctx->interval;
++ } else {
++ xfer->mfindex_kick = asap;
++ }
++ } else {
++ xfer->mfindex_kick = (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
++ & TRB_TR_FRAMEID_MASK;
++ xfer->mfindex_kick |= mfindex & ~0x3fff;
++ if (xfer->mfindex_kick < mfindex) {
++ xfer->mfindex_kick += 0x4000;
++ }
++ }
++}
++
++static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
++ XHCIEPContext *epctx, uint64_t mfindex)
++{
++ if (xfer->mfindex_kick > mfindex) {
++ qemu_mod_timer(epctx->kick_timer, qemu_get_clock_ns(vm_clock) +
++ (xfer->mfindex_kick - mfindex) * 125000);
++ xfer->running_retry = 1;
++ } else {
++ epctx->mfindex_last = xfer->mfindex_kick;
++ qemu_del_timer(epctx->kick_timer);
++ xfer->running_retry = 0;
++ }
++}
++
++
+ static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
+ {
++ uint64_t mfindex;
+ int ret;
+
+ DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", xfer->slotid, xfer->epid);
+
+ xfer->in_xfer = epctx->type>>2;
+
+- if (epctx->type == ET_ISO_IN || epctx->type == ET_ISO_OUT) {
+- xfer->pkts = 1;
+- } else {
+- xfer->pkts = 0;
+- }
+-
+ switch(epctx->type) {
+ case ET_INTR_OUT:
+ case ET_INTR_IN:
+ case ET_BULK_OUT:
+ case ET_BULK_IN:
++ xfer->pkts = 0;
++ xfer->iso_xfer = false;
+ break;
+ case ET_ISO_OUT:
+ case ET_ISO_IN:
+- FIXME();
++ xfer->pkts = 1;
++ xfer->iso_xfer = true;
++ mfindex = xhci_mfindex_get(xhci);
++ xhci_calc_iso_kick(xhci, xfer, epctx, mfindex);
++ xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
++ if (xfer->running_retry) {
++ return -1;
++ }
+ break;
+ default:
+ fprintf(stderr, "xhci: unknown or unhandled EP "
+@@ -1428,6 +1495,7 @@ static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext
+ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid)
+ {
+ XHCIEPContext *epctx;
++ uint64_t mfindex;
+ int length;
+ int i;
+
+@@ -1447,20 +1515,35 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid
+ }
+
+ if (epctx->retry) {
+- /* retry nak'ed transfer */
+ XHCITransfer *xfer = epctx->retry;
+ int result;
+
+ trace_usb_xhci_xfer_retry(xfer);
+ assert(xfer->running_retry);
+- if (xhci_setup_packet(xfer) < 0) {
+- return;
+- }
+- result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
+- if (result == USB_RET_NAK) {
+- return;
++ if (xfer->iso_xfer) {
++ /* retry delayed iso transfer */
++ mfindex = xhci_mfindex_get(xhci);
++ xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
++ if (xfer->running_retry) {
++ return;
++ }
++ if (xhci_setup_packet(xfer) < 0) {
++ return;
++ }
++ result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
++ assert(result != USB_RET_NAK);
++ xhci_complete_packet(xfer, result);
++ } else {
++ /* retry nak'ed transfer */
++ if (xhci_setup_packet(xfer) < 0) {
++ return;
++ }
++ result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
++ if (result == USB_RET_NAK) {
++ return;
++ }
++ xhci_complete_packet(xfer, result);
+ }
+- xhci_complete_packet(xfer, result);
+ assert(!xfer->running_retry);
+ epctx->retry = NULL;
+ }
+@@ -1512,7 +1595,9 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid
+ if (xhci_fire_transfer(xhci, xfer, epctx) >= 0) {
+ epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
+ } else {
+- fprintf(stderr, "xhci: error firing data transfer\n");
++ if (!xfer->iso_xfer) {
++ fprintf(stderr, "xhci: error firing data transfer\n");
++ }
+ }
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 188fbd363df2e7f23ea37fb1b179e984bbce39e5 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 27 Aug 2012 16:09:20 +0200
+Subject: [PATCH] xhci: trace cc codes in cleartext
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
+ trace-events | 2 +-
+ 2 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index b313330..ab352c0 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -465,6 +465,45 @@ static const char *TRBType_names[] = {
+ [CR_VENDOR_NEC_CHALLENGE_RESPONSE] = "CR_VENDOR_NEC_CHALLENGE_RESPONSE",
+ };
+
++static const char *TRBCCode_names[] = {
++ [CC_INVALID] = "CC_INVALID",
++ [CC_SUCCESS] = "CC_SUCCESS",
++ [CC_DATA_BUFFER_ERROR] = "CC_DATA_BUFFER_ERROR",
++ [CC_BABBLE_DETECTED] = "CC_BABBLE_DETECTED",
++ [CC_USB_TRANSACTION_ERROR] = "CC_USB_TRANSACTION_ERROR",
++ [CC_TRB_ERROR] = "CC_TRB_ERROR",
++ [CC_STALL_ERROR] = "CC_STALL_ERROR",
++ [CC_RESOURCE_ERROR] = "CC_RESOURCE_ERROR",
++ [CC_BANDWIDTH_ERROR] = "CC_BANDWIDTH_ERROR",
++ [CC_NO_SLOTS_ERROR] = "CC_NO_SLOTS_ERROR",
++ [CC_INVALID_STREAM_TYPE_ERROR] = "CC_INVALID_STREAM_TYPE_ERROR",
++ [CC_SLOT_NOT_ENABLED_ERROR] = "CC_SLOT_NOT_ENABLED_ERROR",
++ [CC_EP_NOT_ENABLED_ERROR] = "CC_EP_NOT_ENABLED_ERROR",
++ [CC_SHORT_PACKET] = "CC_SHORT_PACKET",
++ [CC_RING_UNDERRUN] = "CC_RING_UNDERRUN",
++ [CC_RING_OVERRUN] = "CC_RING_OVERRUN",
++ [CC_VF_ER_FULL] = "CC_VF_ER_FULL",
++ [CC_PARAMETER_ERROR] = "CC_PARAMETER_ERROR",
++ [CC_BANDWIDTH_OVERRUN] = "CC_BANDWIDTH_OVERRUN",
++ [CC_CONTEXT_STATE_ERROR] = "CC_CONTEXT_STATE_ERROR",
++ [CC_NO_PING_RESPONSE_ERROR] = "CC_NO_PING_RESPONSE_ERROR",
++ [CC_EVENT_RING_FULL_ERROR] = "CC_EVENT_RING_FULL_ERROR",
++ [CC_INCOMPATIBLE_DEVICE_ERROR] = "CC_INCOMPATIBLE_DEVICE_ERROR",
++ [CC_MISSED_SERVICE_ERROR] = "CC_MISSED_SERVICE_ERROR",
++ [CC_COMMAND_RING_STOPPED] = "CC_COMMAND_RING_STOPPED",
++ [CC_COMMAND_ABORTED] = "CC_COMMAND_ABORTED",
++ [CC_STOPPED] = "CC_STOPPED",
++ [CC_STOPPED_LENGTH_INVALID] = "CC_STOPPED_LENGTH_INVALID",
++ [CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR]
++ = "CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR",
++ [CC_ISOCH_BUFFER_OVERRUN] = "CC_ISOCH_BUFFER_OVERRUN",
++ [CC_EVENT_LOST_ERROR] = "CC_EVENT_LOST_ERROR",
++ [CC_UNDEFINED_ERROR] = "CC_UNDEFINED_ERROR",
++ [CC_INVALID_STREAM_ID_ERROR] = "CC_INVALID_STREAM_ID_ERROR",
++ [CC_SECONDARY_BANDWIDTH_ERROR] = "CC_SECONDARY_BANDWIDTH_ERROR",
++ [CC_SPLIT_TRANSACTION_ERROR] = "CC_SPLIT_TRANSACTION_ERROR",
++};
++
+ static const char *lookup_name(uint32_t index, const char **list, uint32_t llen)
+ {
+ if (index >= llen || list[index] == NULL) {
+@@ -479,6 +518,12 @@ static const char *trb_name(XHCITRB *trb)
+ ARRAY_SIZE(TRBType_names));
+ }
+
++static const char *event_name(XHCIEvent *event)
++{
++ return lookup_name(event->ccode, TRBCCode_names,
++ ARRAY_SIZE(TRBCCode_names));
++}
++
+ static uint64_t xhci_mfindex_get(XHCIState *xhci)
+ {
+ int64_t now = qemu_get_clock_ns(vm_clock);
+@@ -574,7 +619,8 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
+ ev_trb.control = cpu_to_le32(ev_trb.control);
+
+ trace_usb_xhci_queue_event(xhci->er_ep_idx, trb_name(&ev_trb),
+- ev_trb.parameter, ev_trb.status, ev_trb.control);
++ event_name(event), ev_trb.parameter,
++ ev_trb.status, ev_trb.control);
+
+ addr = xhci->er_start + TRB_SIZE*xhci->er_ep_idx;
+ pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
+diff --git a/trace-events b/trace-events
+index 07b63f1..b38e32a 100644
+--- a/trace-events
++++ b/trace-events
+@@ -316,7 +316,7 @@ usb_xhci_runtime_write(uint32_t off, uint32_t val) "off 0x%04x, val 0x%08x"
+ usb_xhci_doorbell_write(uint32_t off, uint32_t val) "off 0x%04x, val 0x%08x"
+ usb_xhci_irq_intx(uint32_t level) "level %d"
+ usb_xhci_irq_msi(uint32_t nr) "nr %d"
+-usb_xhci_queue_event(uint32_t idx, const char *name, uint64_t param, uint32_t status, uint32_t control) "idx %d, %s, p %016" PRIx64 ", s %08x, c 0x%08x"
++usb_xhci_queue_event(uint32_t idx, const char *trb, const char *evt, uint64_t param, uint32_t status, uint32_t control) "idx %d, %s, %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_fetch_trb(uint64_t addr, const char *name, uint64_t param, uint32_t status, uint32_t control) "addr %016" PRIx64 ", %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_slot_enable(uint32_t slotid) "slotid %d"
+ usb_xhci_slot_disable(uint32_t slotid) "slotid %d"
+--
+1.7.12.1
+
--- /dev/null
+From 10a1380a50e33f98d5030d75d9d356f7ce024556 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 29 Aug 2012 12:54:59 +0200
+Subject: [PATCH] xhci: add trace_usb_xhci_ep_set_dequeue
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 2 +-
+ trace-events | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index ab352c0..c6ab4a1 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -1145,7 +1145,7 @@ static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
+ return CC_TRB_ERROR;
+ }
+
+- DPRINTF("xhci_set_ep_dequeue(%d, %d, %016"PRIx64")\n", slotid, epid, pdequeue);
++ trace_usb_xhci_ep_set_dequeue(slotid, epid, pdequeue);
+ dequeue = xhci_mask64(pdequeue);
+
+ slot = &xhci->slots[slotid-1];
+diff --git a/trace-events b/trace-events
+index b38e32a..2db1deb 100644
+--- a/trace-events
++++ b/trace-events
+@@ -326,6 +326,7 @@ usb_xhci_slot_evaluate(uint32_t slotid) "slotid %d"
+ usb_xhci_slot_reset(uint32_t slotid) "slotid %d"
+ usb_xhci_ep_enable(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_disable(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
++usb_xhci_ep_set_dequeue(uint32_t slotid, uint32_t epid, uint64_t param) "slotid %d, epid %d, ptr %016" PRIx64
+ usb_xhci_ep_kick(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_stop(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+ usb_xhci_ep_reset(uint32_t slotid, uint32_t epid) "slotid %d, epid %d"
+--
+1.7.12.1
+
--- /dev/null
+From 79e9a5ca778bfcb67073bfecd3f7cea7d93781ce Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 23 Aug 2012 13:26:25 +0200
+Subject: [PATCH] xhci: update register layout
+
+Change the register layout to be a bit more sparse and also not depend
+on the number of ports. Useful when for making the number of ports
+runtime-configurable.
+---
+ hw/usb/hcd-xhci.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index c6ab4a1..d47539d 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -36,13 +36,12 @@
+ #define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \
+ __func__, __LINE__); abort(); } while (0)
+
+-#define MAXSLOTS 8
+-#define MAXINTRS 1
+-
+ #define USB2_PORTS 4
+ #define USB3_PORTS 4
+
+ #define MAXPORTS (USB2_PORTS+USB3_PORTS)
++#define MAXSLOTS MAXPORTS
++#define MAXINTRS 1 /* MAXPORTS */
+
+ #define TD_QUEUE 24
+
+@@ -53,16 +52,22 @@
+ #define ER_FULL_HACK
+
+ #define LEN_CAP 0x40
+-#define OFF_OPER LEN_CAP
+ #define LEN_OPER (0x400 + 0x10 * MAXPORTS)
+-#define OFF_RUNTIME ((OFF_OPER + LEN_OPER + 0x20) & ~0x1f)
+-#define LEN_RUNTIME (0x20 + MAXINTRS * 0x20)
+-#define OFF_DOORBELL (OFF_RUNTIME + LEN_RUNTIME)
++#define LEN_RUNTIME ((MAXINTRS + 1) * 0x20)
+ #define LEN_DOORBELL ((MAXSLOTS + 1) * 0x20)
+
++#define OFF_OPER LEN_CAP
++#define OFF_RUNTIME 0x1000
++#define OFF_DOORBELL 0x2000
+ /* must be power of 2 */
+-#define LEN_REGS 0x2000
++#define LEN_REGS 0x4000
+
++#if (OFF_OPER + LEN_OPER) > OFF_RUNTIME
++#error Increase OFF_RUNTIME
++#endif
++#if (OFF_RUNTIME + LEN_RUNTIME) > OFF_DOORBELL
++#error Increase OFF_DOORBELL
++#endif
+ #if (OFF_DOORBELL + LEN_DOORBELL) > LEN_REGS
+ # error Increase LEN_REGS
+ #endif
+--
+1.7.12.1
+
--- /dev/null
+From 0b1ccd39faa8d1ea71f2d02dbab5dfd13f54ac98 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 13:38:01 +0200
+Subject: [PATCH] xhci: update port handling
+
+This patch changes the way xhci ports are linked to USBPorts. The fixed
+1:1 relationship between xhci ports and USBPorts is gone. Now each
+USBPort represents a physical plug which has usually two xhci ports
+assigned: one usb2 and ond usb3 port. usb devices show up at one or the
+other, depending on whenever they support superspeed or not.
+
+This patch also makes the number of usb2 and usb3 ports runtime
+configurable by adding 'p2' and 'p3' properties. It is allowed to
+have different numbers of usb2 and usb3 ports. Specifying p2=4,p3=2
+will give you an xhci adapter which supports all speeds on physical
+ports 1+2 and usb2 only on ports 3+4.
+---
+ hw/usb/hcd-xhci.c | 137 ++++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 97 insertions(+), 40 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index d47539d..5813b4a 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -36,10 +36,10 @@
+ #define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \
+ __func__, __LINE__); abort(); } while (0)
+
+-#define USB2_PORTS 4
+-#define USB3_PORTS 4
++#define MAXPORTS_2 8
++#define MAXPORTS_3 8
+
+-#define MAXPORTS (USB2_PORTS+USB3_PORTS)
++#define MAXPORTS (MAXPORTS_2+MAXPORTS_3)
+ #define MAXSLOTS MAXPORTS
+ #define MAXINTRS 1 /* MAXPORTS */
+
+@@ -300,8 +300,10 @@ typedef struct XHCIRing {
+ } XHCIRing;
+
+ typedef struct XHCIPort {
+- USBPort port;
+ uint32_t portsc;
++ uint32_t portnr;
++ USBPort *uport;
++ uint32_t speedmask;
+ } XHCIPort;
+
+ struct XHCIState;
+@@ -379,9 +381,13 @@ struct XHCIState {
+ qemu_irq irq;
+ MemoryRegion mem;
+ const char *name;
+- uint32_t msi;
+ unsigned int devaddr;
+
++ /* properties */
++ uint32_t numports_2;
++ uint32_t numports_3;
++ uint32_t msi;
++
+ /* Operational Registers */
+ uint32_t usbcmd;
+ uint32_t usbsts;
+@@ -392,8 +398,10 @@ struct XHCIState {
+ uint32_t dcbaap_high;
+ uint32_t config;
+
++ USBPort uports[MAX(MAXPORTS_2, MAXPORTS_3)];
+ XHCIPort ports[MAXPORTS];
+ XHCISlot slots[MAXSLOTS];
++ uint32_t numports;
+
+ /* Runtime Registers */
+ uint32_t iman;
+@@ -578,6 +586,28 @@ static inline dma_addr_t xhci_mask64(uint64_t addr)
+ }
+ }
+
++static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
++{
++ int index;
++
++ if (!uport->dev) {
++ return NULL;
++ }
++ switch (uport->dev->speed) {
++ case USB_SPEED_LOW:
++ case USB_SPEED_FULL:
++ case USB_SPEED_HIGH:
++ index = uport->index;
++ break;
++ case USB_SPEED_SUPER:
++ index = uport->index + xhci->numports_2;
++ break;
++ default:
++ return NULL;
++ }
++ return &xhci->ports[index];
++}
++
+ static void xhci_irq_update(XHCIState *xhci)
+ {
+ int level = 0;
+@@ -1126,7 +1156,7 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
+ ep |= 0x80;
+ }
+
+- dev = xhci->ports[xhci->slots[slotid-1].port-1].port.dev;
++ dev = xhci->ports[xhci->slots[slotid-1].port-1].uport->dev;
+ if (!dev) {
+ return CC_USB_TRANSACTION_ERROR;
+ }
+@@ -1313,7 +1343,7 @@ static USBDevice *xhci_find_device(XHCIPort *port, uint8_t addr)
+ if (!(port->portsc & PORTSC_PED)) {
+ return NULL;
+ }
+- return usb_find_device(&port->port, addr);
++ return usb_find_device(port->uport, addr);
+ }
+
+ static int xhci_setup_packet(XHCITransfer *xfer)
+@@ -1734,9 +1764,9 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
+ ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
+
+ port = (slot_ctx[1]>>16) & 0xFF;
+- dev = xhci->ports[port-1].port.dev;
++ dev = xhci->ports[port-1].uport->dev;
+
+- if (port < 1 || port > MAXPORTS) {
++ if (port < 1 || port > xhci->numports) {
+ fprintf(stderr, "xhci: bad port %d\n", port);
+ return CC_TRB_ERROR;
+ } else if (!dev) {
+@@ -1985,7 +2015,7 @@ static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *tr
+ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
+ {
+ dma_addr_t ctx;
+- uint8_t bw_ctx[MAXPORTS+1];
++ uint8_t bw_ctx[xhci->numports+1];
+
+ DPRINTF("xhci_get_port_bandwidth()\n");
+
+@@ -1995,7 +2025,7 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
+
+ /* TODO: actually implement real values here */
+ bw_ctx[0] = 0;
+- memset(&bw_ctx[1], 80, MAXPORTS); /* 80% */
++ memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
+ pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx));
+
+ return CC_SUCCESS;
+@@ -2165,12 +2195,11 @@ static void xhci_process_commands(XHCIState *xhci)
+
+ static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach)
+ {
+- int nr = port->port.index + 1;
+-
+ port->portsc = PORTSC_PP;
+- if (port->port.dev && port->port.dev->attached && !is_detach) {
++ if (port->uport->dev && port->uport->dev->attached && !is_detach &&
++ (1 << port->uport->dev->speed) & port->speedmask) {
+ port->portsc |= PORTSC_CCS;
+- switch (port->port.dev->speed) {
++ switch (port->uport->dev->speed) {
+ case USB_SPEED_LOW:
+ port->portsc |= PORTSC_SPEED_LOW;
+ break;
+@@ -2180,14 +2209,18 @@ static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach)
+ case USB_SPEED_HIGH:
+ port->portsc |= PORTSC_SPEED_HIGH;
+ break;
++ case USB_SPEED_SUPER:
++ port->portsc |= PORTSC_SPEED_SUPER;
++ break;
+ }
+ }
+
+ if (xhci_running(xhci)) {
+ port->portsc |= PORTSC_CSC;
+- XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS, nr << 24};
++ XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
++ port->portnr << 24};
+ xhci_event(xhci, &ev);
+- DPRINTF("xhci: port change event for port %d\n", nr);
++ DPRINTF("xhci: port change event for port %d\n", port->portnr);
+ }
+ }
+
+@@ -2215,7 +2248,7 @@ static void xhci_reset(DeviceState *dev)
+ xhci_disable_slot(xhci, i+1);
+ }
+
+- for (i = 0; i < MAXPORTS; i++) {
++ for (i = 0; i < xhci->numports; i++) {
+ xhci_update_port(xhci, xhci->ports + i, 0);
+ }
+
+@@ -2246,7 +2279,8 @@ static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
+ ret = 0x01000000 | LEN_CAP;
+ break;
+ case 0x04: /* HCSPARAMS 1 */
+- ret = (MAXPORTS<<24) | (MAXINTRS<<8) | MAXSLOTS;
++ ret = ((xhci->numports_2+xhci->numports_3)<<24)
++ | (MAXINTRS<<8) | MAXSLOTS;
+ break;
+ case 0x08: /* HCSPARAMS 2 */
+ ret = 0x0000000f;
+@@ -2276,7 +2310,7 @@ static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
+ ret = 0x20425455; /* "USB " */
+ break;
+ case 0x28: /* Supported Protocol:08 */
+- ret = 0x00000001 | (USB2_PORTS<<8);
++ ret = 0x00000001 | (xhci->numports_2<<8);
+ break;
+ case 0x2c: /* Supported Protocol:0c */
+ ret = 0x00000000; /* reserved */
+@@ -2288,7 +2322,7 @@ static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
+ ret = 0x20425455; /* "USB " */
+ break;
+ case 0x38: /* Supported Protocol:08 */
+- ret = 0x00000000 | (USB2_PORTS+1) | (USB3_PORTS<<8);
++ ret = 0x00000000 | (xhci->numports_2+1) | (xhci->numports_3<<8);
+ break;
+ case 0x3c: /* Supported Protocol:0c */
+ ret = 0x00000000; /* reserved */
+@@ -2307,7 +2341,7 @@ static uint32_t xhci_port_read(XHCIState *xhci, uint32_t reg)
+ uint32_t port = reg >> 4;
+ uint32_t ret;
+
+- if (port >= MAXPORTS) {
++ if (port >= xhci->numports) {
+ fprintf(stderr, "xhci_port_read: port %d out of bounds\n", port);
+ ret = 0;
+ goto out;
+@@ -2340,7 +2374,7 @@ static void xhci_port_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+
+ trace_usb_xhci_port_write(port, reg & 0x0f, val);
+
+- if (port >= MAXPORTS) {
++ if (port >= xhci->numports) {
+ fprintf(stderr, "xhci_port_read: port %d out of bounds\n", port);
+ return;
+ }
+@@ -2362,7 +2396,7 @@ static void xhci_port_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ /* write-1-to-start bits */
+ if (val & PORTSC_PR) {
+ DPRINTF("xhci: port %d reset\n", port);
+- usb_device_reset(xhci->ports[port].port.dev);
++ usb_device_reset(xhci->ports[port].uport->dev);
+ portsc |= PORTSC_PRC | PORTSC_PED;
+ }
+ xhci->ports[port].portsc = portsc;
+@@ -2659,7 +2693,7 @@ static const MemoryRegionOps xhci_mem_ops = {
+ static void xhci_attach(USBPort *usbport)
+ {
+ XHCIState *xhci = usbport->opaque;
+- XHCIPort *port = &xhci->ports[usbport->index];
++ XHCIPort *port = xhci_lookup_port(xhci, usbport);
+
+ xhci_update_port(xhci, port, 0);
+ }
+@@ -2667,7 +2701,7 @@ static void xhci_attach(USBPort *usbport)
+ static void xhci_detach(USBPort *usbport)
+ {
+ XHCIState *xhci = usbport->opaque;
+- XHCIPort *port = &xhci->ports[usbport->index];
++ XHCIPort *port = xhci_lookup_port(xhci, usbport);
+
+ xhci_update_port(xhci, port, 1);
+ }
+@@ -2675,9 +2709,9 @@ static void xhci_detach(USBPort *usbport)
+ static void xhci_wakeup(USBPort *usbport)
+ {
+ XHCIState *xhci = usbport->opaque;
+- XHCIPort *port = &xhci->ports[usbport->index];
+- int nr = port->port.index + 1;
+- XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS, nr << 24};
++ XHCIPort *port = xhci_lookup_port(xhci, usbport);
++ XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
++ port->portnr << 24};
+ uint32_t pls;
+
+ pls = (port->portsc >> PORTSC_PLS_SHIFT) & PORTSC_PLS_MASK;
+@@ -2759,22 +2793,43 @@ static USBBusOps xhci_bus_ops = {
+
+ static void usb_xhci_init(XHCIState *xhci, DeviceState *dev)
+ {
+- int i;
++ XHCIPort *port;
++ int i, usbports, speedmask;
+
+ xhci->usbsts = USBSTS_HCH;
+
++ if (xhci->numports_2 > MAXPORTS_2) {
++ xhci->numports_2 = MAXPORTS_2;
++ }
++ if (xhci->numports_3 > MAXPORTS_3) {
++ xhci->numports_3 = MAXPORTS_3;
++ }
++ usbports = MAX(xhci->numports_2, xhci->numports_3);
++ xhci->numports = xhci->numports_2 + xhci->numports_3;
++
+ usb_bus_new(&xhci->bus, &xhci_bus_ops, &xhci->pci_dev.qdev);
+
+- for (i = 0; i < MAXPORTS; i++) {
+- memset(&xhci->ports[i], 0, sizeof(xhci->ports[i]));
+- usb_register_port(&xhci->bus, &xhci->ports[i].port, xhci, i,
+- &xhci_port_ops,
+- USB_SPEED_MASK_LOW |
+- USB_SPEED_MASK_FULL |
+- USB_SPEED_MASK_HIGH);
+- }
+- for (i = 0; i < MAXSLOTS; i++) {
+- xhci->slots[i].enabled = 0;
++ for (i = 0; i < usbports; i++) {
++ speedmask = 0;
++ if (i < xhci->numports_2) {
++ port = &xhci->ports[i];
++ port->portnr = i + 1;
++ port->uport = &xhci->uports[i];
++ port->speedmask =
++ USB_SPEED_MASK_LOW |
++ USB_SPEED_MASK_FULL |
++ USB_SPEED_MASK_HIGH;
++ speedmask |= port->speedmask;
++ }
++ if (i < xhci->numports_3) {
++ port = &xhci->ports[i + xhci->numports_2];
++ port->portnr = i + 1 + xhci->numports_2;
++ port->uport = &xhci->uports[i];
++ port->speedmask = USB_SPEED_MASK_SUPER;
++ speedmask |= port->speedmask;
++ }
++ usb_register_port(&xhci->bus, &xhci->uports[i], xhci, i,
++ &xhci_port_ops, speedmask);
+ }
+ }
+
+@@ -2830,6 +2885,8 @@ static const VMStateDescription vmstate_xhci = {
+
+ static Property xhci_properties[] = {
+ DEFINE_PROP_UINT32("msi", XHCIState, msi, 0),
++ DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
++ DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
+ DEFINE_PROP_END_OF_LIST(),
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From 81e37421158a28277c9857ba733da4371cb06129 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 17:28:50 +0200
+Subject: [PATCH] usb3: superspeed descriptors
+
+Add superspeed descriptor entry to USBDesc,
+advertise superspeed support when present.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/desc.c | 10 +++++++++-
+ hw/usb/desc.h | 1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/desc.c b/hw/usb/desc.c
+index 0a9d3c9..3e8c6cb 100644
+--- a/hw/usb/desc.c
++++ b/hw/usb/desc.c
+@@ -359,6 +359,9 @@ static void usb_desc_setdefaults(USBDevice *dev)
+ case USB_SPEED_HIGH:
+ dev->device = desc->high;
+ break;
++ case USB_SPEED_SUPER:
++ dev->device = desc->super;
++ break;
+ }
+ usb_desc_set_config(dev, 0);
+ }
+@@ -376,6 +379,9 @@ void usb_desc_init(USBDevice *dev)
+ if (desc->high) {
+ dev->speedmask |= USB_SPEED_MASK_HIGH;
+ }
++ if (desc->super) {
++ dev->speedmask |= USB_SPEED_MASK_SUPER;
++ }
+ usb_desc_setdefaults(dev);
+ }
+
+@@ -384,7 +390,9 @@ void usb_desc_attach(USBDevice *dev)
+ const USBDesc *desc = usb_device_get_usb_desc(dev);
+
+ assert(desc != NULL);
+- if (desc->high && (dev->port->speedmask & USB_SPEED_MASK_HIGH)) {
++ if (desc->super && (dev->port->speedmask & USB_SPEED_MASK_SUPER)) {
++ dev->speed = USB_SPEED_SUPER;
++ } else if (desc->high && (dev->port->speedmask & USB_SPEED_MASK_HIGH)) {
+ dev->speed = USB_SPEED_HIGH;
+ } else if (desc->full && (dev->port->speedmask & USB_SPEED_MASK_FULL)) {
+ dev->speed = USB_SPEED_FULL;
+diff --git a/hw/usb/desc.h b/hw/usb/desc.h
+index 7cf5442..d89fa41 100644
+--- a/hw/usb/desc.h
++++ b/hw/usb/desc.h
+@@ -152,6 +152,7 @@ struct USBDesc {
+ USBDescID id;
+ const USBDescDevice *full;
+ const USBDescDevice *high;
++ const USBDescDevice *super;
+ const char* const *str;
+ };
+
+--
+1.7.12.1
+
--- /dev/null
+From e0354b4f91dd198b5bfe1ddf649588d6af84ea9c Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 17:28:03 +0200
+Subject: [PATCH] usb3: superspeed endpoint companion
+
+Add support for building superspeed endpoint companion descriptors,
+create them for superspeed usb devices.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb.h | 1 +
+ hw/usb/desc.c | 55 ++++++++++++++++++++++++++++++++++++++++---------------
+ hw/usb/desc.h | 26 +++++++++++++++++++++-----
+ 3 files changed, 62 insertions(+), 20 deletions(-)
+
+diff --git a/hw/usb.h b/hw/usb.h
+index 684e3f4..78ffdf4 100644
+--- a/hw/usb.h
++++ b/hw/usb.h
+@@ -137,6 +137,7 @@
+ #define USB_DT_INTERFACE_ASSOC 0x0B
+ #define USB_DT_CS_INTERFACE 0x24
+ #define USB_DT_CS_ENDPOINT 0x25
++#define USB_DT_ENDPOINT_COMPANION 0x30
+
+ #define USB_ENDPOINT_XFER_CONTROL 0
+ #define USB_ENDPOINT_XFER_ISOC 1
+diff --git a/hw/usb/desc.c b/hw/usb/desc.c
+index 3e8c6cb..8f5a8e5 100644
+--- a/hw/usb/desc.c
++++ b/hw/usb/desc.c
+@@ -76,7 +76,8 @@ int usb_desc_device_qualifier(const USBDescDevice *dev,
+ return bLength;
+ }
+
+-int usb_desc_config(const USBDescConfig *conf, uint8_t *dest, size_t len)
++int usb_desc_config(const USBDescConfig *conf, int flags,
++ uint8_t *dest, size_t len)
+ {
+ uint8_t bLength = 0x09;
+ uint16_t wTotalLength = 0;
+@@ -99,7 +100,7 @@ int usb_desc_config(const USBDescConfig *conf, uint8_t *dest, size_t len)
+
+ /* handle grouped interfaces if any */
+ for (i = 0; i < conf->nif_groups; i++) {
+- rc = usb_desc_iface_group(&(conf->if_groups[i]),
++ rc = usb_desc_iface_group(&(conf->if_groups[i]), flags,
+ dest + wTotalLength,
+ len - wTotalLength);
+ if (rc < 0) {
+@@ -110,7 +111,8 @@ int usb_desc_config(const USBDescConfig *conf, uint8_t *dest, size_t len)
+
+ /* handle normal (ungrouped / no IAD) interfaces if any */
+ for (i = 0; i < conf->nif; i++) {
+- rc = usb_desc_iface(conf->ifs + i, dest + wTotalLength, len - wTotalLength);
++ rc = usb_desc_iface(conf->ifs + i, flags,
++ dest + wTotalLength, len - wTotalLength);
+ if (rc < 0) {
+ return rc;
+ }
+@@ -122,8 +124,8 @@ int usb_desc_config(const USBDescConfig *conf, uint8_t *dest, size_t len)
+ return wTotalLength;
+ }
+
+-int usb_desc_iface_group(const USBDescIfaceAssoc *iad, uint8_t *dest,
+- size_t len)
++int usb_desc_iface_group(const USBDescIfaceAssoc *iad, int flags,
++ uint8_t *dest, size_t len)
+ {
+ int pos = 0;
+ int i = 0;
+@@ -147,7 +149,7 @@ int usb_desc_iface_group(const USBDescIfaceAssoc *iad, uint8_t *dest,
+
+ /* handle associated interfaces in this group */
+ for (i = 0; i < iad->nif; i++) {
+- int rc = usb_desc_iface(&(iad->ifs[i]), dest + pos, len - pos);
++ int rc = usb_desc_iface(&(iad->ifs[i]), flags, dest + pos, len - pos);
+ if (rc < 0) {
+ return rc;
+ }
+@@ -157,7 +159,8 @@ int usb_desc_iface_group(const USBDescIfaceAssoc *iad, uint8_t *dest,
+ return pos;
+ }
+
+-int usb_desc_iface(const USBDescIface *iface, uint8_t *dest, size_t len)
++int usb_desc_iface(const USBDescIface *iface, int flags,
++ uint8_t *dest, size_t len)
+ {
+ uint8_t bLength = 0x09;
+ int i, rc, pos = 0;
+@@ -188,7 +191,7 @@ int usb_desc_iface(const USBDescIface *iface, uint8_t *dest, size_t len)
+ }
+
+ for (i = 0; i < iface->bNumEndpoints; i++) {
+- rc = usb_desc_endpoint(iface->eps + i, dest + pos, len - pos);
++ rc = usb_desc_endpoint(iface->eps + i, flags, dest + pos, len - pos);
+ if (rc < 0) {
+ return rc;
+ }
+@@ -198,13 +201,15 @@ int usb_desc_iface(const USBDescIface *iface, uint8_t *dest, size_t len)
+ return pos;
+ }
+
+-int usb_desc_endpoint(const USBDescEndpoint *ep, uint8_t *dest, size_t len)
++int usb_desc_endpoint(const USBDescEndpoint *ep, int flags,
++ uint8_t *dest, size_t len)
+ {
+ uint8_t bLength = ep->is_audio ? 0x09 : 0x07;
+ uint8_t extralen = ep->extra ? ep->extra[0] : 0;
++ uint8_t superlen = (flags & USB_DESC_FLAG_SUPER) ? 0x06 : 0;
+ USBDescriptor *d = (void *)dest;
+
+- if (len < bLength + extralen) {
++ if (len < bLength + extralen + superlen) {
+ return -1;
+ }
+
+@@ -224,7 +229,21 @@ int usb_desc_endpoint(const USBDescEndpoint *ep, uint8_t *dest, size_t len)
+ memcpy(dest + bLength, ep->extra, extralen);
+ }
+
+- return bLength + extralen;
++ if (superlen) {
++ USBDescriptor *d = (void *)(dest + bLength + extralen);
++
++ d->bLength = 0x06;
++ d->bDescriptorType = USB_DT_ENDPOINT_COMPANION;
++
++ d->u.super_endpoint.bMaxBurst = ep->bMaxBurst;
++ d->u.super_endpoint.bmAttributes = ep->bmAttributes_super;
++ d->u.super_endpoint.wBytesPerInterval_lo =
++ usb_lo(ep->wBytesPerInterval);
++ d->u.super_endpoint.wBytesPerInterval_hi =
++ usb_hi(ep->wBytesPerInterval);
++ }
++
++ return bLength + extralen + superlen;
+ }
+
+ int usb_desc_other(const USBDescOther *desc, uint8_t *dest, size_t len)
+@@ -509,7 +528,7 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ uint8_t buf[256];
+ uint8_t type = value >> 8;
+ uint8_t index = value & 0xff;
+- int ret = -1;
++ int flags, ret = -1;
+
+ if (dev->speed == USB_SPEED_HIGH) {
+ other_dev = usb_device_get_usb_desc(dev)->full;
+@@ -517,6 +536,11 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ other_dev = usb_device_get_usb_desc(dev)->high;
+ }
+
++ flags = 0;
++ if (dev->device->bcdUSB >= 0x0300) {
++ flags |= USB_DESC_FLAG_SUPER;
++ }
++
+ switch(type) {
+ case USB_DT_DEVICE:
+ ret = usb_desc_device(&desc->id, dev->device, buf, sizeof(buf));
+@@ -524,7 +548,8 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ break;
+ case USB_DT_CONFIG:
+ if (index < dev->device->bNumConfigurations) {
+- ret = usb_desc_config(dev->device->confs + index, buf, sizeof(buf));
++ ret = usb_desc_config(dev->device->confs + index, flags,
++ buf, sizeof(buf));
+ }
+ trace_usb_desc_config(dev->addr, index, len, ret);
+ break;
+@@ -532,7 +557,6 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ ret = usb_desc_string(dev, index, buf, sizeof(buf));
+ trace_usb_desc_string(dev->addr, index, len, ret);
+ break;
+-
+ case USB_DT_DEVICE_QUALIFIER:
+ if (other_dev != NULL) {
+ ret = usb_desc_device_qualifier(other_dev, buf, sizeof(buf));
+@@ -541,7 +565,8 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ break;
+ case USB_DT_OTHER_SPEED_CONFIG:
+ if (other_dev != NULL && index < other_dev->bNumConfigurations) {
+- ret = usb_desc_config(other_dev->confs + index, buf, sizeof(buf));
++ ret = usb_desc_config(other_dev->confs + index, flags,
++ buf, sizeof(buf));
+ buf[0x01] = USB_DT_OTHER_SPEED_CONFIG;
+ }
+ trace_usb_desc_other_speed_config(dev->addr, index, len, ret);
+diff --git a/hw/usb/desc.h b/hw/usb/desc.h
+index d89fa41..4b5e88d 100644
+--- a/hw/usb/desc.h
++++ b/hw/usb/desc.h
+@@ -63,6 +63,12 @@ typedef struct USBDescriptor {
+ uint8_t bRefresh; /* only audio ep */
+ uint8_t bSynchAddress; /* only audio ep */
+ } endpoint;
++ struct {
++ uint8_t bMaxBurst;
++ uint8_t bmAttributes;
++ uint8_t wBytesPerInterval_lo;
++ uint8_t wBytesPerInterval_hi;
++ } super_endpoint;
+ } u;
+ } QEMU_PACKED USBDescriptor;
+
+@@ -139,6 +145,11 @@ struct USBDescEndpoint {
+
+ uint8_t is_audio; /* has bRefresh + bSynchAddress */
+ uint8_t *extra;
++
++ /* superspeed endpoint companion */
++ uint8_t bMaxBurst;
++ uint8_t bmAttributes_super;
++ uint16_t wBytesPerInterval;
+ };
+
+ struct USBDescOther {
+@@ -156,16 +167,21 @@ struct USBDesc {
+ const char* const *str;
+ };
+
++#define USB_DESC_FLAG_SUPER (1 << 1)
++
+ /* generate usb packages from structs */
+ int usb_desc_device(const USBDescID *id, const USBDescDevice *dev,
+ uint8_t *dest, size_t len);
+ int usb_desc_device_qualifier(const USBDescDevice *dev,
+ uint8_t *dest, size_t len);
+-int usb_desc_config(const USBDescConfig *conf, uint8_t *dest, size_t len);
+-int usb_desc_iface_group(const USBDescIfaceAssoc *iad, uint8_t *dest,
+- size_t len);
+-int usb_desc_iface(const USBDescIface *iface, uint8_t *dest, size_t len);
+-int usb_desc_endpoint(const USBDescEndpoint *ep, uint8_t *dest, size_t len);
++int usb_desc_config(const USBDescConfig *conf, int flags,
++ uint8_t *dest, size_t len);
++int usb_desc_iface_group(const USBDescIfaceAssoc *iad, int flags,
++ uint8_t *dest, size_t len);
++int usb_desc_iface(const USBDescIface *iface, int flags,
++ uint8_t *dest, size_t len);
++int usb_desc_endpoint(const USBDescEndpoint *ep, int flags,
++ uint8_t *dest, size_t len);
+ int usb_desc_other(const USBDescOther *desc, uint8_t *dest, size_t len);
+
+ /* control message emulation helpers */
+--
+1.7.12.1
+
--- /dev/null
+From 2014680cdc2834fef9b4cee5e1239f22d8dbdba3 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 17:46:29 +0200
+Subject: [PATCH] usb3: bos decriptor
+
+Add support for creating BOS descriptor and
+device cappability descriptors.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb.h | 6 ++++
+ hw/usb/desc.c | 109 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/usb/desc.h | 25 ++++++++++++++
+ trace-events | 1 +
+ 4 files changed, 141 insertions(+)
+
+diff --git a/hw/usb.h b/hw/usb.h
+index 78ffdf4..48c8926 100644
+--- a/hw/usb.h
++++ b/hw/usb.h
+@@ -135,10 +135,16 @@
+ #define USB_DT_OTHER_SPEED_CONFIG 0x07
+ #define USB_DT_DEBUG 0x0A
+ #define USB_DT_INTERFACE_ASSOC 0x0B
++#define USB_DT_BOS 0x0F
++#define USB_DT_DEVICE_CAPABILITY 0x10
+ #define USB_DT_CS_INTERFACE 0x24
+ #define USB_DT_CS_ENDPOINT 0x25
+ #define USB_DT_ENDPOINT_COMPANION 0x30
+
++#define USB_DEV_CAP_WIRELESS 0x01
++#define USB_DEV_CAP_USB2_EXT 0x02
++#define USB_DEV_CAP_SUPERSPEED 0x03
++
+ #define USB_ENDPOINT_XFER_CONTROL 0
+ #define USB_ENDPOINT_XFER_ISOC 1
+ #define USB_ENDPOINT_XFER_BULK 2
+diff --git a/hw/usb/desc.c b/hw/usb/desc.c
+index 8f5a8e5..1f12eae 100644
+--- a/hw/usb/desc.c
++++ b/hw/usb/desc.c
+@@ -258,6 +258,111 @@ int usb_desc_other(const USBDescOther *desc, uint8_t *dest, size_t len)
+ return bLength;
+ }
+
++static int usb_desc_cap_usb2_ext(const USBDesc *desc, uint8_t *dest, size_t len)
++{
++ uint8_t bLength = 0x07;
++ USBDescriptor *d = (void *)dest;
++
++ if (len < bLength) {
++ return -1;
++ }
++
++ d->bLength = bLength;
++ d->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
++ d->u.cap.bDevCapabilityType = USB_DEV_CAP_USB2_EXT;
++
++ d->u.cap.u.usb2_ext.bmAttributes_1 = (1 << 1); /* LPM */
++ d->u.cap.u.usb2_ext.bmAttributes_2 = 0;
++ d->u.cap.u.usb2_ext.bmAttributes_3 = 0;
++ d->u.cap.u.usb2_ext.bmAttributes_4 = 0;
++
++ return bLength;
++}
++
++static int usb_desc_cap_super(const USBDesc *desc, uint8_t *dest, size_t len)
++{
++ uint8_t bLength = 0x0a;
++ USBDescriptor *d = (void *)dest;
++
++ if (len < bLength) {
++ return -1;
++ }
++
++ d->bLength = bLength;
++ d->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
++ d->u.cap.bDevCapabilityType = USB_DEV_CAP_SUPERSPEED;
++
++ d->u.cap.u.super.bmAttributes = 0;
++ d->u.cap.u.super.wSpeedsSupported_lo = 0;
++ d->u.cap.u.super.wSpeedsSupported_hi = 0;
++ d->u.cap.u.super.bFunctionalitySupport = 0;
++ d->u.cap.u.super.bU1DevExitLat = 0x0a;
++ d->u.cap.u.super.wU2DevExitLat_lo = 0x20;
++ d->u.cap.u.super.wU2DevExitLat_hi = 0;
++
++ if (desc->full) {
++ d->u.cap.u.super.wSpeedsSupported_lo |= (1 << 1);
++ d->u.cap.u.super.bFunctionalitySupport = 1;
++ }
++ if (desc->high) {
++ d->u.cap.u.super.wSpeedsSupported_lo |= (1 << 2);
++ if (!d->u.cap.u.super.bFunctionalitySupport) {
++ d->u.cap.u.super.bFunctionalitySupport = 2;
++ }
++ }
++ if (desc->super) {
++ d->u.cap.u.super.wSpeedsSupported_lo |= (1 << 3);
++ if (!d->u.cap.u.super.bFunctionalitySupport) {
++ d->u.cap.u.super.bFunctionalitySupport = 3;
++ }
++ }
++
++ return bLength;
++}
++
++static int usb_desc_bos(const USBDesc *desc, uint8_t *dest, size_t len)
++{
++ uint8_t bLength = 0x05;
++ uint16_t wTotalLength = 0;
++ uint8_t bNumDeviceCaps = 0;
++ USBDescriptor *d = (void *)dest;
++ int rc;
++
++ if (len < bLength) {
++ return -1;
++ }
++
++ d->bLength = bLength;
++ d->bDescriptorType = USB_DT_BOS;
++
++ wTotalLength += bLength;
++
++ if (desc->high != NULL) {
++ rc = usb_desc_cap_usb2_ext(desc, dest + wTotalLength,
++ len - wTotalLength);
++ if (rc < 0) {
++ return rc;
++ }
++ wTotalLength += rc;
++ bNumDeviceCaps++;
++ }
++
++ if (desc->super != NULL) {
++ rc = usb_desc_cap_super(desc, dest + wTotalLength,
++ len - wTotalLength);
++ if (rc < 0) {
++ return rc;
++ }
++ wTotalLength += rc;
++ bNumDeviceCaps++;
++ }
++
++ d->u.bos.wTotalLength_lo = usb_lo(wTotalLength);
++ d->u.bos.wTotalLength_hi = usb_hi(wTotalLength);
++ d->u.bos.bNumDeviceCaps = bNumDeviceCaps;
++ return wTotalLength;
++}
++
+ /* ------------------------------------------------------------------ */
+
+ static void usb_desc_ep_init(USBDevice *dev)
+@@ -571,6 +676,10 @@ int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len
+ }
+ trace_usb_desc_other_speed_config(dev->addr, index, len, ret);
+ break;
++ case USB_DT_BOS:
++ ret = usb_desc_bos(desc, buf, sizeof(buf));
++ trace_usb_desc_bos(dev->addr, len, ret);
++ break;
+
+ case USB_DT_DEBUG:
+ /* ignore silently */
+diff --git a/hw/usb/desc.h b/hw/usb/desc.h
+index 4b5e88d..68bb570 100644
+--- a/hw/usb/desc.h
++++ b/hw/usb/desc.h
+@@ -69,6 +69,31 @@ typedef struct USBDescriptor {
+ uint8_t wBytesPerInterval_lo;
+ uint8_t wBytesPerInterval_hi;
+ } super_endpoint;
++ struct {
++ uint8_t wTotalLength_lo;
++ uint8_t wTotalLength_hi;
++ uint8_t bNumDeviceCaps;
++ } bos;
++ struct {
++ uint8_t bDevCapabilityType;
++ union {
++ struct {
++ uint8_t bmAttributes_1;
++ uint8_t bmAttributes_2;
++ uint8_t bmAttributes_3;
++ uint8_t bmAttributes_4;
++ } usb2_ext;
++ struct {
++ uint8_t bmAttributes;
++ uint8_t wSpeedsSupported_lo;
++ uint8_t wSpeedsSupported_hi;
++ uint8_t bFunctionalitySupport;
++ uint8_t bU1DevExitLat;
++ uint8_t wU2DevExitLat_lo;
++ uint8_t wU2DevExitLat_hi;
++ } super;
++ } u;
++ } cap;
+ } u;
+ } QEMU_PACKED USBDescriptor;
+
+diff --git a/trace-events b/trace-events
+index 2db1deb..d941e78 100644
+--- a/trace-events
++++ b/trace-events
+@@ -343,6 +343,7 @@ usb_desc_device_qualifier(int addr, int len, int ret) "dev %d query device quali
+ usb_desc_config(int addr, int index, int len, int ret) "dev %d query config %d, len %d, ret %d"
+ usb_desc_other_speed_config(int addr, int index, int len, int ret) "dev %d query config %d, len %d, ret %d"
+ usb_desc_string(int addr, int index, int len, int ret) "dev %d query string %d, len %d, ret %d"
++usb_desc_bos(int addr, int len, int ret) "dev %d bos, len %d, ret %d"
+ usb_set_addr(int addr) "dev %d"
+ usb_set_config(int addr, int config, int ret) "dev %d, config %d, ret %d"
+ usb_set_interface(int addr, int iface, int alt, int ret) "dev %d, interface %d, altsetting %d, ret %d"
+--
+1.7.12.1
+
--- /dev/null
+From 9a6fd10bf6a85c4df63a7ba1cf7d6203220d722e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Aug 2012 17:29:15 +0200
+Subject: [PATCH] usb-storage: usb3 support
+
+Add usb3 descriptors to usb-storage, so it shows up as superspeed
+device when connected to xhci.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/dev-storage.c | 46 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 43 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
+index ff48d91..e732191 100644
+--- a/hw/usb/dev-storage.c
++++ b/hw/usb/dev-storage.c
+@@ -78,6 +78,7 @@ enum {
+ STR_SERIALNUMBER,
+ STR_CONFIG_FULL,
+ STR_CONFIG_HIGH,
++ STR_CONFIG_SUPER,
+ };
+
+ static const USBDescStrings desc_strings = {
+@@ -86,6 +87,7 @@ static const USBDescStrings desc_strings = {
+ [STR_SERIALNUMBER] = "1",
+ [STR_CONFIG_FULL] = "Full speed config (usb 1.1)",
+ [STR_CONFIG_HIGH] = "High speed config (usb 2.0)",
++ [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
+ };
+
+ static const USBDescIface desc_iface_full = {
+@@ -158,6 +160,43 @@ static const USBDescDevice desc_device_high = {
+ },
+ };
+
++static const USBDescIface desc_iface_super = {
++ .bInterfaceNumber = 0,
++ .bNumEndpoints = 2,
++ .bInterfaceClass = USB_CLASS_MASS_STORAGE,
++ .bInterfaceSubClass = 0x06, /* SCSI */
++ .bInterfaceProtocol = 0x50, /* Bulk */
++ .eps = (USBDescEndpoint[]) {
++ {
++ .bEndpointAddress = USB_DIR_IN | 0x01,
++ .bmAttributes = USB_ENDPOINT_XFER_BULK,
++ .wMaxPacketSize = 1024,
++ .bMaxBurst = 15,
++ },{
++ .bEndpointAddress = USB_DIR_OUT | 0x02,
++ .bmAttributes = USB_ENDPOINT_XFER_BULK,
++ .wMaxPacketSize = 1024,
++ .bMaxBurst = 15,
++ },
++ }
++};
++
++static const USBDescDevice desc_device_super = {
++ .bcdUSB = 0x0300,
++ .bMaxPacketSize0 = 9,
++ .bNumConfigurations = 1,
++ .confs = (USBDescConfig[]) {
++ {
++ .bNumInterfaces = 1,
++ .bConfigurationValue = 1,
++ .iConfiguration = STR_CONFIG_SUPER,
++ .bmAttributes = 0xc0,
++ .nif = 1,
++ .ifs = &desc_iface_super,
++ },
++ },
++};
++
+ static const USBDesc desc = {
+ .id = {
+ .idVendor = 0x46f4, /* CRC16() of "QEMU" */
+@@ -167,9 +206,10 @@ static const USBDesc desc = {
+ .iProduct = STR_PRODUCT,
+ .iSerialNumber = STR_SERIALNUMBER,
+ },
+- .full = &desc_device_full,
+- .high = &desc_device_high,
+- .str = desc_strings,
++ .full = &desc_device_full,
++ .high = &desc_device_high,
++ .super = &desc_device_super,
++ .str = desc_strings,
+ };
+
+ static void usb_msd_copy_data(MSDState *s, USBPacket *p)
+--
+1.7.12.1
+
--- /dev/null
+From e97e63460859a74cf53c85e97a6d60633a92cc64 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 10:57:12 +0200
+Subject: [PATCH] xhci: fix & cleanup msi.
+
+Drop custom write_config function which isn't needed any more.
+Make the msi property a bit property so it accepts 'on' & 'off'.
+Enable MSI by default.
+
+TODO: add compat property to disable on old machine types.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 27 +++++++++------------------
+ 1 file changed, 9 insertions(+), 18 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 5813b4a..d2e6ee6 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -386,7 +386,7 @@ struct XHCIState {
+ /* properties */
+ uint32_t numports_2;
+ uint32_t numports_3;
+- uint32_t msi;
++ uint32_t flags;
+
+ /* Operational Registers */
+ uint32_t usbcmd;
+@@ -435,6 +435,10 @@ typedef struct XHCIEvRingSeg {
+ uint32_t rsvd;
+ } XHCIEvRingSeg;
+
++enum xhci_flags {
++ XHCI_FLAG_USE_MSI = 1,
++};
++
+ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
+ unsigned int epid);
+ static void xhci_event(XHCIState *xhci, XHCIEvent *event);
+@@ -617,7 +621,7 @@ static void xhci_irq_update(XHCIState *xhci)
+ level = 1;
+ }
+
+- if (xhci->msi && msi_enabled(&xhci->pci_dev)) {
++ if (msi_enabled(&xhci->pci_dev)) {
+ if (level) {
+ trace_usb_xhci_irq_msi(0);
+ msi_notify(&xhci->pci_dev, 0);
+@@ -2859,32 +2863,20 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
+ ret = pcie_cap_init(&xhci->pci_dev, 0xa0, PCI_EXP_TYPE_ENDPOINT, 0);
+ assert(ret >= 0);
+
+- if (xhci->msi) {
+- ret = msi_init(&xhci->pci_dev, 0x70, 1, true, false);
+- assert(ret >= 0);
++ if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) {
++ msi_init(&xhci->pci_dev, 0x70, MAXINTRS, true, false);
+ }
+
+ return 0;
+ }
+
+-static void xhci_write_config(PCIDevice *dev, uint32_t addr, uint32_t val,
+- int len)
+-{
+- XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev, dev);
+-
+- pci_default_write_config(dev, addr, val, len);
+- if (xhci->msi) {
+- msi_write_config(dev, addr, val, len);
+- }
+-}
+-
+ static const VMStateDescription vmstate_xhci = {
+ .name = "xhci",
+ .unmigratable = 1,
+ };
+
+ static Property xhci_properties[] = {
+- DEFINE_PROP_UINT32("msi", XHCIState, msi, 0),
++ DEFINE_PROP_BIT("msi", XHCIState, flags, XHCI_FLAG_USE_MSI, true),
+ DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
+ DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
+ DEFINE_PROP_END_OF_LIST(),
+@@ -2904,7 +2896,6 @@ static void xhci_class_init(ObjectClass *klass, void *data)
+ k->class_id = PCI_CLASS_SERIAL_USB;
+ k->revision = 0x03;
+ k->is_express = 1;
+- k->config_write = xhci_write_config;
+ }
+
+ static TypeInfo xhci_info = {
+--
+1.7.12.1
+
--- /dev/null
+From 3bf435b656390f75ce8b8990f7484efb162472c9 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 13:05:10 +0200
+Subject: [PATCH] xhci: rework interrupt handling
+
+Split xhci_irq_update into a function which handles intx updates
+(including lowering the irq line once the guests acks the interrupt)
+and one which is used for raising an irq only.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 47 +++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 33 insertions(+), 14 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index d2e6ee6..1857f42 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -612,24 +612,43 @@ static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
+ return &xhci->ports[index];
+ }
+
+-static void xhci_irq_update(XHCIState *xhci)
++static void xhci_intx_update(XHCIState *xhci)
+ {
+ int level = 0;
+
+- if (xhci->iman & IMAN_IP && xhci->iman & IMAN_IE &&
++ if (msi_enabled(&xhci->pci_dev)) {
++ return;
++ }
++
++ if (xhci->iman & IMAN_IP &&
++ xhci->iman & IMAN_IE &&
+ xhci->usbcmd & USBCMD_INTE) {
+ level = 1;
+ }
+
++ trace_usb_xhci_irq_intx(level);
++ qemu_set_irq(xhci->irq, level);
++}
++
++static void xhci_intr_raise(XHCIState *xhci)
++{
++ if (!(xhci->iman & IMAN_IP) ||
++ !(xhci->iman & IMAN_IE)) {
++ return;
++ }
++
++ if (!(xhci->usbcmd & USBCMD_INTE)) {
++ return;
++ }
++
+ if (msi_enabled(&xhci->pci_dev)) {
+- if (level) {
+- trace_usb_xhci_irq_msi(0);
+- msi_notify(&xhci->pci_dev, 0);
+- }
+- } else {
+- trace_usb_xhci_irq_intx(level);
+- qemu_set_irq(xhci->irq, level);
++ trace_usb_xhci_irq_msi(0);
++ msi_notify(&xhci->pci_dev, 0);
++ return;
+ }
++
++ trace_usb_xhci_irq_intx(1);
++ qemu_set_irq(xhci->irq, 1);
+ }
+
+ static inline int xhci_running(XHCIState *xhci)
+@@ -732,7 +751,7 @@ static void xhci_events_update(XHCIState *xhci)
+ xhci->erdp_low |= ERDP_EHB;
+ xhci->iman |= IMAN_IP;
+ xhci->usbsts |= USBSTS_EINT;
+- xhci_irq_update(xhci);
++ xhci_intr_raise(xhci);
+ }
+
+ if (xhci->er_full && xhci->ev_buffer_put == xhci->ev_buffer_get) {
+@@ -796,7 +815,7 @@ static void xhci_event(XHCIState *xhci, XHCIEvent *event)
+ xhci->iman |= IMAN_IP;
+ xhci->usbsts |= USBSTS_EINT;
+
+- xhci_irq_update(xhci);
++ xhci_intr_raise(xhci);
+ }
+
+ static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
+@@ -2479,13 +2498,13 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ if (val & USBCMD_HCRST) {
+ xhci_reset(&xhci->pci_dev.qdev);
+ }
+- xhci_irq_update(xhci);
++ xhci_intx_update(xhci);
+ break;
+
+ case 0x04: /* USBSTS */
+ /* these bits are write-1-to-clear */
+ xhci->usbsts &= ~(val & (USBSTS_HSE|USBSTS_EINT|USBSTS_PCD|USBSTS_SRE));
+- xhci_irq_update(xhci);
++ xhci_intx_update(xhci);
+ break;
+
+ case 0x14: /* DNCTRL */
+@@ -2570,7 +2589,7 @@ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ }
+ xhci->iman &= ~IMAN_IE;
+ xhci->iman |= val & IMAN_IE;
+- xhci_irq_update(xhci);
++ xhci_intx_update(xhci);
+ break;
+ case 0x24: /* IMOD */
+ xhci->imod = val;
+--
+1.7.12.1
+
--- /dev/null
+From b04ba21e22b2df805af8236bc462c5c403fc6ee4 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 12:06:59 +0200
+Subject: [PATCH] xhci: add msix support
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++-
+ trace-events | 3 +++
+ 2 files changed, 49 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 1857f42..777f903 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -23,6 +23,7 @@
+ #include "hw/usb.h"
+ #include "hw/pci.h"
+ #include "hw/msi.h"
++#include "hw/msix.h"
+ #include "trace.h"
+
+ //#define DEBUG_XHCI
+@@ -59,6 +60,8 @@
+ #define OFF_OPER LEN_CAP
+ #define OFF_RUNTIME 0x1000
+ #define OFF_DOORBELL 0x2000
++#define OFF_MSIX_TABLE 0x3000
++#define OFF_MSIX_PBA 0x3800
+ /* must be power of 2 */
+ #define LEN_REGS 0x4000
+
+@@ -411,6 +414,7 @@ struct XHCIState {
+ uint32_t erstba_high;
+ uint32_t erdp_low;
+ uint32_t erdp_high;
++ bool msix_used;
+
+ int64_t mfindex_start;
+ QEMUTimer *mfwrap_timer;
+@@ -437,6 +441,7 @@ typedef struct XHCIEvRingSeg {
+
+ enum xhci_flags {
+ XHCI_FLAG_USE_MSI = 1,
++ XHCI_FLAG_USE_MSI_X,
+ };
+
+ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
+@@ -616,7 +621,8 @@ static void xhci_intx_update(XHCIState *xhci)
+ {
+ int level = 0;
+
+- if (msi_enabled(&xhci->pci_dev)) {
++ if (msix_enabled(&xhci->pci_dev) ||
++ msi_enabled(&xhci->pci_dev)) {
+ return;
+ }
+
+@@ -630,6 +636,30 @@ static void xhci_intx_update(XHCIState *xhci)
+ qemu_set_irq(xhci->irq, level);
+ }
+
++static void xhci_msix_update(XHCIState *xhci)
++{
++ bool enabled;
++
++ if (!msix_enabled(&xhci->pci_dev)) {
++ return;
++ }
++
++ enabled = xhci->iman & IMAN_IE;
++ if (enabled == xhci->msix_used) {
++ return;
++ }
++
++ if (enabled) {
++ trace_usb_xhci_irq_msix_use(0);
++ msix_vector_use(&xhci->pci_dev, 0);
++ xhci->msix_used = true;
++ } else {
++ trace_usb_xhci_irq_msix_unuse(0);
++ msix_vector_unuse(&xhci->pci_dev, 0);
++ xhci->msix_used = false;
++ }
++}
++
+ static void xhci_intr_raise(XHCIState *xhci)
+ {
+ if (!(xhci->iman & IMAN_IP) ||
+@@ -641,6 +671,12 @@ static void xhci_intr_raise(XHCIState *xhci)
+ return;
+ }
+
++ if (msix_enabled(&xhci->pci_dev)) {
++ trace_usb_xhci_irq_msix(0);
++ msix_notify(&xhci->pci_dev, 0);
++ return;
++ }
++
+ if (msi_enabled(&xhci->pci_dev)) {
+ trace_usb_xhci_irq_msi(0);
+ msi_notify(&xhci->pci_dev, 0);
+@@ -2282,6 +2318,7 @@ static void xhci_reset(DeviceState *dev)
+ xhci->erstba_high = 0;
+ xhci->erdp_low = 0;
+ xhci->erdp_high = 0;
++ xhci->msix_used = 0;
+
+ xhci->er_ep_idx = 0;
+ xhci->er_pcs = 1;
+@@ -2590,6 +2627,7 @@ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ xhci->iman &= ~IMAN_IE;
+ xhci->iman |= val & IMAN_IE;
+ xhci_intx_update(xhci);
++ xhci_msix_update(xhci);
+ break;
+ case 0x24: /* IMOD */
+ xhci->imod = val;
+@@ -2885,6 +2923,12 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
+ if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) {
+ msi_init(&xhci->pci_dev, 0x70, MAXINTRS, true, false);
+ }
++ if (xhci->flags & (1 << XHCI_FLAG_USE_MSI_X)) {
++ msix_init(&xhci->pci_dev, MAXINTRS,
++ &xhci->mem, 0, OFF_MSIX_TABLE,
++ &xhci->mem, 0, OFF_MSIX_PBA,
++ 0x90);
++ }
+
+ return 0;
+ }
+@@ -2896,6 +2940,7 @@ static const VMStateDescription vmstate_xhci = {
+
+ static Property xhci_properties[] = {
+ DEFINE_PROP_BIT("msi", XHCIState, flags, XHCI_FLAG_USE_MSI, true),
++ DEFINE_PROP_BIT("msix", XHCIState, flags, XHCI_FLAG_USE_MSI_X, true),
+ DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
+ DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
+ DEFINE_PROP_END_OF_LIST(),
+diff --git a/trace-events b/trace-events
+index d941e78..f86bbda 100644
+--- a/trace-events
++++ b/trace-events
+@@ -316,6 +316,9 @@ usb_xhci_runtime_write(uint32_t off, uint32_t val) "off 0x%04x, val 0x%08x"
+ usb_xhci_doorbell_write(uint32_t off, uint32_t val) "off 0x%04x, val 0x%08x"
+ usb_xhci_irq_intx(uint32_t level) "level %d"
+ usb_xhci_irq_msi(uint32_t nr) "nr %d"
++usb_xhci_irq_msix(uint32_t nr) "nr %d"
++usb_xhci_irq_msix_use(uint32_t nr) "nr %d"
++usb_xhci_irq_msix_unuse(uint32_t nr) "nr %d"
+ usb_xhci_queue_event(uint32_t idx, const char *trb, const char *evt, uint64_t param, uint32_t status, uint32_t control) "idx %d, %s, %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_fetch_trb(uint64_t addr, const char *name, uint64_t param, uint32_t status, uint32_t control) "addr %016" PRIx64 ", %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_slot_enable(uint32_t slotid) "slotid %d"
+--
+1.7.12.1
+
--- /dev/null
+From be996e1a852397f4009d08ac803081e1dfbc7326 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 14:04:04 +0200
+Subject: [PATCH] xhci: move register update into xhci_intr_raise
+
+Now that we have a separate function to raise an IRQ we can move
+some comon code into the function.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 777f903..32d22f7 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -662,8 +662,11 @@ static void xhci_msix_update(XHCIState *xhci)
+
+ static void xhci_intr_raise(XHCIState *xhci)
+ {
+- if (!(xhci->iman & IMAN_IP) ||
+- !(xhci->iman & IMAN_IE)) {
++ xhci->erdp_low |= ERDP_EHB;
++ xhci->iman |= IMAN_IP;
++ xhci->usbsts |= USBSTS_EINT;
++
++ if (!(xhci->iman & IMAN_IE)) {
+ return;
+ }
+
+@@ -784,9 +787,6 @@ static void xhci_events_update(XHCIState *xhci)
+ }
+
+ if (do_irq) {
+- xhci->erdp_low |= ERDP_EHB;
+- xhci->iman |= IMAN_IP;
+- xhci->usbsts |= USBSTS_EINT;
+ xhci_intr_raise(xhci);
+ }
+
+@@ -847,10 +847,6 @@ static void xhci_event(XHCIState *xhci, XHCIEvent *event)
+ xhci_write_event(xhci, event);
+ }
+
+- xhci->erdp_low |= ERDP_EHB;
+- xhci->iman |= IMAN_IP;
+- xhci->usbsts |= USBSTS_EINT;
+-
+ xhci_intr_raise(xhci);
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 40ddf0dafd6a8171d2a0f960a21d7d99bdf73cd6 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 15:49:03 +0200
+Subject: [PATCH] xhci: add XHCIInterrupter
+
+Move all state belonging to the (single) interrupter into a separate
+struct. First step in adding support for multiple interrupters.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 307 ++++++++++++++++++++++++++++--------------------------
+ trace-events | 2 +-
+ 2 files changed, 161 insertions(+), 148 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 32d22f7..8a14ee8 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -378,6 +378,27 @@ typedef struct XHCIEvent {
+ uint8_t epid;
+ } XHCIEvent;
+
++typedef struct XHCIInterrupter {
++ uint32_t iman;
++ uint32_t imod;
++ uint32_t erstsz;
++ uint32_t erstba_low;
++ uint32_t erstba_high;
++ uint32_t erdp_low;
++ uint32_t erdp_high;
++
++ bool msix_used, er_pcs, er_full;
++
++ dma_addr_t er_start;
++ uint32_t er_size;
++ unsigned int er_ep_idx;
++
++ XHCIEvent ev_buffer[EV_QUEUE];
++ unsigned int ev_buffer_put;
++ unsigned int ev_buffer_get;
++
++} XHCIInterrupter;
++
+ struct XHCIState {
+ PCIDevice pci_dev;
+ USBBus bus;
+@@ -407,27 +428,9 @@ struct XHCIState {
+ uint32_t numports;
+
+ /* Runtime Registers */
+- uint32_t iman;
+- uint32_t imod;
+- uint32_t erstsz;
+- uint32_t erstba_low;
+- uint32_t erstba_high;
+- uint32_t erdp_low;
+- uint32_t erdp_high;
+- bool msix_used;
+-
+ int64_t mfindex_start;
+ QEMUTimer *mfwrap_timer;
+-
+- dma_addr_t er_start;
+- uint32_t er_size;
+- bool er_pcs;
+- unsigned int er_ep_idx;
+- bool er_full;
+-
+- XHCIEvent ev_buffer[EV_QUEUE];
+- unsigned int ev_buffer_put;
+- unsigned int ev_buffer_get;
++ XHCIInterrupter intr[MAXINTRS];
+
+ XHCIRing cmd_ring;
+ };
+@@ -446,8 +449,8 @@ enum xhci_flags {
+
+ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
+ unsigned int epid);
+-static void xhci_event(XHCIState *xhci, XHCIEvent *event);
+-static void xhci_write_event(XHCIState *xhci, XHCIEvent *event);
++static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v);
++static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v);
+
+ static const char *TRBType_names[] = {
+ [TRB_RESERVED] = "TRB_RESERVED",
+@@ -573,7 +576,7 @@ static void xhci_mfwrap_timer(void *opaque)
+ XHCIState *xhci = opaque;
+ XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS };
+
+- xhci_event(xhci, &wrap);
++ xhci_event(xhci, &wrap, 0);
+ xhci_mfwrap_update(xhci);
+ }
+
+@@ -626,8 +629,8 @@ static void xhci_intx_update(XHCIState *xhci)
+ return;
+ }
+
+- if (xhci->iman & IMAN_IP &&
+- xhci->iman & IMAN_IE &&
++ if (xhci->intr[0].iman & IMAN_IP &&
++ xhci->intr[0].iman & IMAN_IE &&
+ xhci->usbcmd & USBCMD_INTE) {
+ level = 1;
+ }
+@@ -636,7 +639,7 @@ static void xhci_intx_update(XHCIState *xhci)
+ qemu_set_irq(xhci->irq, level);
+ }
+
+-static void xhci_msix_update(XHCIState *xhci)
++static void xhci_msix_update(XHCIState *xhci, int v)
+ {
+ bool enabled;
+
+@@ -644,29 +647,29 @@ static void xhci_msix_update(XHCIState *xhci)
+ return;
+ }
+
+- enabled = xhci->iman & IMAN_IE;
+- if (enabled == xhci->msix_used) {
++ enabled = xhci->intr[v].iman & IMAN_IE;
++ if (enabled == xhci->intr[v].msix_used) {
+ return;
+ }
+
+ if (enabled) {
+- trace_usb_xhci_irq_msix_use(0);
+- msix_vector_use(&xhci->pci_dev, 0);
+- xhci->msix_used = true;
++ trace_usb_xhci_irq_msix_use(v);
++ msix_vector_use(&xhci->pci_dev, v);
++ xhci->intr[v].msix_used = true;
+ } else {
+- trace_usb_xhci_irq_msix_unuse(0);
+- msix_vector_unuse(&xhci->pci_dev, 0);
+- xhci->msix_used = false;
++ trace_usb_xhci_irq_msix_unuse(v);
++ msix_vector_unuse(&xhci->pci_dev, v);
++ xhci->intr[v].msix_used = false;
+ }
+ }
+
+-static void xhci_intr_raise(XHCIState *xhci)
++static void xhci_intr_raise(XHCIState *xhci, int v)
+ {
+- xhci->erdp_low |= ERDP_EHB;
+- xhci->iman |= IMAN_IP;
++ xhci->intr[v].erdp_low |= ERDP_EHB;
++ xhci->intr[v].iman |= IMAN_IP;
+ xhci->usbsts |= USBSTS_EINT;
+
+- if (!(xhci->iman & IMAN_IE)) {
++ if (!(xhci->intr[v].iman & IMAN_IE)) {
+ return;
+ }
+
+@@ -675,24 +678,26 @@ static void xhci_intr_raise(XHCIState *xhci)
+ }
+
+ if (msix_enabled(&xhci->pci_dev)) {
+- trace_usb_xhci_irq_msix(0);
+- msix_notify(&xhci->pci_dev, 0);
++ trace_usb_xhci_irq_msix(v);
++ msix_notify(&xhci->pci_dev, v);
+ return;
+ }
+
+ if (msi_enabled(&xhci->pci_dev)) {
+- trace_usb_xhci_irq_msi(0);
+- msi_notify(&xhci->pci_dev, 0);
++ trace_usb_xhci_irq_msi(v);
++ msi_notify(&xhci->pci_dev, v);
+ return;
+ }
+
+- trace_usb_xhci_irq_intx(1);
+- qemu_set_irq(xhci->irq, 1);
++ if (v == 0) {
++ trace_usb_xhci_irq_intx(1);
++ qemu_set_irq(xhci->irq, 1);
++ }
+ }
+
+ static inline int xhci_running(XHCIState *xhci)
+ {
+- return !(xhci->usbsts & USBSTS_HCH) && !xhci->er_full;
++ return !(xhci->usbsts & USBSTS_HCH) && !xhci->intr[0].er_full;
+ }
+
+ static void xhci_die(XHCIState *xhci)
+@@ -701,8 +706,9 @@ static void xhci_die(XHCIState *xhci)
+ fprintf(stderr, "xhci: asserted controller error\n");
+ }
+
+-static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
++static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
+ {
++ XHCIInterrupter *intr = &xhci->intr[v];
+ XHCITRB ev_trb;
+ dma_addr_t addr;
+
+@@ -710,27 +716,28 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
+ ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
+ ev_trb.control = (event->slotid << 24) | (event->epid << 16) |
+ event->flags | (event->type << TRB_TYPE_SHIFT);
+- if (xhci->er_pcs) {
++ if (intr->er_pcs) {
+ ev_trb.control |= TRB_C;
+ }
+ ev_trb.control = cpu_to_le32(ev_trb.control);
+
+- trace_usb_xhci_queue_event(xhci->er_ep_idx, trb_name(&ev_trb),
++ trace_usb_xhci_queue_event(v, intr->er_ep_idx, trb_name(&ev_trb),
+ event_name(event), ev_trb.parameter,
+ ev_trb.status, ev_trb.control);
+
+- addr = xhci->er_start + TRB_SIZE*xhci->er_ep_idx;
++ addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
+ pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
+
+- xhci->er_ep_idx++;
+- if (xhci->er_ep_idx >= xhci->er_size) {
+- xhci->er_ep_idx = 0;
+- xhci->er_pcs = !xhci->er_pcs;
++ intr->er_ep_idx++;
++ if (intr->er_ep_idx >= intr->er_size) {
++ intr->er_ep_idx = 0;
++ intr->er_pcs = !intr->er_pcs;
+ }
+ }
+
+-static void xhci_events_update(XHCIState *xhci)
++static void xhci_events_update(XHCIState *xhci, int v)
+ {
++ XHCIInterrupter *intr = &xhci->intr[v];
+ dma_addr_t erdp;
+ unsigned int dp_idx;
+ bool do_irq = 0;
+@@ -739,115 +746,116 @@ static void xhci_events_update(XHCIState *xhci)
+ return;
+ }
+
+- erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high);
+- if (erdp < xhci->er_start ||
+- erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) {
++ erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
++ if (erdp < intr->er_start ||
++ erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
+ fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+- fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n",
+- xhci->er_start, xhci->er_size);
++ fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
++ v, intr->er_start, intr->er_size);
+ xhci_die(xhci);
+ return;
+ }
+- dp_idx = (erdp - xhci->er_start) / TRB_SIZE;
+- assert(dp_idx < xhci->er_size);
++ dp_idx = (erdp - intr->er_start) / TRB_SIZE;
++ assert(dp_idx < intr->er_size);
+
+ /* NEC didn't read section 4.9.4 of the spec (v1.0 p139 top Note) and thus
+ * deadlocks when the ER is full. Hack it by holding off events until
+ * the driver decides to free at least half of the ring */
+- if (xhci->er_full) {
+- int er_free = dp_idx - xhci->er_ep_idx;
++ if (intr->er_full) {
++ int er_free = dp_idx - intr->er_ep_idx;
+ if (er_free <= 0) {
+- er_free += xhci->er_size;
++ er_free += intr->er_size;
+ }
+- if (er_free < (xhci->er_size/2)) {
++ if (er_free < (intr->er_size/2)) {
+ DPRINTF("xhci_events_update(): event ring still "
+ "more than half full (hack)\n");
+ return;
+ }
+ }
+
+- while (xhci->ev_buffer_put != xhci->ev_buffer_get) {
+- assert(xhci->er_full);
+- if (((xhci->er_ep_idx+1) % xhci->er_size) == dp_idx) {
++ while (intr->ev_buffer_put != intr->ev_buffer_get) {
++ assert(intr->er_full);
++ if (((intr->er_ep_idx+1) % intr->er_size) == dp_idx) {
+ DPRINTF("xhci_events_update(): event ring full again\n");
+ #ifndef ER_FULL_HACK
+ XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
+- xhci_write_event(xhci, &full);
++ xhci_write_event(xhci, &full, v);
+ #endif
+ do_irq = 1;
+ break;
+ }
+- XHCIEvent *event = &xhci->ev_buffer[xhci->ev_buffer_get];
+- xhci_write_event(xhci, event);
+- xhci->ev_buffer_get++;
++ XHCIEvent *event = &intr->ev_buffer[intr->ev_buffer_get];
++ xhci_write_event(xhci, event, v);
++ intr->ev_buffer_get++;
+ do_irq = 1;
+- if (xhci->ev_buffer_get == EV_QUEUE) {
+- xhci->ev_buffer_get = 0;
++ if (intr->ev_buffer_get == EV_QUEUE) {
++ intr->ev_buffer_get = 0;
+ }
+ }
+
+ if (do_irq) {
+- xhci_intr_raise(xhci);
++ xhci_intr_raise(xhci, v);
+ }
+
+- if (xhci->er_full && xhci->ev_buffer_put == xhci->ev_buffer_get) {
++ if (intr->er_full && intr->ev_buffer_put == intr->ev_buffer_get) {
+ DPRINTF("xhci_events_update(): event ring no longer full\n");
+- xhci->er_full = 0;
++ intr->er_full = 0;
+ }
+ return;
+ }
+
+-static void xhci_event(XHCIState *xhci, XHCIEvent *event)
++static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v)
+ {
++ XHCIInterrupter *intr = &xhci->intr[v];
+ dma_addr_t erdp;
+ unsigned int dp_idx;
+
+- if (xhci->er_full) {
++ if (intr->er_full) {
+ DPRINTF("xhci_event(): ER full, queueing\n");
+- if (((xhci->ev_buffer_put+1) % EV_QUEUE) == xhci->ev_buffer_get) {
++ if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
+ fprintf(stderr, "xhci: event queue full, dropping event!\n");
+ return;
+ }
+- xhci->ev_buffer[xhci->ev_buffer_put++] = *event;
+- if (xhci->ev_buffer_put == EV_QUEUE) {
+- xhci->ev_buffer_put = 0;
++ intr->ev_buffer[intr->ev_buffer_put++] = *event;
++ if (intr->ev_buffer_put == EV_QUEUE) {
++ intr->ev_buffer_put = 0;
+ }
+ return;
+ }
+
+- erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high);
+- if (erdp < xhci->er_start ||
+- erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) {
++ erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
++ if (erdp < intr->er_start ||
++ erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
+ fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+- fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n",
+- xhci->er_start, xhci->er_size);
++ fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
++ v, intr->er_start, intr->er_size);
+ xhci_die(xhci);
+ return;
+ }
+
+- dp_idx = (erdp - xhci->er_start) / TRB_SIZE;
+- assert(dp_idx < xhci->er_size);
++ dp_idx = (erdp - intr->er_start) / TRB_SIZE;
++ assert(dp_idx < intr->er_size);
+
+- if ((xhci->er_ep_idx+1) % xhci->er_size == dp_idx) {
++ if ((intr->er_ep_idx+1) % intr->er_size == dp_idx) {
+ DPRINTF("xhci_event(): ER full, queueing\n");
+ #ifndef ER_FULL_HACK
+ XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
+ xhci_write_event(xhci, &full);
+ #endif
+- xhci->er_full = 1;
+- if (((xhci->ev_buffer_put+1) % EV_QUEUE) == xhci->ev_buffer_get) {
++ intr->er_full = 1;
++ if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
+ fprintf(stderr, "xhci: event queue full, dropping event!\n");
+ return;
+ }
+- xhci->ev_buffer[xhci->ev_buffer_put++] = *event;
+- if (xhci->ev_buffer_put == EV_QUEUE) {
+- xhci->ev_buffer_put = 0;
++ intr->ev_buffer[intr->ev_buffer_put++] = *event;
++ if (intr->ev_buffer_put == EV_QUEUE) {
++ intr->ev_buffer_put = 0;
+ }
+ } else {
+- xhci_write_event(xhci, event);
++ xhci_write_event(xhci, event, v);
+ }
+
+- xhci_intr_raise(xhci);
++ xhci_intr_raise(xhci, v);
+ }
+
+ static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
+@@ -939,17 +947,18 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
+ }
+ }
+
+-static void xhci_er_reset(XHCIState *xhci)
++static void xhci_er_reset(XHCIState *xhci, int v)
+ {
++ XHCIInterrupter *intr = &xhci->intr[v];
+ XHCIEvRingSeg seg;
+
+ /* cache the (sole) event ring segment location */
+- if (xhci->erstsz != 1) {
+- fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", xhci->erstsz);
++ if (intr->erstsz != 1) {
++ fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
+ xhci_die(xhci);
+ return;
+ }
+- dma_addr_t erstba = xhci_addr64(xhci->erstba_low, xhci->erstba_high);
++ dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);
+ pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg));
+ le32_to_cpus(&seg.addr_low);
+ le32_to_cpus(&seg.addr_high);
+@@ -959,15 +968,15 @@ static void xhci_er_reset(XHCIState *xhci)
+ xhci_die(xhci);
+ return;
+ }
+- xhci->er_start = xhci_addr64(seg.addr_low, seg.addr_high);
+- xhci->er_size = seg.size;
++ intr->er_start = xhci_addr64(seg.addr_low, seg.addr_high);
++ intr->er_size = seg.size;
+
+- xhci->er_ep_idx = 0;
+- xhci->er_pcs = 1;
+- xhci->er_full = 0;
++ intr->er_ep_idx = 0;
++ intr->er_pcs = 1;
++ intr->er_full = 0;
+
+- DPRINTF("xhci: event ring:" DMA_ADDR_FMT " [%d]\n",
+- xhci->er_start, xhci->er_size);
++ DPRINTF("xhci: event ring[%d]:" DMA_ADDR_FMT " [%d]\n",
++ v, intr->er_start, intr->er_size);
+ }
+
+ static void xhci_run(XHCIState *xhci)
+@@ -1368,7 +1377,7 @@ static void xhci_xfer_report(XHCITransfer *xfer)
+ DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length);
+ edtla = 0;
+ }
+- xhci_event(xhci, &event);
++ xhci_event(xhci, &event, 0 /* FIXME */);
+ reported = 1;
+ if (xfer->status != CC_SUCCESS) {
+ return;
+@@ -2244,7 +2253,7 @@ static void xhci_process_commands(XHCIState *xhci)
+ break;
+ }
+ event.slotid = slotid;
+- xhci_event(xhci, &event);
++ xhci_event(xhci, &event, 0 /* FIXME */);
+ }
+ }
+
+@@ -2274,7 +2283,7 @@ static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach)
+ port->portsc |= PORTSC_CSC;
+ XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
+ port->portnr << 24};
+- xhci_event(xhci, &ev);
++ xhci_event(xhci, &ev, 0 /* FIXME */);
+ DPRINTF("xhci: port change event for port %d\n", port->portnr);
+ }
+ }
+@@ -2307,20 +2316,22 @@ static void xhci_reset(DeviceState *dev)
+ xhci_update_port(xhci, xhci->ports + i, 0);
+ }
+
+- xhci->iman = 0;
+- xhci->imod = 0;
+- xhci->erstsz = 0;
+- xhci->erstba_low = 0;
+- xhci->erstba_high = 0;
+- xhci->erdp_low = 0;
+- xhci->erdp_high = 0;
+- xhci->msix_used = 0;
++ for (i = 0; i < MAXINTRS; i++) {
++ xhci->intr[i].iman = 0;
++ xhci->intr[i].imod = 0;
++ xhci->intr[i].erstsz = 0;
++ xhci->intr[i].erstba_low = 0;
++ xhci->intr[i].erstba_high = 0;
++ xhci->intr[i].erdp_low = 0;
++ xhci->intr[i].erdp_high = 0;
++ xhci->intr[i].msix_used = 0;
+
+- xhci->er_ep_idx = 0;
+- xhci->er_pcs = 1;
+- xhci->er_full = 0;
+- xhci->ev_buffer_put = 0;
+- xhci->ev_buffer_get = 0;
++ xhci->intr[i].er_ep_idx = 0;
++ xhci->intr[i].er_pcs = 1;
++ xhci->intr[i].er_full = 0;
++ xhci->intr[i].ev_buffer_put = 0;
++ xhci->intr[i].ev_buffer_get = 0;
++ }
+
+ xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
+ xhci_mfwrap_update(xhci);
+@@ -2551,7 +2562,7 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) {
+ XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED};
+ xhci->crcr_low &= ~CRCR_CRR;
+- xhci_event(xhci, &event);
++ xhci_event(xhci, &event, 0 /* FIXME */);
+ DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
+ } else {
+ dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
+@@ -2575,6 +2586,7 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+
+ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+ {
++ XHCIInterrupter *intr = &xhci->intr[0];
+ uint32_t ret;
+
+ switch (reg) {
+@@ -2582,25 +2594,25 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+ ret = xhci_mfindex_get(xhci) & 0x3fff;
+ break;
+ case 0x20: /* IMAN */
+- ret = xhci->iman;
++ ret = intr->iman;
+ break;
+ case 0x24: /* IMOD */
+- ret = xhci->imod;
++ ret = intr->imod;
+ break;
+ case 0x28: /* ERSTSZ */
+- ret = xhci->erstsz;
++ ret = intr->erstsz;
+ break;
+ case 0x30: /* ERSTBA low */
+- ret = xhci->erstba_low;
++ ret = intr->erstba_low;
+ break;
+ case 0x34: /* ERSTBA high */
+- ret = xhci->erstba_high;
++ ret = intr->erstba_high;
+ break;
+ case 0x38: /* ERDP low */
+- ret = xhci->erdp_low;
++ ret = intr->erdp_low;
+ break;
+ case 0x3c: /* ERDP high */
+- ret = xhci->erdp_high;
++ ret = intr->erdp_high;
+ break;
+ default:
+ fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n", reg);
+@@ -2613,42 +2625,43 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+
+ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ {
++ XHCIInterrupter *intr = &xhci->intr[0];
+ trace_usb_xhci_runtime_write(reg, val);
+
+ switch (reg) {
+ case 0x20: /* IMAN */
+ if (val & IMAN_IP) {
+- xhci->iman &= ~IMAN_IP;
++ intr->iman &= ~IMAN_IP;
+ }
+- xhci->iman &= ~IMAN_IE;
+- xhci->iman |= val & IMAN_IE;
++ intr->iman &= ~IMAN_IE;
++ intr->iman |= val & IMAN_IE;
+ xhci_intx_update(xhci);
+- xhci_msix_update(xhci);
++ xhci_msix_update(xhci, 0);
+ break;
+ case 0x24: /* IMOD */
+- xhci->imod = val;
++ intr->imod = val;
+ break;
+ case 0x28: /* ERSTSZ */
+- xhci->erstsz = val & 0xffff;
++ intr->erstsz = val & 0xffff;
+ break;
+ case 0x30: /* ERSTBA low */
+ /* XXX NEC driver bug: it doesn't align this to 64 bytes
+- xhci->erstba_low = val & 0xffffffc0; */
+- xhci->erstba_low = val & 0xfffffff0;
++ intr->erstba_low = val & 0xffffffc0; */
++ intr->erstba_low = val & 0xfffffff0;
+ break;
+ case 0x34: /* ERSTBA high */
+- xhci->erstba_high = val;
+- xhci_er_reset(xhci);
++ intr->erstba_high = val;
++ xhci_er_reset(xhci, 0);
+ break;
+ case 0x38: /* ERDP low */
+ if (val & ERDP_EHB) {
+- xhci->erdp_low &= ~ERDP_EHB;
++ intr->erdp_low &= ~ERDP_EHB;
+ }
+- xhci->erdp_low = (val & ~ERDP_EHB) | (xhci->erdp_low & ERDP_EHB);
++ intr->erdp_low = (val & ~ERDP_EHB) | (intr->erdp_low & ERDP_EHB);
+ break;
+ case 0x3c: /* ERDP high */
+- xhci->erdp_high = val;
+- xhci_events_update(xhci);
++ intr->erdp_high = val;
++ xhci_events_update(xhci, 0);
+ break;
+ default:
+ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
+@@ -2780,7 +2793,7 @@ static void xhci_wakeup(USBPort *usbport)
+ return;
+ }
+ port->portsc |= PORTSC_PLC;
+- xhci_event(xhci, &ev);
++ xhci_event(xhci, &ev, 0 /* FIXME */);
+ }
+
+ static void xhci_complete(USBPort *port, USBPacket *packet)
+diff --git a/trace-events b/trace-events
+index f86bbda..f5b5097 100644
+--- a/trace-events
++++ b/trace-events
+@@ -319,7 +319,7 @@ usb_xhci_irq_msi(uint32_t nr) "nr %d"
+ usb_xhci_irq_msix(uint32_t nr) "nr %d"
+ usb_xhci_irq_msix_use(uint32_t nr) "nr %d"
+ usb_xhci_irq_msix_unuse(uint32_t nr) "nr %d"
+-usb_xhci_queue_event(uint32_t idx, const char *trb, const char *evt, uint64_t param, uint32_t status, uint32_t control) "idx %d, %s, %s, p %016" PRIx64 ", s %08x, c 0x%08x"
++usb_xhci_queue_event(uint32_t vector, uint32_t idx, const char *trb, const char *evt, uint64_t param, uint32_t status, uint32_t control) "v %d, idx %d, %s, %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_fetch_trb(uint64_t addr, const char *name, uint64_t param, uint32_t status, uint32_t control) "addr %016" PRIx64 ", %s, p %016" PRIx64 ", s %08x, c 0x%08x"
+ usb_xhci_slot_enable(uint32_t slotid) "slotid %d"
+ usb_xhci_slot_disable(uint32_t slotid) "slotid %d"
+--
+1.7.12.1
+
--- /dev/null
+From 670eba790c368e9c37b0c964d94e0ff7f0d0c443 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Aug 2012 17:15:12 +0200
+Subject: [PATCH] xhci: prepare xhci_runtime_{read,write} for multiple
+ interrupters
+
+Prepare xhci runtime register access function for multiple interrupters.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 100 +++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 57 insertions(+), 43 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 8a14ee8..6b3ff16 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -2586,37 +2586,43 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+
+ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+ {
+- XHCIInterrupter *intr = &xhci->intr[0];
+- uint32_t ret;
++ uint32_t ret = 0;
+
+- switch (reg) {
+- case 0x00: /* MFINDEX */
+- ret = xhci_mfindex_get(xhci) & 0x3fff;
+- break;
+- case 0x20: /* IMAN */
+- ret = intr->iman;
+- break;
+- case 0x24: /* IMOD */
+- ret = intr->imod;
+- break;
+- case 0x28: /* ERSTSZ */
+- ret = intr->erstsz;
+- break;
+- case 0x30: /* ERSTBA low */
+- ret = intr->erstba_low;
+- break;
+- case 0x34: /* ERSTBA high */
+- ret = intr->erstba_high;
+- break;
+- case 0x38: /* ERDP low */
+- ret = intr->erdp_low;
+- break;
+- case 0x3c: /* ERDP high */
+- ret = intr->erdp_high;
+- break;
+- default:
+- fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n", reg);
+- ret = 0;
++ if (reg < 0x20) {
++ switch (reg) {
++ case 0x00: /* MFINDEX */
++ ret = xhci_mfindex_get(xhci) & 0x3fff;
++ break;
++ default:
++ fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n", reg);
++ break;
++ }
++ } else {
++ int v = (reg - 0x20) / 0x20;
++ XHCIInterrupter *intr = &xhci->intr[v];
++ switch (reg & 0x1f) {
++ case 0x00: /* IMAN */
++ ret = intr->iman;
++ break;
++ case 0x04: /* IMOD */
++ ret = intr->imod;
++ break;
++ case 0x08: /* ERSTSZ */
++ ret = intr->erstsz;
++ break;
++ case 0x10: /* ERSTBA low */
++ ret = intr->erstba_low;
++ break;
++ case 0x14: /* ERSTBA high */
++ ret = intr->erstba_high;
++ break;
++ case 0x18: /* ERDP low */
++ ret = intr->erdp_low;
++ break;
++ case 0x1c: /* ERDP high */
++ ret = intr->erdp_high;
++ break;
++ }
+ }
+
+ trace_usb_xhci_runtime_read(reg, ret);
+@@ -2625,43 +2631,51 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+
+ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ {
+- XHCIInterrupter *intr = &xhci->intr[0];
++ int v = (reg - 0x20) / 0x20;
++ XHCIInterrupter *intr = &xhci->intr[v];
+ trace_usb_xhci_runtime_write(reg, val);
+
+- switch (reg) {
+- case 0x20: /* IMAN */
++ if (reg < 0x20) {
++ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
++ return;
++ }
++
++ switch (reg & 0x1f) {
++ case 0x00: /* IMAN */
+ if (val & IMAN_IP) {
+ intr->iman &= ~IMAN_IP;
+ }
+ intr->iman &= ~IMAN_IE;
+ intr->iman |= val & IMAN_IE;
+- xhci_intx_update(xhci);
+- xhci_msix_update(xhci, 0);
++ if (v == 0) {
++ xhci_intx_update(xhci);
++ }
++ xhci_msix_update(xhci, v);
+ break;
+- case 0x24: /* IMOD */
++ case 0x04: /* IMOD */
+ intr->imod = val;
+ break;
+- case 0x28: /* ERSTSZ */
++ case 0x08: /* ERSTSZ */
+ intr->erstsz = val & 0xffff;
+ break;
+- case 0x30: /* ERSTBA low */
++ case 0x10: /* ERSTBA low */
+ /* XXX NEC driver bug: it doesn't align this to 64 bytes
+ intr->erstba_low = val & 0xffffffc0; */
+ intr->erstba_low = val & 0xfffffff0;
+ break;
+- case 0x34: /* ERSTBA high */
++ case 0x14: /* ERSTBA high */
+ intr->erstba_high = val;
+- xhci_er_reset(xhci, 0);
++ xhci_er_reset(xhci, v);
+ break;
+- case 0x38: /* ERDP low */
++ case 0x18: /* ERDP low */
+ if (val & ERDP_EHB) {
+ intr->erdp_low &= ~ERDP_EHB;
+ }
+ intr->erdp_low = (val & ~ERDP_EHB) | (intr->erdp_low & ERDP_EHB);
+ break;
+- case 0x3c: /* ERDP high */
++ case 0x1c: /* ERDP high */
+ intr->erdp_high = val;
+- xhci_events_update(xhci, 0);
++ xhci_events_update(xhci, v);
+ break;
+ default:
+ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
+--
+1.7.12.1
+
--- /dev/null
+From d6968ced27f697b26d7a1d5b44f15eeb300a9fd6 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 31 Aug 2012 15:30:51 +0200
+Subject: [PATCH] xhci: pick target interrupter
+
+Pick the correct interrupter when queuing an event.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 6b3ff16..3b03c6c 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -264,6 +264,10 @@ typedef enum TRBCCode {
+
+ #define TRB_LK_TC (1<<1)
+
++#define TRB_INTR_SHIFT 22
++#define TRB_INTR_MASK 0x3ff
++#define TRB_INTR(t) (((t).status >> TRB_INTR_SHIFT) & TRB_INTR_MASK)
++
+ #define EP_TYPE_MASK 0x7
+ #define EP_TYPE_SHIFT 3
+
+@@ -806,10 +810,16 @@ static void xhci_events_update(XHCIState *xhci, int v)
+
+ static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v)
+ {
+- XHCIInterrupter *intr = &xhci->intr[v];
++ XHCIInterrupter *intr;
+ dma_addr_t erdp;
+ unsigned int dp_idx;
+
++ if (v >= MAXINTRS) {
++ DPRINTF("intr nr out of range (%d >= %d)\n", v, MAXINTRS);
++ return;
++ }
++ intr = &xhci->intr[v];
++
+ if (intr->er_full) {
+ DPRINTF("xhci_event(): ER full, queueing\n");
+ if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
+@@ -1377,7 +1387,7 @@ static void xhci_xfer_report(XHCITransfer *xfer)
+ DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length);
+ edtla = 0;
+ }
+- xhci_event(xhci, &event, 0 /* FIXME */);
++ xhci_event(xhci, &event, TRB_INTR(*trb));
+ reported = 1;
+ if (xfer->status != CC_SUCCESS) {
+ return;
+@@ -2253,7 +2263,7 @@ static void xhci_process_commands(XHCIState *xhci)
+ break;
+ }
+ event.slotid = slotid;
+- xhci_event(xhci, &event, 0 /* FIXME */);
++ xhci_event(xhci, &event, 0);
+ }
+ }
+
+@@ -2283,7 +2293,7 @@ static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach)
+ port->portsc |= PORTSC_CSC;
+ XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
+ port->portnr << 24};
+- xhci_event(xhci, &ev, 0 /* FIXME */);
++ xhci_event(xhci, &ev, 0);
+ DPRINTF("xhci: port change event for port %d\n", port->portnr);
+ }
+ }
+@@ -2562,7 +2572,7 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) {
+ XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED};
+ xhci->crcr_low &= ~CRCR_CRR;
+- xhci_event(xhci, &event, 0 /* FIXME */);
++ xhci_event(xhci, &event, 0);
+ DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
+ } else {
+ dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
+@@ -2807,7 +2817,7 @@ static void xhci_wakeup(USBPort *usbport)
+ return;
+ }
+ port->portsc |= PORTSC_PLC;
+- xhci_event(xhci, &ev, 0 /* FIXME */);
++ xhci_event(xhci, &ev, 0);
+ }
+
+ static void xhci_complete(USBPort *port, USBPacket *packet)
+--
+1.7.12.1
+
--- /dev/null
+From 4e4d4191a40b5cbcd6f967ed105eea559104cd8a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 4 Sep 2012 12:56:55 +0200
+Subject: [PATCH] xhci: support multiple interrupters
+
+Everything is in place, flip the big switch now
+and enable support for multiple interrupters.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 3b03c6c..4992705 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -42,7 +42,7 @@
+
+ #define MAXPORTS (MAXPORTS_2+MAXPORTS_3)
+ #define MAXSLOTS MAXPORTS
+-#define MAXINTRS 1 /* MAXPORTS */
++#define MAXINTRS MAXPORTS
+
+ #define TD_QUEUE 24
+
+@@ -75,10 +75,6 @@
+ # error Increase LEN_REGS
+ #endif
+
+-#if MAXINTRS > 1
+-# error TODO: only one interrupter supported
+-#endif
+-
+ /* bit definitions */
+ #define USBCMD_RS (1<<0)
+ #define USBCMD_HCRST (1<<1)
+--
+1.7.12.1
+
--- /dev/null
+From d2efc9f3dc62810ef6075f8759c9856016447c14 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 4 Sep 2012 14:42:20 +0200
+Subject: [PATCH] xhci: kill xhci_mem_{read,write} dispatcher functions
+
+... and register subregions instead, so we offload the dispatching
+to the the memory subsystem which is designed to handle it.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ hw/usb/hcd-xhci.c | 140 +++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 75 insertions(+), 65 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 4992705..4ba9464 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -404,6 +404,10 @@ struct XHCIState {
+ USBBus bus;
+ qemu_irq irq;
+ MemoryRegion mem;
++ MemoryRegion mem_cap;
++ MemoryRegion mem_oper;
++ MemoryRegion mem_runtime;
++ MemoryRegion mem_doorbell;
+ const char *name;
+ unsigned int devaddr;
+
+@@ -2343,8 +2347,9 @@ static void xhci_reset(DeviceState *dev)
+ xhci_mfwrap_update(xhci);
+ }
+
+-static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
++static uint64_t xhci_cap_read(void *ptr, target_phys_addr_t reg, unsigned size)
+ {
++ XHCIState *xhci = ptr;
+ uint32_t ret;
+
+ switch (reg) {
+@@ -2401,7 +2406,7 @@ static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg)
+ ret = 0x00000000; /* reserved */
+ break;
+ default:
+- fprintf(stderr, "xhci_cap_read: reg %d unimplemented\n", reg);
++ fprintf(stderr, "xhci_cap_read: reg %d unimplemented\n", (int)reg);
+ ret = 0;
+ }
+
+@@ -2482,8 +2487,9 @@ static void xhci_port_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ }
+ }
+
+-static uint32_t xhci_oper_read(XHCIState *xhci, uint32_t reg)
++static uint64_t xhci_oper_read(void *ptr, target_phys_addr_t reg, unsigned size)
+ {
++ XHCIState *xhci = ptr;
+ uint32_t ret;
+
+ if (reg >= 0x400) {
+@@ -2519,7 +2525,7 @@ static uint32_t xhci_oper_read(XHCIState *xhci, uint32_t reg)
+ ret = xhci->config;
+ break;
+ default:
+- fprintf(stderr, "xhci_oper_read: reg 0x%x unimplemented\n", reg);
++ fprintf(stderr, "xhci_oper_read: reg 0x%x unimplemented\n", (int)reg);
+ ret = 0;
+ }
+
+@@ -2527,8 +2533,11 @@ static uint32_t xhci_oper_read(XHCIState *xhci, uint32_t reg)
+ return ret;
+ }
+
+-static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
++static void xhci_oper_write(void *ptr, target_phys_addr_t reg,
++ uint64_t val, unsigned size)
+ {
++ XHCIState *xhci = ptr;
++
+ if (reg >= 0x400) {
+ xhci_port_write(xhci, reg - 0x400, val);
+ return;
+@@ -2586,12 +2595,14 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ xhci->config = val & 0xff;
+ break;
+ default:
+- fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
++ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", (int)reg);
+ }
+ }
+
+-static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
++static uint64_t xhci_runtime_read(void *ptr, target_phys_addr_t reg,
++ unsigned size)
+ {
++ XHCIState *xhci = ptr;
+ uint32_t ret = 0;
+
+ if (reg < 0x20) {
+@@ -2600,7 +2611,8 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+ ret = xhci_mfindex_get(xhci) & 0x3fff;
+ break;
+ default:
+- fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n", reg);
++ fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n",
++ (int)reg);
+ break;
+ }
+ } else {
+@@ -2635,14 +2647,16 @@ static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg)
+ return ret;
+ }
+
+-static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
++static void xhci_runtime_write(void *ptr, target_phys_addr_t reg,
++ uint64_t val, unsigned size)
+ {
++ XHCIState *xhci = ptr;
+ int v = (reg - 0x20) / 0x20;
+ XHCIInterrupter *intr = &xhci->intr[v];
+ trace_usb_xhci_runtime_write(reg, val);
+
+ if (reg < 0x20) {
+- fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
++ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", (int)reg);
+ return;
+ }
+
+@@ -2684,19 +2698,24 @@ static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ xhci_events_update(xhci, v);
+ break;
+ default:
+- fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg);
++ fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n",
++ (int)reg);
+ }
+ }
+
+-static uint32_t xhci_doorbell_read(XHCIState *xhci, uint32_t reg)
++static uint64_t xhci_doorbell_read(void *ptr, target_phys_addr_t reg,
++ unsigned size)
+ {
+ /* doorbells always read as 0 */
+ trace_usb_xhci_doorbell_read(reg, 0);
+ return 0;
+ }
+
+-static void xhci_doorbell_write(XHCIState *xhci, uint32_t reg, uint32_t val)
++static void xhci_doorbell_write(void *ptr, target_phys_addr_t reg,
++ uint64_t val, unsigned size)
+ {
++ XHCIState *xhci = ptr;
++
+ trace_usb_xhci_doorbell_write(reg, val);
+
+ if (!xhci_running(xhci)) {
+@@ -2710,69 +2729,47 @@ static void xhci_doorbell_write(XHCIState *xhci, uint32_t reg, uint32_t val)
+ if (val == 0) {
+ xhci_process_commands(xhci);
+ } else {
+- fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n", val);
++ fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n",
++ (uint32_t)val);
+ }
+ } else {
+ if (reg > MAXSLOTS) {
+- fprintf(stderr, "xhci: bad doorbell %d\n", reg);
++ fprintf(stderr, "xhci: bad doorbell %d\n", (int)reg);
+ } else if (val > 31) {
+- fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n", reg, val);
++ fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n",
++ (int)reg, (uint32_t)val);
+ } else {
+ xhci_kick_ep(xhci, reg, val);
+ }
+ }
+ }
+
+-static uint64_t xhci_mem_read(void *ptr, target_phys_addr_t addr,
+- unsigned size)
+-{
+- XHCIState *xhci = ptr;
+-
+- /* Only aligned reads are allowed on xHCI */
+- if (addr & 3) {
+- fprintf(stderr, "xhci_mem_read: Mis-aligned read\n");
+- return 0;
+- }
+-
+- if (addr < LEN_CAP) {
+- return xhci_cap_read(xhci, addr);
+- } else if (addr >= OFF_OPER && addr < (OFF_OPER + LEN_OPER)) {
+- return xhci_oper_read(xhci, addr - OFF_OPER);
+- } else if (addr >= OFF_RUNTIME && addr < (OFF_RUNTIME + LEN_RUNTIME)) {
+- return xhci_runtime_read(xhci, addr - OFF_RUNTIME);
+- } else if (addr >= OFF_DOORBELL && addr < (OFF_DOORBELL + LEN_DOORBELL)) {
+- return xhci_doorbell_read(xhci, addr - OFF_DOORBELL);
+- } else {
+- fprintf(stderr, "xhci_mem_read: Bad offset %x\n", (int)addr);
+- return 0;
+- }
+-}
+-
+-static void xhci_mem_write(void *ptr, target_phys_addr_t addr,
+- uint64_t val, unsigned size)
+-{
+- XHCIState *xhci = ptr;
++static const MemoryRegionOps xhci_cap_ops = {
++ .read = xhci_cap_read,
++ .valid.min_access_size = 4,
++ .valid.max_access_size = 4,
++ .endianness = DEVICE_LITTLE_ENDIAN,
++};
+
+- /* Only aligned writes are allowed on xHCI */
+- if (addr & 3) {
+- fprintf(stderr, "xhci_mem_write: Mis-aligned write\n");
+- return;
+- }
++static const MemoryRegionOps xhci_oper_ops = {
++ .read = xhci_oper_read,
++ .write = xhci_oper_write,
++ .valid.min_access_size = 4,
++ .valid.max_access_size = 4,
++ .endianness = DEVICE_LITTLE_ENDIAN,
++};
+
+- if (addr >= OFF_OPER && addr < (OFF_OPER + LEN_OPER)) {
+- xhci_oper_write(xhci, addr - OFF_OPER, val);
+- } else if (addr >= OFF_RUNTIME && addr < (OFF_RUNTIME + LEN_RUNTIME)) {
+- xhci_runtime_write(xhci, addr - OFF_RUNTIME, val);
+- } else if (addr >= OFF_DOORBELL && addr < (OFF_DOORBELL + LEN_DOORBELL)) {
+- xhci_doorbell_write(xhci, addr - OFF_DOORBELL, val);
+- } else {
+- fprintf(stderr, "xhci_mem_write: Bad offset %x\n", (int)addr);
+- }
+-}
++static const MemoryRegionOps xhci_runtime_ops = {
++ .read = xhci_runtime_read,
++ .write = xhci_runtime_write,
++ .valid.min_access_size = 4,
++ .valid.max_access_size = 4,
++ .endianness = DEVICE_LITTLE_ENDIAN,
++};
+
+-static const MemoryRegionOps xhci_mem_ops = {
+- .read = xhci_mem_read,
+- .write = xhci_mem_write,
++static const MemoryRegionOps xhci_doorbell_ops = {
++ .read = xhci_doorbell_read,
++ .write = xhci_doorbell_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
+ .impl.min_access_size = 4,
+@@ -2940,8 +2937,21 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
+
+ xhci->irq = xhci->pci_dev.irq[0];
+
+- memory_region_init_io(&xhci->mem, &xhci_mem_ops, xhci,
+- "xhci", LEN_REGS);
++ memory_region_init(&xhci->mem, "xhci", LEN_REGS);
++ memory_region_init_io(&xhci->mem_cap, &xhci_cap_ops, xhci,
++ "capabilities", LEN_CAP);
++ memory_region_init_io(&xhci->mem_oper, &xhci_oper_ops, xhci,
++ "operational", 0x400 + 0x10 * xhci->numports);
++ memory_region_init_io(&xhci->mem_runtime, &xhci_runtime_ops, xhci,
++ "runtime", LEN_RUNTIME);
++ memory_region_init_io(&xhci->mem_doorbell, &xhci_doorbell_ops, xhci,
++ "doorbell", LEN_DOORBELL);
++
++ memory_region_add_subregion(&xhci->mem, 0, &xhci->mem_cap);
++ memory_region_add_subregion(&xhci->mem, OFF_OPER, &xhci->mem_oper);
++ memory_region_add_subregion(&xhci->mem, OFF_RUNTIME, &xhci->mem_runtime);
++ memory_region_add_subregion(&xhci->mem, OFF_DOORBELL, &xhci->mem_doorbell);
++
+ pci_register_bar(&xhci->pci_dev, 0,
+ PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
+ &xhci->mem);
+--
+1.7.12.1
+
--- /dev/null
+From 5b44a6c9c102b69690adcc2c5be886857ea35ebd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 4 Sep 2012 14:18:34 +0200
+Subject: [PATCH] usb-redir: Change cancelled packet code into a generic
+ packet-id queue
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 102 +++++++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 71 insertions(+), 31 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index f183263..e2b8159 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -43,7 +43,6 @@
+ #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
+ #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
+
+-typedef struct Cancelled Cancelled;
+ typedef struct USBRedirDevice USBRedirDevice;
+
+ /* Struct to hold buffered packets (iso or int input packets) */
+@@ -69,6 +68,18 @@ struct endp_data {
+ int bufpq_target_size;
+ };
+
++struct PacketIdQueueEntry {
++ uint64_t id;
++ QTAILQ_ENTRY(PacketIdQueueEntry)next;
++};
++
++struct PacketIdQueue {
++ USBRedirDevice *dev;
++ const char *name;
++ QTAILQ_HEAD(, PacketIdQueueEntry) head;
++ int size;
++};
++
+ struct USBRedirDevice {
+ USBDevice dev;
+ /* Properties */
+@@ -86,7 +97,7 @@ struct USBRedirDevice {
+ int64_t next_attach_time;
+ struct usbredirparser *parser;
+ struct endp_data endpoint[MAX_ENDPOINTS];
+- QTAILQ_HEAD(, Cancelled) cancelled;
++ struct PacketIdQueue cancelled;
+ /* Data for device filtering */
+ struct usb_redir_device_connect_header device_info;
+ struct usb_redir_interface_info_header interface_info;
+@@ -94,11 +105,6 @@ struct USBRedirDevice {
+ int filter_rules_count;
+ };
+
+-struct Cancelled {
+- uint64_t id;
+- QTAILQ_ENTRY(Cancelled)next;
+-};
+-
+ static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
+ static void usbredir_device_connect(void *priv,
+ struct usb_redir_device_connect_header *device_connect);
+@@ -251,37 +257,75 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
+ * Cancelled and buffered packets helpers
+ */
+
+-static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
++static void packet_id_queue_init(struct PacketIdQueue *q,
++ USBRedirDevice *dev, const char *name)
+ {
+- USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
+- Cancelled *c;
++ q->dev = dev;
++ q->name = name;
++ QTAILQ_INIT(&q->head);
++ q->size = 0;
++}
++
++static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
++{
++ USBRedirDevice *dev = q->dev;
++ struct PacketIdQueueEntry *e;
++
++ DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
++
++ e = g_malloc0(sizeof(struct PacketIdQueueEntry));
++ e->id = id;
++ QTAILQ_INSERT_TAIL(&q->head, e, next);
++ q->size++;
++}
++
++static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
++{
++ USBRedirDevice *dev = q->dev;
++ struct PacketIdQueueEntry *e;
++
++ QTAILQ_FOREACH(e, &q->head, next) {
++ if (e->id == id) {
++ DPRINTF("removing packet id %"PRIu64" from %s queue\n",
++ id, q->name);
++ QTAILQ_REMOVE(&q->head, e, next);
++ q->size--;
++ g_free(e);
++ return 1;
++ }
++ }
++ return 0;
++}
++
++static void packet_id_queue_empty(struct PacketIdQueue *q)
++{
++ USBRedirDevice *dev = q->dev;
++ struct PacketIdQueueEntry *e, *next_e;
+
+- DPRINTF("cancel packet id %"PRIu64"\n", p->id);
++ DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
+
+- c = g_malloc0(sizeof(Cancelled));
+- c->id = p->id;
+- QTAILQ_INSERT_TAIL(&dev->cancelled, c, next);
++ QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
++ QTAILQ_REMOVE(&q->head, e, next);
++ g_free(e);
++ }
++ q->size = 0;
++}
+
++static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
++{
++ USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
++
++ packet_id_queue_add(&dev->cancelled, p->id);
+ usbredirparser_send_cancel_data_packet(dev->parser, p->id);
+ usbredirparser_do_write(dev->parser);
+ }
+
+ static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
+ {
+- Cancelled *c;
+-
+ if (!dev->dev.attached) {
+ return 1; /* Treat everything as cancelled after a disconnect */
+ }
+-
+- QTAILQ_FOREACH(c, &dev->cancelled, next) {
+- if (c->id == id) {
+- QTAILQ_REMOVE(&dev->cancelled, c, next);
+- g_free(c);
+- return 1;
+- }
+- }
+- return 0;
++ return packet_id_queue_remove(&dev->cancelled, id);
+ }
+
+ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
+@@ -937,7 +981,7 @@ static int usbredir_initfn(USBDevice *udev)
+ dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
+ dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
+
+- QTAILQ_INIT(&dev->cancelled);
++ packet_id_queue_init(&dev->cancelled, dev, "cancelled");
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ QTAILQ_INIT(&dev->endpoint[i].bufpq);
+ }
+@@ -955,13 +999,9 @@ static int usbredir_initfn(USBDevice *udev)
+
+ static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
+ {
+- Cancelled *c, *next_c;
+ int i;
+
+- QTAILQ_FOREACH_SAFE(c, &dev->cancelled, next, next_c) {
+- QTAILQ_REMOVE(&dev->cancelled, c, next);
+- g_free(c);
+- }
++ packet_id_queue_empty(&dev->cancelled);
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ usbredir_free_bufpq(dev, I2EP(i));
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 9a38bd644b97a4a3ae92c9246bdcdd09ba937ae8 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 4 Sep 2012 17:03:54 +0200
+Subject: [PATCH] usb-redir: Add an already_in_flight packet-id queue
+
+After a live migration, the usb-hcd will re-queue all packets by
+walking over the schedule in the guest memory again, but requests which
+were encountered on the migration source before will already be in flight,
+so these should *not* be re-send to the usbredir-host.
+
+This patch adds an already in flight packet ud queue, which will be filled by
+the source before migration and then moved over to the migration dest, any
+async handled packets are then checked against this queue to avoid sending
+the same packet to the usbredir-host twice.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat,com>
+---
+ hw/usb/redirect.c | 43 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index e2b8159..cdd705f 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -98,6 +98,7 @@ struct USBRedirDevice {
+ struct usbredirparser *parser;
+ struct endp_data endpoint[MAX_ENDPOINTS];
+ struct PacketIdQueue cancelled;
++ struct PacketIdQueue already_in_flight;
+ /* Data for device filtering */
+ struct usb_redir_device_connect_header device_info;
+ struct usb_redir_interface_info_header interface_info;
+@@ -328,6 +329,34 @@ static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
+ return packet_id_queue_remove(&dev->cancelled, id);
+ }
+
++static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
++ struct USBEndpoint *ep)
++{
++ static USBPacket *p;
++
++ QTAILQ_FOREACH(p, &ep->queue, queue) {
++ packet_id_queue_add(&dev->already_in_flight, p->id);
++ }
++}
++
++static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
++{
++ int ep;
++ struct USBDevice *udev = &dev->dev;
++
++ usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
++
++ for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
++ usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
++ usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
++ }
++}
++
++static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
++{
++ return packet_id_queue_remove(&dev->already_in_flight, id);
++}
++
+ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
+ uint8_t ep, uint64_t id)
+ {
+@@ -543,6 +572,10 @@ static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
+
+ DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, p->iov.size, p->id);
+
++ if (usbredir_already_in_flight(dev, p->id)) {
++ return USB_RET_ASYNC;
++ }
++
+ bulk_packet.endpoint = ep;
+ bulk_packet.length = p->iov.size;
+ bulk_packet.stream_id = 0;
+@@ -623,6 +656,10 @@ static int usbredir_handle_interrupt_data(USBRedirDevice *dev,
+ DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
+ p->iov.size, p->id);
+
++ if (usbredir_already_in_flight(dev, p->id)) {
++ return USB_RET_ASYNC;
++ }
++
+ interrupt_packet.endpoint = ep;
+ interrupt_packet.length = p->iov.size;
+
+@@ -765,6 +802,10 @@ static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
+ USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
+ struct usb_redir_control_packet_header control_packet;
+
++ if (usbredir_already_in_flight(dev, p->id)) {
++ return USB_RET_ASYNC;
++ }
++
+ /* Special cases for certain standard device requests */
+ switch (request) {
+ case DeviceOutRequest | USB_REQ_SET_ADDRESS:
+@@ -982,6 +1023,7 @@ static int usbredir_initfn(USBDevice *udev)
+ dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
+
+ packet_id_queue_init(&dev->cancelled, dev, "cancelled");
++ packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ QTAILQ_INIT(&dev->endpoint[i].bufpq);
+ }
+@@ -1002,6 +1044,7 @@ static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
+ int i;
+
+ packet_id_queue_empty(&dev->cancelled);
++ packet_id_queue_empty(&dev->already_in_flight);
+ for (i = 0; i < MAX_ENDPOINTS; i++) {
+ usbredir_free_bufpq(dev, I2EP(i));
+ }
+--
+1.7.12.1
+
--- /dev/null
+From c41be182adcd7026fcf76250fc3a64cec8a2c903 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 6 Sep 2012 20:52:36 +0200
+Subject: [PATCH] usb-redir: Store max_packet_size in endp_data
+
+So that we've a place to migrate it to / from to allow restoring it after
+migration.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index cdd705f..6eb3c6d 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -57,6 +57,7 @@ struct endp_data {
+ uint8_t type;
+ uint8_t interval;
+ uint8_t interface; /* bInterfaceNumber this ep belongs to */
++ uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
+ uint8_t iso_started;
+ uint8_t iso_error; /* For reporting iso errors to the HC */
+ uint8_t interrupt_started;
+@@ -1300,7 +1301,8 @@ static void usbredir_ep_info(void *priv,
+ usb_ep->ifnum = dev->endpoint[i].interface;
+ if (usbredirparser_peer_has_cap(dev->parser,
+ usb_redir_cap_ep_info_max_packet_size)) {
+- usb_ep->max_packet_size = ep_info->max_packet_size[i];
++ dev->endpoint[i].max_packet_size =
++ usb_ep->max_packet_size = ep_info->max_packet_size[i];
+ }
+ if (ep_info->type[i] == usb_redir_type_bulk) {
+ usb_ep->pipeline = true;
+--
+1.7.12.1
+
--- /dev/null
+From a056ffda5a57d7169268e49a3e42c7d79c8f7c48 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 5 Sep 2012 09:21:44 +0200
+Subject: [PATCH] usb-redir: Add support for migration
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 349 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 346 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 6eb3c6d..b7387b6 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -65,8 +65,8 @@ struct endp_data {
+ uint8_t bufpq_prefilled;
+ uint8_t bufpq_dropping_packets;
+ QTAILQ_HEAD(, buf_packet) bufpq;
+- int bufpq_size;
+- int bufpq_target_size;
++ int32_t bufpq_size;
++ int32_t bufpq_target_size;
+ };
+
+ struct PacketIdQueueEntry {
+@@ -243,6 +243,11 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
+ return 0;
+ }
+
++ /* Don't send new data to the chardev until our state is fully synced */
++ if (!runstate_check(RUN_STATE_RUNNING)) {
++ return 0;
++ }
++
+ r = qemu_chr_fe_write(dev->cs, data, count);
+
+ if (r < 0) {
+@@ -870,6 +875,7 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+ {
+ uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
+ char version[32];
++ int flags = 0;
+
+ /* Make sure any pending closes are handled (no-op if none pending) */
+ usbredir_chardev_close_bh(dev);
+@@ -902,7 +908,12 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
+ usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
+- usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 0);
++
++ if (runstate_check(RUN_STATE_INMIGRATE)) {
++ flags |= usbredirparser_fl_no_hello;
++ }
++ usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
++ flags);
+ usbredirparser_do_write(dev->parser);
+ }
+
+@@ -948,6 +959,11 @@ static int usbredir_chardev_can_read(void *opaque)
+ return 0;
+ }
+
++ /* Don't read new data from the chardev until our state is fully synced */
++ if (!runstate_check(RUN_STATE_RUNNING)) {
++ return 0;
++ }
++
+ /* usbredir_parser_do_read will consume *all* data we give it */
+ return 1024 * 1024;
+ }
+@@ -999,6 +1015,15 @@ static const QemuChrHandlers usbredir_chr_handlers = {
+ * init + destroy
+ */
+
++static void usbredir_vm_state_change(void *priv, int running, RunState state)
++{
++ USBRedirDevice *dev = priv;
++
++ if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
++ usbredirparser_do_write(dev->parser); /* Flush any pending writes */
++ }
++}
++
+ static int usbredir_initfn(USBDevice *udev)
+ {
+ USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
+@@ -1036,6 +1061,7 @@ static int usbredir_initfn(USBDevice *udev)
+ qemu_chr_fe_open(dev->cs);
+ qemu_chr_add_handlers(dev->cs, &usbredir_chr_handlers, dev);
+
++ qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
+ add_boot_device_path(dev->bootindex, &udev->qdev, NULL);
+ return 0;
+ }
+@@ -1525,6 +1551,322 @@ static void usbredir_interrupt_packet(void *priv, uint64_t id,
+ }
+ }
+
++/*
++ * Migration code
++ */
++
++static void usbredir_pre_save(void *priv)
++{
++ USBRedirDevice *dev = priv;
++
++ usbredir_fill_already_in_flight(dev);
++}
++
++static int usbredir_post_load(void *priv, int version_id)
++{
++ USBRedirDevice *dev = priv;
++ struct USBEndpoint *usb_ep;
++ int i;
++
++ switch (dev->device_info.speed) {
++ case usb_redir_speed_low:
++ dev->dev.speed = USB_SPEED_LOW;
++ break;
++ case usb_redir_speed_full:
++ dev->dev.speed = USB_SPEED_FULL;
++ break;
++ case usb_redir_speed_high:
++ dev->dev.speed = USB_SPEED_HIGH;
++ break;
++ case usb_redir_speed_super:
++ dev->dev.speed = USB_SPEED_SUPER;
++ break;
++ default:
++ dev->dev.speed = USB_SPEED_FULL;
++ }
++ dev->dev.speedmask = (1 << dev->dev.speed);
++
++ for (i = 0; i < MAX_ENDPOINTS; i++) {
++ usb_ep = usb_ep_get(&dev->dev,
++ (i & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT,
++ i & 0x0f);
++ usb_ep->type = dev->endpoint[i].type;
++ usb_ep->ifnum = dev->endpoint[i].interface;
++ usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
++ if (dev->endpoint[i].type == usb_redir_type_bulk) {
++ usb_ep->pipeline = true;
++ }
++ }
++ return 0;
++}
++
++/* For usbredirparser migration */
++static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused)
++{
++ USBRedirDevice *dev = priv;
++ uint8_t *data;
++ int len;
++
++ if (dev->parser == NULL) {
++ qemu_put_be32(f, 0);
++ return;
++ }
++
++ usbredirparser_serialize(dev->parser, &data, &len);
++ qemu_oom_check(data);
++
++ qemu_put_be32(f, len);
++ qemu_put_buffer(f, data, len);
++
++ free(data);
++}
++
++static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused)
++{
++ USBRedirDevice *dev = priv;
++ uint8_t *data;
++ int len, ret;
++
++ len = qemu_get_be32(f);
++ if (len == 0) {
++ return 0;
++ }
++
++ /*
++ * Our chardev should be open already at this point, otherwise
++ * the usbredir channel will be broken (ie spice without seamless)
++ */
++ if (dev->parser == NULL) {
++ ERROR("get_parser called with closed chardev, failing migration\n");
++ return -1;
++ }
++
++ data = g_malloc(len);
++ qemu_get_buffer(f, data, len);
++
++ ret = usbredirparser_unserialize(dev->parser, data, len);
++
++ g_free(data);
++
++ return ret;
++}
++
++static const VMStateInfo usbredir_parser_vmstate_info = {
++ .name = "usb-redir-parser",
++ .put = usbredir_put_parser,
++ .get = usbredir_get_parser,
++};
++
++
++/* For buffered packets (iso/irq) queue migration */
++static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused)
++{
++ struct endp_data *endp = priv;
++ struct buf_packet *bufp;
++ int remain = endp->bufpq_size;
++
++ qemu_put_be32(f, endp->bufpq_size);
++ QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
++ qemu_put_be32(f, bufp->len);
++ qemu_put_be32(f, bufp->status);
++ qemu_put_buffer(f, bufp->data, bufp->len);
++ remain--;
++ }
++ assert(remain == 0);
++}
++
++static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused)
++{
++ struct endp_data *endp = priv;
++ struct buf_packet *bufp;
++ int i;
++
++ endp->bufpq_size = qemu_get_be32(f);
++ for (i = 0; i < endp->bufpq_size; i++) {
++ bufp = g_malloc(sizeof(struct buf_packet));
++ bufp->len = qemu_get_be32(f);
++ bufp->status = qemu_get_be32(f);
++ bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */
++ qemu_get_buffer(f, bufp->data, bufp->len);
++ QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
++ }
++ return 0;
++}
++
++static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
++ .name = "usb-redir-bufpq",
++ .put = usbredir_put_bufpq,
++ .get = usbredir_get_bufpq,
++};
++
++
++/* For endp_data migration */
++static const VMStateDescription usbredir_ep_vmstate = {
++ .name = "usb-redir-ep",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .fields = (VMStateField []) {
++ VMSTATE_UINT8(type, struct endp_data),
++ VMSTATE_UINT8(interval, struct endp_data),
++ VMSTATE_UINT8(interface, struct endp_data),
++ VMSTATE_UINT16(max_packet_size, struct endp_data),
++ VMSTATE_UINT8(iso_started, struct endp_data),
++ VMSTATE_UINT8(iso_error, struct endp_data),
++ VMSTATE_UINT8(interrupt_started, struct endp_data),
++ VMSTATE_UINT8(interrupt_error, struct endp_data),
++ VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
++ VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
++ {
++ .name = "bufpq",
++ .version_id = 0,
++ .field_exists = NULL,
++ .size = 0,
++ .info = &usbredir_ep_bufpq_vmstate_info,
++ .flags = VMS_SINGLE,
++ .offset = 0,
++ },
++ VMSTATE_INT32(bufpq_target_size, struct endp_data),
++ VMSTATE_END_OF_LIST()
++ }
++};
++
++
++/* For PacketIdQueue migration */
++static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused)
++{
++ struct PacketIdQueue *q = priv;
++ USBRedirDevice *dev = q->dev;
++ struct PacketIdQueueEntry *e;
++ int remain = q->size;
++
++ DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
++ qemu_put_be32(f, q->size);
++ QTAILQ_FOREACH(e, &q->head, next) {
++ qemu_put_be64(f, e->id);
++ remain--;
++ }
++ assert(remain == 0);
++}
++
++static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused)
++{
++ struct PacketIdQueue *q = priv;
++ USBRedirDevice *dev = q->dev;
++ int i, size;
++ uint64_t id;
++
++ size = qemu_get_be32(f);
++ DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
++ for (i = 0; i < size; i++) {
++ id = qemu_get_be64(f);
++ packet_id_queue_add(q, id);
++ }
++ assert(q->size == size);
++ return 0;
++}
++
++static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
++ .name = "usb-redir-packet-id-q",
++ .put = usbredir_put_packet_id_q,
++ .get = usbredir_get_packet_id_q,
++};
++
++static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
++ .name = "usb-redir-packet-id-queue",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .fields = (VMStateField []) {
++ {
++ .name = "queue",
++ .version_id = 0,
++ .field_exists = NULL,
++ .size = 0,
++ .info = &usbredir_ep_packet_id_q_vmstate_info,
++ .flags = VMS_SINGLE,
++ .offset = 0,
++ },
++ VMSTATE_END_OF_LIST()
++ }
++};
++
++
++/* For usb_redir_device_connect_header migration */
++static const VMStateDescription usbredir_device_info_vmstate = {
++ .name = "usb-redir-device-info",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .fields = (VMStateField []) {
++ VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
++ VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
++ VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
++ VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
++ VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
++ VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
++ VMSTATE_UINT16(device_version_bcd,
++ struct usb_redir_device_connect_header),
++ VMSTATE_END_OF_LIST()
++ }
++};
++
++
++/* For usb_redir_interface_info_header migration */
++static const VMStateDescription usbredir_interface_info_vmstate = {
++ .name = "usb-redir-interface-info",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .fields = (VMStateField []) {
++ VMSTATE_UINT32(interface_count,
++ struct usb_redir_interface_info_header),
++ VMSTATE_UINT8_ARRAY(interface,
++ struct usb_redir_interface_info_header, 32),
++ VMSTATE_UINT8_ARRAY(interface_class,
++ struct usb_redir_interface_info_header, 32),
++ VMSTATE_UINT8_ARRAY(interface_subclass,
++ struct usb_redir_interface_info_header, 32),
++ VMSTATE_UINT8_ARRAY(interface_protocol,
++ struct usb_redir_interface_info_header, 32),
++ VMSTATE_END_OF_LIST()
++ }
++};
++
++
++/* And finally the USBRedirDevice vmstate itself */
++static const VMStateDescription usbredir_vmstate = {
++ .name = "usb-redir",
++ .version_id = 1,
++ .minimum_version_id = 1,
++ .pre_save = usbredir_pre_save,
++ .post_load = usbredir_post_load,
++ .fields = (VMStateField []) {
++ VMSTATE_USB_DEVICE(dev, USBRedirDevice),
++ VMSTATE_TIMER(attach_timer, USBRedirDevice),
++ {
++ .name = "parser",
++ .version_id = 0,
++ .field_exists = NULL,
++ .size = 0,
++ .info = &usbredir_parser_vmstate_info,
++ .flags = VMS_SINGLE,
++ .offset = 0,
++ },
++ VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
++ usbredir_ep_vmstate, struct endp_data),
++ VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
++ usbredir_ep_packet_id_queue_vmstate,
++ struct PacketIdQueue),
++ VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
++ usbredir_ep_packet_id_queue_vmstate,
++ struct PacketIdQueue),
++ VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
++ usbredir_device_info_vmstate,
++ struct usb_redir_device_connect_header),
++ VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
++ usbredir_interface_info_vmstate,
++ struct usb_redir_interface_info_header),
++ VMSTATE_END_OF_LIST()
++ }
++};
++
+ static Property usbredir_properties[] = {
+ DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
+ DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, 0),
+@@ -1545,6 +1887,7 @@ static void usbredir_class_initfn(ObjectClass *klass, void *data)
+ uc->handle_reset = usbredir_handle_reset;
+ uc->handle_data = usbredir_handle_data;
+ uc->handle_control = usbredir_handle_control;
++ dc->vmsd = &usbredir_vmstate;
+ dc->props = usbredir_properties;
+ }
+
+--
+1.7.12.1
+
--- /dev/null
+From 5a717110d859cbd989634e8acdcedd800ee2be74 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 5 Sep 2012 15:56:57 +0200
+Subject: [PATCH] usb-redir: Add chardev open / close debug logging
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index b7387b6..57e6289 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -866,6 +866,7 @@ static void usbredir_chardev_close_bh(void *opaque)
+ usbredir_device_disconnect(dev);
+
+ if (dev->parser) {
++ DPRINTF("destroying usbredirparser\n");
+ usbredirparser_destroy(dev->parser);
+ dev->parser = NULL;
+ }
+@@ -881,6 +882,8 @@ static void usbredir_chardev_open(USBRedirDevice *dev)
+ usbredir_chardev_close_bh(dev);
+ qemu_bh_cancel(dev->chardev_close_bh);
+
++ DPRINTF("creating usbredirparser\n");
++
+ dev->parser = qemu_oom_check(usbredirparser_create());
+ dev->parser->priv = dev;
+ dev->parser->log_func = usbredir_log;
+@@ -989,9 +992,11 @@ static void usbredir_chardev_event(void *opaque, int event)
+
+ switch (event) {
+ case CHR_EVENT_OPENED:
++ DPRINTF("chardev open\n");
+ usbredir_chardev_open(dev);
+ break;
+ case CHR_EVENT_CLOSED:
++ DPRINTF("chardev close\n");
+ qemu_bh_schedule(dev->chardev_close_bh);
+ break;
+ }
+@@ -1250,6 +1255,7 @@ static void usbredir_device_disconnect(void *priv)
+ qemu_del_timer(dev->attach_timer);
+
+ if (dev->dev.attached) {
++ DPRINTF("detaching device\n");
+ usb_device_detach(&dev->dev);
+ /*
+ * Delay next usb device attach to give the guest a chance to see
+--
+1.7.12.1
+
--- /dev/null
+From b95fb22d2799ed07c55bccbd7ffa3cb19fb7feb3 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 10 Sep 2012 13:49:46 +0200
+Subject: [PATCH] usb-redir: Revert usb-redir part of commit 93bfef4c
+
+Commit 93bfef4c6e4b23caea9d51e1099d06433d8835a4 makes qemu-devices
+which report the qemu version string to the guest in some way use a
+qemu_get_version function which reports a machine-specific version string.
+
+However usb-redir does not expose the qemu version to the guest, only to
+the usbredir-host as part of the initial handshake. This can then be logged
+on the usbredir-host side for debugging purposes and is otherwise completely
+unused! For debugging purposes it is important to have the real qemu version
+in there, rather then the machine-specific version.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 57e6289..78e93a7 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -875,7 +875,6 @@ static void usbredir_chardev_close_bh(void *opaque)
+ static void usbredir_chardev_open(USBRedirDevice *dev)
+ {
+ uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
+- char version[32];
+ int flags = 0;
+
+ /* Make sure any pending closes are handled (no-op if none pending) */
+--
+1.7.12.1
+
--- /dev/null
+From d6fe9953a8277a54ae7f4cefa192b49d9bf99e3d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 20 Sep 2012 16:55:02 +0200
+Subject: [PATCH] ehci: Fix interrupt packet MULT handling
+
+There are several issues with our handling of the MULT epcap field
+of interrupt qhs, which this patch fixes.
+
+1) When we don't execute a transaction because of the transaction counter
+being 0, p->async stays EHCI_ASYNC_NONE, and the next time we process the
+same qtd we hit an assert in ehci_state_fetchqtd because of this. Even though
+I believe that this is caused by 3 below, this patch still removes the assert,
+as that can still happen without 3, when multiple packets are queued for the
+same interrupt ep.
+
+2) We only *check* the transaction counter from ehci_state_execute, any
+packets queued up by fill_queue bypass this check. This is fixed by not calling
+fill_queue for interrupt packets.
+
+3) Some versions of Windows set the MULT field of the qh to 0, which is a
+clear violation of the EHCI spec, but still they do it. This means that we
+will never execute a qtd for these, making interrupt ep-s on USB-2 devices
+not work, and after recent changes, triggering 1).
+
+So far we've stored the transaction counter in our copy of the mult field,
+but with this beginnig at 0 already when dealing with these version of windows
+this won't work. So this patch adds a transact_ctr field to our qh struct,
+and sets this to the MULT field value on fetchqh. When the MULT field value
+is 0, we set it to 4. Assuming that windows gets way with setting it to 0,
+by the actual hardware going horizontal on a 1 -> 0 transition, which will
+give it 4 transactions (MULT goes from 0 - 3).
+
+Note that we cannot stop on detecting the 1 -> 0 transition, as our decrement
+of the transaction counter, and checking for it are done in 2 different places.
+
+Reported-by: Shawn Starr <shawn.starr@rogers.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/hcd-ehci.c | 39 +++++++++++++++++++--------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
+index 6a5da84..46f6d99 100644
+--- a/hw/usb/hcd-ehci.c
++++ b/hw/usb/hcd-ehci.c
+@@ -373,6 +373,7 @@ struct EHCIQueue {
+ uint32_t seen;
+ uint64_t ts;
+ int async;
++ int transact_ctr;
+
+ /* cached data from guest - needs to be flushed
+ * when guest removes an entry (doorbell, handshake sequence)
+@@ -1837,6 +1838,10 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
+ }
+ q->qh = qh;
+
++ q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
++ if (q->transact_ctr == 0) /* Guest bug in some versions of windows */
++ q->transact_ctr = 4;
++
+ if (q->dev == NULL) {
+ q->dev = ehci_find_device(q->ehci, devaddr);
+ }
+@@ -2014,11 +2019,8 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
+ } else if (p != NULL) {
+ switch (p->async) {
+ case EHCI_ASYNC_NONE:
+- /* Should never happen packet should at least be initialized */
+- assert(0);
+- break;
+ case EHCI_ASYNC_INITIALIZED:
+- /* Previously nacked packet (likely interrupt ep) */
++ /* Not yet executed (MULT), or previously nacked (int) packet */
+ ehci_set_state(q->ehci, q->async, EST_EXECUTE);
+ break;
+ case EHCI_ASYNC_INFLIGHT:
+@@ -2107,15 +2109,12 @@ static int ehci_state_execute(EHCIQueue *q)
+
+ // TODO verify enough time remains in the uframe as in 4.4.1.1
+ // TODO write back ptr to async list when done or out of time
+- // TODO Windows does not seem to ever set the MULT field
+
+- if (!q->async) {
+- int transactCtr = get_field(q->qh.epcap, QH_EPCAP_MULT);
+- if (!transactCtr) {
+- ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
+- again = 1;
+- goto out;
+- }
++ /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
++ if (!q->async && q->transact_ctr == 0) {
++ ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
++ again = 1;
++ goto out;
+ }
+
+ if (q->async) {
+@@ -2132,7 +2131,11 @@ static int ehci_state_execute(EHCIQueue *q)
+ trace_usb_ehci_packet_action(p->queue, p, "async");
+ p->async = EHCI_ASYNC_INFLIGHT;
+ ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
+- again = (ehci_fill_queue(p) == USB_RET_PROCERR) ? -1 : 1;
++ if (q->async) {
++ again = (ehci_fill_queue(p) == USB_RET_PROCERR) ? -1 : 1;
++ } else {
++ again = 1;
++ }
+ goto out;
+ }
+
+@@ -2152,13 +2155,9 @@ static int ehci_state_executing(EHCIQueue *q)
+
+ ehci_execute_complete(q);
+
+- // 4.10.3
+- if (!q->async) {
+- int transactCtr = get_field(q->qh.epcap, QH_EPCAP_MULT);
+- transactCtr--;
+- set_field(&q->qh.epcap, transactCtr, QH_EPCAP_MULT);
+- // 4.10.3, bottom of page 82, should exit this state when transaction
+- // counter decrements to 0
++ /* 4.10.3 */
++ if (!q->async && q->transact_ctr > 0) {
++ q->transact_ctr--;
+ }
+
+ /* 4.10.5 */
+--
+1.7.12.1
+
--- /dev/null
+From 79467d7c3fe963b39b00c884a5624cb1e754db9d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 25 Sep 2012 13:22:21 +0200
+Subject: [PATCH] usb-redir: Adjust pkg-config check for usbredirparser .pc
+ file rename (v2)
+
+The usbredir 0.5 release introduced the new API for 64 bit packet ids, but
+it kept the libusbredirparser.pc name as is, meaning that older versions of
+qemu will still have their pkg-config check for usbredirparser fulfilled,
+and build with the usb-redir device. Due to the API change there will be
+some compiler warnings, but the build will succeed, however the usb-redir
+device will be broken on 32 bit machines.
+
+To solve this a new usbredir-0.5.2 release is coming, which renames the
+libusbredirparser.pc file to libusbredirparser-0.5.pc, so that it will no
+longer fulfill the pkg-config check of the qemu-1.2 and older releases,
+stopping the (silent) breakage. This patch adjusts qemu master's configure
+to properly detect the new usbredir release.
+
+Changes in v2:
+-Not only use the new .pc name in the check but also when getting cflags
+ and libs!
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ configure | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/configure b/configure
+index 2c4469f..f019526 100755
+--- a/configure
++++ b/configure
+@@ -2758,10 +2758,10 @@ fi
+
+ # check for usbredirparser for usb network redirection support
+ if test "$usb_redir" != "no" ; then
+- if $pkg_config --atleast-version=0.5 libusbredirparser >/dev/null 2>&1 ; then
++ if $pkg_config --atleast-version=0.5 libusbredirparser-0.5 >/dev/null 2>&1 ; then
+ usb_redir="yes"
+- usb_redir_cflags=$($pkg_config --cflags libusbredirparser 2>/dev/null)
+- usb_redir_libs=$($pkg_config --libs libusbredirparser 2>/dev/null)
++ usb_redir_cflags=$($pkg_config --cflags libusbredirparser-0.5 2>/dev/null)
++ usb_redir_libs=$($pkg_config --libs libusbredirparser-0.5 2>/dev/null)
+ QEMU_CFLAGS="$QEMU_CFLAGS $usb_redir_cflags"
+ libs_softmmu="$libs_softmmu $usb_redir_libs"
+ else
+--
+1.7.12.1
+
--- /dev/null
+From 9ebfb490e04e1fe5466a4d31df17c5e6283236cb Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 27 Sep 2012 16:59:50 +0200
+Subject: [PATCH] usb-redir: Change usbredir_open_chardev into
+ usbredir_create_parser
+
+As we need to create the parser at more places.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 78e93a7..5d16aff 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -872,15 +872,11 @@ static void usbredir_chardev_close_bh(void *opaque)
+ }
+ }
+
+-static void usbredir_chardev_open(USBRedirDevice *dev)
++static void usbredir_create_parser(USBRedirDevice *dev)
+ {
+ uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
+ int flags = 0;
+
+- /* Make sure any pending closes are handled (no-op if none pending) */
+- usbredir_chardev_close_bh(dev);
+- qemu_bh_cancel(dev->chardev_close_bh);
+-
+ DPRINTF("creating usbredirparser\n");
+
+ dev->parser = qemu_oom_check(usbredirparser_create());
+@@ -992,7 +988,10 @@ static void usbredir_chardev_event(void *opaque, int event)
+ switch (event) {
+ case CHR_EVENT_OPENED:
+ DPRINTF("chardev open\n");
+- usbredir_chardev_open(dev);
++ /* Make sure any pending closes are handled (no-op if none pending) */
++ usbredir_chardev_close_bh(dev);
++ qemu_bh_cancel(dev->chardev_close_bh);
++ usbredir_create_parser(dev);
+ break;
+ case CHR_EVENT_CLOSED:
+ DPRINTF("chardev close\n");
+--
+1.7.12.1
+
--- /dev/null
+From c57b03073357e813ade4b3b34f6c1e3c0de394c2 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 27 Sep 2012 16:57:41 +0200
+Subject: [PATCH] usb-redir: Don't make migration fail in none seamless case
+
+Instead simple disconnect the device like host redirection does on
+migration.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/usb/redirect.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 5d16aff..022ba42 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -1637,12 +1637,17 @@ static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused)
+ }
+
+ /*
+- * Our chardev should be open already at this point, otherwise
+- * the usbredir channel will be broken (ie spice without seamless)
++ * If our chardev is not open already at this point the usbredir connection
++ * has been broken (non seamless migration, or restore from disk).
++ *
++ * In this case create a temporary parser to receive the migration data,
++ * and schedule the close_bh to report the device as disconnected to the
++ * guest and to destroy the parser again.
+ */
+ if (dev->parser == NULL) {
+- ERROR("get_parser called with closed chardev, failing migration\n");
+- return -1;
++ WARNING("usb-redir connection broken during migration\n");
++ usbredir_create_parser(dev);
++ qemu_bh_schedule(dev->chardev_close_bh);
+ }
+
+ data = g_malloc(len);
+--
+1.7.12.1
+
--- /dev/null
+From 5196eaa783b83110e6a8b99bfeb244b758b6e9c7 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Mon, 6 Aug 2012 17:12:40 -0400
+Subject: [PATCH] mips: Fix link error with 'piix4_pm_init'
+
+ LINK mips-softmmu/qemu-system-mips
+ LINK m68k-softmmu/qemu-system-m68k
+hw/mips/../mips_malta.o: In function `mips_malta_init':
+/home/crobinso/qemu-kvm/hw/mips/../mips_malta.c:961: undefined reference to `piix4_pm_init'
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ hw/mips/Makefile.objs | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/mips/Makefile.objs b/hw/mips/Makefile.objs
+index 29a5d0d..89af0e9 100644
+--- a/hw/mips/Makefile.objs
++++ b/hw/mips/Makefile.objs
+@@ -1,6 +1,7 @@
+ obj-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
+ obj-y += mips_addr.o mips_timer.o mips_int.o
+ obj-y += gt64xxx.o mc146818rtc.o
++obj-y += acpi.o acpi_piix4.o
+ obj-$(CONFIG_FULONG) += bonito.o vt82c686.o mips_fulong2e.o
+
+ obj-y := $(addprefix ../,$(obj-y))
+--
+1.7.12.1
+
--- /dev/null
+From b80fff00ed7f9baff808edb6c2c9f98f7e75e8ca Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Mon, 13 Aug 2012 18:39:54 -0400
+Subject: [PATCH] configure: Add --disable-kvm-options
+
+In Fedora, our qemu package is based on qemu-kvm, and we go to convoluted
+lengths to provide a qemu-kvm binary with KVM on by default, but all
+qemu-system-* with KVM off by default (using ./configure --disable-kvm)
+
+For qemu-system*, what we really want is upstream qemu symantics of TCG
+by default, but the opt in option for KVM. CONFIG_KVM_OPTIONS fits the
+bill, so let's expose it through ./configure. This will also simplify
+our packaging for non-x86 KVM.
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ configure | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/configure b/configure
+index f019526..933754d 100755
+--- a/configure
++++ b/configure
+@@ -210,6 +210,7 @@ bsd_user="no"
+ guest_base=""
+ uname_release=""
+ mixemu="no"
++kvmoptions="yes"
+ aix="no"
+ blobs="yes"
+ pkgversion=" ($(kvm_version))"
+@@ -732,6 +733,8 @@ for opt do
+ ;;
+ --enable-kvm) kvm="yes"
+ ;;
++ --disable-kvm-options) kvmoptions="no"
++ ;;
+ --disable-tcg-interpreter) tcg_interpreter="no"
+ ;;
+ --enable-tcg-interpreter) tcg_interpreter="yes"
+@@ -1080,6 +1083,8 @@ echo " --enable-bluez enable bluez stack connectivity"
+ echo " --disable-slirp disable SLIRP userspace network connectivity"
+ echo " --disable-kvm disable KVM acceleration support"
+ echo " --enable-kvm enable KVM acceleration support"
++echo " --disable-kvm-options if KVM is enabled, default to KVM=off, and"
++echo " remove non-upstream cli options"
+ echo " --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
+ echo " --disable-nptl disable usermode NPTL support"
+ echo " --enable-nptl enable usermode NPTL support"
+@@ -3160,6 +3165,7 @@ echo "ATTR/XATTR support $attr"
+ echo "Install blobs $blobs"
+ echo "KVM support $kvm"
+ echo "TCG interpreter $tcg_interpreter"
++echo "KVM CLI options $kvmoptions"
+ echo "fdt support $fdt"
+ echo "preadv support $preadv"
+ echo "fdatasync $fdatasync"
+@@ -3893,7 +3899,10 @@ case "$target_arch2" in
+ \( "$target_arch2" = "x86_64" -a "$cpu" = "i386" \) -o \
+ \( "$target_arch2" = "i386" -a "$cpu" = "x86_64" \) \) ; then
+ echo "CONFIG_KVM=y" >> $config_target_mak
+- echo "CONFIG_KVM_OPTIONS=y" >> $config_host_mak
++
++ if test "$kvmoptions" = "yes" ; then
++ echo "CONFIG_KVM_OPTIONS=y" >> $config_host_mak
++ fi
+ if test "$vhost_net" = "yes" ; then
+ echo "CONFIG_VHOST_NET=y" >> $config_target_mak
+ fi
+--
+1.7.12.1
+
--- /dev/null
+From d3a43fe4b870154032db4651824bc88e3cb81dc5 Mon Sep 17 00:00:00 2001
+From: Peter Maydell <peter.maydell@linaro.org>
+Date: Fri, 26 Oct 2012 16:29:38 +0100
+Subject: [PATCH] arm_boot: Change initrd load address to "halfway through
+ RAM"
+
+To avoid continually having to bump the initrd load address
+to account for larger kernel images, put the initrd halfway
+through RAM. This allows large kernels on new boards with lots
+of RAM to work OK, without breaking existing usecases for
+boards with only 32MB of RAM.
+
+Note that this change fixes in passing a bug where we were
+passing an overly large max_size to load_image_targphys()
+for the initrd, which meant that we wouldn't correctly refuse
+to load an enormous initrd that didn't actually fit into RAM.
+
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm-misc.h | 1 +
+ hw/arm_boot.c | 41 ++++++++++++++++++++++++++---------------
+ 2 files changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/hw/arm-misc.h b/hw/arm-misc.h
+index bdd8fec..0f7deb5 100644
+--- a/hw/arm-misc.h
++++ b/hw/arm-misc.h
+@@ -56,6 +56,7 @@ struct arm_boot_info {
+ const struct arm_boot_info *info);
+ /* Used internally by arm_boot.c */
+ int is_linux;
++ target_phys_addr_t initrd_start;
+ target_phys_addr_t initrd_size;
+ target_phys_addr_t entry;
+ };
+diff --git a/hw/arm_boot.c b/hw/arm_boot.c
+index a6e9143..920c337 100644
+--- a/hw/arm_boot.c
++++ b/hw/arm_boot.c
+@@ -18,7 +18,6 @@
+
+ #define KERNEL_ARGS_ADDR 0x100
+ #define KERNEL_LOAD_ADDR 0x00010000
+-#define INITRD_LOAD_ADDR 0x00d00000
+
+ /* The worlds second smallest bootloader. Set r0-r2, then jump to kernel. */
+ static uint32_t bootloader[] = {
+@@ -109,7 +108,7 @@ static void set_kernel_args(const struct arm_boot_info *info)
+ /* ATAG_INITRD2 */
+ WRITE_WORD(p, 4);
+ WRITE_WORD(p, 0x54420005);
+- WRITE_WORD(p, info->loader_start + INITRD_LOAD_ADDR);
++ WRITE_WORD(p, info->initrd_start);
+ WRITE_WORD(p, initrd_size);
+ }
+ if (info->kernel_cmdline && *info->kernel_cmdline) {
+@@ -185,10 +184,11 @@ static void set_kernel_args_old(const struct arm_boot_info *info)
+ /* pages_in_vram */
+ WRITE_WORD(p, 0);
+ /* initrd_start */
+- if (initrd_size)
+- WRITE_WORD(p, info->loader_start + INITRD_LOAD_ADDR);
+- else
++ if (initrd_size) {
++ WRITE_WORD(p, info->initrd_start);
++ } else {
+ WRITE_WORD(p, 0);
++ }
+ /* initrd_size */
+ WRITE_WORD(p, initrd_size);
+ /* rd_start */
+@@ -281,14 +281,13 @@ static int load_dtb(target_phys_addr_t addr, const struct arm_boot_info *binfo)
+
+ if (binfo->initrd_size) {
+ rc = qemu_devtree_setprop_cell(fdt, "/chosen", "linux,initrd-start",
+- binfo->loader_start + INITRD_LOAD_ADDR);
++ binfo->initrd_start);
+ if (rc < 0) {
+ fprintf(stderr, "couldn't set /chosen/linux,initrd-start\n");
+ }
+
+ rc = qemu_devtree_setprop_cell(fdt, "/chosen", "linux,initrd-end",
+- binfo->loader_start + INITRD_LOAD_ADDR +
+- binfo->initrd_size);
++ binfo->initrd_start + binfo->initrd_size);
+ if (rc < 0) {
+ fprintf(stderr, "couldn't set /chosen/linux,initrd-end\n");
+ }
+@@ -375,6 +374,19 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
+ big_endian = 0;
+ #endif
+
++ /* We want to put the initrd far enough into RAM that when the
++ * kernel is uncompressed it will not clobber the initrd. However
++ * on boards without much RAM we must ensure that we still leave
++ * enough room for a decent sized initrd, and on boards with large
++ * amounts of RAM we must avoid the initrd being so far up in RAM
++ * that it is outside lowmem and inaccessible to the kernel.
++ * So for boards with less than 256MB of RAM we put the initrd
++ * halfway into RAM, and for boards with 256MB of RAM or more we put
++ * the initrd at 128MB.
++ */
++ info->initrd_start = info->loader_start +
++ MIN(info->ram_size / 2, 128 * 1024 * 1024);
++
+ /* Assume that raw images are linux kernels, and ELF images are not. */
+ kernel_size = load_elf(info->kernel_filename, NULL, NULL, &elf_entry,
+ NULL, NULL, big_endian, ELF_MACHINE, 1);
+@@ -398,10 +410,9 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
+ if (is_linux) {
+ if (info->initrd_filename) {
+ initrd_size = load_image_targphys(info->initrd_filename,
+- info->loader_start
+- + INITRD_LOAD_ADDR,
+- info->ram_size
+- - INITRD_LOAD_ADDR);
++ info->initrd_start,
++ info->ram_size -
++ info->initrd_start);
+ if (initrd_size < 0) {
+ fprintf(stderr, "qemu: could not load initrd '%s'\n",
+ info->initrd_filename);
+@@ -419,9 +430,9 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
+ */
+ if (info->dtb_filename) {
+ /* Place the DTB after the initrd in memory */
+- target_phys_addr_t dtb_start = TARGET_PAGE_ALIGN(info->loader_start
+- + INITRD_LOAD_ADDR
+- + initrd_size);
++ target_phys_addr_t dtb_start = TARGET_PAGE_ALIGN(
++ info->initrd_start +
++ initrd_size);
+ if (load_dtb(dtb_start, info)) {
+ exit(1);
+ }
+--
+1.7.12.1
+
--- /dev/null
+From 4780bb16558d2753e2277e1570644bec49551534 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Sun, 2 Sep 2012 02:04:16 +0300
+Subject: [PATCH] dtrace backend: add function to reserved words
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
+---
+ scripts/tracetool/backend/dtrace.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/tracetool/backend/dtrace.py b/scripts/tracetool/backend/dtrace.py
+index 9cab75c..6be7047 100644
+--- a/scripts/tracetool/backend/dtrace.py
++++ b/scripts/tracetool/backend/dtrace.py
+@@ -87,7 +87,7 @@ def stap(events):
+ if len(e.args) > 0:
+ for name in e.args.names():
+ # Append underscore to reserved keywords
+- if name in ('limit', 'in', 'next', 'self'):
++ if name in ('limit', 'in', 'next', 'self', 'function'):
+ name += '_'
+ out(' %s = $arg%d;' % (name, i))
+ i += 1
+--
+1.7.12.1
+
--- /dev/null
+From e0575d0a1a14e8f4e8fc11d549cbd07cca433383 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 30 Oct 2012 18:00:33 +0200
+Subject: [PATCH] wip: hw/qxl: inject interrupts in any state
+
+---
+ hw/qxl.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/hw/qxl.c b/hw/qxl.c
+index 9389752..b137731 100644
+--- a/hw/qxl.c
++++ b/hw/qxl.c
+@@ -1714,7 +1714,6 @@ static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
+ uint32_t le_events = cpu_to_le32(events);
+
+ trace_qxl_send_events(d->id, events);
+- assert(qemu_spice_display_is_running(&d->ssd));
+ old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
+ if ((old_pending & le_events) == le_events) {
+ return;
+--
+1.7.12.1
+
--- /dev/null
+From 38f419f35225decdbaea9fe1fd00218f8924ce84 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Wed, 17 Oct 2012 19:09:25 +0200
+Subject: [PATCH] configure: Fix CONFIG_QEMU_HELPERDIR generation
+
+We need to evaluate $libexecdir in configure, otherwise we literally end
+up with "${prefix}/libexec" instead of the absolute path as
+CONFIG_QEMU_HELPERDIR.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+---
+ configure | 2 +-
+ 1 file modificato, 1 inserzione(+). 1 rimozione(-)
+
+diff --git a/configure b/configure
+index f9c31f4..9f33c7d 100755
+--- a/configure
++++ b/configure
+@@ -3200,7 +3200,7 @@ echo "qemu_confdir=$qemu_confdir" >> $config_host_mak
+ echo "qemu_confdir=$qemu_confdir" >> $config_host_mak
+ echo "qemu_datadir=$qemu_datadir" >> $config_host_mak
+ echo "qemu_docdir=$qemu_docdir" >> $config_host_mak
+-echo "CONFIG_QEMU_HELPERDIR=\"$libexecdir\"" >> $config_host_mak
++echo "CONFIG_QEMU_HELPERDIR=\"`eval echo $libexecdir`\"" >> $config_host_mak
+
+ echo "ARCH=$ARCH" >> $config_host_mak
+ if test "$debug_tcg" = "yes" ; then
+--
+1.7.12.1
+
--- /dev/null
+KERNEL=="kvm", GROUP="kvm", MODE="0666"
--- /dev/null
+SUBSYSTEM=="virtio-ports", ATTR{name}=="org.qemu.guest_agent.0", \
+ TAG+="systemd" ENV{SYSTEMD_WANTS}="qemu-guest-agent.service"
--- /dev/null
+allow virbr0
--- /dev/null
+[Unit]
+Description=Kernel Samepage Merging
+ConditionPathExists=/sys/kernel/mm/ksm
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=-/etc/sysconfig/ksm
+ExecStart=/lib/systemd/ksmctl start
+ExecStop=/lib/systemd/ksmctl stop
+
+[Install]
+WantedBy=multi-user.target
--- /dev/null
+# The maximum number of unswappable kernel pages
+# which may be allocated by ksm (0 for unlimited)
+# If unset, defaults to half of total memory
+# KSM_MAX_KERNEL_PAGES=
--- /dev/null
+/* Start/stop KSM, for systemd.
+ * Copyright (C) 2009, 2011 Red Hat, Inc.
+ * Written by Paolo Bonzini <pbonzini@redhat.com>.
+ * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
+ * This file is distributed under the GNU General Public License, version 2
+ * or later. */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
+#define KSM_RUN_FILE "/sys/kernel/mm/ksm/run"
+
+char *program_name;
+
+int usage(void)
+{
+ fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
+ return 1;
+}
+
+int write_value(uint64_t value, char *filename)
+{
+ FILE *fp;
+ if (!(fp = fopen(filename, "w")) ||
+ fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
+ fflush(fp) == EOF ||
+ fclose(fp) == EOF)
+ return 1;
+
+ return 0;
+}
+
+uint64_t ksm_max_kernel_pages()
+{
+ char *var = getenv("KSM_MAX_KERNEL_PAGES");
+ char *endptr;
+ uint64_t value;
+ if (var && *var) {
+ value = strtoll(var, &endptr, 0);
+ if (value < LLONG_MAX && !*endptr)
+ return value;
+ }
+ /* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
+ * total memory. */
+ return sysconf(_SC_PHYS_PAGES) / 2;
+}
+
+int start(void)
+{
+ if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
+ write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
+ return write_value(1, KSM_RUN_FILE);
+}
+
+int stop(void)
+{
+ return write_value(0, KSM_RUN_FILE);
+}
+
+int main(int argc, char **argv)
+{
+ program_name = argv[0];
+ if (argc < 2) {
+ return usage();
+ } else if (!strcmp(argv[1], "start")) {
+ return start();
+ } else if (!strcmp(argv[1], "stop")) {
+ return stop();
+ } else {
+ return usage();
+ }
+}
--- /dev/null
+#!/bin/bash
+#
+# Copyright 2009 Red Hat, Inc. and/or its affiliates.
+# Released under the GPL
+#
+# Author: Dan Kenigsberg <danken@redhat.com>
+#
+# ksmtuned - a simple script that controls whether (and with what vigor) ksm
+# should search for duplicated pages.
+#
+# starts ksm when memory commited to qemu processes exceeds a threshold, and
+# make ksm work harder and harder untill memory load falls below that
+# threshold.
+#
+# send SIGUSR1 to this process right after a new qemu process is started, or
+# following its death, to retune ksm accordingly
+#
+# needs testing and ironing. contact danken@redhat.com if something breaks.
+
+if [ -f /etc/ksmtuned.conf ]; then
+ . /etc/ksmtuned.conf
+fi
+
+debug() {
+ if [ -n "$DEBUG" ]; then
+ s="`/bin/date`: $*"
+ [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
+ fi
+}
+
+
+KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
+KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
+KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
+
+KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
+KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
+# millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
+# more, bigger sleep less.
+KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
+
+KSM_THRES_COEF=${KSM_THRES_COEF:-20}
+KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
+
+total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
+debug total $total
+
+npages=0
+sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
+[ $sleep -le 10 ] && sleep=10
+debug sleep $sleep
+thres=$[total * KSM_THRES_COEF / 100]
+if [ $KSM_THRES_CONST -gt $thres ]; then
+ thres=$KSM_THRES_CONST
+fi
+debug thres $thres
+
+KSMCTL () {
+ case x$1 in
+ xstop)
+ echo 0 > /sys/kernel/mm/ksm/run
+ ;;
+ xstart)
+ echo $2 > /sys/kernel/mm/ksm/pages_to_scan
+ echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
+ echo 1 > /sys/kernel/mm/ksm/run
+ ;;
+ esac
+}
+
+committed_memory () {
+ # calculate how much memory is committed to running qemu processes
+ local progname
+ progname=${1:-qemu-kvm}
+ ps -C "$progname" -o rsz | awk '{ sum += $1 }; END { print sum }'
+}
+
+free_memory () {
+ awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
+ /proc/meminfo
+}
+
+increase_npages() {
+ local delta
+ delta=${1:-0}
+ npages=$[npages + delta]
+ if [ $npages -lt $KSM_NPAGES_MIN ]; then
+ npages=$KSM_NPAGES_MIN
+ elif [ $npages -gt $KSM_NPAGES_MAX ]; then
+ npages=$KSM_NPAGES_MAX
+ fi
+ echo $npages
+}
+
+
+adjust () {
+ local free committed
+ free=`free_memory`
+ committed=`committed_memory`
+ debug committed $committed free $free
+ if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
+ KSMCTL stop
+ debug "$[committed + thres] < $total and free > $thres, stop ksm"
+ return 1
+ fi
+ debug "$[committed + thres] > $total, start ksm"
+ if [ $free -lt $thres ]; then
+ npages=`increase_npages $KSM_NPAGES_BOOST`
+ debug "$free < $thres, boost"
+ else
+ npages=`increase_npages $KSM_NPAGES_DECAY`
+ debug "$free > $thres, decay"
+ fi
+ KSMCTL start $npages $sleep
+ debug "KSMCTL start $npages $sleep"
+ return 0
+}
+
+function nothing () {
+ :
+}
+
+loop () {
+ trap nothing SIGUSR1
+ while true
+ do
+ sleep $KSM_MONITOR_INTERVAL &
+ wait $!
+ adjust
+ done
+}
+
+PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
+if touch "$PIDFILE"; then
+ loop &
+ echo $! > "$PIDFILE"
+fi
--- /dev/null
+# Configuration file for ksmtuned.
+
+# How long ksmtuned should sleep between tuning adjustments
+# KSM_MONITOR_INTERVAL=60
+
+# Millisecond sleep between ksm scans for 16Gb server.
+# Smaller servers sleep more, bigger sleep less.
+# KSM_SLEEP_MSEC=10
+
+# KSM_NPAGES_BOOST=300
+# KSM_NPAGES_DECAY=-50
+# KSM_NPAGES_MIN=64
+# KSM_NPAGES_MAX=1250
+
+# KSM_THRES_COEF=20
+# KSM_THRES_CONST=2048
+
+# uncomment the following if you want ksmtuned debug info
+
+# LOGFILE=/var/log/ksmtuned
+# DEBUG=1
--- /dev/null
+[Unit]
+Description=Kernel Samepage Merging (KSM) Tuning Daemon
+After=ksm.service
+Requires=ksm.service
+
+[Service]
+ExecStart=/usr/sbin/ksmtuned
+ExecReload=/bin/kill -USR1 $MAINPID
+Type=forking
+
+[Install]
+WantedBy=multi-user.target
--- /dev/null
+#!/bin/sh
+
+case $(uname -m) in
+ i?86|x86_64)
+ grep vmx /proc/cpuinfo >/dev/null 2>&1 && vmx=1
+ grep svm /proc/cpuinfo >/dev/null 2>&1 && svm=1
+
+ if [ "$vmx" ] || [ "$svm" ]; then
+ [ "$vmx" ] && modprobe -b kvm-intel >/dev/null 2>&1 && kvm=1
+ [ "$svm" ] && modprobe -b kvm-amd >/dev/null 2>&1 && kvm=1
+ fi
+ ;;
+ ppc64)
+ grep OPAL /proc/cpuinfo >/dev/null 2>&1 && opal=1
+
+ if [ "$opal" ]; then
+ modprobe -b kvm >/dev/null 2>&1 && kvm=1
+ fi
+ ;;
+ s390x)
+ modprobe -b kvm >/dev/null 2>&1 && kvm=1
+ ;;
+esac
+
+if [ "$kvm" ]; then
+ # no reason why vhost should not work with TCG, but currently it does not
+ modprobe -b vhost-net >/dev/null 2>&1
+else
+ exit 0
+fi
--- /dev/null
+[Unit]
+Description=QEMU Guest Agent
+BindTo=dev-virtio\x2dports-org.qemu.guest_agent.0.device
+After=dev-virtio\x2dports-org.qemu.guest_agent.0.device
+
+[Service]
+ExecStart=-/usr/bin/qemu-ga
+Restart=always
+RestartSec=0
+
+[Install]
--- /dev/null
+:qemu-i386:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00:\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-i386:
+:qemu-i486:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x06\x00:\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-i386:
+:qemu-alpha:M::\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x26\x90:\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-alpha:
+:qemu-arm:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-arm:
+:qemu-armeb:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-armeb:
+:qemu-sparc:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02:\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-sparc:
+:qemu-ppc:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x14:\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-ppc:
+:qemu-m68k:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x04:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-m68k:
+:qemu-mips:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-mips:
+:qemu-mipsel:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-mipsel:
+:qemu-mipsn32:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-mipsn32:
+:qemu-mipsn32el:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-mipsn32el:
+:qemu-mips64:M::\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-mips64:
+:qemu-mips64el:M::\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-mips64el:
+:qemu-sh4:M::\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x2a\x00:\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-sh4:
+:qemu-sh4eb:M::\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x2a:\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-sh4eb:
+:qemu-s390x:M::\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x16:\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff:/usr/bin/qemu-s390x:
--- /dev/null
+# build-time settings that support --with or --without:
+#
+# = kvmonly =
+# Build only KVM-enabled QEMU targets, on KVM-enabled architectures.
+#
+# Disabled by default.
+#
+# = exclusive_x86_64 =
+# ExclusiveArch: x86_64
+#
+# Disabled by default, except on RHEL. Only makes sense with kvmonly.
+#
+# = rbd =
+# Enable rbd support.
+#
+# Enable by default, except on RHEL.
+
+%if 0%{?rhel}
+# RHEL-specific defaults:
+%bcond_without kvmonly # enabled
+%bcond_without exclusive_x86_64 # enabled
+%bcond_without spice # enabled
+%bcond_with seccomp # disabled
+%else
+# General defaults:
+%bcond_with kvmonly # disabled
+%bcond_with exclusive_x86_64 # disabled
+%bcond_without spice # enabled
+%bcond_without seccomp # enabled
+%endif
+
+%global SLOF_gittagdate 20120731
+
+%if %{with exclusive_x86_64}
+%global kvm_archs x86_64
+%else
+%global kvm_archs %{ix86} x86_64 ppc64 s390x
+%endif
+
+%ifarch %{ix86} x86_64
+%if %{with seccomp}
+%global have_seccomp 1
+%endif
+%if %{with spice}
+%global have_spice 1
+%endif
+%endif
+
+%global need_qemu_kvm %{with kvmonly}
+
+# These values for system_xyz are overridden below for non-kvmonly builds.
+# Instead, these values for kvm_package are overridden below for kvmonly builds.
+# Somewhat confusing, but avoids complicated nested conditionals.
+
+%ifarch %{ix86}
+%global system_x86 kvm
+%global kvm_package system-x86
+%global kvm_target i386
+%global need_qemu_kvm 1
+%endif
+%ifarch x86_64
+%global system_x86 kvm
+%global kvm_package system-x86
+%global kvm_target x86_64
+%global need_qemu_kvm 1
+%endif
+%ifarch ppc64
+%global system_ppc kvm
+%global kvm_package system-ppc
+%global kvm_target ppc64
+%endif
+%ifarch s390x
+%global system_s390x kvm
+%global kvm_package system-s390x
+%global kvm_target s390x
+%endif
+
+%if %{with kvmonly}
+# If kvmonly, put the qemu-kvm binary in the qemu-kvm package
+%global kvm_package kvm
+%else
+# If not kvmonly, build all packages and give them normal names. qemu-kvm
+# is a simple wrapper package and is only build for archs that support KVM.
+%global user user
+%global system_alpha system-alpha
+%global system_arm system-arm
+%global system_cris system-cris
+%global system_lm32 system-lm32
+%global system_m68k system-m68k
+%global system_microblaze system-microblaze
+%global system_mips system-mips
+%global system_or32 system-or32
+%global system_ppc system-ppc
+%global system_s390x system-s390x
+%global system_sh4 system-sh4
+%global system_sparc system-sparc
+%global system_x86 system-x86
+%global system_xtensa system-xtensa
+%global system_unicore32 system-unicore32
+%endif
+
+# libfdt is only needed to build ARM, Microblaze or PPC emulators
+%if 0%{?system_arm:1}%{?system_microblaze:1}%{?system_ppc:1}
+%global need_fdt 1
+%endif
+
+Summary: QEMU is a FAST! processor emulator
+Name: qemu
+Version: 1.2.0
+Release: 24%{?dist}
+# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
+Epoch: 2
+License: GPLv2+ and LGPLv2+ and BSD
+Group: Development/Tools
+URL: http://www.qemu.org/
+# RHEL will build Qemu only on x86_64:
+%if %{with kvmonly}
+ExclusiveArch: %{kvm_archs}
+%endif
+
+# OOM killer breaks builds with parallel make on s390(x)
+%ifarch s390 s390x
+%define _smp_mflags %{nil}
+%endif
+
+# This is generated from the git qemu-kvm-1.2.0 tag, replace with proper
+# upstream tarbal once available
+Source0: qemu-kvm-%{version}.tar.gz
+#Source0: http://downloads.sourceforge.net/sourceforge/kvm/qemu-kvm-%{version}.tar.gz
+
+Source1: qemu.binfmt
+
+# Loads kvm kernel modules at boot
+Source2: kvm.modules
+
+# Creates /dev/kvm
+Source3: 80-kvm.rules
+
+# KSM control scripts
+Source4: ksm.service
+Source5: ksm.sysconfig
+Source6: ksmctl.c
+Source7: ksmtuned.service
+Source8: ksmtuned
+Source9: ksmtuned.conf
+
+Source10: qemu-guest-agent.service
+Source11: 99-qemu-guest-agent.rules
+Source12: bridge.conf
+
+# Patches queued for 1.2.1 stable
+Patch0001: 0001-target-xtensa-convert-host-errno-values-to-guest.patch
+Patch0002: 0002-target-cris-Fix-buffer-overflow.patch
+Patch0003: 0003-target-xtensa-fix-missing-errno-codes-for-mingw32.patch
+Patch0004: 0004-target-sparc-fix-fcmp-s-d-q-instructions-wrt-excepti.patch
+Patch0005: 0005-target-s390x-fix-style.patch
+Patch0006: 0006-target-s390x-split-FPU-ops.patch
+Patch0007: 0007-target-s390x-split-condition-code-helpers.patch
+Patch0008: 0008-target-s390x-split-integer-helpers.patch
+Patch0009: 0009-target-s390x-split-memory-access-helpers.patch
+Patch0010: 0010-target-s390x-rename-op_helper.c-to-misc_helper.c.patch
+Patch0011: 0011-target-s390x-avoid-AREG0-for-FPU-helpers.patch
+Patch0012: 0012-target-s390x-avoid-AREG0-for-integer-helpers.patch
+Patch0013: 0013-target-s390x-avoid-AREG0-for-condition-code-helpers.patch
+Patch0014: 0014-target-s390x-avoid-AREG0-for-misc-helpers.patch
+Patch0015: 0015-target-s390x-switch-to-AREG0-free-mode.patch
+Patch0016: 0016-tcg-s390-fix-ld-st-with-CONFIG_TCG_PASS_AREG0.patch
+Patch0017: 0017-target-arm-Fix-potential-buffer-overflow.patch
+Patch0018: 0018-tcg-optimize-split-expression-simplification.patch
+Patch0019: 0019-tcg-optimize-simplify-or-xor-r-a-0-cases.patch
+Patch0020: 0020-tcg-optimize-simplify-and-r-a-0-cases.patch
+Patch0021: 0021-tcg-optimize-simplify-shift-rot-r-0-a-movi-r-0-cases.patch
+Patch0022: 0022-tcg-optimize-swap-brcond-setcond-arguments-when-poss.patch
+Patch0023: 0023-tcg-optimize-add-constant-folding-for-setcond.patch
+Patch0024: 0024-tcg-optimize-add-constant-folding-for-brcond.patch
+Patch0025: 0025-tcg-optimize-fix-if-else-break-coding-style.patch
+Patch0026: 0026-target-s390x-avoid-cpu_single_env.patch
+Patch0027: 0027-target-lm32-switch-to-AREG0-free-mode.patch
+Patch0028: 0028-target-m68k-switch-to-AREG0-free-mode.patch
+Patch0029: 0029-target-m68k-avoid-using-cpu_single_env.patch
+Patch0030: 0030-target-unicore32-switch-to-AREG0-free-mode.patch
+Patch0031: 0031-target-arm-convert-void-helpers.patch
+Patch0032: 0032-target-arm-convert-remaining-helpers.patch
+Patch0033: 0033-target-arm-final-conversion-to-AREG0-free-mode.patch
+Patch0034: 0034-target-microblaze-switch-to-AREG0-free-mode.patch
+Patch0035: 0035-target-cris-Avoid-AREG0-for-helpers.patch
+Patch0036: 0036-target-cris-Switch-to-AREG0-free-mode.patch
+Patch0037: 0037-target-sh4-switch-to-AREG0-free-mode.patch
+Patch0038: 0038-target-mips-switch-to-AREG0-free-mode.patch
+Patch0039: 0039-Remove-unused-CONFIG_TCG_PASS_AREG0-and-dead-code.patch
+Patch0040: 0040-tcg-i386-allow-constants-in-load-store-ops.patch
+Patch0041: 0041-tcg-mark-set_label-with-TCG_OPF_BB_END-flag.patch
+Patch0042: 0042-revert-TCG-fix-copy-propagation.patch
+Patch0043: 0043-target-mips-Set-opn-in-gen_ldst_multiple.patch
+Patch0044: 0044-target-mips-Fix-MIPS_DEBUG.patch
+Patch0045: 0045-target-mips-Always-evaluate-debugging-macro-argument.patch
+Patch0046: 0046-tcg-optimize-fix-end-of-basic-block-detection.patch
+Patch0047: 0047-target-xtensa-fix-extui-shift-amount.patch
+Patch0048: 0048-target-xtensa-don-t-emit-extra-tcg_gen_goto_tb.patch
+Patch0049: 0049-tcg-Introduce-movcond.patch
+Patch0050: 0050-target-alpha-Use-movcond.patch
+Patch0051: 0051-tcg-i386-Implement-movcond.patch
+Patch0052: 0052-tcg-Optimize-movcond-for-constant-comparisons.patch
+Patch0053: 0053-tcg-Optimize-two-address-commutative-operations.patch
+Patch0054: 0054-gdbstub-sh4-fix-build-with-USE_SOFTFLOAT_STRUCT_TYPE.patch
+Patch0055: 0055-tcg-Fix-USE_DIRECT_JUMP.patch
+Patch0056: 0056-tcg-hppa-Fix-brcond2-and-setcond2.patch
+Patch0057: 0057-tcg-hppa-Fix-broken-load-store-helpers.patch
+Patch0058: 0058-tcg-mips-fix-wrong-usage-of-Z-constraint.patch
+Patch0059: 0059-tcg-mips-kill-warnings-in-user-mode.patch
+Patch0060: 0060-tcg-mips-use-TCGArg-or-TCGReg-instead-of-int.patch
+Patch0061: 0061-tcg-mips-don-t-use-global-pointer.patch
+Patch0062: 0062-tcg-mips-use-stack-for-TCG-temps.patch
+Patch0063: 0063-tcg-mips-optimize-brcond-arg-0.patch
+Patch0064: 0064-tcg-mips-optimize-bswap-16-16s-32-on-MIPS32R2.patch
+Patch0065: 0065-tcg-mips-implement-rotl-rotr-ops-on-MIPS32R2.patch
+Patch0066: 0066-tcg-mips-implement-deposit-op-on-MIPS32R2.patch
+Patch0067: 0067-tcg-mips-implement-movcond-op-on-MIPS32R2.patch
+Patch0068: 0068-tcg-optimize-remove-TCG_TEMP_ANY.patch
+Patch0069: 0069-tcg-optimize-check-types-in-copy-propagation.patch
+Patch0070: 0070-tcg-optimize-rework-copy-progagation.patch
+Patch0071: 0071-tcg-optimize-do-copy-propagation-for-all-operations.patch
+Patch0072: 0072-tcg-optimize-optimize-op-r-a-a-mov-r-a.patch
+Patch0073: 0073-tcg-optimize-optimize-op-r-a-a-movi-r-0.patch
+Patch0074: 0074-tcg-optimize-further-optimize-brcond-movcond-setcond.patch
+Patch0075: 0075-tcg-optimize-prefer-the-op-a-a-b-form-for-commutativ.patch
+Patch0076: 0076-tcg-remove-ifdef-endif-around-TCGOpcode-tests.patch
+Patch0077: 0077-tcg-optimize-add-constant-folding-for-deposit.patch
+Patch0078: 0078-tcg-README-document-tcg_gen_goto_tb-restrictions.patch
+Patch0079: 0079-w64-Fix-TCG-helper-functions-with-5-arguments.patch
+Patch0080: 0080-tcg-ppc32-Implement-movcond32.patch
+Patch0081: 0081-tcg-sparc-Hack-in-qemu_ld-st64-for-32-bit.patch
+Patch0082: 0082-tcg-sparc-Fix-ADDX-opcode.patch
+Patch0083: 0083-tcg-sparc-Don-t-MAP_FIXED-on-top-of-the-program.patch
+Patch0084: 0084-tcg-sparc-Assume-v9-cpu-always-i.e.-force-v8plus-in-.patch
+Patch0085: 0085-tcg-sparc-Fix-qemu_ld-st-to-handle-32-bit-host.patch
+Patch0086: 0086-tcg-sparc-Support-GUEST_BASE.patch
+Patch0087: 0087-tcg-sparc-Change-AREG0-in-generated-code-to-i0.patch
+Patch0088: 0088-tcg-sparc-Clean-up-cruft-stemming-from-attempts-to-u.patch
+Patch0089: 0089-tcg-sparc-Mask-shift-immediates-to-avoid-illegal-ins.patch
+Patch0090: 0090-tcg-sparc-Use-defines-for-temporaries.patch
+Patch0091: 0091-tcg-sparc-Add-g-o-registers-to-alloc_order.patch
+Patch0092: 0092-tcg-sparc-Fix-and-enable-direct-TB-chaining.patch
+Patch0093: 0093-tcg-sparc-Preserve-branch-destinations-during-retran.patch
+Patch0094: 0094-target-alpha-Initialize-env-cpu_model_str.patch
+Patch0095: 0095-tcg-mips-fix-MIPS32-R2-detection.patch
+Patch0096: 0096-tcg-Adjust-descriptions-of-cond-opcodes.patch
+Patch0097: 0097-tcg-i386-fix-build-with-march-i686.patch
+Patch0098: 0098-tcg-Fix-MAX_OPC_PARAM_IARGS.patch
+Patch0099: 0099-tci-Fix-for-AREG0-free-mode.patch
+Patch0100: 0100-spice-abort-on-invalid-streaming-cmdline-params.patch
+Patch0101: 0101-spice-notify-spice-server-on-vm-start-stop.patch
+Patch0102: 0102-spice-notify-on-vm-state-change-only-via-spice_serve.patch
+Patch0103: 0103-spice-migration-add-QEVENT_SPICE_MIGRATE_COMPLETED.patch
+Patch0104: 0104-spice-add-migrated-flag-to-spice-info.patch
+Patch0105: 0105-spice-adding-seamless-migration-option-to-the-comman.patch
+Patch0106: 0106-spice-increase-the-verbosity-of-spice-section-in-qem.patch
+Patch0107: 0107-qxl-update_area_io-guest_bug-on-invalid-parameters.patch
+Patch0108: 0108-qxl-add-QXL_IO_MONITORS_CONFIG_ASYNC.patch
+Patch0109: 0109-configure-print-spice-protocol-and-spice-server-vers.patch
+Patch0110: 0110-fix-doc-of-using-raw-values-with-sendkey.patch
+Patch0111: 0111-qapi-Fix-potential-NULL-pointer-segfault.patch
+Patch0112: 0112-json-parser-Fix-potential-NULL-pointer-segfault.patch
+Patch0113: 0113-pcie-drop-version_id-field-for-live-migration.patch
+Patch0114: 0114-pcie_aer-clear-cmask-for-Advanced-Error-Interrupt-Me.patch
+Patch0115: 0115-fix-entry-pointer-for-ELF-kernels-loaded-with-kernel.patch
+Patch0116: 0116-lan9118-fix-multicast-filtering.patch
+Patch0117: 0117-MIPS-user-Fix-reset-CPU-state-initialization.patch
+Patch0118: 0118-Add-MAINTAINERS-entry-for-leon3.patch
+Patch0119: 0119-musicpal-Fix-flash-mapping.patch
+Patch0120: 0120-qemu-Use-valgrind-annotations-to-mark-kvm-guest-memo.patch
+Patch0121: 0121-hw-wm8750-Fix-potential-buffer-overflow.patch
+Patch0122: 0122-hw-mcf5206-Fix-buffer-overflow-for-MBAR-read-write.patch
+Patch0123: 0123-use-libexecdir-instead-of-ignoring-it-first-and-rein.patch
+Patch0124: 0124-socket-don-t-attempt-to-reconnect-a-TCP-socket-in-se.patch
+Patch0125: 0125-Add-ability-to-force-enable-disable-of-tools-build.patch
+Patch0126: 0126-usb-controllers-do-not-need-to-check-for-babble-them.patch
+Patch0127: 0127-usb-core-Don-t-set-packet-state-to-complete-on-a-nak.patch
+Patch0128: 0128-usb-core-Add-a-usb_ep_find_packet_by_id-helper-funct.patch
+Patch0129: 0129-usb-core-Allow-the-first-packet-of-a-pipelined-ep-to.patch
+Patch0130: 0130-Revert-ehci-don-t-flush-cache-on-doorbell-rings.patch
+Patch0131: 0131-ehci-Validate-qh-is-not-changed-unexpectedly-by-the-.patch
+Patch0132: 0132-ehci-Update-copyright-headers-to-reflect-recent-work.patch
+Patch0133: 0133-ehci-Properly-cleanup-packets-on-cancel.patch
+Patch0134: 0134-ehci-Properly-report-completed-but-not-yet-processed.patch
+Patch0135: 0135-ehci-check-for-EHCI_ASYNC_FINISHED-first-in-ehci_fre.patch
+Patch0136: 0136-ehci-trace-guest-bugs.patch
+Patch0137: 0137-ehci-add-doorbell-trace-events.patch
+Patch0138: 0138-ehci-Add-some-additional-ehci_trace_guest_bug-calls.patch
+Patch0139: 0139-ehci-Fix-memory-leak-in-handling-of-NAK-ed-packets.patch
+Patch0140: 0140-ehci-Handle-USB_RET_PROCERR-in-ehci_fill_queue.patch
+Patch0141: 0141-ehci-Correct-a-comment-in-fetchqtd-packet-processing.patch
+Patch0142: 0142-usb-redir-Never-return-USB_RET_NAK-for-async-handled.patch
+Patch0143: 0143-usb-redir-Don-t-delay-handling-of-open-events-to-a-b.patch
+Patch0144: 0144-usb-redir-Get-rid-of-async-struct-get-member.patch
+Patch0145: 0145-usb-redir-Get-rid-of-local-shadow-copy-of-packet-hea.patch
+Patch0146: 0146-usb-redir-Get-rid-of-unused-async-struct-dev-member.patch
+Patch0147: 0147-usb-redir-Move-to-core-packet-id-and-queue-handling.patch
+Patch0148: 0148-usb-redir-Return-babble-when-getting-more-bulk-data-.patch
+Patch0149: 0149-Better-name-usb-braille-device.patch
+Patch0150: 0150-usb-audio-fix-usb-version.patch
+Patch0151: 0151-xhci-rip-out-background-transfer-code.patch
+Patch0152: 0152-xhci-drop-buffering.patch
+Patch0153: 0153-xhci-fix-runtime-write-tracepoint.patch
+Patch0154: 0154-xhci-allow-bytewise-capability-register-reads.patch
+Patch0155: 0155-qxl-dont-update-invalid-area.patch
+Patch0156: 0156-usb-host-allow-emulated-non-async-control-requests-w.patch
+Patch0157: 0157-qxl-better-cleanup-for-surface-destroy.patch
+Patch0158: 0158-ehci-switch-to-new-style-memory-ops.patch
+Patch0159: 0159-ehci-Fix-interrupts-stopping-when-Interrupt-Threshol.patch
+Patch0160: 0160-ehci-Don-t-process-too-much-frames-in-1-timer-tick-v.patch
+Patch0161: 0161-sheepdog-fix-savevm-and-loadvm.patch
+Patch0162: 0162-ide-Fix-error-messages-from-static-code-analysis-no-.patch
+Patch0163: 0163-block-curl-Fix-wrong-free-statement.patch
+Patch0164: 0164-vdi-Fix-warning-from-clang.patch
+Patch0165: 0165-block-fix-block-tray-status.patch
+Patch0166: 0166-ahci-properly-reset-PxCMD-on-HBA-reset.patch
+Patch0167: 0167-Don-t-require-encryption-password-for-qemu-img-info-.patch
+Patch0168: 0168-block-Don-t-forget-to-delete-temporary-file.patch
+Patch0169: 0169-hw-qxl-tracing-fixes.patch
+Patch0170: 0170-configure-usbredir-fixes.patch
+Patch0171: 0171-ehci-Don-t-set-seen-to-0-when-removing-unseen-queue-.patch
+Patch0172: 0172-ehci-Walk-async-schedule-before-and-after-migration.patch
+Patch0173: 0173-usb-redir-Revert-usb-redir-part-of-commit-93bfef4c.patch
+Patch0174: 0174-uhci-Don-t-queue-up-packets-after-one-with-the-SPD-f.patch
+Patch0175: 0175-slirp-Remove-wrong-type-casts-ins-debug-statements.patch
+Patch0176: 0176-slirp-Fix-error-reported-by-static-code-analysis.patch
+Patch0177: 0177-slirp-improve-TFTP-performance.patch
+Patch0178: 0178-slirp-Handle-more-than-65535-blocks-in-TFTP-transfer.patch
+Patch0179: 0179-slirp-Implement-TFTP-Blocksize-option.patch
+Patch0180: 0180-srp-Don-t-use-QEMU_PACKED-for-single-elements-of-a-s.patch
+Patch0181: 0181-Spelling-fixes-in-comments-and-documentation.patch
+Patch0182: 0182-console-Clean-up-bytes-per-pixel-calculation.patch
+Patch0183: 0183-qapi-Fix-enumeration-typo-error.patch
+Patch0184: 0184-kvm-Fix-warning-from-static-code-analysis.patch
+Patch0185: 0185-arch_init.c-add-missing-symbols-before-PRIu64-in-deb.patch
+Patch0186: 0186-net-notify-iothread-after-flushing-queue.patch
+Patch0187: 0187-e1000-flush-queue-whenever-can_receive-can-go-from-f.patch
+Patch0188: 0188-xen-flush-queue-when-getting-an-event.patch
+Patch0189: 0189-eepro100-Fix-network-hang-when-rx-buffers-run-out.patch
+Patch0190: 0190-net-add-receive_disabled-logic-to-iov-delivery-path.patch
+Patch0191: 0191-net-do-not-report-queued-packets-as-sent.patch
+Patch0192: 0192-net-add-netdev-options-to-man-page.patch
+Patch0193: 0193-net-clean-up-usbnet_receive.patch
+Patch0194: 0194-net-fix-usbnet_receive-packet-drops.patch
+Patch0195: 0195-net-broadcast-hub-packets-if-at-least-one-port-can-r.patch
+Patch0196: 0196-net-asynchronous-send-receive-infrastructure-for-net.patch
+Patch0197: 0197-net-EAGAIN-handling-for-net-socket.c-UDP.patch
+Patch0198: 0198-net-EAGAIN-handling-for-net-socket.c-TCP.patch
+Patch0199: 0199-configure-fix-seccomp-check.patch
+Patch0200: 0200-configure-properly-check-if-lrt-and-lm-is-needed.patch
+Patch0201: 0201-Revert-455aa1e08-and-c3767ed0eb.patch
+Patch0202: 0202-qemu-char-BUGFIX-don-t-call-FD_ISSET-with-negative-f.patch
+Patch0203: 0203-cpu_physical_memory_write_rom-needs-to-do-TB-invalid.patch
+Patch0204: 0204-arch_init.c-Improve-soundhw-help-for-non-HAS_AUDIO_C.patch
+Patch0205: 0205-xilinx_timer-Removed-comma-in-device-name.patch
+Patch0206: 0206-xilinx_timer-Send-dbg-msgs-to-stderr-not-stdout.patch
+Patch0207: 0207-xilinx.h-Error-check-when-setting-links.patch
+Patch0208: 0208-xilinx_timer-Fix-a-compile-error-if-debug-enabled.patch
+Patch0209: 0209-pflash_cfi01-fix-vendor-specific-extended-query.patch
+Patch0210: 0210-MAINTAINERS-Add-entry-for-QOM-CPU.patch
+Patch0211: 0211-iSCSI-We-need-to-support-SG_IO-also-from-iscsi_ioctl.patch
+Patch0212: 0212-iSCSI-We-dont-need-to-explicitely-call-qemu_notify_e.patch
+Patch0213: 0213-scsi-disk-introduce-check_lba_range.patch
+Patch0214: 0214-scsi-disk-fix-check-for-out-of-range-LBA.patch
+Patch0215: 0215-SCSI-Standard-INQUIRY-data-should-report-HiSup-flag-.patch
+Patch0216: 0216-audio-Fix-warning-from-static-code-analysis.patch
+Patch0217: 0217-qemu-ga-Remove-unreachable-code-after-g_error.patch
+Patch0218: 0218-qemu-sockets-Fix-potential-memory-leak.patch
+Patch0219: 0219-cadence_uart-Fix-buffer-overflow.patch
+Patch0220: 0220-lm4549-Fix-buffer-overflow.patch
+Patch0221: 0221-ioh3420-Remove-unreachable-code.patch
+Patch0222: 0222-pflash_cfi01-Fix-warning-caused-by-unreachable-code.patch
+Patch0223: 0223-curses-don-t-initialize-curses-when-qemu-is-daemoniz.patch
+Patch0224: 0224-TextConsole-saturate-escape-parameter-in-TTY_STATE_C.patch
+Patch0225: 0225-linux-user-Remove-redundant-null-check-and-replace-f.patch
+Patch0226: 0226-net-socket-Fix-compiler-warning-regression-for-MinGW.patch
+Patch0227: 0227-w32-Always-use-standard-instead-of-native-format-str.patch
+Patch0228: 0228-w32-Add-implementation-of-gmtime_r-localtime_r.patch
+Patch0229: 0229-blockdev-preserve-readonly-and-snapshot-states-acros.patch
+Patch0230: 0230-block-correctly-set-the-keep_read_only-flag.patch
+Patch0231: 0231-configure-Allow-builds-without-any-system-or-user-em.patch
+Patch0232: 0232-Refactor-inet_connect_opts-function.patch
+Patch0233: 0233-Separate-inet_connect-into-inet_connect-blocking-and.patch
+Patch0234: 0234-Fix-address-handling-in-inet_nonblocking_connect.patch
+Patch0235: 0235-Clear-handler-only-for-valid-fd.patch
+Patch0236: 0236-pl190-fix-read-of-VECTADDR.patch
+Patch0237: 0237-hw-armv7m_nvic-Correctly-register-GIC-region-when-se.patch
+Patch0238: 0238-Versatile-Express-Fix-NOR-flash-0-address-and-remove.patch
+Patch0239: 0239-i386-kvm-bit-10-of-CPUID-8000_0001-.EDX-is-reserved.patch
+Patch0240: 0240-fpu-softfloat.c-Return-correctly-signed-values-from-.patch
+Patch0241: 0241-pseries-Don-t-test-for-MSR_PR-for-hypercalls-under-K.patch
+Patch0242: 0242-update-VERSION-for-v1.2.1.patch
+
+# The infamous chardev flow control patches
+Patch0400: 0400-char-Split-out-tcp-socket-close-code-in-a-separate-f.patch
+Patch0401: 0401-char-Add-a-QemuChrHandlers-struct-to-initialise-char.patch
+Patch0402: 0402-iohandlers-Add-enable-disable_write_fd_handler-funct.patch
+Patch0403: 0403-char-Add-framework-for-a-write-unblocked-callback.patch
+Patch0404: 0404-char-Update-send_all-to-handle-nonblocking-chardev-w.patch
+Patch0405: 0405-char-Equip-the-unix-tcp-backend-to-handle-nonblockin.patch
+Patch0406: 0406-char-Throttle-when-host-connection-is-down.patch
+Patch0407: 0407-virtio-console-Enable-port-throttling-when-chardev-i.patch
+Patch0408: 0408-spice-qemu-char.c-add-throttling.patch
+Patch0409: 0409-spice-qemu-char.c-remove-intermediate-buffer.patch
+Patch0410: 0410-usb-redir-Add-flow-control-support.patch
+# 411 superceded by 414 which does the same thing but on top of 413 that is
+# going upstream.
+Patch0412: 0412-char-Disable-write-callback-if-throttled-chardev-is-.patch
+Patch0413: 0413-hw-virtio-serial-bus-post_load-send_event-when-vm-is.patch
+Patch0414: 0414-hw-virtio-serial-bus-replay-guest-open-on-destinatio.patch
+
+# Spice features from upstream master: seamless migration & dynamic monitors
+Patch0500: 0500-qxl-disallow-unknown-revisions.patch
+Patch0501: 0501-spice-make-number-of-surfaces-runtime-configurable.patch
+Patch0502: 0502-qxl-Add-set_client_capabilities-interface-to-QXLInte.patch
+Patch0503: 0503-Remove-ifdef-QXL_COMMAND_FLAG_COMPAT_16BPP.patch
+Patch0504: 0504-spice-switch-to-queue-for-vga-mode-updates.patch
+Patch0505: 0505-spice-split-qemu_spice_create_update.patch
+Patch0506: 0506-spice-add-screen-mirror.patch
+Patch0507: 0507-spice-send-updates-only-for-changed-screen-content.patch
+Patch0508: 0508-qxl-Ignore-set_client_capabilities-pre-post-migrate.patch
+Patch0509: 0509-qxl-add-trace-event-for-QXL_IO_LOG.patch
+Patch0510: 0510-hw-qxl-support-client-monitor-configuration-via-devi.patch
+Patch0511: 0511-qxl-always-update-displaysurface-on-resize.patch
+Patch0512: 0512-qxl-update_area_io-cleanup-invalid-parameters-handli.patch
+Patch0513: 0513-qxl-fix-range-check-for-rev3-io-commands.patch
+Patch0514: 0514-hw-qxl-exit-on-failure-to-register-qxl-interface.patch
+Patch0515: 0515-hw-qxl-fix-condition-for-exiting-guest_bug.patch
+Patch0516: 0516-hw-qxl-qxl_dirty_surfaces-use-uintptr_t.patch
+Patch0517: 0517-spice-raise-requirement-to-0.12.patch
+Patch0518: 0518-qxl-set-default-revision-to-4.patch
+
+# usb-redir live-migration and misc bits, will be in before 1.3.0
+Patch0600: 0600-usb-redir-Convert-to-new-libusbredirparser-0.5-API.patch
+Patch0601: 0601-usb-redir-Set-ep-max_packet_size-if-available.patch
+Patch0602: 0602-usb-redir-Add-a-usbredir_reject_device-helper-functi.patch
+Patch0603: 0603-usb-redir-Ensure-our-peer-has-the-necessary-caps-whe.patch
+Patch0604: 0604-usb-redir-Enable-pipelining-for-bulk-endpoints.patch
+Patch0605: 0605-xhci-move-device-lookup-into-xhci_setup_packet.patch
+Patch0606: 0606-xhci-implement-mfindex.patch
+Patch0607: 0607-xhci-iso-xfer-support.patch
+Patch0608: 0608-xhci-trace-cc-codes-in-cleartext.patch
+Patch0609: 0609-xhci-add-trace_usb_xhci_ep_set_dequeue.patch
+Patch0610: 0610-xhci-update-register-layout.patch
+Patch0611: 0611-xhci-update-port-handling.patch
+Patch0612: 0612-usb3-superspeed-descriptors.patch
+Patch0613: 0613-usb3-superspeed-endpoint-companion.patch
+Patch0614: 0614-usb3-bos-decriptor.patch
+Patch0615: 0615-usb-storage-usb3-support.patch
+Patch0616: 0616-xhci-fix-cleanup-msi.patch
+Patch0617: 0617-xhci-rework-interrupt-handling.patch
+Patch0618: 0618-xhci-add-msix-support.patch
+Patch0619: 0619-xhci-move-register-update-into-xhci_intr_raise.patch
+Patch0620: 0620-xhci-add-XHCIInterrupter.patch
+Patch0621: 0621-xhci-prepare-xhci_runtime_-read-write-for-multiple-i.patch
+Patch0622: 0622-xhci-pick-target-interrupter.patch
+Patch0623: 0623-xhci-support-multiple-interrupters.patch
+Patch0624: 0624-xhci-kill-xhci_mem_-read-write-dispatcher-functions.patch
+Patch0625: 0625-usb-redir-Change-cancelled-packet-code-into-a-generi.patch
+Patch0626: 0626-usb-redir-Add-an-already_in_flight-packet-id-queue.patch
+Patch0627: 0627-usb-redir-Store-max_packet_size-in-endp_data.patch
+Patch0628: 0628-usb-redir-Add-support-for-migration.patch
+Patch0629: 0629-usb-redir-Add-chardev-open-close-debug-logging.patch
+Patch0630: 0630-usb-redir-Revert-usb-redir-part-of-commit-93bfef4c.patch
+Patch0631: 0631-ehci-Fix-interrupt-packet-MULT-handling.patch
+Patch0632: 0632-usb-redir-Adjust-pkg-config-check-for-usbredirparser.patch
+Patch0633: 0633-usb-redir-Change-usbredir_open_chardev-into-usbredir.patch
+Patch0634: 0634-usb-redir-Don-t-make-migration-fail-in-none-seamless.patch
+
+# Non upstream build fix, http://www.spinics.net/lists/kvm/msg80589.html
+Patch0800: 0800-mips-Fix-link-error-with-piix4_pm_init.patch
+# Add ./configure --disable-kvm-options
+# keep: Carrying locally until qemu-kvm is fully merged into qemu.git
+Patch0801: 0801-configure-Add-disable-kvm-options.patch
+# Fix loading arm initrd if kernel is very large (bz 862766)
+Patch802: 0802-arm_boot-Change-initrd-load-address-to-halfway-throu.patch
+# Don't use reserved word 'function' in systemtap files (bz 870972)
+Patch803: 0803-dtrace-backend-add-function-to-reserved-words.patch
+# Drop assertion that was triggering when pausing guests w/ qxl (bz
+# 870972)
+Patch804: 0804-wip-hw-qxl-inject-interrupts-in-any-state.patch
+# 38f419f (configure: Fix CONFIG_QEMU_HELPERDIR generation, 2012-10-17)
+Patch805: 0805-configure-Fix-CONFIG_QEMU_HELPERDIR-generation.patch
+
+BuildRequires: SDL-devel
+BuildRequires: zlib-devel
+BuildRequires: which
+BuildRequires: texi2html
+BuildRequires: gnutls-devel
+BuildRequires: cyrus-sasl-devel
+BuildRequires: libtool
+BuildRequires: libaio-devel
+BuildRequires: rsync
+BuildRequires: pciutils-devel
+BuildRequires: pulseaudio-libs-devel
+BuildRequires: ncurses-devel
+BuildRequires: libattr-devel
+BuildRequires: usbredir-devel >= 0.5.1
+BuildRequires: texinfo
+%if 0%{?have_spice:1}
+BuildRequires: spice-protocol >= 0.12.2
+BuildRequires: spice-server-devel >= 0.12.0
+%endif
+%if 0%{?have_seccomp:1}
+BuildRequires: libseccomp-devel >= 1.0.0
+%endif
+# For network block driver
+BuildRequires: libcurl-devel
+# For rbd block driver
+BuildRequires: ceph-devel
+# We need both because the 'stap' binary is probed for by configure
+BuildRequires: systemtap
+BuildRequires: systemtap-sdt-devel
+# For smartcard NSS support
+BuildRequires: nss-devel
+# For XFS discard support in raw-posix.c
+BuildRequires: xfsprogs-devel
+# For VNC JPEG support
+BuildRequires: libjpeg-devel
+# For VNC PNG support
+BuildRequires: libpng-devel
+# For uuid generation
+BuildRequires: libuuid-devel
+# For BlueZ device support
+BuildRequires: bluez-libs-devel
+# For Braille device support
+BuildRequires: brlapi-devel
+%if 0%{?need_fdt:1}
+# For FDT device tree support
+BuildRequires: libfdt-devel
+%endif
+# For test suite
+BuildRequires: check-devel
+# For virtfs
+BuildRequires: libcap-devel
+%if 0%{?user:1}
+Requires: %{name}-%{user} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_alpha:1}
+Requires: %{name}-%{system_alpha} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_arm:1}
+Requires: %{name}-%{system_arm} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_cris:1}
+Requires: %{name}-%{system_cris} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_lm32:1}
+Requires: %{name}-%{system_lm32} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_m68k:1}
+Requires: %{name}-%{system_m68k} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_microblaze:1}
+Requires: %{name}-%{system_microblaze} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_mips:1}
+Requires: %{name}-%{system_mips} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_or32:1}
+Requires: %{name}-%{system_or32} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_ppc:1}
+Requires: %{name}-%{system_ppc} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_s390x:1}
+Requires: %{name}-%{system_s390x} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_sh4:1}
+Requires: %{name}-%{system_sh4} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_sparc:1}
+Requires: %{name}-%{system_sparc} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_unicore32:1}
+Requires: %{name}-%{system_unicore32} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_x86:1}
+Requires: %{name}-%{system_x86} = %{epoch}:%{version}-%{release}
+%endif
+%if 0%{?system_xtensa:1}
+Requires: %{name}-%{system_xtensa} = %{epoch}:%{version}-%{release}
+%endif
+Requires: %{name}-img = %{epoch}:%{version}-%{release}
+
+%define qemudocdir %{_docdir}/%{name}
+
+%description
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation. QEMU has two operating modes:
+
+ * Full system emulation. In this mode, QEMU emulates a full system (for
+ example a PC), including a processor and various peripherials. It can be
+ used to launch different Operating Systems without rebooting the PC or
+ to debug system code.
+ * User mode emulation. In this mode, QEMU can launch Linux processes compiled
+ for one CPU on another CPU.
+
+As QEMU requires no host kernel patches to run, it is safe and easy to use.
+
+%if %{without kvmonly}
+%ifarch %{kvm_archs}
+%package kvm
+Summary: QEMU metapackage for KVM support
+Group: Development/Tools
+Requires: qemu-%{kvm_package} = %{epoch}:%{version}-%{release}
+
+%description kvm
+This is a meta-package that provides a qemu-system-<arch> package for native
+architectures where kvm can be enabled. For example, in an x86 system, this
+will install qemu-system-x86
+%endif
+%endif
+
+%package img
+Summary: QEMU command line tool for manipulating disk images
+Group: Development/Tools
+# librbd (from ceph) added new symbol rbd_flush recently. If you
+# update qemu-img without updating librdb you get:
+# qemu-img: undefined symbol: rbd_flush
+# ** NB ** This can be removed after Fedora 17 is released.
+Conflicts: ceph < 0.37-2
+
+%description img
+This package provides a command line tool for manipulating disk images
+
+%package common
+Summary: QEMU common files needed by all QEMU targets
+Group: Development/Tools
+Requires(post): /usr/bin/getent
+Requires(post): /usr/sbin/groupadd
+Requires(post): /usr/sbin/useradd
+%description common
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the common files needed by all QEMU targets
+
+%package guest-agent
+Summary: QEMU guest agent
+Group: System Environment/Daemons
+
+%description guest-agent
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides an agent to run inside guests, which communicates
+with the host over a virtio-serial channel named "org.qemu.guest_agent.0"
+
+This package does not need to be installed on the host OS.
+
+%post guest-agent
+if [ $1 -eq 1 ] ; then
+ # Initial installation.
+ /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+fi
+
+%preun guest-agent
+if [ $1 -eq 0 ] ; then
+ # Package removal, not upgrade.
+ /bin/systemctl stop qemu-guest-agent.service > /dev/null 2>&1 || :
+fi
+
+%postun guest-agent
+/bin/systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ] ; then
+ # Package upgrade, not uninstall.
+ /bin/systemctl try-restart qemu-guest-agent.service >/dev/null 2>&1 || :
+fi
+
+
+
+%if 0%{?user:1}
+%package %{user}
+Summary: QEMU user mode emulation of qemu targets
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{user}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the user mode emulation of qemu targets
+%endif
+
+%if 0%{?system_x86:1}
+%package %{system_x86}
+Summary: QEMU system emulator for x86
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+Provides: kvm = 85
+Obsoletes: kvm < 85
+Requires: vgabios >= 0.6c-2
+Requires: seabios-bin >= 0.6.0-2
+Requires: sgabios-bin
+Requires: ipxe-roms-qemu
+%if 0%{?have_seccomp:1}
+Requires: libseccomp >= 1.0.0
+%endif
+
+%description %{system_x86}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for x86. When being run in a x86
+machine that supports it, this package also provides the KVM virtualization
+platform.
+%endif
+
+%if 0%{?system_alpha:1}
+%package %{system_alpha}
+Summary: QEMU system emulator for Alpha
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_alpha}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for Alpha systems.
+%endif
+
+%if 0%{?system_arm:1}
+%package %{system_arm}
+Summary: QEMU system emulator for ARM
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_arm}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for ARM boards.
+%endif
+
+%if 0%{?system_mips:1}
+%package %{system_mips}
+Summary: QEMU system emulator for MIPS
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_mips}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for MIPS boards.
+%endif
+
+%if 0%{?system_cris:1}
+%package %{system_cris}
+Summary: QEMU system emulator for CRIS
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_cris}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for CRIS boards.
+%endif
+
+%if 0%{?system_lm32:1}
+%package %{system_lm32}
+Summary: QEMU system emulator for LatticeMico32
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_lm32}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for LatticeMico32 boards.
+%endif
+
+%if 0%{?system_m68k:1}
+%package %{system_m68k}
+Summary: QEMU system emulator for ColdFire (m68k)
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_m68k}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for ColdFire boards.
+%endif
+
+%if 0%{?system_microblaze:1}
+%package %{system_microblaze}
+Summary: QEMU system emulator for Microblaze
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_microblaze}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for Microblaze boards.
+%endif
+
+%if 0%{?system_or32:1}
+%package %{system_or32}
+Summary: QEMU system emulator for OpenRisc32
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_or32}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for OpenRisc32 boards.
+%endif
+
+%if 0%{?system_s390x:1}
+%package %{system_s390x}
+Summary: QEMU system emulator for S390
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_s390x}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for S390 systems.
+%endif
+
+%if 0%{?system_sh4:1}
+%package %{system_sh4}
+Summary: QEMU system emulator for SH4
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_sh4}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for SH4 boards.
+%endif
+
+%if 0%{?system_sparc:1}
+%package %{system_sparc}
+Summary: QEMU system emulator for SPARC
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+Requires: openbios
+%description %{system_sparc}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for SPARC and SPARC64 systems.
+%endif
+
+%if 0%{?system_ppc:1}
+%package %{system_ppc}
+Summary: QEMU system emulator for PPC
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+Requires: openbios
+Requires: SLOF = 0.1.git%{SLOF_gittagdate}
+%description %{system_ppc}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for PPC and PPC64 systems.
+%endif
+
+%if 0%{?system_xtensa:1}
+%package %{system_xtensa}
+Summary: QEMU system emulator for Xtensa
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_xtensa}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for Xtensa boards.
+%endif
+
+%if 0%{?system_unicore32:1}
+%package %{system_unicore32}
+Summary: QEMU system emulator for Unicore32
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_unicore32}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for Unicore32 boards.
+%endif
+
+%ifarch %{kvm_archs}
+%package kvm-tools
+Summary: KVM debugging and diagnostics tools
+Group: Development/Tools
+
+%description kvm-tools
+This package contains some diagnostics and debugging tools for KVM,
+such as kvm_stat.
+%endif
+
+%prep
+%setup -q -n qemu-kvm-%{version}
+
+%patch0001 -p1
+%patch0002 -p1
+%patch0003 -p1
+%patch0004 -p1
+%patch0005 -p1
+%patch0006 -p1
+%patch0007 -p1
+%patch0008 -p1
+%patch0009 -p1
+%patch0010 -p1
+%patch0011 -p1
+%patch0012 -p1
+%patch0013 -p1
+%patch0014 -p1
+%patch0015 -p1
+%patch0016 -p1
+%patch0017 -p1
+%patch0018 -p1
+%patch0019 -p1
+%patch0020 -p1
+%patch0021 -p1
+%patch0022 -p1
+%patch0023 -p1
+%patch0024 -p1
+%patch0025 -p1
+%patch0026 -p1
+%patch0027 -p1
+%patch0028 -p1
+%patch0029 -p1
+%patch0030 -p1
+%patch0031 -p1
+%patch0032 -p1
+%patch0033 -p1
+%patch0034 -p1
+%patch0035 -p1
+%patch0036 -p1
+%patch0037 -p1
+%patch0038 -p1
+%patch0039 -p1
+%patch0040 -p1
+%patch0041 -p1
+%patch0042 -p1
+%patch0043 -p1
+%patch0044 -p1
+%patch0045 -p1
+%patch0046 -p1
+%patch0047 -p1
+%patch0048 -p1
+%patch0049 -p1
+%patch0050 -p1
+%patch0051 -p1
+%patch0052 -p1
+%patch0053 -p1
+%patch0054 -p1
+%patch0055 -p1
+%patch0056 -p1
+%patch0057 -p1
+%patch0058 -p1
+%patch0059 -p1
+%patch0060 -p1
+%patch0061 -p1
+%patch0062 -p1
+%patch0063 -p1
+%patch0064 -p1
+%patch0065 -p1
+%patch0066 -p1
+%patch0067 -p1
+%patch0068 -p1
+%patch0069 -p1
+%patch0070 -p1
+%patch0071 -p1
+%patch0072 -p1
+%patch0073 -p1
+%patch0074 -p1
+%patch0075 -p1
+%patch0076 -p1
+%patch0077 -p1
+%patch0078 -p1
+%patch0079 -p1
+%patch0080 -p1
+%patch0081 -p1
+%patch0082 -p1
+%patch0083 -p1
+%patch0084 -p1
+%patch0085 -p1
+%patch0086 -p1
+%patch0087 -p1
+%patch0088 -p1
+%patch0089 -p1
+%patch0090 -p1
+%patch0091 -p1
+%patch0092 -p1
+%patch0093 -p1
+%patch0094 -p1
+%patch0095 -p1
+%patch0096 -p1
+%patch0097 -p1
+%patch0098 -p1
+%patch0099 -p1
+%patch0100 -p1
+%patch0101 -p1
+%patch0102 -p1
+%patch0103 -p1
+%patch0104 -p1
+%patch0105 -p1
+%patch0106 -p1
+%patch0107 -p1
+%patch0108 -p1
+%patch0109 -p1
+%patch0110 -p1
+%patch0111 -p1
+%patch0112 -p1
+%patch0113 -p1
+%patch0114 -p1
+%patch0115 -p1
+%patch0116 -p1
+%patch0117 -p1
+%patch0118 -p1
+%patch0119 -p1
+%patch0120 -p1
+%patch0121 -p1
+%patch0122 -p1
+%patch0123 -p1
+%patch0124 -p1
+%patch0125 -p1
+%patch0126 -p1
+%patch0127 -p1
+%patch0128 -p1
+%patch0129 -p1
+%patch0130 -p1
+%patch0131 -p1
+%patch0132 -p1
+%patch0133 -p1
+%patch0134 -p1
+%patch0135 -p1
+%patch0136 -p1
+%patch0137 -p1
+%patch0138 -p1
+%patch0139 -p1
+%patch0140 -p1
+%patch0141 -p1
+%patch0142 -p1
+%patch0143 -p1
+%patch0144 -p1
+%patch0145 -p1
+%patch0146 -p1
+%patch0147 -p1
+%patch0148 -p1
+%patch0149 -p1
+%patch0150 -p1
+%patch0151 -p1
+%patch0152 -p1
+%patch0153 -p1
+%patch0154 -p1
+%patch0155 -p1
+%patch0156 -p1
+%patch0157 -p1
+%patch0158 -p1
+%patch0159 -p1
+%patch0160 -p1
+%patch0161 -p1
+%patch0162 -p1
+%patch0163 -p1
+%patch0164 -p1
+%patch0165 -p1
+%patch0166 -p1
+%patch0167 -p1
+%patch0168 -p1
+%patch0169 -p1
+%patch0170 -p1
+%patch0171 -p1
+%patch0172 -p1
+%patch0173 -p1
+%patch0174 -p1
+%patch0175 -p1
+%patch0176 -p1
+%patch0177 -p1
+%patch0178 -p1
+%patch0179 -p1
+%patch0180 -p1
+%patch0181 -p1
+%patch0182 -p1
+%patch0183 -p1
+%patch0184 -p1
+%patch0185 -p1
+%patch0186 -p1
+%patch0187 -p1
+%patch0188 -p1
+%patch0189 -p1
+%patch0190 -p1
+%patch0191 -p1
+%patch0192 -p1
+%patch0193 -p1
+%patch0194 -p1
+%patch0195 -p1
+%patch0196 -p1
+%patch0197 -p1
+%patch0198 -p1
+%patch0199 -p1
+%patch0200 -p1
+%patch0201 -p1
+%patch0202 -p1
+%patch0203 -p1
+%patch0204 -p1
+%patch0205 -p1
+%patch0206 -p1
+%patch0207 -p1
+%patch0208 -p1
+%patch0209 -p1
+%patch0210 -p1
+%patch0211 -p1
+%patch0212 -p1
+%patch0213 -p1
+%patch0214 -p1
+%patch0215 -p1
+%patch0216 -p1
+%patch0217 -p1
+%patch0218 -p1
+%patch0219 -p1
+%patch0220 -p1
+%patch0221 -p1
+%patch0222 -p1
+%patch0223 -p1
+%patch0224 -p1
+%patch0225 -p1
+%patch0226 -p1
+%patch0227 -p1
+%patch0228 -p1
+%patch0229 -p1
+%patch0230 -p1
+%patch0231 -p1
+%patch0232 -p1
+%patch0233 -p1
+%patch0234 -p1
+%patch0235 -p1
+%patch0236 -p1
+%patch0237 -p1
+%patch0238 -p1
+%patch0239 -p1
+%patch0240 -p1
+%patch0241 -p1
+%patch0242 -p1
+
+%patch0400 -p1
+%patch0401 -p1
+%patch0402 -p1
+%patch0403 -p1
+%patch0404 -p1
+%patch0405 -p1
+%patch0406 -p1
+%patch0407 -p1
+%patch0408 -p1
+%patch0409 -p1
+%patch0410 -p1
+# 411 superceded by 414
+%patch0412 -p1
+%patch0413 -p1
+%patch0414 -p1
+
+%patch0500 -p1
+%patch0501 -p1
+%patch0502 -p1
+%patch0503 -p1
+%patch0504 -p1
+%patch0505 -p1
+%patch0506 -p1
+%patch0507 -p1
+%patch0508 -p1
+%patch0509 -p1
+%patch0510 -p1
+%patch0511 -p1
+%patch0512 -p1
+%patch0513 -p1
+%patch0514 -p1
+%patch0515 -p1
+%patch0516 -p1
+%patch0517 -p1
+%patch0518 -p1
+
+%patch0600 -p1
+%patch0601 -p1
+%patch0602 -p1
+%patch0603 -p1
+%patch0604 -p1
+%patch0605 -p1
+%patch0606 -p1
+%patch0607 -p1
+%patch0608 -p1
+%patch0609 -p1
+%patch0610 -p1
+%patch0611 -p1
+%patch0612 -p1
+%patch0613 -p1
+%patch0614 -p1
+%patch0615 -p1
+%patch0616 -p1
+%patch0617 -p1
+%patch0618 -p1
+%patch0619 -p1
+%patch0620 -p1
+%patch0621 -p1
+%patch0622 -p1
+%patch0623 -p1
+%patch0624 -p1
+%patch0625 -p1
+%patch0626 -p1
+%patch0627 -p1
+%patch0628 -p1
+%patch0629 -p1
+%patch0630 -p1
+%patch0631 -p1
+%patch0632 -p1
+%patch0633 -p1
+%patch0634 -p1
+
+%patch0800 -p1
+%patch0801 -p1
+%patch802 -p1
+%patch803 -p1
+%patch804 -p1
+%patch805 -p1
+
+%build
+%if %{with kvmonly}
+ buildarch="%{kvm_target}-softmmu"
+%else
+buildarch="i386-softmmu x86_64-softmmu alpha-softmmu arm-softmmu cris-softmmu \
+ lm32-softmmu m68k-softmmu microblaze-softmmu microblazeel-softmmu \
+ mips-softmmu mipsel-softmmu mips64-softmmu mips64el-softmmu \
+ or32-softmmu ppc-softmmu ppcemb-softmmu ppc64-softmmu s390x-softmmu \
+ sh4-softmmu sh4eb-softmmu sparc-softmmu sparc64-softmmu \
+ xtensa-softmmu xtensaeb-softmmu unicore32-softmmu \
+ i386-linux-user x86_64-linux-user alpha-linux-user arm-linux-user \
+ armeb-linux-user cris-linux-user m68k-linux-user \
+ microblaze-linux-user microblazeel-linux-user mips-linux-user \
+ mipsel-linux-user or32-linux-user ppc-linux-user ppc64-linux-user \
+ ppc64abi32-linux-user s390x-linux-user sh4-linux-user sh4eb-linux-user \
+ sparc-linux-user sparc64-linux-user sparc32plus-linux-user \
+ unicore32-linux-user"
+%endif
+
+# --build-id option is used for giving info to the debug packages.
+extraldflags="-Wl,--build-id";
+buildldflags="VL_LDFLAGS=-Wl,--build-id"
+
+%ifarch s390
+# drop -g flag to prevent memory exhaustion by linker
+%global optflags %(echo %{optflags} | sed 's/-g//')
+sed -i.debug 's/"-g $CFLAGS"/"$CFLAGS"/g' configure
+%endif
+
+
+dobuild() {
+ ./configure \
+ --prefix=%{_prefix} \
+ --sysconfdir=%{_sysconfdir} \
+ --interp-prefix=%{_prefix}/qemu-%%M \
+ --audio-drv-list=pa,sdl,alsa,oss \
+ --disable-strip \
+ --extra-ldflags="$extraldflags -pie -Wl,-z,relro -Wl,-z,now" \
+ --extra-cflags="%{optflags} -fPIE -DPIE" \
+%if 0%{?have_spice:1}
+ --enable-spice \
+%endif
+ --enable-mixemu \
+%if 0%{?have_seccomp:1}
+ --enable-seccomp \
+%endif
+ --enable-rbd \
+%if 0%{?need_fdt:1}
+ --enable-fdt \
+%else
+ --disable-fdt \
+%endif
+ --enable-trace-backend=dtrace \
+ --disable-werror \
+ --disable-xen \
+ --enable-kvm \
+ "$@"
+
+ echo "config-host.mak contents:"
+ echo "==="
+ cat config-host.mak
+ echo "==="
+
+ make V=1 %{?_smp_mflags} $buildldflags
+}
+
+# This is kind of confusing. We run ./configure + make twice here to
+# preserve some back compat: if on x86, we want to provide a qemu-kvm
+# binary that defaults to KVM=on. All other qemu-system* should be
+# able to use KVM, but default to KVM=off (upstream qemu semantics).
+#
+# Once qemu-kvm and qemu fully merge, and we base off qemu releases,
+# all qemu-system-* will default to KVM=off, so we hopefully won't need
+# to do these double builds. But then I'm not sure how we are going to
+# generate a back compat qemu-kvm binary...
+
+%if 0%{?need_qemu_kvm}
+# Build qemu-kvm back compat binary
+dobuild --target-list=%{kvm_target}-softmmu
+
+# Setup back compat qemu-kvm binary which defaults to KVM=on
+./scripts/tracetool.py --backend dtrace --format stap \
+ --binary %{_bindir}/qemu-kvm --target-arch %{kvm_target} --target-type system \
+ --probe-prefix qemu.kvm < ./trace-events > qemu-kvm.stp
+
+cp -a %{kvm_target}-softmmu/qemu-system-%{kvm_target} qemu-kvm
+
+%endif
+
+%if %{without kvmonly}
+%if 0%{?need_qemu_kvm}
+make clean
+%endif
+
+# Build qemu-system-* with consistent default of kvm=off
+dobuild --target-list="$buildarch" --disable-kvm-options
+%endif
+
+gcc %{SOURCE6} -O2 -g -o ksmctl
+
+
+%install
+
+%define _udevdir /lib/udev/rules.d
+
+install -D -p -m 0644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/ksm
+
+install -D -p -m 0755 %{SOURCE8} $RPM_BUILD_ROOT%{_sbindir}/ksmtuned
+install -D -p -m 0644 %{SOURCE9} $RPM_BUILD_ROOT%{_sysconfdir}/ksmtuned.conf
+
+%ifarch %{kvm_archs}
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/modules
+mkdir -p $RPM_BUILD_ROOT%{_bindir}/
+mkdir -p $RPM_BUILD_ROOT%{_udevdir}
+
+install -m 0755 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/modules/kvm.modules
+install -m 0755 scripts/kvm/kvm_stat $RPM_BUILD_ROOT%{_bindir}/
+install -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_udevdir}
+%endif
+
+make DESTDIR=$RPM_BUILD_ROOT install
+
+%if 0%{?need_qemu_kvm}
+mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}
+mkdir -p $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset
+
+install -m 0755 qemu-kvm $RPM_BUILD_ROOT%{_bindir}/
+install -m 0644 qemu-kvm.stp $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/
+%endif
+
+%if %{with kvmonly}
+rm $RPM_BUILD_ROOT%{_bindir}/qemu-system-%{kvm_target}
+rm $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/qemu-system-%{kvm_target}.stp
+%endif
+
+chmod -x ${RPM_BUILD_ROOT}%{_mandir}/man1/*
+install -D -p -m 0644 -t ${RPM_BUILD_ROOT}%{qemudocdir} Changelog README TODO COPYING COPYING.LIB LICENSE
+
+install -D -p -m 0644 qemu.sasl $RPM_BUILD_ROOT%{_sysconfdir}/sasl2/qemu.conf
+
+# Provided by package openbios
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/openbios-ppc
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/openbios-sparc32
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/openbios-sparc64
+# Provided by package SLOF
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/slof.bin
+
+# Remove possibly unpackaged files. Unlike others that are removed
+# unconditionally, these firmware files are still distributed as a binary
+# together with the qemu package. We should try to move at least s390-zipl.rom
+# to a separate package... Discussed here on the packaging list:
+# https://lists.fedoraproject.org/pipermail/packaging/2012-July/008563.html
+%if 0%{!?system_alpha:1}
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/palcode-clipper
+%endif
+%if 0%{!?system_microblaze:1}
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/petalogix*.dtb
+%endif
+%if 0%{!?system_ppc:1}
+rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}/bamboo.dtb
+rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}/ppc_rom.bin
+rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}/spapr-rtas.bin
+%endif
+%if 0%{!?system_s390x:1}
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/s390-zipl.rom
+%endif
+
+# Provided by package ipxe
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/pxe*rom
+# Provided by package vgabios
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/vgabios*bin
+# Provided by package seabios
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/bios.bin
+# Provided by package sgabios
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/sgabios.bin
+
+%if 0%{?system_x86:1}
+# the pxe gpxe images will be symlinks to the images on
+# /usr/share/ipxe, as QEMU doesn't know how to look
+# for other paths, yet.
+pxe_link() {
+ ln -s ../ipxe/$2.rom %{buildroot}%{_datadir}/%{name}/pxe-$1.rom
+}
+
+pxe_link e1000 8086100e
+pxe_link ne2k_pci 10ec8029
+pxe_link pcnet 10222000
+pxe_link rtl8139 10ec8139
+pxe_link virtio 1af41000
+
+rom_link() {
+ ln -s $1 %{buildroot}%{_datadir}/%{name}/$2
+}
+
+rom_link ../vgabios/VGABIOS-lgpl-latest.bin vgabios.bin
+rom_link ../vgabios/VGABIOS-lgpl-latest.cirrus.bin vgabios-cirrus.bin
+rom_link ../vgabios/VGABIOS-lgpl-latest.qxl.bin vgabios-qxl.bin
+rom_link ../vgabios/VGABIOS-lgpl-latest.stdvga.bin vgabios-stdvga.bin
+rom_link ../vgabios/VGABIOS-lgpl-latest.vmware.bin vgabios-vmware.bin
+rom_link ../seabios/bios.bin bios.bin
+rom_link ../sgabios/sgabios.bin sgabios.bin
+%endif
+
+%if 0%{?user:1}
+mkdir -p $RPM_BUILD_ROOT%{_exec_prefix}/lib/binfmt.d
+for i in dummy \
+%ifnarch %{ix86} x86_64
+ qemu-i386 \
+%endif
+%ifnarch alpha
+ qemu-alpha \
+%endif
+%ifnarch arm
+ qemu-arm \
+%endif
+ qemu-armeb \
+%ifnarch mips
+ qemu-mips qemu-mipsn32 qemu-mips64 \
+%endif
+%ifnarch mipsel
+ qemu-mipsel qemu-mipsn32el qemu-mips64el \
+%endif
+%ifnarch m68k
+ qemu-m68k \
+%endif
+%ifnarch ppc ppc64
+ qemu-ppc \
+%endif
+%ifnarch sparc sparc64
+ qemu-sparc \
+%endif
+%ifnarch s390 s390x
+ qemu-s390x \
+%endif
+%ifnarch sh4
+ qemu-sh4 \
+%endif
+ qemu-sh4eb \
+; do
+ test $i = dummy && continue
+ grep /$i:\$ %{SOURCE1} > $RPM_BUILD_ROOT%{_exec_prefix}/lib/binfmt.d/$i.conf
+ chmod 644 $RPM_BUILD_ROOT%{_exec_prefix}/lib/binfmt.d/$i.conf
+done < %{SOURCE1}
+%endif
+
+# For the qemu-guest-agent subpackage install the systemd
+# service and udev rules.
+mkdir -p $RPM_BUILD_ROOT%{_udevdir}
+install -m 0644 %{SOURCE11} $RPM_BUILD_ROOT%{_udevdir}
+
+# Install rules to use the bridge helper with libvirt's virbr0
+install -m 0644 %{SOURCE12} $RPM_BUILD_ROOT%{_sysconfdir}/qemu
+chmod u+s $RPM_BUILD_ROOT%{_libexecdir}/qemu-bridge-helper
+
+%check
+make check
+
+%ifarch %{kvm_archs}
+%post %{kvm_package}
+# load kvm modules now, so we can make sure no reboot is needed.
+# If there's already a kvm module installed, we don't mess with it
+sh %{_sysconfdir}/sysconfig/modules/kvm.modules || :
+udevadm trigger --sysname-match=kvm || :
+%endif
+
+%post common
+if [ $1 -eq 1 ] ; then
+ # Initial installation
+ /bin/systemctl enable ksm.service >/dev/null 2>&1 || :
+ /bin/systemctl enable ksmtuned.service >/dev/null 2>&1 || :
+fi
+
+getent group kvm >/dev/null || groupadd -g 36 -r kvm
+getent group qemu >/dev/null || groupadd -g 107 -r qemu
+getent passwd qemu >/dev/null || \
+ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
+ -c "qemu user" qemu
+
+%preun common
+if [ $1 -eq 0 ] ; then
+ # Package removal, not upgrade
+ /bin/systemctl --no-reload disable ksmtuned.service > /dev/null 2>&1 || :
+ /bin/systemctl --no-reload disable ksm.service > /dev/null 2>&1 || :
+ /bin/systemctl stop ksmtuned.service > /dev/null 2>&1 || :
+ /bin/systemctl stop ksm.service > /dev/null 2>&1 || :
+fi
+
+%postun common
+/bin/systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ] ; then
+ # Package upgrade, not uninstall
+ /bin/systemctl try-restart ksmtuned.service >/dev/null 2>&1 || :
+ /bin/systemctl try-restart ksm.service >/dev/null 2>&1 || :
+fi
+
+
+%global kvm_files \
+%{_sysconfdir}/sysconfig/modules/kvm.modules \
+%{_udevdir}/80-kvm.rules
+
+%if 0%{?need_qemu_kvm}
+%global qemu_kvm_files \
+%{_bindir}/qemu-kvm \
+%{_datadir}/systemtap/tapset/qemu-kvm.stp
+%endif
+
+%files
+%defattr(-,root,root)
+
+%ifarch %{kvm_archs}
+%files kvm
+%defattr(-,root,root)
+%endif
+
+%files common
+%defattr(-,root,root)
+%dir %{qemudocdir}
+%doc %{qemudocdir}/Changelog
+%doc %{qemudocdir}/README
+%doc %{qemudocdir}/TODO
+%doc %{qemudocdir}/qemu-doc.html
+%doc %{qemudocdir}/qemu-tech.html
+%doc %{qemudocdir}/qmp-commands.txt
+%doc %{qemudocdir}/COPYING
+%doc %{qemudocdir}/COPYING.LIB
+%doc %{qemudocdir}/LICENSE
+%dir %{_datadir}/%{name}/
+%{_datadir}/%{name}/keymaps/
+%{_mandir}/man1/qemu.1*
+%{_mandir}/man1/virtfs-proxy-helper.1*
+%{_mandir}/man8/qemu-nbd.8*
+%{_bindir}/qemu-nbd
+%{_bindir}/virtfs-proxy-helper
+%{_libexecdir}/qemu-bridge-helper
+%config(noreplace) %{_sysconfdir}/sasl2/qemu.conf
+%config(noreplace) %{_sysconfdir}/sysconfig/ksm
+%{_sbindir}/ksmtuned
+%config(noreplace) %{_sysconfdir}/ksmtuned.conf
+%dir %{_sysconfdir}/qemu
+%config(noreplace) %{_sysconfdir}/qemu/bridge.conf
+
+%files guest-agent
+%defattr(-,root,root,-)
+%doc COPYING README
+%{_bindir}/qemu-ga
+%{_udevdir}/99-qemu-guest-agent.rules
+
+%if 0%{?user:1}
+%files %{user}
+%defattr(-,root,root)
+%{_exec_prefix}/lib/binfmt.d/qemu-*.conf
+%{_bindir}/qemu-i386
+%{_bindir}/qemu-x86_64
+%{_bindir}/qemu-alpha
+%{_bindir}/qemu-arm
+%{_bindir}/qemu-armeb
+%{_bindir}/qemu-cris
+%{_bindir}/qemu-m68k
+%{_bindir}/qemu-microblaze
+%{_bindir}/qemu-microblazeel
+%{_bindir}/qemu-mips
+%{_bindir}/qemu-mipsel
+%{_bindir}/qemu-or32
+%{_bindir}/qemu-ppc
+%{_bindir}/qemu-ppc64
+%{_bindir}/qemu-ppc64abi32
+%{_bindir}/qemu-s390x
+%{_bindir}/qemu-sh4
+%{_bindir}/qemu-sh4eb
+%{_bindir}/qemu-sparc
+%{_bindir}/qemu-sparc32plus
+%{_bindir}/qemu-sparc64
+%{_bindir}/qemu-unicore32
+%{_datadir}/systemtap/tapset/qemu-i386.stp
+%{_datadir}/systemtap/tapset/qemu-x86_64.stp
+%{_datadir}/systemtap/tapset/qemu-alpha.stp
+%{_datadir}/systemtap/tapset/qemu-arm.stp
+%{_datadir}/systemtap/tapset/qemu-armeb.stp
+%{_datadir}/systemtap/tapset/qemu-cris.stp
+%{_datadir}/systemtap/tapset/qemu-m68k.stp
+%{_datadir}/systemtap/tapset/qemu-microblaze.stp
+%{_datadir}/systemtap/tapset/qemu-microblazeel.stp
+%{_datadir}/systemtap/tapset/qemu-mips.stp
+%{_datadir}/systemtap/tapset/qemu-mipsel.stp
+%{_datadir}/systemtap/tapset/qemu-or32.stp
+%{_datadir}/systemtap/tapset/qemu-ppc.stp
+%{_datadir}/systemtap/tapset/qemu-ppc64.stp
+%{_datadir}/systemtap/tapset/qemu-ppc64abi32.stp
+%{_datadir}/systemtap/tapset/qemu-s390x.stp
+%{_datadir}/systemtap/tapset/qemu-sh4.stp
+%{_datadir}/systemtap/tapset/qemu-sh4eb.stp
+%{_datadir}/systemtap/tapset/qemu-sparc.stp
+%{_datadir}/systemtap/tapset/qemu-sparc32plus.stp
+%{_datadir}/systemtap/tapset/qemu-sparc64.stp
+%{_datadir}/systemtap/tapset/qemu-unicore32.stp
+%endif
+
+%if 0%{?system_x86:1}
+%files %{system_x86}
+%defattr(-,root,root)
+%if %{without kvmonly}
+%{_bindir}/qemu-system-i386
+%{_bindir}/qemu-system-x86_64
+%{_datadir}/systemtap/tapset/qemu-system-i386.stp
+%{_datadir}/systemtap/tapset/qemu-system-x86_64.stp
+%endif
+%{_datadir}/%{name}/bios.bin
+%{_datadir}/%{name}/sgabios.bin
+%{_datadir}/%{name}/linuxboot.bin
+%{_datadir}/%{name}/multiboot.bin
+%{_datadir}/%{name}/kvmvapic.bin
+%{_datadir}/%{name}/vgabios.bin
+%{_datadir}/%{name}/vgabios-cirrus.bin
+%{_datadir}/%{name}/vgabios-qxl.bin
+%{_datadir}/%{name}/vgabios-stdvga.bin
+%{_datadir}/%{name}/vgabios-vmware.bin
+%{_datadir}/%{name}/pxe-e1000.rom
+%{_datadir}/%{name}/pxe-virtio.rom
+%{_datadir}/%{name}/pxe-pcnet.rom
+%{_datadir}/%{name}/pxe-rtl8139.rom
+%{_datadir}/%{name}/pxe-ne2k_pci.rom
+%{_datadir}/%{name}/cpus-x86_64.conf
+%{_datadir}/%{name}/qemu-icon.bmp
+%config(noreplace) %{_sysconfdir}/qemu/target-x86_64.conf
+%ifarch %{ix86} x86_64
+%{?kvm_files:}
+%{?qemu_kvm_files:}
+%endif
+%endif
+
+%ifarch %{kvm_archs}
+%files kvm-tools
+%defattr(-,root,root,-)
+%{_bindir}/kvm_stat
+%endif
+
+%if 0%{?system_alpha:1}
+%files %{system_alpha}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-alpha
+%{_datadir}/systemtap/tapset/qemu-system-alpha.stp
+%{_datadir}/%{name}/palcode-clipper
+%endif
+
+%if 0%{?system_arm:1}
+%files %{system_arm}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-arm
+%{_datadir}/systemtap/tapset/qemu-system-arm.stp
+%endif
+
+%if 0%{?system_mips:1}
+%files %{system_mips}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-mips
+%{_bindir}/qemu-system-mipsel
+%{_bindir}/qemu-system-mips64
+%{_bindir}/qemu-system-mips64el
+%{_datadir}/systemtap/tapset/qemu-system-mips.stp
+%{_datadir}/systemtap/tapset/qemu-system-mipsel.stp
+%{_datadir}/systemtap/tapset/qemu-system-mips64el.stp
+%{_datadir}/systemtap/tapset/qemu-system-mips64.stp
+%endif
+
+%if 0%{?system_cris:1}
+%files %{system_cris}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-cris
+%{_datadir}/systemtap/tapset/qemu-system-cris.stp
+%endif
+
+%if 0%{?system_lm32:1}
+%files %{system_lm32}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-lm32
+%{_datadir}/systemtap/tapset/qemu-system-lm32.stp
+%endif
+
+%if 0%{?system_m68k:1}
+%files %{system_m68k}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-m68k
+%{_datadir}/systemtap/tapset/qemu-system-m68k.stp
+%endif
+
+%if 0%{?system_microblaze:1}
+%files %{system_microblaze}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-microblaze
+%{_bindir}/qemu-system-microblazeel
+%{_datadir}/systemtap/tapset/qemu-system-microblaze.stp
+%{_datadir}/systemtap/tapset/qemu-system-microblazeel.stp
+%{_datadir}/%{name}/petalogix*.dtb
+%endif
+
+%if 0%{?system_or32:1}
+%files %{system_or32}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-or32
+%{_datadir}/systemtap/tapset/qemu-system-or32.stp
+%endif
+
+%if 0%{?system_s390x:1}
+%files %{system_s390x}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-s390x
+%{_datadir}/systemtap/tapset/qemu-system-s390x.stp
+%{_datadir}/%{name}/s390-zipl.rom
+%ifarch s390x
+%{?kvm_files:}
+%{?qemu_kvm_files:}
+%endif
+%endif
+
+%if 0%{?system_sh4:1}
+%files %{system_sh4}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-sh4
+%{_bindir}/qemu-system-sh4eb
+%{_datadir}/systemtap/tapset/qemu-system-sh4.stp
+%{_datadir}/systemtap/tapset/qemu-system-sh4eb.stp
+%endif
+
+%if 0%{?system_sparc:1}
+%files %{system_sparc}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-sparc
+%{_bindir}/qemu-system-sparc64
+%{_datadir}/systemtap/tapset/qemu-system-sparc.stp
+%{_datadir}/systemtap/tapset/qemu-system-sparc64.stp
+%endif
+
+%if 0%{?system_ppc:1}
+%files %{system_ppc}
+%defattr(-,root,root)
+%if %{without kvmonly}
+%{_bindir}/qemu-system-ppc
+%{_bindir}/qemu-system-ppc64
+%{_bindir}/qemu-system-ppcemb
+%{_datadir}/systemtap/tapset/qemu-system-ppc.stp
+%{_datadir}/systemtap/tapset/qemu-system-ppc64.stp
+%{_datadir}/systemtap/tapset/qemu-system-ppcemb.stp
+%endif
+%{_datadir}/%{name}/bamboo.dtb
+%{_datadir}/%{name}/ppc_rom.bin
+%{_datadir}/%{name}/spapr-rtas.bin
+%ifarch ppc64
+%{?kvm_files:}
+%{?qemu_kvm_files:}
+%endif
+%endif
+
+%if 0%{?system_unicore32:1}
+%files %{system_unicore32}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-unicore32
+%{_datadir}/systemtap/tapset/qemu-system-unicore32.stp
+%endif
+
+%if 0%{?system_xtensa:1}
+%files %{system_xtensa}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-xtensa
+%{_bindir}/qemu-system-xtensaeb
+%{_datadir}/systemtap/tapset/qemu-system-xtensa.stp
+%{_datadir}/systemtap/tapset/qemu-system-xtensaeb.stp
+%endif
+
+%files img
+%defattr(-,root,root)
+%{_bindir}/qemu-img
+%{_bindir}/qemu-io
+%{_bindir}/vscclient
+%{_mandir}/man1/qemu-img.1*
+
+%changelog
+* Thu Aug 22 2013 Mirantis Product <product@mirantis.com> - 2:1.2.0-24
+- remove systemd stuff not needed for Centos
+- lower usbredir req to >= 0.5.1
+- unconditionally enable rbd
+
+* Tue Nov 17 2012 Alon Levy <alevy@redhat.com> - 2:1.2.0-23
+- Rewrite fix for bz #725965 based on fix for bz #867366
+- Resolve bz #867366
+
+* Fri Nov 16 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-22
+- Fix previous commit
+
+* Fri Nov 16 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-21
+- Backport commit 38f419f (configure: Fix CONFIG_QEMU_HELPERDIR generation,
+ 2012-10-17)
+
+* Thu Nov 15 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-20
+- Install qemu-bridge-helper as suid root
+- Distribute a sample /etc/qemu/bridge.conf file
+
+* Thu Nov 1 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-19
+- Sync spice patches with upstream, minor bugfixes and set the qxl pci
+ device revision to 4 by default, so that guests know they can use
+ the new features
+
+* Tue Oct 30 2012 Cole Robinson <crobinso@redhat.com> - 2:1.2.0-18
+- Fix loading arm initrd if kernel is very large (bz #862766)
+- Don't use reserved word 'function' in systemtap files (bz #870972)
+- Drop assertion that was triggering when pausing guests w/ qxl (bz
+ #870972)
+
+* Sun Oct 28 2012 Cole Robinson <crobinso@redhat.com> - 2:1.2.0-17
+- Pull patches queued for qemu 1.2.1
+
+* Fri Oct 19 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-16
+- add s390x KVM support
+- distribute pre-built firmware or device trees for Alpha, Microblaze, S390
+- add missing system targets
+- add missing linux-user targets
+- fix previous commit
+
+* Thu Oct 18 2012 Dan Horák <dan[at]danny.cz> - 2:1.2.0-15
+- fix build on non-kvm arches like s390(x)
+
+* Wed Oct 17 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-14
+- Change SLOF Requires for the new version number
+
+* Thu Oct 11 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-13
+- Add ppc support to kvm.modules (original patch by David Gibson)
+- Replace x86only build with kvmonly build: add separate defines and
+ conditionals for all packages, so that they can be chosen and
+ renamed in kvmonly builds and so that qemu has the appropriate requires
+- Automatically pick libfdt dependancy
+- Add knob to disable spice+seccomp
+
+* Fri Sep 28 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-12
+- Call udevadm on post, fixing bug 860658
+
+* Fri Sep 28 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-11
+- Rebuild against latest spice-server and spice-protocol
+- Fix non-seamless migration failing with vms with usb-redir devices,
+ to allow boxes to load such vms from disk
+
+* Tue Sep 25 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-10
+- Sync Spice patchsets with upstream (rhbz#860238)
+- Fix building with usbredir >= 0.5.2
+
+* Thu Sep 20 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-9
+- Sync USB and Spice patchsets with upstream
+
+* Sun Sep 16 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-8
+- Use 'global' instead of 'define', and underscore in definition name,
+ n-v-r, and 'dist' tag of SLOF, all to fix RHBZ#855252.
+
+* Fri Sep 14 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-4
+- add versioned dependency from qemu-system-ppc to SLOF (BZ#855252)
+
+* Wed Sep 12 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-3
+- Fix RHBZ#853408 which causes libguestfs failure.
+
+* Sat Sep 8 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-2
+- Fix crash on (seamless) migration
+- Sync usbredir live migration patches with upstream
+
+* Fri Sep 7 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-1
+- New upstream release 1.2.0 final
+- Add support for Spice seamless migration
+- Add support for Spice dynamic monitors
+- Add support for usb-redir live migration
+
+* Tue Sep 04 2012 Adam Jackson <ajax@redhat.com> 1.2.0-0.5.rc1
+- Flip Requires: ceph >= foo to Conflicts: ceph < foo, so we pull in only the
+ libraries which we need and not the rest of ceph which we don't.
+
+* Tue Aug 28 2012 Cole Robinson <crobinso@redhat.com> 1.2.0-0.4.rc1
+- Update to 1.2.0-rc1
+
+* Mon Aug 20 2012 Richard W.M. Jones <rjones@redhat.com> - 1.2-0.3.20120806git3e430569
+- Backport Bonzini's vhost-net fix (RHBZ#848400).
+
+* Tue Aug 14 2012 Cole Robinson <crobinso@redhat.com> - 1.2-0.2.20120806git3e430569
+- Bump release number, previous build forgot but the dist bump helped us out
+
+* Tue Aug 14 2012 Cole Robinson <crobinso@redhat.com> - 1.2-0.1.20120806git3e430569
+- Revive qemu-system-{ppc*, sparc*} (bz 844502)
+- Enable KVM support for all targets (bz 844503)
+
+* Mon Aug 06 2012 Cole Robinson <crobinso@redhat.com> - 1.2-0.1.20120806git3e430569.fc18
+- Update to git snapshot
+
+* Sun Jul 29 2012 Cole Robinson <crobinso@redhat.com> - 1.1.1-1
+- Upstream stable release 1.1.1
+- Fix systemtap tapsets (bz 831763)
+- Fix VNC audio tunnelling (bz 840653)
+- Don't renable ksm on update (bz 815156)
+- Bump usbredir dep (bz 812097)
+- Fix RPM install error on non-virt machines (bz 660629)
+- Obsolete openbios to fix upgrade dependency issues (bz 694802)
+
+* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:1.1.0-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Tue Jul 10 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-8
+- Re-diff previous patch so that it applies and actually apply it
+
+* Tue Jul 10 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-7
+- Add patch to fix default machine options. This fixes libvirt
+ detection of qemu.
+- Back out patch 1 which conflicts.
+
+* Fri Jul 6 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.1.0-5
+- Fix qemu crashing (on an assert) whenever USB-2.0 isoc transfers are used
+
+* Thu Jul 5 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-4
+- Disable tests since they hang intermittently.
+- Add kvmvapic.bin (replaces vapic.bin).
+- Add cpus-x86_64.conf. qemu now creates /etc/qemu/target-x86_64.conf
+ as an empty file.
+- Add qemu-icon.bmp.
+- Add qemu-bridge-helper.
+- Build and include virtfs-proxy-helper + man page (thanks Hans de Goede).
+
+* Wed Jul 4 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.1.0-1
+- New upstream release 1.1.0
+- Drop about a 100 spice + USB patches, which are all upstream
+
+* Mon Apr 23 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.0-17
+- Fix install failure due to set -e (rhbz #815272)
+
+* Mon Apr 23 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.0-16
+- Fix kvm.modules to exit successfully on non-KVM capable systems (rhbz #814932)
+
+* Thu Apr 19 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.0-15
+- Add a couple of backported QXL/Spice bugfixes
+- Add spice volume control patches
+
+* Fri Apr 6 2012 Paolo Bonzini <pbonzini@redhat.com> - 2:1.0-12
+- Add back PPC and SPARC user emulators
+- Update binfmt rules from upstream
+
+* Mon Apr 2 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.0-11
+- Some more USB bugfixes from upstream
+
+* Thu Mar 29 2012 Eduardo Habkost <ehabkost@redhat.com> - 2:1.0-12
+- Fix ExclusiveArch mistake that disabled all non-x86_64 builds on Fedora
+
+* Wed Mar 28 2012 Eduardo Habkost <ehabkost@redhat.com> - 2:1.0-11
+- Use --with variables for build-time settings
+
+* Wed Mar 28 2012 Daniel P. Berrange <berrange@redhat.com> - 2:1.0-10
+- Switch to use iPXE for netboot ROMs
+
+* Thu Mar 22 2012 Daniel P. Berrange <berrange@redhat.com> - 2:1.0-9
+- Remove O_NOATIME for 9p filesystems
+
+* Mon Mar 19 2012 Daniel P. Berrange <berrange@redhat.com> - 2:1.0-8
+- Move udev rules to /lib/udev/rules.d (rhbz #748207)
+
+* Fri Mar 9 2012 Hans de Goede <hdegoede@redhat.com> - 2:1.0-7
+- Add a whole bunch of USB bugfixes from upstream
+
+* Mon Feb 13 2012 Daniel P. Berrange <berrange@redhat.com> - 2:1.0-6
+- Add many more missing BRs for misc QEMU features
+- Enable running of test suite during build
+
+* Tue Feb 07 2012 Justin M. Forbes <jforbes@redhat.com> - 2:1.0-5
+- Add support for virtio-scsi
+
+* Sun Feb 5 2012 Richard W.M. Jones <rjones@redhat.com> - 2:1.0-4
+- Require updated ceph for latest librbd with rbd_flush symbol.
+
+* Tue Jan 24 2012 Justin M. Forbes <jforbes@redhat.com> - 2:1.0-3
+- Add support for vPMU
+- e1000: bounds packet size against buffer size CVE-2012-0029
+
+* Fri Jan 13 2012 Justin M. Forbes <jforbes@redhat.com> - 2:1.0-2
+- Add patches for USB redirect bits
+- Remove palcode-clipper, we don't build it
+
+* Wed Jan 11 2012 Justin M. Forbes <jforbes@redhat.com> - 2:1.0-1
+- Add patches from 1.0.1 queue
+
+* Fri Dec 16 2011 Justin M. Forbes <jforbes@redhat.com> - 2:1.0-1
+- Update to qemu 1.0
+
+* Tue Nov 15 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-3
+- Enable spice for i686 users as well
+
+* Thu Nov 03 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-2
+- Fix POSTIN scriplet failure (#748281)
+
+* Fri Oct 21 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-1
+- Require seabios-bin >= 0.6.0-2 (#741992)
+- Replace init scripts with systemd units (#741920)
+- Update to 0.15.1 stable upstream
+
+* Fri Oct 21 2011 Paul Moore <pmoore@redhat.com>
+- Enable full relro and PIE (rhbz #738812)
+
+* Wed Oct 12 2011 Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-6
+- Add BR on ceph-devel to enable RBD block device
+
+* Wed Oct 5 2011 Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-5
+- Create a qemu-guest-agent sub-RPM for guest installation
+
+* Tue Sep 13 2011 Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-4
+- Enable DTrace tracing backend for SystemTAP (rhbz #737763)
+- Enable build with curl (rhbz #737006)
+
+* Thu Aug 18 2011 Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-3
+- Add missing BuildRequires: usbredir-devel, so that the usbredir code
+ actually gets build
+
+* Thu Aug 18 2011 Richard W.M. Jones <rjones@redhat.com> - 2:0.15.0-2
+- Add upstream qemu patch 'Allow to leave type on default in -machine'
+ (2645c6dcaf6ea2a51a3b6dfa407dd203004e4d11).
+
+* Sun Aug 14 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.0-1
+- Update to 0.15.0 stable release.
+
+* Thu Aug 04 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.0-0.3.201108040af4922
+- Update to 0.15.0-rc1 as we prepare for 0.15.0 release
+
+* Thu Aug 4 2011 Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-0.3.2011072859fadcc
+- Fix default accelerator for non-KVM builds (rhbz #724814)
+
+* Thu Jul 28 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.0-0.1.2011072859fadcc
+- Update to 0.15.0-rc0 as we prepare for 0.15.0 release
+
+* Tue Jul 19 2011 Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-0.2.20110718525e3df
+- Add support usb redirection over the network, see:
+ http://fedoraproject.org/wiki/Features/UsbNetworkRedirection
+- Restore chardev flow control patches
+
+* Mon Jul 18 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.15.0-0.1.20110718525e3df
+- Update to git snapshot as we prepare for 0.15.0 release
+
+* Wed Jun 22 2011 Richard W.M. Jones <rjones@redhat.com> - 2:0.14.0-9
+- Add BR libattr-devel. This caused the -fstype option to be disabled.
+ https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017
+
+* Mon May 2 2011 Hans de Goede <hdegoede@redhat.com> - 2:0.14.0-8
+- Fix a bug in the spice flow control patches which breaks the tcp chardev
+
+* Tue Mar 29 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-7
+- Disable qemu-ppc and qemu-sparc packages (#679179)
+
+* Mon Mar 28 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-6
+- Spice fixes for flow control.
+
+* Tue Mar 22 2011 Dan Horák <dan[at]danny.cz> - 2:0.14.0-5
+- be more careful when removing the -g flag on s390
+
+* Fri Mar 18 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-4
+- Fix thinko on adding the most recent patches.
+
+* Wed Mar 16 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-3
+- Fix migration issue with vhost
+- Fix qxl locking issues for spice
+
+* Wed Mar 02 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-2
+- Re-enable sparc and cris builds
+
+* Thu Feb 24 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-1
+- Update to 0.14.0 release
+
+* Fri Feb 11 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110210git7aa8c46
+- Update git snapshot
+- Temporarily disable qemu-cris and qemu-sparc due to build errors (to be resolved shorly)
+
+* Tue Feb 08 2011 Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110208git3593e6b
+- Update to 0.14.0 rc git snapshot
+- Add virtio-net to modules
+
+* Wed Nov 3 2010 Daniel P. Berrange <berrange@redhat.com> - 2:0.13.0-2
+- Revert previous change
+- Make qemu-common own the /etc/qemu directory
+- Add /etc/qemu/target-x86_64.conf to qemu-system-x86 regardless
+ of host architecture.
+
+* Wed Nov 03 2010 Dan Horák <dan[at]danny.cz> - 2:0.13.0-2
+- Remove kvm config file on non-x86 arches (part of #639471)
+- Own the /etc/qemu directory
+
+* Mon Oct 18 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-1
+- Update to 0.13.0 upstream release
+- Fixes for vhost
+- Fix mouse in certain guests (#636887)
+- Fix issues with WinXP guest install (#579348)
+- Resolve build issues with S390 (#639471)
+- Fix Windows XP on Raw Devices (#631591)
+
+* Tue Oct 05 2010 jkeating - 2:0.13.0-0.7.rc1.1
+- Rebuilt for gcc bug 634757
+
+* Tue Sep 21 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.7.rc1
+- Flip qxl pci id from unstable to stable (#634535)
+- KSM Fixes from upstream (#558281)
+
+* Tue Sep 14 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.6.rc1
+- Move away from git snapshots as 0.13 is close to release
+- Updates for spice 0.6
+
+* Tue Aug 10 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.5.20100809git25fdf4a
+- Fix typo in e1000 gpxe rom requires.
+- Add links to newer vgabios
+
+* Tue Aug 10 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.4.20100809git25fdf4a
+- Disable spice on 32bit, it is not supported and buildreqs don't exist.
+
+* Mon Aug 9 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.3.20100809git25fdf4a
+- Updates from upstream towards 0.13 stable
+- Fix requires on gpxe
+- enable spice now that buildreqs are in the repository.
+- ksmtrace has moved to a separate upstream package
+
+* Tue Jul 27 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.2.20100727gitb81fe95
+- add texinfo buildreq for manpages.
+
+* Tue Jul 27 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.1.20100727gitb81fe95
+- Update to 0.13.0 upstream snapshot
+- ksm init fixes from upstream
+
+* Tue Jul 20 2010 Dan Horák <dan[at]danny.cz> - 2:0.12.3-8
+- Add avoid-llseek patch from upstream needed for building on s390(x)
+- Don't use parallel make on s390(x)
+
+* Tue Jun 22 2010 Amit Shah <amit.shah@redhat.com> - 2:0.12.3-7
+- Add vvfat hardening patch from upstream (#605202)
+
+* Fri Apr 23 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
+- Change requires to the noarch seabios-bin
+- Add ownership of docdir to qemu-common (#572110)
+- Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)
+
+* Thu Apr 15 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-5
+- Update virtio console patches from upstream
+
+* Mon Mar 11 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-4
+- Detect cdrom via ioctl (#473154)
+- re add increased buffer for USB control requests (#546483)
+
+* Wed Mar 10 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-3
+- Migration clear the fd in error cases (#518032)
+
+* Tue Mar 09 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-2
+- Allow builds --with x86only
+- Add libaio-devel buildreq for aio support
+
+* Fri Feb 26 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-1
+- Update to 0.12.3 upstream
+- vhost-net migration/restart fixes
+- Add F-13 machine type
+- virtio-serial fixes
+
+* Tue Feb 09 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-6
+- Add vhost net support.
+
+* Thu Feb 04 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-5
+- Avoid creating too large iovecs in multiwrite merge (#559717)
+- Don't try to set max_kernel_pages during ksm init on newer kernels (#558281)
+- Add logfile options for ksmtuned debug.
+
+* Wed Jan 27 2010 Amit Shah <amit.shah@redhat.com> - 2:0.12.2-4
+- Remove build dependency on iasl now that we have seabios
+
+* Wed Jan 27 2010 Amit Shah <amit.shah@redhat.com> - 2:0.12.2-3
+- Remove source target for 0.12.1.2
+
+* Wed Jan 27 2010 Amit Shah <amit.shah@redhat.com> - 2:0.12.2-2
+- Add virtio-console patches from upstream for the F13 VirtioSerial feature
+
+* Mon Jan 25 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-1
+- Update to 0.12.2 upstream
+
+* Fri Jan 10 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.1.2-3
+- Point to seabios instead of bochs, and add a requires for seabios
+
+* Mon Jan 4 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.1.2-2
+- Remove qcow2 virtio backing file patch
+
+* Mon Jan 4 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.1.2-1
+- Update to 0.12.1.2 upstream
+- Remove patches included in upstream
+
+* Fri Nov 20 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
+- Fix a use-after-free crasher in the slirp code (#539583)
+- Fix overflow in the parallels image format support (#533573)
+
+* Wed Nov 4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-11
+- Temporarily disable preadv/pwritev support to fix data corruption (#526549)
+
+* Tue Nov 3 2009 Justin M. Forbes <jforbes@redhat.com> - 2:0.11.0-10
+- Default ksm and ksmtuned services on.
+
+* Thu Oct 29 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-9
+- Fix dropped packets with non-virtio NICs (#531419)
+
+* Wed Oct 21 2009 Glauber Costa <gcosta@redhat.com> - 2:0.11.0-8
+- Properly save kvm time registers (#524229)
+
+* Mon Oct 19 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-7
+- Fix potential segfault from too small MSR_COUNT (#528901)
+
+* Fri Oct 9 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
+- Fix fs errors with virtio and qcow2 backing file (#524734)
+- Fix ksm initscript errors on kernel missing ksm (#527653)
+- Add missing Requires(post): getent, useradd, groupadd (#527087)
+
+* Tue Oct 6 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-5
+- Add 'retune' verb to ksmtuned init script
+
+* Mon Oct 5 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-4
+- Use rtl8029 PXE rom for ne2k_pci, not ne (#526777)
+- Also, replace the gpxe-roms-qemu pkg requires with file-based requires
+
+* Thu Oct 1 2009 Justin M. Forbes <jmforbes@redhat.com> - 2:0.11.0-3
+- Improve error reporting on file access (#524695)
+
+* Mon Sep 28 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-2
+- Fix pci hotplug to not exit if supplied an invalid NIC model (#524022)
+
+* Mon Sep 28 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-1
+- Update to 0.11.0 release
+- Drop a couple of upstreamed patches
+
+* Wed Sep 23 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-5
+- Fix issue causing NIC hotplug confusion when no model is specified (#524022)
+
+* Wed Sep 16 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-4
+- Fix for KSM patch from Justin Forbes
+
+* Wed Sep 16 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-3
+- Add ksmtuned, also from Dan Kenigsberg
+- Use %_initddir macro
+
+* Wed Sep 16 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-2
+- Add ksm control script from Dan Kenigsberg
+
+* Mon Sep 7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
+- Update to qemu-kvm-0.11.0-rc2
+- Drop upstreamed patches
+- extboot install now fixed upstream
+- Re-place TCG init fix (#516543) with the one gone upstream
+
+* Mon Sep 7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.10.rc1
+- Fix MSI-X error handling on older kernels (#519787)
+
+* Fri Sep 4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.9.rc1
+- Make pulseaudio the default audio backend (#519540, #495964, #496627)
+
+* Thu Aug 20 2009 Richard W.M. Jones <rjones@redhat.com> - 2:0.10.91-0.8.rc1
+- Fix segfault when qemu-kvm is invoked inside a VM (#516543)
+
+* Tue Aug 18 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.7.rc1
+- Fix permissions on udev rules (#517571)
+
+* Mon Aug 17 2009 Lubomir Rintel <lkundrak@v3.sk> - 2:0.10.91-0.6.rc1
+- Allow blacklisting of kvm modules (#517866)
+
+* Fri Aug 7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.5.rc1
+- Fix virtio_net with -net user (#516022)
+
+* Tue Aug 4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.4.rc1
+- Update to qemu-kvm-0.11-rc1; no changes from rc1-rc0
+
+* Tue Aug 4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.3.rc1.rc0
+- Fix extboot checksum (bug #514899)
+
+* Fri Jul 31 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.2.rc1.rc0
+- Add KSM support
+- Require bochs-bios >= 2.3.8-0.8 for latest kvm bios updates
+
+* Thu Jul 30 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.1.rc1.rc0
+- Update to qemu-kvm-0.11.0-rc1-rc0
+- This is a pre-release of the official -rc1
+- A vista installer regression is blocking the official -rc1 release
+- Drop qemu-prefer-sysfs-for-usb-host-devices.patch
+- Drop qemu-fix-build-for-esd-audio.patch
+- Drop qemu-slirp-Fix-guestfwd-for-incoming-data.patch
+- Add patch to ensure extboot.bin is installed
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:0.10.50-14.kvm88
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Thu Jul 23 2009 Glauber Costa <glommer@redhat.com> - 2:0.10.50-13.kvm88
+- Fix bug 513249, -net channel option is broken
+
+* Thu Jul 16 2009 Daniel P. Berrange <berrange@redhat.com> - 2:0.10.50-12.kvm88
+- Add 'qemu' user and group accounts
+- Force disable xen until it can be made to build
+
+* Thu Jul 16 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-11.kvm88
+- Update to kvm-88, see http://www.linux-kvm.org/page/ChangeLog
+- Package mutiboot.bin
+- Update for how extboot is built
+- Fix sf.net source URL
+- Drop qemu-fix-ppc-softmmu-kvm-disabled-build.patch
+- Drop qemu-fix-pcspk-build-with-kvm-disabled.patch
+- Cherry-pick fix for esound support build failure
+
+* Wed Jul 15 2009 Daniel Berrange <berrange@lettuce.camlab.fab.redhat.com> - 2:0.10.50-10.kvm87
+- Add udev rules to make /dev/kvm world accessible & group=kvm (rhbz #497341)
+- Create a kvm group if it doesn't exist (rhbz #346151)
+
+* Tue Jul 07 2009 Glauber Costa <glommer@redhat.com> - 2:0.10.50-9.kvm87
+- use pxe roms from gpxe, instead of etherboot package.
+
+* Fri Jul 3 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-8.kvm87
+- Prefer sysfs over usbfs for usb passthrough (#508326)
+
+* Sat Jun 27 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
+- Update to kvm-87
+- Drop upstreamed patches
+- Cherry-pick new ppc build fix from upstream
+- Work around broken linux-user build on ppc
+- Fix hw/pcspk.c build with --disable-kvm
+- Re-enable preadv()/pwritev() since #497429 is long since fixed
+- Kill petalogix-s3adsp1800.dtb, since we don't ship the microblaze target
+
+* Fri Jun 5 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
+- Fix 'kernel requires an x86-64 CPU' error
+- BuildRequires ncurses-devel to enable '-curses' option (#504226)
+
+* Wed Jun 3 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-5.kvm86
+- Prevent locked cdrom eject - fixes hang at end of anaconda installs (#501412)
+- Avoid harmless 'unhandled wrmsr' warnings (#499712)
+
+* Thu May 21 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-4.kvm86
+- Update to kvm-86 release
+- ChangeLog here: http://marc.info/?l=kvm&m=124282885729710
+
+* Fri May 1 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-3.kvm85
+- Really provide qemu-kvm as a metapackage for comps
+
+* Tue Apr 28 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-2.kvm85
+- Provide qemu-kvm as a metapackage for comps
+
+* Mon Apr 27 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-1.kvm85
+- Update to qemu-kvm-devel-85
+- kvm-85 is based on qemu development branch, currently version 0.10.50
+- Include new qemu-io utility in qemu-img package
+- Re-instate -help string for boot=on to fix virtio booting with libvirt
+- Drop upstreamed patches
+- Fix missing kernel/include/asm symlink in upstream tarball
+- Fix target-arm build
+- Fix build on ppc
+- Disable preadv()/pwritev() until bug #497429 is fixed
+- Kill more .kernelrelease uselessness
+- Make non-kvm qemu build verbose
+
+* Fri Apr 24 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-15
+- Fix source numbering typos caused by make-release addition
+
+* Thu Apr 23 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-14
+- Improve instructions for generating the tarball
+
+* Tue Apr 21 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-13
+- Enable pulseaudio driver to fix qemu lockup at shutdown (#495964)
+
+* Tue Apr 21 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-12
+- Another qcow2 image corruption fix (#496642)
+
+* Mon Apr 20 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-11
+- Fix qcow2 image corruption (#496642)
+
+* Sun Apr 19 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-10
+- Run sysconfig.modules from %post on x86_64 too (#494739)
+
+* Sun Apr 19 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-9
+- Align VGA ROM to 4k boundary - fixes 'qemu-kvm -std vga' (#494376)
+
+* Tue Apr 14 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-8
+- Provide qemu-kvm conditional on the architecture.
+
+* Thu Apr 9 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-7
+- Add a much cleaner fix for vga segfault (#494002)
+
+* Sun Apr 5 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-6
+- Fixed qcow2 segfault creating disks over 2TB. #491943
+
+* Fri Apr 3 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-5
+- Fix vga segfault under kvm-autotest (#494002)
+- Kill kernelrelease hack; it's not needed
+- Build with "make V=1" for more verbose logs
+
+* Thu Apr 02 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-4
+- Support botting gpxe roms.
+
+* Wed Apr 01 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-2
+- added missing patch. love for CVS.
+
+* Wed Apr 01 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-1
+- Include debuginfo for qemu-img
+- Do not require qemu-common for qemu-img
+- Explicitly own each of the firmware files
+- remove firmwares for ppc and sparc. They should be provided by an external package.
+ Not that the packages exists for sparc in the secondary arch repo as noarch, but they
+ don't automatically get into main repos. Unfortunately it's the best we can do right
+ now.
+- rollback a bit in time. Snapshot from avi's maint/2.6.30
+ - this requires the sasl patches to come back.
+ - with-patched-kernel comes back.
+
+* Wed Mar 25 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10-0.12.kvm20090323git
+- BuildRequires pciutils-devel for device assignment (#492076)
+
+* Mon Mar 23 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.11.kvm20090323git
+- Update to snapshot kvm20090323.
+- Removed patch2 (upstream).
+- use upstream's new split package.
+- --with-patched-kernel flag not needed anymore
+- Tell how to get the sources.
+
+* Wed Mar 18 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.10.kvm20090310git
+- Added extboot to files list.
+
+* Wed Mar 11 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.9.kvm20090310git
+- Fix wrong reference to bochs bios.
+
+* Wed Mar 11 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.8.kvm20090310git
+- fix Obsolete/Provides pair
+- Use kvm bios from bochs-bios package.
+- Using RPM_OPT_FLAGS in configure
+- Picked back audio-drv-list from kvm package
+
+* Tue Mar 10 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.7.kvm20090310git
+- modify ppc patch
+
+* Tue Mar 10 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.6.kvm20090310git
+- updated to kvm20090310git
+- removed sasl patches (already in this release)
+
+* Tue Mar 10 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.5.kvm20090303git
+- kvm.modules were being wrongly mentioned at %%install.
+- update description for the x86 system package to include kvm support
+- build kvm's own bios. It is still necessary while kvm uses a slightly different
+ irq routing mechanism
+
+* Thu Mar 05 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.4.kvm20090303git
+- seems Epoch does not go into the tags. So start back here.
+
+* Thu Mar 05 2009 Glauber Costa <glommer@redhat.com> - 2:0.10-0.1.kvm20090303git
+- Use bochs-bios instead of bochs-bios-data
+- It's official: upstream set on 0.10
+
+* Thu Mar 5 2009 Daniel P. Berrange <berrange@redhat.com> - 2:0.9.2-0.2.kvm20090303git
+- Added BSD to license list, since many files are covered by BSD
+
+* Wed Mar 04 2009 Glauber Costa <glommer@redhat.com> - 0.9.2-0.1.kvm20090303git
+- missing a dot. shame on me
+
+* Wed Mar 04 2009 Glauber Costa <glommer@redhat.com> - 0.92-0.1.kvm20090303git
+- Set Epoch to 2
+- Set version to 0.92. It seems upstream keep changing minds here, so pick the lowest
+- Provides KVM, Obsoletes KVM
+- Only install qemu-kvm in ix86 and x86_64
+- Remove pkgdesc macros, as they were generating bogus output for rpm -qi.
+- fix ppc and ppc64 builds
+
+* Tue Mar 03 2009 Glauber Costa <glommer@redhat.com> - 0.10-0.3.kvm20090303git
+- only execute post scripts for user package.
+- added kvm tools.
+
+* Tue Mar 03 2009 Glauber Costa <glommer@redhat.com> - 0.10-0.2.kvm20090303git
+- put kvm.modules into cvs
+
+* Tue Mar 03 2009 Glauber Costa <glommer@redhat.com> - 0.10-0.1.kvm20090303git
+- Set Epoch to 1
+- Build KVM (basic build, no tools yet)
+- Set ppc in ExcludeArch. This is temporary, just to fix one issue at a time.
+ ppc users (IBM ? ;-)) please wait a little bit.
+
+* Tue Mar 3 2009 Daniel P. Berrange <berrange@redhat.com> - 1.0-0.5.svn6666
+- Support VNC SASL authentication protocol
+- Fix dep on bochs-bios-data
+
+* Tue Mar 03 2009 Glauber Costa <glommer@redhat.com> - 1.0-0.4.svn6666
+- use bios from bochs-bios package.
+
+* Tue Mar 03 2009 Glauber Costa <glommer@redhat.com> - 1.0-0.3.svn6666
+- use vgabios from vgabios package.
+
+* Mon Mar 02 2009 Glauber Costa <glommer@redhat.com> - 1.0-0.2.svn6666
+- use pxe roms from etherboot package.
+
+* Mon Mar 02 2009 Glauber Costa <glommer@redhat.com> - 1.0-0.1.svn6666
+- Updated to tip svn (release 6666). Featuring split packages for qemu.
+ Unfortunately, still using binary blobs for the bioses.
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.1-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Sun Jan 11 2009 Debarshi Ray <rishi@fedoraproject.org> - 0.9.1-12
+- Updated build patch. Closes Red Hat Bugzilla bug #465041.
+
+* Wed Dec 31 2008 Dennis Gilmore <dennis@ausil.us> - 0.9.1-11
+- add sparcv9 and sparc64 support
+
+* Fri Jul 25 2008 Bill Nottingham <notting@redhat.com>
+- Fix qemu-img summary (#456344)
+
+* Wed Jun 25 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-10.fc10
+- Rebuild for GNU TLS ABI change
+
+* Wed Jun 11 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-9.fc10
+- Remove bogus wildcard from files list (rhbz #450701)
+
+* Sat May 17 2008 Lubomir Rintel <lkundrak@v3.sk> - 0.9.1-8
+- Register binary handlers also for shared libraries
+
+* Mon May 5 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-7.fc10
+- Fix text console PTYs to be in rawmode
+
+* Sun Apr 27 2008 Lubomir Kundrak <lkundrak@redhat.com> - 0.9.1-6
+- Register binary handler for SuperH-4 CPU
+
+* Wed Mar 19 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-5.fc9
+- Split qemu-img tool into sub-package for smaller footprint installs
+
+* Wed Feb 27 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-4.fc9
+- Fix block device checks for extendable disk formats (rhbz #435139)
+
+* Sat Feb 23 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-3.fc9
+- Fix block device extents check (rhbz #433560)
+
+* Mon Feb 18 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 0.9.1-2
+- Autorebuild for GCC 4.3
+
+* Tue Jan 8 2008 Daniel P. Berrange <berrange@redhat.com> - 0.9.1-1.fc9
+- Updated to 0.9.1 release
+- Fix license tag syntax
+- Don't mark init script as a config file
+
+* Wed Sep 26 2007 Daniel P. Berrange <berrange@redhat.com> - 0.9.0-5.fc8
+- Fix rtl8139 checksum calculation for Vista (rhbz #308201)
+
+* Tue Aug 28 2007 Daniel P. Berrange <berrange@redhat.com> - 0.9.0-4.fc8
+- Fix debuginfo by passing -Wl,--build-id to linker
+
+* Tue Aug 28 2007 David Woodhouse <dwmw2@infradead.org> 0.9.0-4
+- Update licence
+- Fix CDROM emulation (#253542)
+
+* Tue Aug 28 2007 Daniel P. Berrange <berrange@redhat.com> - 0.9.0-3.fc8
+- Added backport of VNC password auth, and TLS+x509 cert auth
+- Switch to rtl8139 NIC by default for linkstate reporting
+- Fix rtl8139 mmio region mappings with multiple NICs
+
+* Sun Apr 1 2007 Hans de Goede <j.w.r.degoede@hhs.nl> 0.9.0-2
+- Fix direct loading of a linux kernel with -kernel & -initrd (bz 234681)
+- Remove spurious execute bits from manpages (bz 222573)
+
+* Tue Feb 6 2007 David Woodhouse <dwmw2@infradead.org> 0.9.0-1
+- Update to 0.9.0
+
+* Wed Jan 31 2007 David Woodhouse <dwmw2@infradead.org> 0.8.2-5
+- Include licences
+
+* Mon Nov 13 2006 Hans de Goede <j.w.r.degoede@hhs.nl> 0.8.2-4
+- Backport patch to make FC6 guests work by Kevin Kofler
+ <Kevin@tigcc.ticalc.org> (bz 207843).
+
+* Mon Sep 11 2006 David Woodhouse <dwmw2@infradead.org> 0.8.2-3
+- Rebuild
+
+* Thu Aug 24 2006 Matthias Saou <http://freshrpms.net/> 0.8.2-2
+- Remove the target-list iteration for x86_64 since they all build again.
+- Make gcc32 vs. gcc34 conditional on %%{fedora} to share the same spec for
+ FC5 and FC6.
+
+* Wed Aug 23 2006 Matthias Saou <http://freshrpms.net/> 0.8.2-1
+- Update to 0.8.2 (#200065).
+- Drop upstreamed syscall-macros patch2.
+- Put correct scriplet dependencies.
+- Force install mode for the init script to avoid umask problems.
+- Add %%postun condrestart for changes to the init script to be applied if any.
+- Update description with the latest "about" from the web page (more current).
+- Update URL to qemu.org one like the Source.
+- Add which build requirement.
+- Don't include texi files in %%doc since we ship them in html.
+- Switch to using gcc34 on devel, FC5 still has gcc32.
+- Add kernheaders patch to fix linux/compiler.h inclusion.
+- Add target-sparc patch to fix compiling on ppc (some int32 to float).
+
+* Thu Jun 8 2006 David Woodhouse <dwmw2@infradead.org> 0.8.1-3
+- More header abuse in modify_ldt(), change BuildRoot:
+
+* Wed Jun 7 2006 David Woodhouse <dwmw2@infradead.org> 0.8.1-2
+- Fix up kernel header abuse
+
+* Tue May 30 2006 David Woodhouse <dwmw2@infradead.org> 0.8.1-1
+- Update to 0.8.1
+
+* Sat Mar 18 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-6
+- Update linker script for PPC
+
+* Sat Mar 18 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-5
+- Just drop $RPM_OPT_FLAGS. They're too much of a PITA
+
+* Sat Mar 18 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-4
+- Disable stack-protector options which gcc 3.2 doesn't like
+
+* Fri Mar 17 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-3
+- Use -mcpu= instead of -mtune= on x86_64 too
+- Disable SPARC targets on x86_64, because dyngen doesn't like fnegs
+
+* Fri Mar 17 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-2
+- Don't use -mtune=pentium4 on i386. GCC 3.2 doesn't like it
+
+* Fri Mar 17 2006 David Woodhouse <dwmw2@infradead.org> 0.8.0-1
+- Update to 0.8.0
+- Resort to using compat-gcc-32
+- Enable ALSA
+
+* Mon May 16 2005 David Woodhouse <dwmw2@infradead.org> 0.7.0-2
+- Proper fix for GCC 4 putting 'blr' or 'ret' in the middle of the function,
+ for i386, x86_64 and PPC.
+
+* Sat Apr 30 2005 David Woodhouse <dwmw2@infradead.org> 0.7.0-1
+- Update to 0.7.0
+- Fix dyngen for PPC functions which end in unconditional branch
+
+* Fri Apr 7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
+- rebuilt
+
+* Sun Feb 13 2005 David Woodhouse <dwmw2@infradead.org> 0.6.1-2
+- Package cleanup
+
+* Sun Nov 21 2004 David Woodhouse <dwmw2@redhat.com> 0.6.1-1
+- Update to 0.6.1
+
+* Tue Jul 20 2004 David Woodhouse <dwmw2@redhat.com> 0.6.0-2
+- Compile fix from qemu CVS, add x86_64 host support
+
+* Mon May 12 2004 David Woodhouse <dwmw2@redhat.com> 0.6.0-1
+- Update to 0.6.0.
+
+* Sat May 8 2004 David Woodhouse <dwmw2@redhat.com> 0.5.5-1
+- Update to 0.5.5.
+
+* Thu May 2 2004 David Woodhouse <dwmw2@redhat.com> 0.5.4-1
+- Update to 0.5.4.
+
+* Thu Apr 22 2004 David Woodhouse <dwmw2@redhat.com> 0.5.3-1
+- Update to 0.5.3. Add init script.
+
+* Thu Jul 17 2003 Jeff Johnson <jbj@redhat.com> 0.4.3-1
+- Create.
Code Review / packages / centos6 / qemu.git / commitdiff