target-arm: Clear IT bits when taking exceptions in v7M

[qemu.git] / target-arm / helper.c

diff --git a/target-arm/helper.c b/target-arm/helper.c
index ae4f334e40a5b4c1725f1ec077088766d6fb9d09..1314f23d59b09179dbcaea35c3b80a6396181da0 100644 (file)
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1,15 +1,20 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-

 #include "cpu.h"
 #include "gdbstub.h"
 #include "helper.h"
 #include "cpu.h"
 #include "gdbstub.h"
 #include "helper.h"

-#include "qemu-common.h"

 #include "host-utils.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
 #include "host-utils.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif

+#include "sysemu.h"
+
+static uint32_t cortexa15_cp15_c0_c1[8] = {
+    0x00001131, 0x00011011, 0x02010555, 0x00000000,
+    0x10201105, 0x20000000, 0x01240000, 0x02102211
+};
+
+static uint32_t cortexa15_cp15_c0_c2[8] = {
+    0x02101110, 0x13112111, 0x21232041, 0x11112131, 0x10011142, 0, 0, 0
+};

 
 static uint32_t cortexa9_cp15_c0_c1[8] =
 { 0x1031, 0x11, 0x000, 0, 0x00100103, 0x20000000, 0x01230000, 0x00002111 };
 
 static uint32_t cortexa9_cp15_c0_c1[8] =
 { 0x1031, 0x11, 0x000, 0, 0x00100103, 0x20000000, 0x01230000, 0x00002111 };


@@ -35,6 +40,12 @@ static uint32_t arm1136_cp15_c0_c1[8] =
 static uint32_t arm1136_cp15_c0_c2[8] =
 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
 
 static uint32_t arm1136_cp15_c0_c2[8] =
 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
 

+static uint32_t arm1176_cp15_c0_c1[8] =
+{ 0x111, 0x11, 0x33, 0, 0x01130003, 0x10030302, 0x01222100, 0 };
+
+static uint32_t arm1176_cp15_c0_c2[8] =
+{ 0x0140011, 0x12002111, 0x11231121, 0x01102131, 0x01141, 0, 0, 0 };
+

 static uint32_t cpu_arm_find_by_name(const char *name);
 
 static inline void set_feature(CPUARMState *env, int feature)
 static uint32_t cpu_arm_find_by_name(const char *name);
 
 static inline void set_feature(CPUARMState *env, int feature)


@@ -47,7 +58,6 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
     env->cp15.c0_cpuid = id;
     switch (id) {
     case ARM_CPUID_ARM926:
     env->cp15.c0_cpuid = id;
     switch (id) {
     case ARM_CPUID_ARM926:

-        set_feature(env, ARM_FEATURE_V4T);

         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_VFP);
         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_VFP);
         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;


@@ -55,14 +65,12 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c1_sys = 0x00090078;
         break;
     case ARM_CPUID_ARM946:
         env->cp15.c1_sys = 0x00090078;
         break;
     case ARM_CPUID_ARM946:

-        set_feature(env, ARM_FEATURE_V4T);

         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_MPU);
         env->cp15.c0_cachetype = 0x0f004006;
         env->cp15.c1_sys = 0x00000078;
         break;
     case ARM_CPUID_ARM1026:
         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_MPU);
         env->cp15.c0_cachetype = 0x0f004006;
         env->cp15.c1_sys = 0x00000078;
         break;
     case ARM_CPUID_ARM1026:

-        set_feature(env, ARM_FEATURE_V4T);

         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_VFP);
         set_feature(env, ARM_FEATURE_AUXCR);
         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_VFP);
         set_feature(env, ARM_FEATURE_AUXCR);


@@ -70,13 +78,21 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00090078;
         break;
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00090078;
         break;

-    case ARM_CPUID_ARM1136_R2:

     case ARM_CPUID_ARM1136:
     case ARM_CPUID_ARM1136:

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
+        /* This is the 1136 r1, which is a v6K core */
+        set_feature(env, ARM_FEATURE_V6K);
+        /* Fall through */
+    case ARM_CPUID_ARM1136_R2:
+        /* What qemu calls "arm1136_r2" is actually the 1136 r0p2, ie an
+         * older core than plain "arm1136". In particular this does not
+         * have the v6K features.
+         */

         set_feature(env, ARM_FEATURE_V6);
         set_feature(env, ARM_FEATURE_VFP);
         set_feature(env, ARM_FEATURE_V6);
         set_feature(env, ARM_FEATURE_VFP);

-        set_feature(env, ARM_FEATURE_AUXCR);
+        /* These ID register values are correct for 1136 but may be wrong
+         * for 1136_r2 (in particular r0p2 does not actually implement most
+         * of the ID registers).
+         */

         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;


@@ -85,13 +101,22 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00050078;
         break;
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00050078;
         break;

+    case ARM_CPUID_ARM1176:
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VAPA);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b5;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, arm1176_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c2, arm1176_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        env->cp15.c1_sys = 0x00050078;
+        break;

     case ARM_CPUID_ARM11MPCORE:
     case ARM_CPUID_ARM11MPCORE:

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
-        set_feature(env, ARM_FEATURE_V6);

         set_feature(env, ARM_FEATURE_V6K);
         set_feature(env, ARM_FEATURE_VFP);
         set_feature(env, ARM_FEATURE_V6K);
         set_feature(env, ARM_FEATURE_VFP);

-        set_feature(env, ARM_FEATURE_AUXCR);
+        set_feature(env, ARM_FEATURE_VAPA);

         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;


@@ -100,14 +125,7 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c0_cachetype = 0x1dd20d2;
         break;
     case ARM_CPUID_CORTEXA8:
         env->cp15.c0_cachetype = 0x1dd20d2;
         break;
     case ARM_CPUID_CORTEXA8:

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
-        set_feature(env, ARM_FEATURE_V6);
-        set_feature(env, ARM_FEATURE_V6K);

         set_feature(env, ARM_FEATURE_V7);
         set_feature(env, ARM_FEATURE_V7);

-        set_feature(env, ARM_FEATURE_AUXCR);
-        set_feature(env, ARM_FEATURE_THUMB2);
-        set_feature(env, ARM_FEATURE_VFP);

         set_feature(env, ARM_FEATURE_VFP3);
         set_feature(env, ARM_FEATURE_NEON);
         set_feature(env, ARM_FEATURE_THUMB2EE);
         set_feature(env, ARM_FEATURE_VFP3);
         set_feature(env, ARM_FEATURE_NEON);
         set_feature(env, ARM_FEATURE_THUMB2EE);


@@ -124,14 +142,7 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c1_sys = 0x00c50078;
         break;
     case ARM_CPUID_CORTEXA9:
         env->cp15.c1_sys = 0x00c50078;
         break;
     case ARM_CPUID_CORTEXA9:

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
-        set_feature(env, ARM_FEATURE_V6);
-        set_feature(env, ARM_FEATURE_V6K);

         set_feature(env, ARM_FEATURE_V7);
         set_feature(env, ARM_FEATURE_V7);

-        set_feature(env, ARM_FEATURE_AUXCR);
-        set_feature(env, ARM_FEATURE_THUMB2);
-        set_feature(env, ARM_FEATURE_VFP);

         set_feature(env, ARM_FEATURE_VFP3);
         set_feature(env, ARM_FEATURE_VFP_FP16);
         set_feature(env, ARM_FEATURE_NEON);
         set_feature(env, ARM_FEATURE_VFP3);
         set_feature(env, ARM_FEATURE_VFP_FP16);
         set_feature(env, ARM_FEATURE_NEON);


@@ -141,7 +152,7 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
          * and valid configurations; we don't model A9UP).
          */
         set_feature(env, ARM_FEATURE_V7MP);
          * and valid configurations; we don't model A9UP).
          */
         set_feature(env, ARM_FEATURE_V7MP);

-        env->vfp.xregs[ARM_VFP_FPSID] = 0x41034000; /* Guess */
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x41033090;

         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x01111111;
         memcpy(env->cp15.c0_c1, cortexa9_cp15_c0_c1, 8 * sizeof(uint32_t));
         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
         env->vfp.xregs[ARM_VFP_MVFR1] = 0x01111111;
         memcpy(env->cp15.c0_c1, cortexa9_cp15_c0_c1, 8 * sizeof(uint32_t));


@@ -152,28 +163,38 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c0_ccsid[1] = 0x200fe015; /* 16k L1 icache. */
         env->cp15.c1_sys = 0x00c50078;
         break;
         env->cp15.c0_ccsid[1] = 0x200fe015; /* 16k L1 icache. */
         env->cp15.c1_sys = 0x00c50078;
         break;

+    case ARM_CPUID_CORTEXA15:
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_VFP4);
+        set_feature(env, ARM_FEATURE_VFP_FP16);
+        set_feature(env, ARM_FEATURE_NEON);
+        set_feature(env, ARM_FEATURE_THUMB2EE);
+        set_feature(env, ARM_FEATURE_ARM_DIV);
+        set_feature(env, ARM_FEATURE_V7MP);
+        set_feature(env, ARM_FEATURE_GENERIC_TIMER);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410430f0;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x10110222;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x11111111;
+        memcpy(env->cp15.c0_c1, cortexa15_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c2, cortexa15_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x8444c004;
+        env->cp15.c0_clid = 0x0a200023;
+        env->cp15.c0_ccsid[0] = 0x701fe00a; /* 32K L1 dcache */
+        env->cp15.c0_ccsid[1] = 0x201fe00a; /* 32K L1 icache */
+        env->cp15.c0_ccsid[2] = 0x711fe07a; /* 4096K L2 unified cache */
+        env->cp15.c1_sys = 0x00c50078;
+        break;

     case ARM_CPUID_CORTEXM3:
     case ARM_CPUID_CORTEXM3:

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
-        set_feature(env, ARM_FEATURE_V6);
-        set_feature(env, ARM_FEATURE_THUMB2);

         set_feature(env, ARM_FEATURE_V7);
         set_feature(env, ARM_FEATURE_M);
         set_feature(env, ARM_FEATURE_V7);
         set_feature(env, ARM_FEATURE_M);

-        set_feature(env, ARM_FEATURE_DIV);

         break;
     case ARM_CPUID_ANY: /* For userspace emulation.  */
         break;
     case ARM_CPUID_ANY: /* For userspace emulation.  */

-        set_feature(env, ARM_FEATURE_V4T);
-        set_feature(env, ARM_FEATURE_V5);
-        set_feature(env, ARM_FEATURE_V6);
-        set_feature(env, ARM_FEATURE_V6K);

         set_feature(env, ARM_FEATURE_V7);
         set_feature(env, ARM_FEATURE_V7);

-        set_feature(env, ARM_FEATURE_THUMB2);
-        set_feature(env, ARM_FEATURE_VFP);
-        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_VFP4);

         set_feature(env, ARM_FEATURE_VFP_FP16);
         set_feature(env, ARM_FEATURE_NEON);
         set_feature(env, ARM_FEATURE_THUMB2EE);
         set_feature(env, ARM_FEATURE_VFP_FP16);
         set_feature(env, ARM_FEATURE_NEON);
         set_feature(env, ARM_FEATURE_THUMB2EE);

-        set_feature(env, ARM_FEATURE_DIV);
+        set_feature(env, ARM_FEATURE_ARM_DIV);

         set_feature(env, ARM_FEATURE_V7MP);
         break;
     case ARM_CPUID_TI915T:
         set_feature(env, ARM_FEATURE_V7MP);
         break;
     case ARM_CPUID_TI915T:


@@ -191,7 +212,6 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
     case ARM_CPUID_PXA260:
     case ARM_CPUID_PXA261:
     case ARM_CPUID_PXA262:
     case ARM_CPUID_PXA260:
     case ARM_CPUID_PXA261:
     case ARM_CPUID_PXA262:

-        set_feature(env, ARM_FEATURE_V4T);

         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_XSCALE);
         /* JTAG_ID is ((id << 28) | 0x09265013) */
         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_XSCALE);
         /* JTAG_ID is ((id << 28) | 0x09265013) */


@@ -204,7 +224,6 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
     case ARM_CPUID_PXA270_B1:
     case ARM_CPUID_PXA270_C0:
     case ARM_CPUID_PXA270_C5:
     case ARM_CPUID_PXA270_B1:
     case ARM_CPUID_PXA270_C0:
     case ARM_CPUID_PXA270_C5:

-        set_feature(env, ARM_FEATURE_V4T);

         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_XSCALE);
         /* JTAG_ID is ((id << 28) | 0x09265013) */
         set_feature(env, ARM_FEATURE_V5);
         set_feature(env, ARM_FEATURE_XSCALE);
         /* JTAG_ID is ((id << 28) | 0x09265013) */


@@ -222,11 +241,47 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         cpu_abort(env, "Bad CPU ID: %x\n", id);
         break;
     }
         cpu_abort(env, "Bad CPU ID: %x\n", id);
         break;
     }

+
+    /* Some features automatically imply others: */
+    if (arm_feature(env, ARM_FEATURE_V7)) {
+        set_feature(env, ARM_FEATURE_VAPA);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        if (!arm_feature(env, ARM_FEATURE_M)) {
+            set_feature(env, ARM_FEATURE_V6K);
+        } else {
+            set_feature(env, ARM_FEATURE_V6);
+        }
+    }
+    if (arm_feature(env, ARM_FEATURE_V6K)) {
+        set_feature(env, ARM_FEATURE_V6);
+    }
+    if (arm_feature(env, ARM_FEATURE_V6)) {
+        set_feature(env, ARM_FEATURE_V5);
+        if (!arm_feature(env, ARM_FEATURE_M)) {
+            set_feature(env, ARM_FEATURE_AUXCR);
+        }
+    }
+    if (arm_feature(env, ARM_FEATURE_V5)) {
+        set_feature(env, ARM_FEATURE_V4T);
+    }
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        set_feature(env, ARM_FEATURE_THUMB_DIV);
+    }
+    if (arm_feature(env, ARM_FEATURE_ARM_DIV)) {
+        set_feature(env, ARM_FEATURE_THUMB_DIV);
+    }
+    if (arm_feature(env, ARM_FEATURE_VFP4)) {
+        set_feature(env, ARM_FEATURE_VFP3);
+    }
+    if (arm_feature(env, ARM_FEATURE_VFP3)) {
+        set_feature(env, ARM_FEATURE_VFP);
+    }

 }
 
 }
 

-void cpu_reset(CPUARMState *env)
+void cpu_state_reset(CPUARMState *env)

 {
     uint32_t id;
 {
     uint32_t id;

+    uint32_t tmp = 0;

 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);


@@ -234,9 +289,11 @@ void cpu_reset(CPUARMState *env)
     }
 
     id = env->cp15.c0_cpuid;
     }
 
     id = env->cp15.c0_cpuid;

+    tmp = env->cp15.c15_config_base_address;

     memset(env, 0, offsetof(CPUARMState, breakpoints));
     if (id)
         cpu_reset_model_id(env, id);
     memset(env, 0, offsetof(CPUARMState, breakpoints));
     if (id)
         cpu_reset_model_id(env, id);

+    env->cp15.c15_config_base_address = tmp;

 #if defined (CONFIG_USER_ONLY)
     env->uncached_cpsr = ARM_CPU_MODE_USR;
     /* For user mode we must enable access to coprocessors */
 #if defined (CONFIG_USER_ONLY)
     env->uncached_cpsr = ARM_CPU_MODE_USR;
     /* For user mode we must enable access to coprocessors */


@@ -259,7 +316,7 @@ void cpu_reset(CPUARMState *env)
         if (rom) {
             /* We should really use ldl_phys here, in case the guest
                modified flash and reset itself.  However images
         if (rom) {
             /* We should really use ldl_phys here, in case the guest
                modified flash and reset itself.  However images

-               loaded via -kenrel have not been copied yet, so load the
+               loaded via -kernel have not been copied yet, so load the

                values directly from there.  */
             env->regs[13] = ldl_p(rom);
             pc = ldl_p(rom + 4);
                values directly from there.  */
             env->regs[13] = ldl_p(rom);
             pc = ldl_p(rom + 4);


@@ -282,9 +339,14 @@ void cpu_reset(CPUARMState *env)
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
     tlb_flush(env, 1);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
     tlb_flush(env, 1);

+    /* Reset is a state change for some CPUARMState fields which we
+     * bake assumptions about into translated code, so we need to
+     * tb_flush().
+     */
+    tb_flush(env);

 }
 
 }
 

-static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
+static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)

 {
     int nregs;
 
 {
     int nregs;
 


@@ -311,7 +373,7 @@ static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
     return 0;
 }
 
     return 0;
 }
 

-static int vfp_gdb_set_reg(CPUState *env, uint8_t *buf, int reg)
+static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)

 {
     int nregs;
 
 {
     int nregs;
 


@@ -345,16 +407,16 @@ CPUARMState *cpu_arm_init(const char *cpu_model)
     id = cpu_arm_find_by_name(cpu_model);
     if (id == 0)
         return NULL;
     id = cpu_arm_find_by_name(cpu_model);
     if (id == 0)
         return NULL;

-    env = qemu_mallocz(sizeof(CPUARMState));
+    env = g_malloc0(sizeof(CPUARMState));

     cpu_exec_init(env);
     cpu_exec_init(env);

-    if (!inited) {
+    if (tcg_enabled() && !inited) {

         inited = 1;
         arm_translate_init();
     }
 
     env->cpu_model_str = cpu_model;
     env->cp15.c0_cpuid = id;
         inited = 1;
         arm_translate_init();
     }
 
     env->cpu_model_str = cpu_model;
     env->cp15.c0_cpuid = id;

-    cpu_reset(env);
+    cpu_state_reset(env);

     if (arm_feature(env, ARM_FEATURE_NEON)) {
         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  51, "arm-neon.xml", 0);
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  51, "arm-neon.xml", 0);


@@ -380,10 +442,12 @@ static const struct arm_cpu_t arm_cpu_names[] = {
     { ARM_CPUID_ARM1026, "arm1026"},
     { ARM_CPUID_ARM1136, "arm1136"},
     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
     { ARM_CPUID_ARM1026, "arm1026"},
     { ARM_CPUID_ARM1136, "arm1136"},
     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},

+    { ARM_CPUID_ARM1176, "arm1176"},

     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
     { ARM_CPUID_CORTEXM3, "cortex-m3"},
     { ARM_CPUID_CORTEXA8, "cortex-a8"},
     { ARM_CPUID_CORTEXA9, "cortex-a9"},
     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
     { ARM_CPUID_CORTEXM3, "cortex-m3"},
     { ARM_CPUID_CORTEXA8, "cortex-a8"},
     { ARM_CPUID_CORTEXA9, "cortex-a9"},

+    { ARM_CPUID_CORTEXA15, "cortex-a15" },

     { ARM_CPUID_TI925T, "ti925t" },
     { ARM_CPUID_PXA250, "pxa250" },
     { ARM_CPUID_SA1100,    "sa1100" },
     { ARM_CPUID_TI925T, "ti925t" },
     { ARM_CPUID_PXA250, "pxa250" },
     { ARM_CPUID_SA1100,    "sa1100" },


@@ -431,7 +495,27 @@ static uint32_t cpu_arm_find_by_name(const char *name)
 
 void cpu_arm_close(CPUARMState *env)
 {
 
 void cpu_arm_close(CPUARMState *env)
 {

-    free(env);
+    g_free(env);
+}
+
+static int bad_mode_switch(CPUARMState *env, int mode)
+{
+    /* Return true if it is not valid for us to switch to
+     * this CPU mode (ie all the UNPREDICTABLE cases in
+     * the ARM ARM CPSRWriteByInstr pseudocode).
+     */
+    switch (mode) {
+    case ARM_CPU_MODE_USR:
+    case ARM_CPU_MODE_SYS:
+    case ARM_CPU_MODE_SVC:
+    case ARM_CPU_MODE_ABT:
+    case ARM_CPU_MODE_UND:
+    case ARM_CPU_MODE_IRQ:
+    case ARM_CPU_MODE_FIQ:
+        return 0;
+    default:
+        return 1;
+    }

 }
 
 uint32_t cpsr_read(CPUARMState *env)
 }
 
 uint32_t cpsr_read(CPUARMState *env)


@@ -470,7 +554,15 @@ void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
     }
 
     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
     }
 
     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {

-        switch_mode(env, val & CPSR_M);
+        if (bad_mode_switch(env, val & CPSR_M)) {
+            /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
+             * We choose to ignore the attempt and leave the CPSR M field
+             * untouched.
+             */
+            mask &= ~CPSR_M;
+        } else {
+            switch_mode(env, val & CPSR_M);
+        }

     }
     mask &= ~CACHED_CPSR_BITS;
     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
     }
     mask &= ~CACHED_CPSR_BITS;
     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);


@@ -536,13 +628,13 @@ uint32_t HELPER(abs)(uint32_t x)
 
 #if defined(CONFIG_USER_ONLY)
 
 
 #if defined(CONFIG_USER_ONLY)
 

-void do_interrupt (CPUState *env)
+void do_interrupt (CPUARMState *env)

 {
     env->exception_index = -1;
 }
 
 {
     env->exception_index = -1;
 }
 

-int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int mmu_idx, int is_softmmu)
+int cpu_arm_handle_mmu_fault (CPUARMState *env, target_ulong address, int rw,
+                              int mmu_idx)

 {
     if (rw == 2) {
         env->exception_index = EXCP_PREFETCH_ABORT;
 {
     if (rw == 2) {
         env->exception_index = EXCP_PREFETCH_ABORT;


@@ -555,54 +647,54 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 }
 
 /* These should probably raise undefined insn exceptions.  */
 }
 
 /* These should probably raise undefined insn exceptions.  */

-void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
+void HELPER(set_cp)(CPUARMState *env, uint32_t insn, uint32_t val)

 {
     int op1 = (insn >> 8) & 0xf;
     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
     return;
 }
 
 {
     int op1 = (insn >> 8) & 0xf;
     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
     return;
 }
 

-uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp)(CPUARMState *env, uint32_t insn)

 {
     int op1 = (insn >> 8) & 0xf;
     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
     return 0;
 }
 
 {
     int op1 = (insn >> 8) & 0xf;
     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
     return 0;
 }
 

-void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
+void HELPER(set_cp15)(CPUARMState *env, uint32_t insn, uint32_t val)

 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
 }
 
 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
 }
 

-uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp15)(CPUARMState *env, uint32_t insn)

 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
 }
 
 /* These should probably raise undefined insn exceptions.  */
 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
 }
 
 /* These should probably raise undefined insn exceptions.  */

-void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
+void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)

 {
     cpu_abort(env, "v7m_mrs %d\n", reg);
 }
 
 {
     cpu_abort(env, "v7m_mrs %d\n", reg);
 }
 

-uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
+uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

 {
     cpu_abort(env, "v7m_mrs %d\n", reg);
     return 0;
 }
 
 {
     cpu_abort(env, "v7m_mrs %d\n", reg);
     return 0;
 }
 

-void switch_mode(CPUState *env, int mode)
+void switch_mode(CPUARMState *env, int mode)

 {
     if (mode != ARM_CPU_MODE_USR)
         cpu_abort(env, "Tried to switch out of user mode\n");
 }
 
 {
     if (mode != ARM_CPU_MODE_USR)
         cpu_abort(env, "Tried to switch out of user mode\n");
 }
 

-void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
+void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)

 {
     cpu_abort(env, "banked r13 write\n");
 }
 
 {
     cpu_abort(env, "banked r13 write\n");
 }
 

-uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
+uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)

 {
     cpu_abort(env, "banked r13 read\n");
     return 0;
 {
     cpu_abort(env, "banked r13 read\n");
     return 0;


@@ -610,10 +702,8 @@ uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
 
 #else
 
 
 #else
 

-extern int semihosting_enabled;
-

 /* Map CPU modes onto saved register banks.  */
 /* Map CPU modes onto saved register banks.  */

-static inline int bank_number (int mode)
+static inline int bank_number(CPUARMState *env, int mode)

 {
     switch (mode) {
     case ARM_CPU_MODE_USR:
 {
     switch (mode) {
     case ARM_CPU_MODE_USR:


@@ -630,11 +720,11 @@ static inline int bank_number (int mode)
     case ARM_CPU_MODE_FIQ:
         return 5;
     }
     case ARM_CPU_MODE_FIQ:
         return 5;
     }

-    cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
+    cpu_abort(env, "Bad mode %x\n", mode);

     return -1;
 }
 
     return -1;
 }
 

-void switch_mode(CPUState *env, int mode)
+void switch_mode(CPUARMState *env, int mode)

 {
     int old_mode;
     int i;
 {
     int old_mode;
     int i;


@@ -651,12 +741,12 @@ void switch_mode(CPUState *env, int mode)
         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
     }
 
         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
     }
 

-    i = bank_number(old_mode);
+    i = bank_number(env, old_mode);

     env->banked_r13[i] = env->regs[13];
     env->banked_r14[i] = env->regs[14];
     env->banked_spsr[i] = env->spsr;
 
     env->banked_r13[i] = env->regs[13];
     env->banked_r14[i] = env->regs[14];
     env->banked_spsr[i] = env->spsr;
 

-    i = bank_number(mode);
+    i = bank_number(env, mode);

     env->regs[13] = env->banked_r13[i];
     env->regs[14] = env->banked_r14[i];
     env->spsr = env->banked_spsr[i];
     env->regs[13] = env->banked_r13[i];
     env->regs[14] = env->banked_r14[i];
     env->spsr = env->banked_spsr[i];


@@ -787,7 +877,8 @@ static void do_interrupt_v7m(CPUARMState *env)
     v7m_push(env, env->regs[1]);
     v7m_push(env, env->regs[0]);
     switch_v7m_sp(env, 0);
     v7m_push(env, env->regs[1]);
     v7m_push(env, env->regs[0]);
     switch_v7m_sp(env, 0);

-    env->uncached_cpsr &= ~CPSR_IT;
+    /* Clear IT bits */
+    env->condexec_bits = 0;

     env->regs[14] = lr;
     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
     env->regs[15] = addr & 0xfffffffe;
     env->regs[14] = lr;
     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
     env->regs[15] = addr & 0xfffffffe;


@@ -907,13 +998,14 @@ void do_interrupt(CPUARMState *env)
 /* Check section/page access permissions.
    Returns the page protection flags, or zero if the access is not
    permitted.  */
 /* Check section/page access permissions.
    Returns the page protection flags, or zero if the access is not
    permitted.  */

-static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
-                           int is_user)
+static inline int check_ap(CPUARMState *env, int ap, int domain_prot,
+                           int access_type, int is_user)

 {
   int prot_ro;
 
 {
   int prot_ro;
 

-  if (domain == 3)
+  if (domain_prot == 3) {

     return PAGE_READ | PAGE_WRITE;
     return PAGE_READ | PAGE_WRITE;

+  }

 
   if (access_type == 1)
       prot_ro = 0;
 
   if (access_type == 1)
       prot_ro = 0;


@@ -948,7 +1040,7 @@ static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
   case 6:
       return prot_ro;
   case 7:
   case 6:
       return prot_ro;
   case 7:

-      if (!arm_feature (env, ARM_FEATURE_V7))
+      if (!arm_feature (env, ARM_FEATURE_V6K))

           return 0;
       return prot_ro;
   default:
           return 0;
       return prot_ro;
   default:


@@ -956,7 +1048,7 @@ static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
   }
 }
 
   }
 }
 

-static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
+static uint32_t get_level1_table_address(CPUARMState *env, uint32_t address)

 {
     uint32_t table;
 
 {
     uint32_t table;
 


@@ -969,7 +1061,7 @@ static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
     return table;
 }
 
     return table;
 }
 

-static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
+static int get_phys_addr_v5(CPUARMState *env, uint32_t address, int access_type,

                            int is_user, uint32_t *phys_ptr, int *prot,
                             target_ulong *page_size)
 {
                            int is_user, uint32_t *phys_ptr, int *prot,
                             target_ulong *page_size)
 {


@@ -979,6 +1071,7 @@ static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
     int type;
     int ap;
     int domain;
     int type;
     int ap;
     int domain;

+    int domain_prot;

     uint32_t phys_addr;
 
     /* Pagetable walk.  */
     uint32_t phys_addr;
 
     /* Pagetable walk.  */


@@ -986,13 +1079,14 @@ static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
     table = get_level1_table_address(env, address);
     desc = ldl_phys(table);
     type = (desc & 3);
     table = get_level1_table_address(env, address);
     desc = ldl_phys(table);
     type = (desc & 3);

-    domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
+    domain = (desc >> 5) & 0x0f;
+    domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;

     if (type == 0) {
         /* Section translation fault.  */
         code = 5;
         goto do_fault;
     }
     if (type == 0) {
         /* Section translation fault.  */
         code = 5;
         goto do_fault;
     }

-    if (domain == 0 || domain == 2) {
+    if (domain_prot == 0 || domain_prot == 2) {

         if (type == 2)
             code = 9; /* Section domain fault.  */
         else
         if (type == 2)
             code = 9; /* Section domain fault.  */
         else


@@ -1050,7 +1144,7 @@ static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
         }
         code = 15;
     }
         }
         code = 15;
     }

-    *prot = check_ap(env, ap, domain, access_type, is_user);
+    *prot = check_ap(env, ap, domain_prot, access_type, is_user);

     if (!*prot) {
         /* Access permission fault.  */
         goto do_fault;
     if (!*prot) {
         /* Access permission fault.  */
         goto do_fault;


@@ -1062,7 +1156,7 @@ do_fault:
     return code | (domain << 4);
 }
 
     return code | (domain << 4);
 }
 

-static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
+static int get_phys_addr_v6(CPUARMState *env, uint32_t address, int access_type,

                            int is_user, uint32_t *phys_ptr, int *prot,
                             target_ulong *page_size)
 {
                            int is_user, uint32_t *phys_ptr, int *prot,
                             target_ulong *page_size)
 {


@@ -1073,6 +1167,7 @@ static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
     int type;
     int ap;
     int domain;
     int type;
     int ap;
     int domain;

+    int domain_prot;

     uint32_t phys_addr;
 
     /* Pagetable walk.  */
     uint32_t phys_addr;
 
     /* Pagetable walk.  */


@@ -1090,10 +1185,10 @@ static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
         domain = 0;
     } else {
         /* Section or page.  */
         domain = 0;
     } else {
         /* Section or page.  */

-        domain = (desc >> 4) & 0x1e;
+        domain = (desc >> 5) & 0x0f;

     }
     }

-    domain = (env->cp15.c3 >> domain) & 3;
-    if (domain == 0 || domain == 2) {
+    domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;
+    if (domain_prot == 0 || domain_prot == 2) {

         if (type == 2)
             code = 9; /* Section domain fault.  */
         else
         if (type == 2)
             code = 9; /* Section domain fault.  */
         else


@@ -1138,7 +1233,7 @@ static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
         }
         code = 15;
     }
         }
         code = 15;
     }

-    if (domain == 3) {
+    if (domain_prot == 3) {

         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     } else {
         if (xn && access_type == 2)
         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     } else {
         if (xn && access_type == 2)


@@ -1150,7 +1245,7 @@ static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
             code = (code == 15) ? 6 : 3;
             goto do_fault;
         }
             code = (code == 15) ? 6 : 3;
             goto do_fault;
         }

-        *prot = check_ap(env, ap, domain, access_type, is_user);
+        *prot = check_ap(env, ap, domain_prot, access_type, is_user);

         if (!*prot) {
             /* Access permission fault.  */
             goto do_fault;
         if (!*prot) {
             /* Access permission fault.  */
             goto do_fault;


@@ -1165,7 +1260,7 @@ do_fault:
     return code | (domain << 4);
 }
 
     return code | (domain << 4);
 }
 

-static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
+static int get_phys_addr_mpu(CPUARMState *env, uint32_t address, int access_type,

                             int is_user, uint32_t *phys_ptr, int *prot)
 {
     int n;
                             int is_user, uint32_t *phys_ptr, int *prot)
 {
     int n;


@@ -1225,7 +1320,7 @@ static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
     return 0;
 }
 
     return 0;
 }
 

-static inline int get_phys_addr(CPUState *env, uint32_t address,
+static inline int get_phys_addr(CPUARMState *env, uint32_t address,

                                 int access_type, int is_user,
                                 uint32_t *phys_ptr, int *prot,
                                 target_ulong *page_size)
                                 int access_type, int is_user,
                                 uint32_t *phys_ptr, int *prot,
                                 target_ulong *page_size)


@@ -1253,8 +1348,8 @@ static inline int get_phys_addr(CPUState *env, uint32_t address,
     }
 }
 
     }
 }
 

-int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
-                              int access_type, int mmu_idx, int is_softmmu)
+int cpu_arm_handle_mmu_fault (CPUARMState *env, target_ulong address,
+                              int access_type, int mmu_idx)

 {
     uint32_t phys_addr;
     target_ulong page_size;
 {
     uint32_t phys_addr;
     target_ulong page_size;


@@ -1286,7 +1381,7 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
     return 1;
 }
 
     return 1;
 }
 

-target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
+target_phys_addr_t cpu_get_phys_page_debug(CPUARMState *env, target_ulong addr)

 {
     uint32_t phys_addr;
     target_ulong page_size;
 {
     uint32_t phys_addr;
     target_ulong page_size;


@@ -1301,7 +1396,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
     return phys_addr;
 }
 
     return phys_addr;
 }
 

-void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
+void HELPER(set_cp)(CPUARMState *env, uint32_t insn, uint32_t val)

 {
     int cp_num = (insn >> 8) & 0xf;
     int cp_info = (insn >> 5) & 7;
 {
     int cp_num = (insn >> 8) & 0xf;
     int cp_info = (insn >> 5) & 7;


@@ -1313,7 +1408,7 @@ void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
                                  cp_info, src, operand, val);
 }
 
                                  cp_info, src, operand, val);
 }
 

-uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp)(CPUARMState *env, uint32_t insn)

 {
     int cp_num = (insn >> 8) & 0xf;
     int cp_info = (insn >> 5) & 7;
 {
     int cp_num = (insn >> 8) & 0xf;
     int cp_info = (insn >> 5) & 7;


@@ -1356,7 +1451,7 @@ static uint32_t extended_mpu_ap_bits(uint32_t val)
     return ret;
 }
 
     return ret;
 }
 

-void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
+void HELPER(set_cp15)(CPUARMState *env, uint32_t insn, uint32_t val)

 {
     int op1;
     int op2;
 {
     int op1;
     int op2;


@@ -1379,6 +1474,11 @@ void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
         }
         goto bad_reg;
     case 1: /* System configuration.  */
         }
         goto bad_reg;
     case 1: /* System configuration.  */

+        if (arm_feature(env, ARM_FEATURE_V7)
+                && op1 == 0 && crm == 1 && op2 == 0) {
+            env->cp15.c1_scr = val;
+            break;
+        }

         if (arm_feature(env, ARM_FEATURE_OMAPCP))
             op2 = 0;
         switch (op2) {
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
             op2 = 0;
         switch (op2) {


@@ -1502,7 +1602,7 @@ void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
             goto bad_reg;
         }
         /* No cache, so nothing to do except VA->PA translations. */
             goto bad_reg;
         }
         /* No cache, so nothing to do except VA->PA translations. */

-        if (arm_feature(env, ARM_FEATURE_V6K)) {
+        if (arm_feature(env, ARM_FEATURE_VAPA)) {

             switch (crm) {
             case 4:
                 if (arm_feature(env, ARM_FEATURE_V7)) {
             switch (crm) {
             case 4:
                 if (arm_feature(env, ARM_FEATURE_V7)) {


@@ -1544,18 +1644,17 @@ void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
         break;
     case 8: /* MMU TLB control.  */
         switch (op2) {
         break;
     case 8: /* MMU TLB control.  */
         switch (op2) {

-        case 0: /* Invalidate all.  */
-            tlb_flush(env, 0);
+        case 0: /* Invalidate all (TLBIALL) */
+            tlb_flush(env, 1);

             break;
             break;

-        case 1: /* Invalidate single TLB entry.  */
+        case 1: /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */

             tlb_flush_page(env, val & TARGET_PAGE_MASK);
             break;
             tlb_flush_page(env, val & TARGET_PAGE_MASK);
             break;

-        case 2: /* Invalidate on ASID.  */
+        case 2: /* Invalidate by ASID (TLBIASID) */

             tlb_flush(env, val == 0);
             break;
             tlb_flush(env, val == 0);
             break;

-        case 3: /* Invalidate single entry on MVA.  */
-            /* ??? This is like case 1, but ignores ASID.  */
-            tlb_flush(env, 1);
+        case 3: /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
+            tlb_flush_page(env, val & TARGET_PAGE_MASK);

             break;
         default:
             goto bad_reg;
             break;
         default:
             goto bad_reg;


@@ -1696,7 +1795,11 @@ void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
             goto bad_reg;
         }
         break;
             goto bad_reg;
         }
         break;

-    case 14: /* Reserved.  */
+    case 14: /* Generic timer */
+        if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
+            /* Dummy implementation: RAZ/WI for all */
+            break;
+        }

         goto bad_reg;
     case 15: /* Implementation specific.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
         goto bad_reg;
     case 15: /* Implementation specific.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE)) {


@@ -1735,6 +1838,20 @@ void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
                 goto bad_reg;
             }
         }
                 goto bad_reg;
             }
         }

+        if (ARM_CPUID(env) == ARM_CPUID_CORTEXA9) {
+            switch (crm) {
+            case 0:
+                if ((op1 == 0) && (op2 == 0)) {
+                    env->cp15.c15_power_control = val;
+                } else if ((op1 == 0) && (op2 == 1)) {
+                    env->cp15.c15_diagnostic = val;
+                } else if ((op1 == 0) && (op2 == 2)) {
+                    env->cp15.c15_power_diagnostic = val;
+                }
+            default:
+                break;
+            }
+        }

         break;
     }
     return;
         break;
     }
     return;


@@ -1744,7 +1861,7 @@ bad_reg:
               (insn >> 16) & 0xf, crm, op1, op2);
 }
 
               (insn >> 16) & 0xf, crm, op1, op2);
 }
 

-uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp15)(CPUARMState *env, uint32_t insn)

 {
     int op1;
     int op2;
 {
     int op1;
     int op2;


@@ -1833,6 +1950,10 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
             goto bad_reg;
         }
     case 1: /* System configuration.  */
             goto bad_reg;
         }
     case 1: /* System configuration.  */

+        if (arm_feature(env, ARM_FEATURE_V7)
+            && op1 == 0 && crm == 1 && op2 == 0) {
+            return env->cp15.c1_scr;
+        }

         if (arm_feature(env, ARM_FEATURE_OMAPCP))
             op2 = 0;
         switch (op2) {
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
             op2 = 0;
         switch (op2) {


@@ -1848,12 +1969,14 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
                 return 1;
             case ARM_CPUID_ARM1136:
             case ARM_CPUID_ARM1136_R2:
                 return 1;
             case ARM_CPUID_ARM1136:
             case ARM_CPUID_ARM1136_R2:

+            case ARM_CPUID_ARM1176:

                 return 7;
             case ARM_CPUID_ARM11MPCORE:
                 return 1;
             case ARM_CPUID_CORTEXA8:
                 return 2;
             case ARM_CPUID_CORTEXA9:
                 return 7;
             case ARM_CPUID_ARM11MPCORE:
                 return 1;
             case ARM_CPUID_CORTEXA8:
                 return 2;
             case ARM_CPUID_CORTEXA9:

+            case ARM_CPUID_CORTEXA15:

                 return 0;
             default:
                 goto bad_reg;
                 return 0;
             default:
                 goto bad_reg;


@@ -1903,7 +2026,7 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
             return env->cp15.c5_data;
         case 1:
             if (arm_feature(env, ARM_FEATURE_MPU))
             return env->cp15.c5_data;
         case 1:
             if (arm_feature(env, ARM_FEATURE_MPU))

-                return simple_mpu_ap_bits(env->cp15.c5_data);
+                return simple_mpu_ap_bits(env->cp15.c5_insn);

             return env->cp15.c5_insn;
         case 2:
             if (!arm_feature(env, ARM_FEATURE_MPU))
             return env->cp15.c5_insn;
         case 2:
             if (!arm_feature(env, ARM_FEATURE_MPU))


@@ -1974,11 +2097,26 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
                     goto bad_reg;
                 }
             case 1: /* L2 cache */
                     goto bad_reg;
                 }
             case 1: /* L2 cache */

-                if (crm != 0) {
+                /* L2 Lockdown and Auxiliary control.  */
+                switch (op2) {
+                case 0:
+                    /* L2 cache lockdown (A8 only) */
+                    return 0;
+                case 2:
+                    /* L2 cache auxiliary control (A8) or control (A15) */
+                    if (ARM_CPUID(env) == ARM_CPUID_CORTEXA15) {
+                        /* Linux wants the number of processors from here.
+                         * Might as well set the interrupt-controller bit too.
+                         */
+                        return ((smp_cpus - 1) << 24) | (1 << 23);
+                    }
+                    return 0;
+                case 3:
+                    /* L2 cache extended control (A15) */
+                    return 0;
+                default:

                     goto bad_reg;
                 }
                     goto bad_reg;
                 }

-                /* L2 Lockdown and Auxiliary control.  */
-                return 0;

             default:
                 goto bad_reg;
             }
             default:
                 goto bad_reg;
             }


@@ -2047,7 +2185,11 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
         default:
             goto bad_reg;
         }
         default:
             goto bad_reg;
         }

-    case 14: /* Reserved.  */
+    case 14: /* Generic timer */
+        if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
+            /* Dummy implementation: RAZ/WI for all */
+            return 0;
+        }

         goto bad_reg;
     case 15: /* Implementation specific.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
         goto bad_reg;
     case 15: /* Implementation specific.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE)) {


@@ -2077,6 +2219,40 @@ uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
              * 0x200 << ($rn & 0xfff), when MMU is off.  */
             goto bad_reg;
         }
              * 0x200 << ($rn & 0xfff), when MMU is off.  */
             goto bad_reg;
         }

+        if (ARM_CPUID(env) == ARM_CPUID_CORTEXA9) {
+            switch (crm) {
+            case 0:
+                if ((op1 == 4) && (op2 == 0)) {
+                    /* The config_base_address should hold the value of
+                     * the peripheral base. ARM should get this from a CPU
+                     * object property, but that support isn't available in
+                     * December 2011. Default to 0 for now and board models
+                     * that care can set it by a private hook */
+                    return env->cp15.c15_config_base_address;
+                } else if ((op1 == 0) && (op2 == 0)) {
+                    /* power_control should be set to maximum latency. Again,
+                       default to 0 and set by private hook */
+                    return env->cp15.c15_power_control;
+                } else if ((op1 == 0) && (op2 == 1)) {
+                    return env->cp15.c15_diagnostic;
+                } else if ((op1 == 0) && (op2 == 2)) {
+                    return env->cp15.c15_power_diagnostic;
+                }
+                break;
+            case 1: /* NEON Busy */
+                return 0;
+            case 5: /* tlb lockdown */
+            case 6:
+            case 7:
+                if ((op1 == 5) && (op2 == 2)) {
+                    return 0;
+                }
+                break;
+            default:
+                break;
+            }
+            goto bad_reg;
+        }

         return 0;
     }
 bad_reg:
         return 0;
     }
 bad_reg:


@@ -2086,25 +2262,25 @@ bad_reg:
     return 0;
 }
 
     return 0;
 }
 

-void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
+void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)

 {
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         env->regs[13] = val;
     } else {
 {
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         env->regs[13] = val;
     } else {

-        env->banked_r13[bank_number(mode)] = val;
+        env->banked_r13[bank_number(env, mode)] = val;

     }
 }
 
     }
 }
 

-uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
+uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)

 {
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         return env->regs[13];
     } else {
 {
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         return env->regs[13];
     } else {

-        return env->banked_r13[bank_number(mode)];
+        return env->banked_r13[bank_number(env, mode)];

     }
 }
 
     }
 }
 

-uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
+uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

 {
     switch (reg) {
     case 0: /* APSR */
 {
     switch (reg) {
     case 0: /* APSR */


@@ -2141,7 +2317,7 @@ uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
     }
 }
 
     }
 }
 

-void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
+void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)

 {
     switch (reg) {
     case 0: /* APSR */
 {
     switch (reg) {
     case 0: /* APSR */


@@ -2497,7 +2673,7 @@ static inline int vfp_exceptbits_from_host(int host_bits)
     return target_bits;
 }
 
     return target_bits;
 }
 

-uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
+uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)

 {
     int i;
     uint32_t fpscr;
 {
     int i;
     uint32_t fpscr;


@@ -2511,7 +2687,7 @@ uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
     return fpscr;
 }
 
     return fpscr;
 }
 

-uint32_t vfp_get_fpscr(CPUState *env)
+uint32_t vfp_get_fpscr(CPUARMState *env)

 {
     return HELPER(vfp_get_fpscr)(env);
 }
 {
     return HELPER(vfp_get_fpscr)(env);
 }


@@ -2536,7 +2712,7 @@ static inline int vfp_exceptbits_to_host(int target_bits)
     return host_bits;
 }
 
     return host_bits;
 }
 

-void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
+void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)

 {
     int i;
     uint32_t changed;
 {
     int i;
     uint32_t changed;


@@ -2577,7 +2753,7 @@ void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
 }
 
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
 }
 

-void vfp_set_fpscr(CPUState *env, uint32_t val)
+void vfp_set_fpscr(CPUARMState *env, uint32_t val)

 {
     HELPER(vfp_set_fpscr)(env, val);
 }
 {
     HELPER(vfp_set_fpscr)(env, val);
 }


@@ -2621,19 +2797,19 @@ float64 VFP_HELPER(abs, d)(float64 a)
     return float64_abs(a);
 }
 
     return float64_abs(a);
 }
 

-float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
+float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)

 {
     return float32_sqrt(a, &env->vfp.fp_status);
 }
 
 {
     return float32_sqrt(a, &env->vfp.fp_status);
 }
 

-float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
+float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)

 {
     return float64_sqrt(a, &env->vfp.fp_status);
 }
 
 /* XXX: check quiet/signaling case */
 #define DO_VFP_cmp(p, type) \
 {
     return float64_sqrt(a, &env->vfp.fp_status);
 }
 
 /* XXX: check quiet/signaling case */
 #define DO_VFP_cmp(p, type) \

-void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
+void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env)  \

 { \
     uint32_t flags; \
     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
 { \
     uint32_t flags; \
     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \


@@ -2645,7 +2821,7 @@ void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
 } \
     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
 } \

-void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
+void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \

 { \
     uint32_t flags; \
     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
 { \
     uint32_t flags; \
     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \


@@ -2667,7 +2843,7 @@ DO_VFP_cmp(d, float64)
     float##fsz HELPER(name)(uint32_t x, void *fpstp) \
 { \
     float_status *fpst = fpstp; \
     float##fsz HELPER(name)(uint32_t x, void *fpstp) \
 { \
     float_status *fpst = fpstp; \

-    return sign##int32_to_##float##fsz(x, fpst); \
+    return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \

 }
 
 #define CONV_FTOI(name, fsz, sign, round) \
 }
 
 #define CONV_FTOI(name, fsz, sign, round) \


@@ -2696,7 +2872,7 @@ FLOAT_CONVS(ui, d, 64, u)
 #undef FLOAT_CONVS
 
 /* floating point conversion */
 #undef FLOAT_CONVS
 
 /* floating point conversion */

-float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
+float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)

 {
     float64 r = float32_to_float64(x, &env->vfp.fp_status);
     /* ARM requires that S<->D conversion of any kind of NaN generates
 {
     float64 r = float32_to_float64(x, &env->vfp.fp_status);
     /* ARM requires that S<->D conversion of any kind of NaN generates


@@ -2705,7 +2881,7 @@ float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
     return float64_maybe_silence_nan(r);
 }
 
     return float64_maybe_silence_nan(r);
 }
 

-float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
+float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)

 {
     float32 r =  float64_to_float32(x, &env->vfp.fp_status);
     /* ARM requires that S<->D conversion of any kind of NaN generates
 {
     float32 r =  float64_to_float32(x, &env->vfp.fp_status);
     /* ARM requires that S<->D conversion of any kind of NaN generates


@@ -2748,7 +2924,7 @@ VFP_CONV_FIX(ul, s, 32, uint32, u)
 #undef VFP_CONV_FIX
 
 /* Half precision conversions.  */
 #undef VFP_CONV_FIX
 
 /* Half precision conversions.  */

-static float32 do_fcvt_f16_to_f32(uint32_t a, CPUState *env, float_status *s)
+static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)

 {
     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
     float32 r = float16_to_float32(make_float16(a), ieee, s);
 {
     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
     float32 r = float16_to_float32(make_float16(a), ieee, s);


@@ -2758,7 +2934,7 @@ static float32 do_fcvt_f16_to_f32(uint32_t a, CPUState *env, float_status *s)
     return r;
 }
 
     return r;
 }
 

-static uint32_t do_fcvt_f32_to_f16(float32 a, CPUState *env, float_status *s)
+static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)

 {
     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
     float16 r = float32_to_float16(a, ieee, s);
 {
     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
     float16 r = float32_to_float16(a, ieee, s);


@@ -2768,22 +2944,22 @@ static uint32_t do_fcvt_f32_to_f16(float32 a, CPUState *env, float_status *s)
     return float16_val(r);
 }
 
     return float16_val(r);
 }
 

-float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUState *env)
+float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)

 {
     return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
 }
 
 {
     return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
 }
 

-uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUState *env)
+uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)

 {
     return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
 }
 
 {
     return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
 }
 

-float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUState *env)
+float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)

 {
     return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
 }
 
 {
     return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
 }
 

-uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUState *env)
+uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)

 {
     return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
 }
 {
     return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
 }


@@ -2792,7 +2968,7 @@ uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUState *env)
 #define float32_three make_float32(0x40400000)
 #define float32_one_point_five make_float32(0x3fc00000)
 
 #define float32_three make_float32(0x40400000)
 #define float32_one_point_five make_float32(0x3fc00000)
 

-float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
+float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)

 {
     float_status *s = &env->vfp.standard_fp_status;
     if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
 {
     float_status *s = &env->vfp.standard_fp_status;
     if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||


@@ -2805,7 +2981,7 @@ float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
     return float32_sub(float32_two, float32_mul(a, b, s), s);
 }
 
     return float32_sub(float32_two, float32_mul(a, b, s), s);
 }
 

-float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
+float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)

 {
     float_status *s = &env->vfp.standard_fp_status;
     float32 product;
 {
     float_status *s = &env->vfp.standard_fp_status;
     float32 product;


@@ -2830,7 +3006,7 @@ float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
 /* The algorithm that must be used to calculate the estimate
  * is specified by the ARM ARM.
  */
 /* The algorithm that must be used to calculate the estimate
  * is specified by the ARM ARM.
  */

-static float64 recip_estimate(float64 a, CPUState *env)
+static float64 recip_estimate(float64 a, CPUARMState *env)

 {
     /* These calculations mustn't set any fp exception flags,
      * so we use a local copy of the fp_status.
 {
     /* These calculations mustn't set any fp exception flags,
      * so we use a local copy of the fp_status.


@@ -2856,7 +3032,7 @@ static float64 recip_estimate(float64 a, CPUState *env)
     return float64_div(int64_to_float64(q_int, s), float64_256, s);
 }
 
     return float64_div(int64_to_float64(q_int, s), float64_256, s);
 }
 

-float32 HELPER(recpe_f32)(float32 a, CPUState *env)
+float32 HELPER(recpe_f32)(float32 a, CPUARMState *env)

 {
     float_status *s = &env->vfp.standard_fp_status;
     float64 f64;
 {
     float_status *s = &env->vfp.standard_fp_status;
     float64 f64;


@@ -2900,7 +3076,7 @@ float32 HELPER(recpe_f32)(float32 a, CPUState *env)
 /* The algorithm that must be used to calculate the estimate
  * is specified by the ARM ARM.
  */
 /* The algorithm that must be used to calculate the estimate
  * is specified by the ARM ARM.
  */

-static float64 recip_sqrt_estimate(float64 a, CPUState *env)
+static float64 recip_sqrt_estimate(float64 a, CPUARMState *env)

 {
     /* These calculations mustn't set any fp exception flags,
      * so we use a local copy of the fp_status.
 {
     /* These calculations mustn't set any fp exception flags,
      * so we use a local copy of the fp_status.


@@ -2952,7 +3128,7 @@ static float64 recip_sqrt_estimate(float64 a, CPUState *env)
     return float64_div(int64_to_float64(q_int, s), float64_256, s);
 }
 
     return float64_div(int64_to_float64(q_int, s), float64_256, s);
 }
 

-float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
+float32 HELPER(rsqrte_f32)(float32 a, CPUARMState *env)

 {
     float_status *s = &env->vfp.standard_fp_status;
     int result_exp;
 {
     float_status *s = &env->vfp.standard_fp_status;
     int result_exp;


@@ -2998,13 +3174,12 @@ float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
 
     val64 = float64_val(f64);
 
 
     val64 = float64_val(f64);
 

-    val = ((val64 >> 63)  & 0x80000000)
-        | ((result_exp & 0xff) << 23)
+    val = ((result_exp & 0xff) << 23)

         | ((val64 >> 29)  & 0x7fffff);
     return make_float32(val);
 }
 
         | ((val64 >> 29)  & 0x7fffff);
     return make_float32(val);
 }
 

-uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
+uint32_t HELPER(recpe_u32)(uint32_t a, CPUARMState *env)

 {
     float64 f64;
 
 {
     float64 f64;
 


@@ -3020,7 +3195,7 @@ uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
 }
 
     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
 }
 

-uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
+uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUARMState *env)

 {
     float64 f64;
 
 {
     float64 f64;
 


@@ -3041,7 +3216,20 @@ uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
 }
 
     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
 }
 

-void HELPER(set_teecr)(CPUState *env, uint32_t val)
+/* VFPv4 fused multiply-accumulate */
+float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
+{
+    float_status *fpst = fpstp;
+    return float32_muladd(a, b, c, 0, fpst);
+}
+
+float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
+{
+    float_status *fpst = fpstp;
+    return float64_muladd(a, b, c, 0, fpst);
+}
+
+void HELPER(set_teecr)(CPUARMState *env, uint32_t val)

 {
     val &= 1;
     if (env->teecr != val) {
 {
     val &= 1;
     if (env->teecr != val) {