Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-A random mix of items here, nothing very major.
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
-thanks
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
 -- PMM
+are available in the Git repository at:
-The following changes since commit d0dff238a87fa81393ed72754d4dc8b09e50b08b:
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170206' into staging (2017-02-07 15:29:26 +0000)
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-are available in the git repository at:
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170207
 for you to fetch changes up to 7727b832886fafbdec7299eb7773dc9071bf4cdd:
   stellaris: Use the 'unimplemented' device for parts we don't implement (2017-02-07 18:30:00 +0000)
 ----------------------------------------------------------------
-target-arm:
+target-arm queue:
- * new "unimplemented" device for stubbing out devices in a
+ * Fix coverity nit in int_to_float code
-   system model so accesses can be logged
+ * Don't set Invalid for float-to-int(MAXINT)
- * stellaris: document the SoC memory map
+ * Fix fp_status_f16 tininess before rounding
- * arm: create instruction syndromes for AArch32 data aborts
+ * Add various missing insns from the v8.2-FP16 extension
- * arm: Correctly handle watchpoints for BE32 CPUs
+ * Fix sqrt_f16 exception raising
- * Fix Thumb-1 BE32 execution and disassembly
+ * sdcard: Correct CRC16 offset in sd_function_switch()
- * arm: Add cfgend parameter for ARM CPU selection
+ * tcg: Optionally log FPU state in TCG -d cpu logging
  * sd: sdhci: check data length during dma_memory_read
  * aspeed: add a watchdog controller
  * integratorcp: adding vmstate for save/restore
 ----------------------------------------------------------------
-Cédric Le Goater (2):
+Alex Bennée (5):
-      wdt: Add Aspeed watchdog device model
+      fpu/softfloat: int_to_float ensure r fully initialised
-      aspeed: add a watchdog controller
+      target/arm: Implement FCMP for fp16
       target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Julian Brown (4):
+Peter Maydell (3):
-      hw/arm/integratorcp: Support specifying features via -cpu
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-      target/arm: Add cfgend parameter for ARM CPU selection.
+      target/arm: Fix fp_status_f16 tininess before rounding
-      Fix Thumb-1 BE32 execution and disassembly.
+      tcg: Optionally log FPU state in TCG -d cpu logging
       arm: Correctly handle watchpoints for BE32 CPUs
-Pavel Dovgalyuk (1):
+Philippe Mathieu-Daudé (1):
-      integratorcp: adding vmstate for save/restore
+      sdcard: Correct CRC16 offset in sd_function_switch()
-Peter Maydell (5):
+Richard Henderson (7):
-      target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode
+      target/arm: Implement FMOV (general) for fp16
-      target/arm: A32, T32: Create Instruction Syndromes for Data Aborts
+      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-      stellaris: Document memory map and which SoC devices are unimplemented
+      target/arm: Implement FCVT (scalar, integer) for fp16
-      hw/misc: New "unimplemented" sysbus device
+      target/arm: Implement FCVT (scalar, fixed-point) for fp16
-      stellaris: Use the 'unimplemented' device for parts we don't implement
+      target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
-Prasad J Pandit (1):
+ include/qemu/log.h         |   1 +
-      sd: sdhci: check data length during dma_memory_read
+ target/arm/helper-a64.h    |   2 +
  target/arm/helper.h        |   6 +
  accel/tcg/cpu-exec.c       |   9 +-
  fpu/softfloat.c            |   6 +-
  hw/sd/sd.c                 |   2 +-
  target/arm/cpu.c           |   2 +
  target/arm/helper-a64.c    |  10 ++
  target/arm/helper.c        |  38 +++-
  target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
  util/log.c                 |   2 +
 files changed, 428 insertions(+), 71 deletions(-)
- hw/misc/Makefile.objs            |   2 +
- hw/watchdog/Makefile.objs        |   1 +
- include/disas/bfd.h              |   7 ++
- include/hw/arm/aspeed_soc.h      |   2 +
- include/hw/misc/unimp.h          |  39 +++++++
- include/hw/watchdog/wdt_aspeed.h |  32 ++++++
- include/qom/cpu.h                |   3 +
- target/arm/arm_ldst.h            |  10 +-
- target/arm/cpu.h                 |   7 ++
- target/arm/internals.h           |   5 +
- target/arm/translate.h           |  14 +++
- disas.c                          |   1 +
- exec.c                           |   1 +
- hw/arm/aspeed_soc.c              |  13 +++
- hw/arm/integratorcp.c            |  78 +++++++++++++-
- hw/arm/stellaris.c               |  48 +++++++++
- hw/misc/unimp.c                  | 107 +++++++++++++++++++
- hw/sd/sdhci.c                    |   2 +-
- hw/watchdog/wdt_aspeed.c         | 225 +++++++++++++++++++++++++++++++++++++++
- qom/cpu.c                        |   6 ++
- target/arm/cpu.c                 |  39 +++++++
- target/arm/op_helper.c           |  22 ++++
- target/arm/translate-a64.c       |  14 ---
- target/arm/translate.c           | 193 ++++++++++++++++++++++++---------
-files changed, 801 insertions(+), 70 deletions(-)
- create mode 100644 include/hw/misc/unimp.h
- create mode 100644 include/hw/watchdog/wdt_aspeed.h
- create mode 100644 hw/misc/unimp.c
- create mode 100644 hw/watchdog/wdt_aspeed.c

-New patch
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+From: Alex Bennée <alex.bennee@linaro.org>
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
+later on so we might as well mirror that.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ fpu/softfloat.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+ static FloatParts int_to_float(int64_t a, float_status *status)
+ {
+-    FloatParts r;
++    FloatParts r = {};
+     if (a == 0) {
+         r.cls = float_class_zero;
+         r.sign = false;
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+In float-to-integer conversion, if the floating point input
+converts exactly to the largest or smallest integer that
+fits in to the result type, this is not an overflow.
+In this situation we were producing the correct result value,
+but were incorrectly setting the Invalid flag.
+For example for Arm A64, "FCVTAS w0, d0" on an input of
+x41dfffffffc00000 should produce 0x7fffffff and set no flags.
+Fix the boundary case to take the right half of the if()
+statements.
+This fixes a regression from 2.11 introduced by the softfloat
+refactoring.
+Cc: qemu-stable@nongnu.org
+Fixes: ab52f973a50
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+---
+ fpu/softfloat.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+             r = UINT64_MAX;
+         }
+         if (p.sign) {
+-            if (r < -(uint64_t) min) {
++            if (r <= -(uint64_t) min) {
+                 return -r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
+                 return min;
+             }
+         } else {
+-            if (r < max) {
++            if (r <= max) {
+                 return r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
+--
+.17.0

-[Qemu-devel] [PULL 08/13] arm: Correctly handle watchpoints for BE32 CPUs
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
-From: Julian Brown <julian@codesourcery.com>
+In commit d81ce0ef2c4f105 we added an extra float_status field
 fp_status_fp16 for Arm, but forgot to initialize it correctly
 by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-In BE32 mode, sub-word size watchpoints can fail to trigger because the
+Add the missing initialization.
 address of the access is adjusted in the opcode helpers before being
 compared with the watchpoint registers.  This patch reverses the address
 adjustment before performing the comparison with the help of a new CPUClass
 hook.
-This version of the patch augments and tidies up comments a little.
+Fixes: d81ce0ef2c4f105
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
  target/arm/cpu.c | 2 ++
 file changed, 2 insertions(+)
-Signed-off-by: Julian Brown <julian@codesourcery.com>
-Message-id: caaf64ffc72f6ae183015337b7afdbd4b8989cb6.1484929304.git.julian@codesourcery.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qom/cpu.h      |  3 +++
- target/arm/internals.h |  5 +++++
- exec.c                 |  1 +
- qom/cpu.c              |  6 ++++++
- target/arm/cpu.c       |  3 +++
- target/arm/op_helper.c | 22 ++++++++++++++++++++++
-files changed, 40 insertions(+)
-diff --git a/include/qom/cpu.h b/include/qom/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qom/cpu.h
-+++ b/include/qom/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
-  * @cpu_exec_exit: Callback for cpu_exec cleanup.
-  * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
-  * @disas_set_info: Setup architecture specific components of disassembly info
-+ * @adjust_watchpoint_address: Perform a target-specific adjustment to an
-+ * address before attempting to match it against watchpoints.
-  *
-  * Represents a CPU family or model.
-  */
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
-+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
- } CPUClass;
- #ifdef HOST_WORDS_BIGENDIAN
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update_all(ARMCPU *cpu);
- /* Callback function for checking if a watchpoint should trigger. */
- bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
-+/* Adjust addresses (in BE32 mode) before testing against watchpoint
-+ * addresses.
-+ */
-+vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
-+
- /* Callback function for when a watchpoint or breakpoint triggers. */
- void arm_debug_excp_handler(CPUState *cs);
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-         return;
-     }
-     vaddr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
-+    vaddr = cc->adjust_watchpoint_address(cpu, vaddr, len);
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-         if (cpu_watchpoint_address_matches(wp, vaddr, len)
-             && (wp->flags & flags)) {
-diff --git a/qom/cpu.c b/qom/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/qom/cpu.c
-+++ b/qom/cpu.c
-@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
-     return cpu->cpu_index;
- }
-+static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
-+{
-+    return addr;
-+}
-+
- static void cpu_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
-     k->cpu_exec_enter = cpu_common_noop;
-     k->cpu_exec_exit = cpu_common_noop;
-     k->cpu_exec_interrupt = cpu_common_exec_interrupt;
-+    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
-     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
-     dc->realize = cpu_common_realizefn;
-     dc->unrealize = cpu_common_unrealizefn;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-     cc->gdb_stop_before_watchpoint = true;
+                               &env->vfp.fp_status);
-     cc->debug_excp_handler = arm_debug_excp_handler;
+     set_float_detect_tininess(float_tininess_before_rounding,
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
+                               &env->vfp.standard_fp_status);
-+#if !defined(CONFIG_USER_ONLY)
++    set_float_detect_tininess(float_tininess_before_rounding,
-+    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
++                              &env->vfp.fp_status_f16);
-+#endif
+ #ifndef CONFIG_USER_ONLY
+     if (kvm_enabled()) {
-     cc->disas_set_info = arm_disas_set_info;
+         kvm_arm_reset_vcpu(cpu);
  }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      return check_watchpoints(cpu);
  }
 +vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +
 +    /* In BE32 system mode, target memory is stored byteswapped (on a
 +     * little-endian host system), and by the time we reach here (via an
 +     * opcode helper) the addresses of subword accesses have been adjusted
 +     * to account for that, which means that watchpoints will not match.
 +     * Undo the adjustment here.
 +     */
 +    if (arm_sctlr_b(env)) {
 +        if (len == 1) {
 +            addr ^= 3;
 +        } else if (len == 2) {
 +            addr ^= 2;
 +        }
 +    }
 +
 +    return addr;
 +}
 +
  void arm_debug_excp_handler(CPUState *cs)
  {
      /* Called by core code when a watchpoint or breakpoint fires;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 13/13] stellaris: Use the 'unimplemented' device for parts we don't implement
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
-Use the 'unimplemented' dummy device to cover regions of the
+From: Richard Henderson <richard.henderson@linaro.org>
 SoC device memory map which we don't have proper device
 implementations for yet.
+Adding the fp16 moves to/from general registers.
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1484247815-15279-4-git-send-email-peter.maydell@linaro.org
 ---
- hw/arm/stellaris.c | 14 ++++++++++++++
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 14 insertions(+)
+file changed, 21 insertions(+)
-diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stellaris.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/stellaris.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
- #include "exec/address-spaces.h"
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
- #include "sysemu/sysemu.h"
+             clear_vec_high(s, true, rd);
- #include "hw/char/pl011.h"
+             break;
-+#include "hw/misc/unimp.h"
++        case 3:
++            /* 16 bit */
- #define GPIO_A 0
++            tmp = tcg_temp_new_i64();
- #define GPIO_B 1
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
-@@ -XXX,XX +XXX,XX @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
++            write_fp_dreg(s, rd, tmp);
-             }
++            tcg_temp_free_i64(tmp);
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
-+
-+    /* Add dummy regions for the devices we don't implement yet,
-+     * so guest accesses don't cause unlogged crashes.
-+     */
-+    create_unimplemented_device("wdtimer", 0x40000000, 0x1000);
-+    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
-+    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
-+    create_unimplemented_device("PWM", 0x40028000, 0x1000);
-+    create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
-+    create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
-+    create_unimplemented_device("analogue-comparator", 0x4003c000, 0x1000);
-+    create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
-+    create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
  }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
- /* FIXME: Figure out how to generate these from stellaris_boards.  */
+         case 0xa: /* 64 bit */
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 11/13] stellaris: Document memory map and which SoC devices are unimplemented
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-Add a comment documenting the memory map of the SoC devices and which
+From: Richard Henderson <richard.henderson@linaro.org>
 are not implemented.
+No sense in emitting code after the exception.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1484247815-15279-2-git-send-email-peter.maydell@linaro.org
 ---
- hw/arm/stellaris.c | 34 ++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 2 +-
-file changed, 34 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stellaris.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/stellaris.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
-x40024000, 0x40025000, 0x40026000};
+         default:
-     static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+             /* all other sf/type/rmode combinations are invalid */
+             unallocated_encoding(s);
-+    /* Memory map of SoC devices, from
+-            break;
-+     * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
++            return;
-+     * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
+         }
-+     *
-+     * 40000000 wdtimer (unimplemented)
+         if (!fp_access_check(s)) {
 +     * 40002000 i2c (unimplemented)
 +     * 40004000 GPIO
 +     * 40005000 GPIO
 +     * 40006000 GPIO
 +     * 40007000 GPIO
 +     * 40008000 SSI
 +     * 4000c000 UART
 +     * 4000d000 UART
 +     * 4000e000 UART
 +     * 40020000 i2c
 +     * 40021000 i2c (unimplemented)
 +     * 40024000 GPIO
 +     * 40025000 GPIO
 +     * 40026000 GPIO
 +     * 40028000 PWM (unimplemented)
 +     * 4002c000 QEI (unimplemented)
 +     * 4002d000 QEI (unimplemented)
 +     * 40030000 gptimer
 +     * 40031000 gptimer
 +     * 40032000 gptimer
 +     * 40033000 gptimer
 +     * 40038000 ADC
 +     * 4003c000 analogue comparator (unimplemented)
 +     * 40048000 ethernet
 +     * 400fc000 hibernation module (unimplemented)
 +     * 400fd000 flash memory control (unimplemented)
 +     * 400fe000 system control
 +     */
 +
      DeviceState *gpio_dev[7], *nvic;
      qemu_irq gpio_in[7][8];
      qemu_irq gpio_out[7][8];
 --
-.7.4
+.17.0

-New patch
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+From: Richard Henderson <richard.henderson@linaro.org>
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.h        |  6 +++
  target/arm/helper.c        | 38 ++++++++++++++-
  target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 files changed, 122 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
 +DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
  DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
 +DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
 +DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
  DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
  #undef VFP_CONV_FIX_A64
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
 .17.0

-[Qemu-devel] [PULL 06/13] target/arm: Add cfgend parameter for ARM CPU selection.
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
-From: Julian Brown <julian@codesourcery.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a new "cfgend" property which selects whether the CPU resets into
+Cc: qemu-stable@nongnu.org
-big-endian mode or not.  This setting affects whether we reset with
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-SCTLR_B (ARMv6 and earlier) or SCTLR_EE (ARMv7 and later) set.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Julian Brown <julian@codesourcery.com>
+Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Message-id: 11420d1c49636c1790e60578ee996e51f0f0b835.1484929304.git.julian@codesourcery.com
 [PMM: use error_report_err() rather than error_report();
  move the integratorcp changes to their own patch;
  drop an unnecessary extra #include;
  rephrase commit message accordingly;
  move setting of reset_sctlr above registration of cpregs
  so it actually has an effect]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h |  7 +++++++
+ target/arm/translate-a64.c | 17 +++++++++++++++--
- target/arm/cpu.c | 13 +++++++++++++
+file changed, 15 insertions(+), 2 deletions(-)
 files changed, 20 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
-     int gic_vpribits; /* number of virtual priority bits */
+     bool sf = extract32(insn, 31, 1);
-     int gic_vprebits; /* number of virtual preemption bits */
+     bool itof;
-+    /* Whether the cfgend input is high (i.e. this CPU should reset into
+-    if (sbit || (type > 1)
-+     * big-endian mode).  This setting isn't used directly: instead it modifies
+-        || (!sf && scale < 32)) {
-+     * the reset_sctlr value to have SCTLR_B or SCTLR_EE set, depending on the
++    if (sbit || (!sf && scale < 32)) {
-+     * architecture version.
++        unallocated_encoding(s);
-+     */
++        return;
 +    bool cfgend;
 +
      ARMELChangeHook *el_change_hook;
      void *el_change_hook_opaque;
  };
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_el2_property =
  static Property arm_cpu_has_el3_property =
              DEFINE_PROP_BOOL("has_el3", ARMCPU, has_el3, true);
 +static Property arm_cpu_cfgend_property =
 +            DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
 +
  /* use property name "pmu" to match other archs and virt tools */
  static Property arm_cpu_has_pmu_property =
              DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
          }
      }
 +    qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
 +                             &error_abort);
  }
  static void arm_cpu_finalizefn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
              cpu->reset_sctlr |= (1 << 13);
      }
 +    if (cpu->cfgend) {
 +        if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
 +            cpu->reset_sctlr |= SCTLR_EE;
 +        } else {
 +            cpu->reset_sctlr |= SCTLR_B;
 +        }
 +    }
 +
-     if (!cpu->has_el3) {
++    switch (type) {
-         /* If the has_el3 CPU property is disabled then we need to disable the
++    case 0: /* float32 */
-          * feature.
++    case 1: /* float64 */
 +        break;
 +    case 3: /* float16 */
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 05/13] hw/arm/integratorcp: Support specifying features via -cpu
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
-From: Julian Brown <julian@codesourcery.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Since the integratorcp board creates the CPU object directly
+Cc: qemu-stable@nongnu.org
 rather than via cpu_arm_init(), we have to call the CPU
 class parse_features() method ourselves if we want to
 support the user passing features via the -cpu command
 line argument as well as just the cpu name. Do so.
 Signed-off-by: Julian Brown <julian@codesourcery.com>
 [PMM: split out into its own patch]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/integratorcp.c | 19 +++++++++++++++++--
+ target/arm/translate-a64.c | 30 ++++++++++++++----------------
-file changed, 17 insertions(+), 2 deletions(-)
+file changed, 14 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/integratorcp.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/integratorcp.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
-     const char *kernel_filename = machine->kernel_filename;
+     return v;
-     const char *kernel_cmdline = machine->kernel_cmdline;
+ }
-     const char *initrd_filename = machine->initrd_filename;
-+    char **cpustr;
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
-     ObjectClass *cpu_oc;
++{
-+    CPUClass *cc;
++    TCGv_i32 v = tcg_temp_new_i32();
-     Object *cpuobj;
++
-     ARMCPU *cpu;
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
-+    const char *typename;
++    return v;
-     MemoryRegion *address_space_mem = get_system_memory();
++}
-     MemoryRegion *ram = g_new(MemoryRegion, 1);
++
-     MemoryRegion *ram_alias = g_new(MemoryRegion, 1);
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
-     qemu_irq pic[32];
+  * If SVE is not enabled, then there are only 128 bits in the vector.
-     DeviceState *dev, *sic, *icp;
+  */
-     int i;
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+    Error *err = NULL;
+ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+ {
-     if (!cpu_model) {
+     TCGv_ptr fpst = NULL;
-         cpu_model = "arm926";
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
 +    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
      TCGv_i32 tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
      switch (opcode) {
      case 0x0: /* FMOV */
          tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
          tcg_temp_free_i64(tcg_op2);
          tcg_temp_free_i64(tcg_res);
      } else {
 -        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
 -        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
 +        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
          TCGv_i64 tcg_res = tcg_temp_new_i64();
 -        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
--    cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);
+     if (is_scalar) {
-+    cpustr = g_strsplit(cpu_model, ",", 2);
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
-+
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-+    cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]);
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
-     if (!cpu_oc) {
-         fprintf(stderr, "Unable to find CPU definition\n");
+-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-         exit(1);
+-
-     }
+         switch (fpop) {
-+    typename = object_class_get_name(cpu_oc);
+         case 0x1a: /* FCVTNS */
-+
+         case 0x1b: /* FCVTMS */
 +    cc = CPU_CLASS(cpu_oc);
 +    cc->parse_features(typename, cpustr[1], &err);
 +    g_strfreev(cpustr);
 +    if (err) {
 +        error_report_err(err);
 +        exit(1);
 +    }
 -    cpuobj = object_new(object_class_get_name(cpu_oc));
 +    cpuobj = object_new(typename);
      /* By default ARM1176 CPUs have EL3 enabled.  This board does not
       * currently support EL3 so the CPU EL3 property is disabled before
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 07/13] Fix Thumb-1 BE32 execution and disassembly.
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
-From: Julian Brown <julian@codesourcery.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Thumb-1 code has some issues in BE32 mode (as currently implemented). In
+We missed all of the scalar fp16 binary operations.
 short, since bytes are swapped within words at load time for BE32
 executables, this also swaps pairs of adjacent Thumb-1 instructions.
-This patch un-swaps those pairs of instructions again, both for execution,
+Cc: qemu-stable@nongnu.org
-and for disassembly. (The previous version of the patch always read four
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-bytes in arm_read_memory_func and then extracted the proper two bytes,
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-in a probably misguided attempt to match the behaviour of actual hardware
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-as described by e.g. the ARM9TDMI TRM, section 3.3 "Endian effects for
+Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 instruction fetches". It's less complicated to just read the correct
 two bytes though.)
 Signed-off-by: Julian Brown <julian@codesourcery.com>
 Message-id: ca20462a044848000370318a8bd41dd0a4ed273f.1484929304.git.julian@codesourcery.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/disas/bfd.h   |  7 +++++++
+ target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
- target/arm/arm_ldst.h | 10 +++++++++-
+file changed, 65 insertions(+)
  disas.c               |  1 +
  target/arm/cpu.c      | 23 +++++++++++++++++++++++
 files changed, 40 insertions(+), 1 deletion(-)
-diff --git a/include/disas/bfd.h b/include/disas/bfd.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/disas/bfd.h
+--- a/target/arm/translate-a64.c
-+++ b/include/disas/bfd.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
-      The bottom 16 bits are for the internal use of the disassembler.  */
+     tcg_temp_free_i64(tcg_res);
-   unsigned long flags;
+ }
- #define INSN_HAS_RELOC    0x80000000
-+#define INSN_ARM_BE32    0x00010000
++/* Floating-point data-processing (2 source) - half precision */
-   PTR private_data;
++static void handle_fp_2src_half(DisasContext *s, int opcode,
++                                int rd, int rn, int rm)
-   /* Function used to get bytes to disassemble.  MEMADDR is the
++{
-@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {
++    TCGv_i32 tcg_op1;
-     (bfd_vma memaddr, bfd_byte *myaddr, int length,
++    TCGv_i32 tcg_op2;
-          struct disassemble_info *info);
++    TCGv_i32 tcg_res;
++    TCGv_ptr fpst;
 +  /* A place to stash the real read_memory_func if read_memory_func wants to
 +     do some funky address arithmetic or similar (e.g. for ARM BE32 mode).  */
 +  int (*read_memory_inner_func)
 +    (bfd_vma memaddr, bfd_byte *myaddr, int length,
 +             struct disassemble_info *info);
 +
-   /* Function which should be called if we get an error that we can't
++    tcg_res = tcg_temp_new_i32();
-      recover from.  STATUS is the errno value from read_memory_func and
++    fpst = get_fpstatus_ptr(true);
-      MEMADDR is the address that we were trying to read.  INFO is a
++    tcg_op1 = read_fp_hreg(s, rn);
-diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
++    tcg_op2 = read_fp_hreg(s, rm);
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/arm/arm_ldst.h
++    switch (opcode) {
-+++ b/target/arm/arm_ldst.h
++    case 0x0: /* FMUL */
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
++        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
- static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
++        break;
-                                      bool sctlr_b)
++    case 0x1: /* FDIV */
- {
++        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
--    uint16_t insn = cpu_lduw_code(env, addr);
++        break;
-+    uint16_t insn;
++    case 0x2: /* FADD */
-+#ifndef CONFIG_USER_ONLY
++        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
-+    /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
++        break;
-+       within each word.  Undo that now.  */
++    case 0x3: /* FSUB */
-+    if (sctlr_b) {
++        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
-+        addr ^= 2;
++        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
-+#endif
-+    insn = cpu_lduw_code(env, addr);
-     if (bswap_code(sctlr_b)) {
-         return bswap16(insn);
-     }
-diff --git a/disas.c b/disas.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas.c
-+++ b/disas.c
-@@ -XXX,XX +XXX,XX @@ void target_disas(FILE *out, CPUState *cpu, target_ulong code,
-     s.cpu = cpu;
-     s.info.read_memory_func = target_read_memory;
-+    s.info.read_memory_inner_func = NULL;
-     s.info.buffer_vma = code;
-     s.info.buffer_length = size;
-     s.info.print_address_func = generic_print_address;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ print_insn_thumb1(bfd_vma pc, disassemble_info *info)
-   return print_insn_arm(pc | 1, info);
- }
-+static int arm_read_memory_func(bfd_vma memaddr, bfd_byte *b,
-+                                int length, struct disassemble_info *info)
-+{
-+    assert(info->read_memory_inner_func);
-+    assert((info->flags & INSN_ARM_BE32) == 0 || length == 2 || length == 4);
 +
-+    if ((info->flags & INSN_ARM_BE32) != 0 && length == 2) {
++    write_fp_sreg(s, rd, tcg_res);
-+        assert(info->endian == BFD_ENDIAN_LITTLE);
++
-+        return info->read_memory_inner_func(memaddr ^ 2, (bfd_byte *)b, 2,
++    tcg_temp_free_ptr(fpst);
-+                                            info);
++    tcg_temp_free_i32(tcg_op1);
-+    } else {
++    tcg_temp_free_i32(tcg_op2);
-+        return info->read_memory_inner_func(memaddr, b, length, info);
++    tcg_temp_free_i32(tcg_res);
 +    }
 +}
 +
- static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
+ /* Floating point data-processing (2 source)
- {
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
-     ARMCPU *ac = ARM_CPU(cpu);
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
-@@ -XXX,XX +XXX,XX @@ static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
-         info->endian = BFD_ENDIAN_BIG;
+         }
- #endif
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
-+    if (info->read_memory_inner_func == NULL) {
-+        info->read_memory_inner_func = info->read_memory_func;
-+        info->read_memory_func = arm_read_memory_func;
-+    }
-+    info->flags &= ~INSN_ARM_BE32;
-+    if (arm_sctlr_b(env)) {
-+        info->flags |= INSN_ARM_BE32;
-+    }
- }
- static void arm_cpu_initfn(Object *obj)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 02/13] wdt: Add Aspeed watchdog device model
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The Aspeed SoC includes a set of watchdog timers using 32-bit
+We missed all of the scalar fp16 fma operations.
 decrement counters, which can be based either on the APB clock or
 a 1 MHz clock.
-The watchdog timer is designed to prevent system deadlock and, in
+Cc: qemu-stable@nongnu.org
-general, it should be restarted before timeout. When a timeout occurs,
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-different types of signals can be generated, ARM reset, SOC reset,
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-System reset, CPU Interrupt, external signal or boot from alternate
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-block. The current model only performs the system reset function as
+Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 this is used by U-Boot and Linux.
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Message-id: 1485452251-1593-2-git-send-email-clg@kaod.org
 [clg: - fixed compile breakage
       - fixed io region size
       - added watchdog_perform_action() on timer expiry
       - wrote a commit log
       - merged fixes from Andrew Jeffery to scale the reload value ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/watchdog/Makefile.objs        |   1 +
+ target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
- include/hw/watchdog/wdt_aspeed.h |  32 ++++++
+file changed, 48 insertions(+)
  hw/watchdog/wdt_aspeed.c         | 225 +++++++++++++++++++++++++++++++++++++++
 files changed, 258 insertions(+)
  create mode 100644 include/hw/watchdog/wdt_aspeed.h
  create mode 100644 hw/watchdog/wdt_aspeed.c
-diff --git a/hw/watchdog/Makefile.objs b/hw/watchdog/Makefile.objs
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/watchdog/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ common-obj-y += watchdog.o
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
- common-obj-$(CONFIG_WDT_IB6300ESB) += wdt_i6300esb.o
+     tcg_temp_free_i64(tcg_res);
- common-obj-$(CONFIG_WDT_IB700) += wdt_ib700.o
+ }
- common-obj-$(CONFIG_WDT_DIAG288) += wdt_diag288.o
-+common-obj-$(CONFIG_ASPEED_SOC) += wdt_aspeed.o
++/* Floating-point data-processing (3 source) - half precision */
-diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
-new file mode 100644
++                                int rd, int rn, int rm, int ra)
-index XXXXXXX..XXXXXXX
++{
---- /dev/null
++    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
-+++ b/include/hw/watchdog/wdt_aspeed.h
++    TCGv_i32 tcg_res = tcg_temp_new_i32();
-@@ -XXX,XX +XXX,XX @@
++    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +/*
 + * ASPEED Watchdog Controller
 + *
 + * Copyright (C) 2016-2017 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later. See the
 + * COPYING file in the top-level directory.
 + */
 +#ifndef ASPEED_WDT_H
 +#define ASPEED_WDT_H
 +
-+#include "hw/sysbus.h"
++    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
 +    tcg_op3 = read_fp_hreg(s, ra);
 +
-+#define TYPE_ASPEED_WDT "aspeed.wdt"
++    /* These are fused multiply-add, and must be done as one
-+#define ASPEED_WDT(obj) \
++     * floating point operation with no rounding between the
-+    OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
++     * multiplication and addition steps.
 +     * NB that doing the negations here as separate steps is
 +     * correct : an input NaN should come out with its sign bit
 +     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
-+#define ASPEED_WDT_REGS_MAX        (0x20 / 4)
++    if (o0 != o1) {
 +        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +    }
 +
-+typedef struct AspeedWDTState {
++    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    QEMUTimer *timer;
 +
-+    /*< public >*/
++    write_fp_sreg(s, rd, tcg_res);
 +    MemoryRegion iomem;
 +    uint32_t regs[ASPEED_WDT_REGS_MAX];
 +
-+    uint32_t pclk_freq;
++    tcg_temp_free_ptr(fpst);
-+} AspeedWDTState;
++    tcg_temp_free_i32(tcg_op1);
-+
++    tcg_temp_free_i32(tcg_op2);
-+#endif  /* ASPEED_WDT_H */
++    tcg_temp_free_i32(tcg_op3);
-diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
++    tcg_temp_free_i32(tcg_res);
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ASPEED Watchdog Controller
 + *
 + * Copyright (C) 2016-2017 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later. See the
 + * COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "sysemu/watchdog.h"
 +#include "hw/sysbus.h"
 +#include "qemu/timer.h"
 +#include "hw/watchdog/wdt_aspeed.h"
 +
 +#define WDT_STATUS              (0x00 / 4)
 +#define WDT_RELOAD_VALUE        (0x04 / 4)
 +#define WDT_RESTART             (0x08 / 4)
 +#define WDT_CTRL                (0x0C / 4)
 +#define   WDT_CTRL_RESET_MODE_SOC       (0x00 << 5)
 +#define   WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5)
 +#define   WDT_CTRL_1MHZ_CLK             BIT(4)
 +#define   WDT_CTRL_WDT_EXT              BIT(3)
 +#define   WDT_CTRL_WDT_INTR             BIT(2)
 +#define   WDT_CTRL_RESET_SYSTEM         BIT(1)
 +#define   WDT_CTRL_ENABLE               BIT(0)
 +
 +#define WDT_TIMEOUT_STATUS      (0x10 / 4)
 +#define WDT_TIMEOUT_CLEAR       (0x14 / 4)
 +#define WDT_RESET_WDITH         (0x18 / 4)
 +
 +#define WDT_RESTART_MAGIC       0x4755
 +
 +static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)
 +{
 +    return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;
 +}
 +
-+static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
+ /* Floating point data-processing (3 source)
-+{
+  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
-+    AspeedWDTState *s = ASPEED_WDT(opaque);
+  * +---+---+---+-----------+------+----+------+----+------+------+------+
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
-+    offset >>= 2;
+         }
-+
+         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
-+    switch (offset) {
+         break;
-+    case WDT_STATUS:
++    case 3:
-+        return s->regs[WDT_STATUS];
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+    case WDT_RELOAD_VALUE:
++            unallocated_encoding(s);
-+        return s->regs[WDT_RELOAD_VALUE];
++            return;
-+    case WDT_RESTART:
++        }
-+        qemu_log_mask(LOG_GUEST_ERROR,
++        if (!fp_access_check(s)) {
-+                      "%s: read from write-only reg at offset 0x%"
++            return;
-+                      HWADDR_PRIx "\n", __func__, offset);
++        }
-+        return 0;
++        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +    case WDT_CTRL:
 +        return s->regs[WDT_CTRL];
 +    case WDT_TIMEOUT_STATUS:
 +    case WDT_TIMEOUT_CLEAR:
 +    case WDT_RESET_WDITH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: uninmplemented read at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        return 0;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        return 0;
 +    }
 +
 +}
 +
 +static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)
 +{
 +    uint32_t reload;
 +
 +    if (pclk) {
 +        reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
 +                          s->pclk_freq);
 +    } else {
 +        reload = s->regs[WDT_RELOAD_VALUE] * 1000;
 +    }
 +
 +    if (aspeed_wdt_is_enabled(s)) {
 +        timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + reload);
 +    }
 +}
 +
 +static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
 +                             unsigned size)
 +{
 +    AspeedWDTState *s = ASPEED_WDT(opaque);
 +    bool enable = data & WDT_CTRL_ENABLE;
 +
 +    offset >>= 2;
 +
 +    switch (offset) {
 +    case WDT_STATUS:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: write to read-only reg at offset 0x%"
 +                      HWADDR_PRIx "\n", __func__, offset);
 +        break;
-+    case WDT_RELOAD_VALUE:
+     default:
-+        s->regs[WDT_RELOAD_VALUE] = data;
+         unallocated_encoding(s);
-+        break;
+     }
 +    case WDT_RESTART:
 +        if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {
 +            s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];
 +            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
 +        }
 +        break;
 +    case WDT_CTRL:
 +        if (enable && !aspeed_wdt_is_enabled(s)) {
 +            s->regs[WDT_CTRL] = data;
 +            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
 +        } else if (!enable && aspeed_wdt_is_enabled(s)) {
 +            s->regs[WDT_CTRL] = data;
 +            timer_del(s->timer);
 +        }
 +        break;
 +    case WDT_TIMEOUT_STATUS:
 +    case WDT_TIMEOUT_CLEAR:
 +    case WDT_RESET_WDITH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: uninmplemented write at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +    }
 +    return;
 +}
 +
 +static WatchdogTimerModel model = {
 +    .wdt_name = TYPE_ASPEED_WDT,
 +    .wdt_description = "Aspeed watchdog device",
 +};
 +
 +static const VMStateDescription vmstate_aspeed_wdt = {
 +    .name = "vmstate_aspeed_wdt",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_TIMER_PTR(timer, AspeedWDTState),
 +        VMSTATE_UINT32_ARRAY(regs, AspeedWDTState, ASPEED_WDT_REGS_MAX),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static const MemoryRegionOps aspeed_wdt_ops = {
 +    .read = aspeed_wdt_read,
 +    .write = aspeed_wdt_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 4,
 +    .valid.max_access_size = 4,
 +    .valid.unaligned = false,
 +};
 +
 +static void aspeed_wdt_reset(DeviceState *dev)
 +{
 +    AspeedWDTState *s = ASPEED_WDT(dev);
 +
 +    s->regs[WDT_STATUS] = 0x3EF1480;
 +    s->regs[WDT_RELOAD_VALUE] = 0x03EF1480;
 +    s->regs[WDT_RESTART] = 0;
 +    s->regs[WDT_CTRL] = 0;
 +
 +    timer_del(s->timer);
 +}
 +
 +static void aspeed_wdt_timer_expired(void *dev)
 +{
 +    AspeedWDTState *s = ASPEED_WDT(dev);
 +
 +    qemu_log_mask(CPU_LOG_RESET, "Watchdog timer expired.\n");
 +    watchdog_perform_action();
 +    timer_del(s->timer);
 +}
 +
 +#define PCLK_HZ 24000000
 +
 +static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    AspeedWDTState *s = ASPEED_WDT(dev);
 +
 +    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);
 +
 +    /* FIXME: This setting should be derived from the SCU hw strapping
 +     * register SCU70
 +     */
 +    s->pclk_freq = PCLK_HZ;
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_wdt_ops, s,
 +                          TYPE_ASPEED_WDT, ASPEED_WDT_REGS_MAX * 4);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = aspeed_wdt_realize;
 +    dc->reset = aspeed_wdt_reset;
 +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 +    dc->vmsd = &vmstate_aspeed_wdt;
 +}
 +
 +static const TypeInfo aspeed_wdt_info = {
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .name  = TYPE_ASPEED_WDT,
 +    .instance_size  = sizeof(AspeedWDTState),
 +    .class_init = aspeed_wdt_class_init,
 +};
 +
 +static void wdt_aspeed_register_types(void)
 +{
 +    watchdog_add_model(&model);
 +    type_register_static(&aspeed_wdt_info);
 +}
 +
 +type_init(wdt_aspeed_register_types)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 10/13] target/arm: A32, T32: Create Instruction Syndromes for Data Aborts
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
-Add support for generating the ISS (Instruction Specific Syndrome)
+From: Alex Bennée <alex.bennee@linaro.org>
-for Data Abort exceptions taken from AArch32. These syndromes are
-used by hypervisors for example to trap and emulate memory accesses.
+These where missed out from the rest of the half-precision work.
-This is the equivalent for AArch32 guests of the work done for AArch64
+Cc: qemu-stable@nongnu.org
-guests in commit aaa1f954d4cab243.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
 [rth: Diagnose lack of FP16 before fp_access_check]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 ---
- target/arm/translate.h     |  14 ++++
+ target/arm/helper-a64.h    |  2 +
- target/arm/translate-a64.c |  14 ----
+ target/arm/helper-a64.c    | 10 +++++
- target/arm/translate.c     | 184 +++++++++++++++++++++++++++++++++------------
+ target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
-files changed, 149 insertions(+), 63 deletions(-)
+files changed, 83 insertions(+), 17 deletions(-)
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
+--- a/target/arm/helper-a64.h
-+++ b/target/arm/translate.h
++++ b/target/arm/helper-a64.h
-@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@
-             ? 3 : MAX(1, s->current_el);
+ DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
  DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
  DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
 +DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
 +DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
  DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
  DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
  DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
      return flags;
  }
-+static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
++uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
 +{
-+    /* We don't need to save all of the syndrome so we mask and shift
++    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
 +     * out unneeded bits to help the sleb128 encoder do a better job.
 +     */
 +    syn &= ARM_INSN_START_WORD2_MASK;
 +    syn >>= ARM_INSN_START_WORD2_SHIFT;
 +
 +    /* We check and clear insn_start_idx to catch multiple updates.  */
 +    assert(s->insn_start_idx != 0);
 +    tcg_set_insn_param(s->insn_start_idx, 2, syn);
 +    s->insn_start_idx = 0;
 +}
 +
- /* target-specific extra values for is_jmp */
++uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
- /* These instructions trap after executing, so the A32/T32 decoder must
++{
-  * defer them until after the conditional execution state has been updated.
++    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
      return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
+@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
      }
  }
--static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+-static void handle_fp_compare(DisasContext *s, bool is_double,
--{
++static void handle_fp_compare(DisasContext *s, int size,
--    /* We don't need to save all of the syndrome so we mask and shift
+                               unsigned int rn, unsigned int rm,
--     * out uneeded bits to help the sleb128 encoder do a better job.
+                               bool cmp_with_zero, bool signal_all_nans)
 -     */
 -    syn &= ARM_INSN_START_WORD2_MASK;
 -    syn >>= ARM_INSN_START_WORD2_SHIFT;
 -
 -    /* We check and clear insn_start_idx to catch multiple updates.  */
 -    assert(s->insn_start_idx != 0);
 -    tcg_set_insn_param(s->insn_start_idx, 2, syn);
 -    s->insn_start_idx = 0;
 -}
 -
  static void unallocated_encoding(DisasContext *s)
  {
-     /* Unallocated and reserved encodings are uncategorized */
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+-    TCGv_ptr fpst = get_fpstatus_ptr(false);
-index XXXXXXX..XXXXXXX 100644
++    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
+-    if (is_double) {
-@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
++    if (size == MO_64) {
-     a64_translate_init();
+         TCGv_i64 tcg_vn, tcg_vm;
- }
+         tcg_vn = read_fp_dreg(s, rn);
-+/* Flags for the disas_set_da_iss info argument:
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
-+ * lower bits hold the Rt register number, higher bits are flags.
+         tcg_temp_free_i64(tcg_vn);
-+ */
+         tcg_temp_free_i64(tcg_vm);
-+typedef enum ISSInfo {
+     } else {
-+    ISSNone = 0,
+-        TCGv_i32 tcg_vn, tcg_vm;
-+    ISSRegMask = 0x1f,
++        TCGv_i32 tcg_vn = tcg_temp_new_i32();
-+    ISSInvalid = (1 << 5),
++        TCGv_i32 tcg_vm = tcg_temp_new_i32();
-+    ISSIsAcqRel = (1 << 6),
-+    ISSIsWrite = (1 << 7),
+-        tcg_vn = read_fp_sreg(s, rn);
-+    ISSIs16Bit = (1 << 8),
++        read_vec_element_i32(s, tcg_vn, rn, 0, size);
-+} ISSInfo;
+         if (cmp_with_zero) {
-+
+-            tcg_vm = tcg_const_i32(0);
-+/* Save the syndrome information for a Data Abort */
++            tcg_gen_movi_i32(tcg_vm, 0);
-+static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
+         } else {
-+{
+-            tcg_vm = read_fp_sreg(s, rm);
-+    uint32_t syn;
++            read_vec_element_i32(s, tcg_vm, rm, 0, size);
-+    int sas = memop & MO_SIZE;
+         }
-+    bool sse = memop & MO_SIGN;
+-        if (signal_all_nans) {
-+    bool is_acqrel = issinfo & ISSIsAcqRel;
+-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+    bool is_write = issinfo & ISSIsWrite;
+-        } else {
-+    bool is_16bit = issinfo & ISSIs16Bit;
+-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+    int srt = issinfo & ISSRegMask;
++
-+
++        switch (size) {
-+    if (issinfo & ISSInvalid) {
++        case MO_32:
-+        /* Some callsites want to conditionally provide ISS info,
++            if (signal_all_nans) {
-+         * eg "only if this was not a writeback"
++                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+         */
++            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    if (srt == 15) {
++    switch (type) {
-+        /* For AArch32, insns where the src/dest is R15 never generate
++    case 0:
-+         * ISS information. Catching that here saves checking at all
++        size = MO_32;
-+         * the call sites.
++        break;
-+         */
++    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
  /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    syn = syn_data_abort_with_iss(0, sas, sse, srt, 0, is_acqrel,
++    switch (type) {
-+                                  0, 0, 0, is_write, 0, is_16bit);
++    case 0:
-+    disas_set_insn_syndrome(s, syn);
++        size = MO_32;
-+}
++        break;
-+
++    case 1:
- static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
++        size = MO_64;
- {
++        break;
-     /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
++    case 3:
-@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val,      \
++        size = MO_16;
-                                      TCGv_i32 a32, int index)            \
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- {                                                                        \
++            break;
-     gen_aa32_ld_i32(s, val, a32, index, OPC | s->be_data);               \
++        }
-+}                                                                        \
++        /* fallthru */
-+static inline void gen_aa32_ld##SUFF##_iss(DisasContext *s,              \
++    default:
-+                                           TCGv_i32 val,                 \
+         unallocated_encoding(s);
-+                                           TCGv_i32 a32, int index,      \
+         return;
-+                                           ISSInfo issinfo)              \
+     }
-+{                                                                        \
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-+    gen_aa32_ld_i32(s, val, a32, index, OPC | s->be_data);               \
+         gen_set_label(label_match);
-+    disas_set_da_iss(s, OPC, issinfo);                                   \
+     }
- }
+-    handle_fp_compare(s, type, rn, rm, false, op);
- #define DO_GEN_ST(SUFF, OPC)                                             \
++    handle_fp_compare(s, size, rn, rm, false, op);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val,      \
-                                      TCGv_i32 a32, int index)            \
+     if (cond < 0x0e) {
- {                                                                        \
+         gen_set_label(label_continue);
      gen_aa32_st_i32(s, val, a32, index, OPC | s->be_data);               \
 +}                                                                        \
 +static inline void gen_aa32_st##SUFF##_iss(DisasContext *s,              \
 +                                           TCGv_i32 val,                 \
 +                                           TCGv_i32 a32, int index,      \
 +                                           ISSInfo issinfo)              \
 +{                                                                        \
 +    gen_aa32_st_i32(s, val, a32, index, OPC | s->be_data);               \
 +    disas_set_da_iss(s, OPC, issinfo | ISSIsWrite);                      \
  }
  static inline void gen_aa32_frob64(DisasContext *s, TCGv_i64 val)
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                                  tmp = tcg_temp_new_i32();
                                  switch (op1) {
                                  case 0: /* lda */
 -                                    gen_aa32_ld32u(s, tmp, addr,
 -                                                   get_mem_index(s));
 +                                    gen_aa32_ld32u_iss(s, tmp, addr,
 +                                                       get_mem_index(s),
 +                                                       rd | ISSIsAcqRel);
                                      break;
                                  case 2: /* ldab */
 -                                    gen_aa32_ld8u(s, tmp, addr,
 -                                                  get_mem_index(s));
 +                                    gen_aa32_ld8u_iss(s, tmp, addr,
 +                                                      get_mem_index(s),
 +                                                      rd | ISSIsAcqRel);
                                      break;
                                  case 3: /* ldah */
 -                                    gen_aa32_ld16u(s, tmp, addr,
 -                                                   get_mem_index(s));
 +                                    gen_aa32_ld16u_iss(s, tmp, addr,
 +                                                       get_mem_index(s),
 +                                                       rd | ISSIsAcqRel);
                                      break;
                                  default:
                                      abort();
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                                  tmp = load_reg(s, rm);
                                  switch (op1) {
                                  case 0: /* stl */
 -                                    gen_aa32_st32(s, tmp, addr,
 -                                                  get_mem_index(s));
 +                                    gen_aa32_st32_iss(s, tmp, addr,
 +                                                      get_mem_index(s),
 +                                                      rm | ISSIsAcqRel);
                                      break;
                                  case 2: /* stlb */
 -                                    gen_aa32_st8(s, tmp, addr,
 -                                                 get_mem_index(s));
 +                                    gen_aa32_st8_iss(s, tmp, addr,
 +                                                     get_mem_index(s),
 +                                                     rm | ISSIsAcqRel);
                                      break;
                                  case 3: /* stlh */
 -                                    gen_aa32_st16(s, tmp, addr,
 -                                                  get_mem_index(s));
 +                                    gen_aa32_st16_iss(s, tmp, addr,
 +                                                      get_mem_index(s),
 +                                                      rm | ISSIsAcqRel);
                                      break;
                                  default:
                                      abort();
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  bool wbit = insn & (1 << 21);
                  bool pbit = insn & (1 << 24);
                  bool doubleword = false;
 +                ISSInfo issinfo;
 +
                  /* Misc load/store */
                  rn = (insn >> 16) & 0xf;
                  rd = (insn >> 12) & 0xf;
 +                /* ISS not valid if writeback */
 +                issinfo = (pbit & !wbit) ? rd : ISSInvalid;
 +
                  if (!load && (sh & 2)) {
                      /* doubleword */
                      ARCH(5TE);
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                      tmp = tcg_temp_new_i32();
                      switch (sh) {
                      case 1:
 -                        gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
 +                        gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s),
 +                                           issinfo);
                          break;
                      case 2:
 -                        gen_aa32_ld8s(s, tmp, addr, get_mem_index(s));
 +                        gen_aa32_ld8s_iss(s, tmp, addr, get_mem_index(s),
 +                                          issinfo);
                          break;
                      default:
                      case 3:
 -                        gen_aa32_ld16s(s, tmp, addr, get_mem_index(s));
 +                        gen_aa32_ld16s_iss(s, tmp, addr, get_mem_index(s),
 +                                           issinfo);
                          break;
                      }
                  } else {
                      /* store */
                      tmp = load_reg(s, rd);
 -                    gen_aa32_st16(s, tmp, addr, get_mem_index(s));
 +                    gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), issinfo);
                      tcg_temp_free_i32(tmp);
                  }
                  /* Perform base writeback before the loaded value to
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  /* load */
                  tmp = tcg_temp_new_i32();
                  if (insn & (1 << 22)) {
 -                    gen_aa32_ld8u(s, tmp, tmp2, i);
 +                    gen_aa32_ld8u_iss(s, tmp, tmp2, i, rd);
                  } else {
 -                    gen_aa32_ld32u(s, tmp, tmp2, i);
 +                    gen_aa32_ld32u_iss(s, tmp, tmp2, i, rd);
                  }
              } else {
                  /* store */
                  tmp = load_reg(s, rd);
                  if (insn & (1 << 22)) {
 -                    gen_aa32_st8(s, tmp, tmp2, i);
 +                    gen_aa32_st8_iss(s, tmp, tmp2, i, rd);
                  } else {
 -                    gen_aa32_st32(s, tmp, tmp2, i);
 +                    gen_aa32_st32_iss(s, tmp, tmp2, i, rd);
                  }
                  tcg_temp_free_i32(tmp);
              }
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                          tmp = tcg_temp_new_i32();
                          switch (op) {
                          case 0: /* ldab */
 -                            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s),
 +                                              rs | ISSIsAcqRel);
                              break;
                          case 1: /* ldah */
 -                            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s),
 +                                               rs | ISSIsAcqRel);
                              break;
                          case 2: /* lda */
 -                            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
 +                                               rs | ISSIsAcqRel);
                              break;
                          default:
                              abort();
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                          tmp = load_reg(s, rs);
                          switch (op) {
                          case 0: /* stlb */
 -                            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s),
 +                                             rs | ISSIsAcqRel);
                              break;
                          case 1: /* stlh */
 -                            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s),
 +                                              rs | ISSIsAcqRel);
                              break;
                          case 2: /* stl */
 -                            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
 +                            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s),
 +                                              rs | ISSIsAcqRel);
                              break;
                          default:
                              abort();
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
          int postinc = 0;
          int writeback = 0;
          int memidx;
 +        ISSInfo issinfo;
 +
          if ((insn & 0x01100000) == 0x01000000) {
              if (disas_neon_ls_insn(s, insn)) {
                  goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                  }
              }
          }
 +
 +        issinfo = writeback ? ISSInvalid : rs;
 +
          if (insn & (1 << 20)) {
              /* Load.  */
              tmp = tcg_temp_new_i32();
              switch (op) {
              case 0:
 -                gen_aa32_ld8u(s, tmp, addr, memidx);
 +                gen_aa32_ld8u_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 4:
 -                gen_aa32_ld8s(s, tmp, addr, memidx);
 +                gen_aa32_ld8s_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 1:
 -                gen_aa32_ld16u(s, tmp, addr, memidx);
 +                gen_aa32_ld16u_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 5:
 -                gen_aa32_ld16s(s, tmp, addr, memidx);
 +                gen_aa32_ld16s_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 2:
 -                gen_aa32_ld32u(s, tmp, addr, memidx);
 +                gen_aa32_ld32u_iss(s, tmp, addr, memidx, issinfo);
                  break;
              default:
                  tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
              tmp = load_reg(s, rs);
              switch (op) {
              case 0:
 -                gen_aa32_st8(s, tmp, addr, memidx);
 +                gen_aa32_st8_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 1:
 -                gen_aa32_st16(s, tmp, addr, memidx);
 +                gen_aa32_st16_iss(s, tmp, addr, memidx, issinfo);
                  break;
              case 2:
 -                gen_aa32_st32(s, tmp, addr, memidx);
 +                gen_aa32_st32_iss(s, tmp, addr, memidx, issinfo);
                  break;
              default:
                  tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
              addr = tcg_temp_new_i32();
              tcg_gen_movi_i32(addr, val);
              tmp = tcg_temp_new_i32();
 -            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
 +                               rd | ISSIs16Bit);
              tcg_temp_free_i32(addr);
              store_reg(s, rd, tmp);
              break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
          switch (op) {
          case 0: /* str */
 -            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 1: /* strh */
 -            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 2: /* strb */
 -            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 3: /* ldrsb */
 -            gen_aa32_ld8s(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld8s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 4: /* ldr */
 -            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 5: /* ldrh */
 -            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 6: /* ldrb */
 -            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          case 7: /* ldrsh */
 -            gen_aa32_ld16s(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld16s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              break;
          }
          if (op >= 3) { /* load */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
          if (insn & (1 << 11)) {
              /* load */
              tmp = tcg_temp_new_i32();
 -            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              store_reg(s, rd, tmp);
          } else {
              /* store */
              tmp = load_reg(s, rd);
 -            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              tcg_temp_free_i32(tmp);
          }
          tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
          if (insn & (1 << 11)) {
              /* load */
              tmp = tcg_temp_new_i32();
 -            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              store_reg(s, rd, tmp);
          } else {
              /* store */
              tmp = load_reg(s, rd);
 -            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              tcg_temp_free_i32(tmp);
          }
          tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
          if (insn & (1 << 11)) {
              /* load */
              tmp = tcg_temp_new_i32();
 -            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              store_reg(s, rd, tmp);
          } else {
              /* store */
              tmp = load_reg(s, rd);
 -            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
 +            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
              tcg_temp_free_i32(tmp);
          }
          tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
          store_cpu_field(tmp, condexec_bits);
        }
      do {
 +        dc->insn_start_idx = tcg_op_buf_count();
          tcg_gen_insn_start(dc->pc,
                             (dc->condexec_cond << 4) | (dc->condexec_mask >> 1),
 );
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 12/13] hw/misc: New "unimplemented" sysbus device
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-Create a new "unimplemented" sysbus device, which simply accepts
+From: Alex Bennée <alex.bennee@linaro.org>
 all read and write accesses, and implements them as read-as-zero,
 write-ignored, with logging of the access as LOG_UNIMP.
-This is useful for stubbing out bits of an SoC or board model
+These were missed out from the rest of the half-precision work.
 which haven't been written yet.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
+[rth: Fix erroneous check vs type]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1484247815-15279-3-git-send-email-peter.maydell@linaro.org
 ---
- hw/misc/Makefile.objs   |   2 +
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
- include/hw/misc/unimp.h |  39 ++++++++++++++++++
+file changed, 25 insertions(+), 6 deletions(-)
  hw/misc/unimp.c         | 107 ++++++++++++++++++++++++++++++++++++++++++++++++
 files changed, 148 insertions(+)
  create mode 100644 include/hw/misc/unimp.h
  create mode 100644 hw/misc/unimp.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SGA) += sga.o
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
+     unsigned int mos, type, rm, cond, rn, rd;
- common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
+     TCGv_i64 t_true, t_false, t_zero;
+     DisasCompare64 c;
-+common-obj-y += unimp.o
++    TCGMemOp sz;
-+
- obj-$(CONFIG_VMPORT) += vmport.o
+     mos = extract32(insn, 29, 3);
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
- # ARM devices
++    type = extract32(insn, 22, 2);
-diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
+     rm = extract32(insn, 16, 5);
-new file mode 100644
+     cond = extract32(insn, 12, 4);
-index XXXXXXX..XXXXXXX
+     rn = extract32(insn, 5, 5);
---- /dev/null
+     rd = extract32(insn, 0, 5);
-+++ b/include/hw/misc/unimp.h
-@@ -XXX,XX +XXX,XX @@
+-    if (mos || type > 1) {
-+/*
++    if (mos) {
-+ * "Unimplemented" device
++        unallocated_encoding(s);
 + *
 + * Copyright Linaro Limited, 2017
 + * Written by Peter Maydell
 + */
 +
 +#ifndef HW_MISC_UNIMP_H
 +#define HW_MISC_UNIMP_H
 +
 +#define TYPE_UNIMPLEMENTED_DEVICE "unimplemented-device"
 +
 +/**
 + * create_unimplemented_device: create and map a dummy device
 + * @name: name of the device for debug logging
 + * @base: base address of the device's MMIO region
 + * @size: size of the device's MMIO region
 + *
 + * This utility function creates and maps an instance of unimplemented-device,
 + * which is a dummy device which simply logs all guest accesses to
 + * it via the qemu_log LOG_UNIMP debug log.
 + * The device is mapped at priority -1000, which means that you can
 + * use it to cover a large region and then map other devices on top of it
 + * if necessary.
 + */
 +static inline void create_unimplemented_device(const char *name,
 +                                               hwaddr base,
 +                                               hwaddr size)
 +{
 +    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
 +
 +    qdev_prop_set_string(dev, "name", name);
 +    qdev_prop_set_uint64(dev, "size", size);
 +    qdev_init_nofail(dev);
 +
 +    sysbus_mmio_map_overlap(SYS_BUS_DEVICE(dev), 0, base, -1000);
 +}
 +
 +#endif
 diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/unimp.c
@@ -XXX,XX +XXX,XX @@
 +/* "Unimplemented" device
 + *
 + * This is a dummy device which accepts and logs all accesses.
 + * It's useful for stubbing out regions of an SoC or board
 + * map which correspond to devices that have not yet been
 + * implemented. This is often sufficient to placate initial
 + * guest device driver probing such that the system will
 + * come up.
 + *
 + * Copyright Linaro Limited, 2017
 + * Written by Peter Maydell
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/hw.h"
 +#include "hw/sysbus.h"
 +#include "hw/misc/unimp.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +
 +#define UNIMPLEMENTED_DEVICE(obj) \
 +    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
 +
 +typedef struct {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +    char *name;
 +    uint64_t size;
 +} UnimplementedDeviceState;
 +
 +static uint64_t unimp_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
 +
 +    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
 +                  "(size %d, offset 0x%" HWADDR_PRIx ")\n",
 +                  s->name, size, offset);
 +    return 0;
 +}
 +
 +static void unimp_write(void *opaque, hwaddr offset,
 +                        uint64_t value, unsigned size)
 +{
 +    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
 +
 +    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
 +                  "(size %d, value 0x%" PRIx64
 +                  ", offset 0x%" HWADDR_PRIx ")\n",
 +                  s->name, size, value, offset);
 +}
 +
 +static const MemoryRegionOps unimp_ops = {
 +    .read = unimp_read,
 +    .write = unimp_write,
 +    .impl.min_access_size = 1,
 +    .impl.max_access_size = 8,
 +    .valid.min_access_size = 1,
 +    .valid.max_access_size = 8,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void unimp_realize(DeviceState *dev, Error **errp)
 +{
 +    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(dev);
 +
 +    if (s->size == 0) {
 +        error_setg(errp, "property 'size' not specified or zero");
 +        return;
 +    }
 +
-+    if (s->name == NULL) {
++    switch (type) {
-+        error_setg(errp, "property 'name' not specified");
++    case 0:
-+        return;
++        sz = MO_32;
-+    }
++        break;
-+
++    case 1:
-+    memory_region_init_io(&s->iomem, OBJECT(s), &unimp_ops, s,
++        sz = MO_64;
-+                          s->name, s->size);
++        break;
-+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
++    case 3:
-+}
++        sz = MO_16;
-+
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+static Property unimp_properties[] = {
++            break;
-+    DEFINE_PROP_UINT64("size", UnimplementedDeviceState, size, 0),
++        }
-+    DEFINE_PROP_STRING("name", UnimplementedDeviceState, name),
++        /* fallthru */
-+    DEFINE_PROP_END_OF_LIST(),
++    default:
-+};
+         unallocated_encoding(s);
-+
+         return;
-+static void unimp_class_init(ObjectClass *klass, void *data)
+     }
-+{
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+    DeviceClass *dc = DEVICE_CLASS(klass);
+         return;
-+
+     }
-+    dc->realize = unimp_realize;
-+    dc->props = unimp_properties;
+-    /* Zero extend sreg inputs to 64 bits now.  */
-+}
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-+
+     t_true = tcg_temp_new_i64();
-+static const TypeInfo unimp_info = {
+     t_false = tcg_temp_new_i64();
-+    .name = TYPE_UNIMPLEMENTED_DEVICE,
+-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-+    .parent = TYPE_SYS_BUS_DEVICE,
+-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-+    .instance_size = sizeof(UnimplementedDeviceState),
++    read_vec_element(s, t_true, rn, 0, sz);
-+    .class_init = unimp_class_init,
++    read_vec_element(s, t_false, rm, 0, sz);
-+};
-+
+     a64_test_cc(&c, cond);
-+static void unimp_register_types(void)
+     t_zero = tcg_const_i64(0);
-+{
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+    type_register_static(&unimp_info);
+     tcg_temp_free_i64(t_false);
-+}
+     a64_free_cc(&c);
-+
-+type_init(unimp_register_types)
+-    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 03/13] aspeed: add a watchdog controller
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
-From: Cédric Le Goater <clg@kaod.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-This enables reboot of a guest from U-Boot and Linux.
+All the hard work is already done by vfp_expand_imm, we just need to
 make sure we pick up the correct size.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1485452251-1593-3-git-send-email-clg@kaod.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  2 ++
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
- hw/arm/aspeed_soc.c         | 13 +++++++++++++
+file changed, 17 insertions(+), 3 deletions(-)
 files changed, 15 insertions(+)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
- #include "hw/timer/aspeed_timer.h"
+ {
- #include "hw/i2c/aspeed_i2c.h"
+     int rd = extract32(insn, 0, 5);
- #include "hw/ssi/aspeed_smc.h"
+     int imm8 = extract32(insn, 13, 8);
-+#include "hw/watchdog/wdt_aspeed.h"
+-    int is_double = extract32(insn, 22, 2);
++    int type = extract32(insn, 22, 2);
- #define ASPEED_SPIS_NUM  2
+     uint64_t imm;
+     TCGv_i64 tcg_res;
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
++    TCGMemOp sz;
-     AspeedSMCState fmc;
-     AspeedSMCState spi[ASPEED_SPIS_NUM];
+-    if (is_double > 1) {
-     AspeedSDMCState sdmc;
++    switch (type) {
-+    AspeedWDTState wdt;
++    case 0:
- } AspeedSoCState;
++        sz = MO_32;
++        break;
- #define TYPE_ASPEED_SOC "aspeed-soc"
++    case 1:
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
++        sz = MO_64;
-index XXXXXXX..XXXXXXX 100644
++        break;
---- a/hw/arm/aspeed_soc.c
++    case 3:
-+++ b/hw/arm/aspeed_soc.c
++        sz = MO_16;
-@@ -XXX,XX +XXX,XX @@
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- #define ASPEED_SOC_SCU_BASE         0x1E6E2000
++            break;
- #define ASPEED_SOC_SRAM_BASE        0x1E720000
++        }
- #define ASPEED_SOC_TIMER_BASE       0x1E782000
++        /* fallthru */
-+#define ASPEED_SOC_WDT_BASE         0x1E785000
++    default:
- #define ASPEED_SOC_I2C_BASE         0x1E78A000
+         unallocated_encoding(s);
  static const int uart_irqs[] = { 9, 32, 33, 34, 10 };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                           sc->info->silicon_rev);
      object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                                "ram-size", &error_abort);
 +
 +    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
 +    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
 +    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
  }
  static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          return;
      }
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-+
+         return;
-+    /* Watch dog */
+     }
-+    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
-+    if (err) {
+-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
-+        error_propagate(errp, err);
++    imm = vfp_expand_imm(sz, imm8);
-+        return;
-+    }
+     tcg_res = tcg_const_i64(imm);
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
+     write_fp_dreg(s, rd, tcg_res);
  }
  static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 04/13] sd: sdhci: check data length during dma_memory_read
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-While doing multi block SDMA transfer in routine
+We are meant to explicitly pass fpst, not cpu_env.
 'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
 index 'begin' and data length 's->data_count' could end up to be same.
 This could lead to an OOB access issue. Correct transfer data length
 to avoid it.
 Cc: qemu-stable@nongnu.org
-Reported-by: Jiang Xin <jiangxin1@huawei.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20170130064736.9236-1-ppandit@redhat.com
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 2 +-
+ target/arm/translate-a64.c | 3 ++-
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/sd/sdhci.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
-                 boundary_count -= block_size - begin;
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-             }
+         break;
-             dma_memory_read(&address_space_memory, s->sdmasysad,
+     case 0x3: /* FSQRT */
--                            &s->fifo_buffer[begin], s->data_count);
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
-+                            &s->fifo_buffer[begin], s->data_count - begin);
++        fpst = get_fpstatus_ptr(true);
-             s->sdmasysad += s->data_count - begin;
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
-             if (s->data_count == block_size) {
+         break;
-                 for (n = 0; n < block_size; n++) {
+     case 0x8: /* FRINTN */
      case 0x9: /* FRINTP */
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 01/13] integratorcp: adding vmstate for save/restore
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
-From: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-VMState added by this patch preserves correct
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
 loading of the integratorcp device state.
-Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
+  The block length is predefined to 512 bits
-Message-id: 20170131114310.6768.79416.stgit@PASHA-ISP
-[PMM: removed unnecessary minimum_version_id_old lines]
+and "4.10.2 SD Status":
   The SD Status contains status bits that are related to the SD Memory Card
   proprietary features and may be used for future application-specific usage.
   The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/integratorcp.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/sd/sd.c | 2 +-
-file changed, 59 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/integratorcp.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/integratorcp.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static uint8_t integrator_spd[128] = {
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
-xe, 4, 0x1c, 1, 2, 0x20, 0xc0, 0, 0, 0, 0, 0x30, 0x28, 0x30, 0x28, 0x40
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
- };
+     }
+     memset(&sd->data[17], 0, 47);
-+static const VMStateDescription vmstate_integratorcm = {
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-+    .name = "integratorcm",
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields      = (VMStateField[]) {
 +        VMSTATE_UINT32(cm_osc, IntegratorCMState),
 +        VMSTATE_UINT32(cm_ctrl, IntegratorCMState),
 +        VMSTATE_UINT32(cm_lock, IntegratorCMState),
 +        VMSTATE_UINT32(cm_auxosc, IntegratorCMState),
 +        VMSTATE_UINT32(cm_sdram, IntegratorCMState),
 +        VMSTATE_UINT32(cm_init, IntegratorCMState),
 +        VMSTATE_UINT32(cm_flags, IntegratorCMState),
 +        VMSTATE_UINT32(cm_nvflags, IntegratorCMState),
 +        VMSTATE_UINT32(int_level, IntegratorCMState),
 +        VMSTATE_UINT32(irq_enabled, IntegratorCMState),
 +        VMSTATE_UINT32(fiq_enabled, IntegratorCMState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static uint64_t integratorcm_read(void *opaque, hwaddr offset,
                                    unsigned size)
  {
@@ -XXX,XX +XXX,XX @@ typedef struct icp_pic_state {
      qemu_irq parent_fiq;
  } icp_pic_state;
 +static const VMStateDescription vmstate_icp_pic = {
 +    .name = "icp_pic",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields      = (VMStateField[]) {
 +        VMSTATE_UINT32(level, icp_pic_state),
 +        VMSTATE_UINT32(irq_enabled, icp_pic_state),
 +        VMSTATE_UINT32(fiq_enabled, icp_pic_state),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static void icp_pic_update(icp_pic_state *s)
  {
      uint32_t flags;
@@ -XXX,XX +XXX,XX @@ typedef struct ICPCtrlRegsState {
  #define ICP_INTREG_WPROT        (1 << 0)
  #define ICP_INTREG_CARDIN       (1 << 3)
 +static const VMStateDescription vmstate_icp_control = {
 +    .name = "icp_control",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields      = (VMStateField[]) {
 +        VMSTATE_UINT32(intreg_state, ICPCtrlRegsState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static uint64_t icp_control_read(void *opaque, hwaddr offset,
                                   unsigned size)
  {
@@ -XXX,XX +XXX,XX @@ static void core_class_init(ObjectClass *klass, void *data)
      dc->props = core_properties;
      dc->realize = integratorcm_realize;
 +    dc->vmsd = &vmstate_integratorcm;
 +}
 +
 +static void icp_pic_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_icp_pic;
 +}
 +
 +static void icp_control_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_icp_control;
  }
- static const TypeInfo core_info = {
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo icp_pic_info = {
      .parent        = TYPE_SYS_BUS_DEVICE,
      .instance_size = sizeof(icp_pic_state),
      .instance_init = icp_pic_init,
 +    .class_init    = icp_pic_class_init,
  };
  static const TypeInfo icp_ctrl_regs_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo icp_ctrl_regs_info = {
      .parent        = TYPE_SYS_BUS_DEVICE,
      .instance_size = sizeof(ICPCtrlRegsState),
      .instance_init = icp_control_init,
 +    .class_init    = icp_control_class_init,
  };
  static void integratorcp_register_types(void)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 09/13] target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-In the ARM ldr/str decode path, rather than directly testing
+Usually the logging of the CPU state produced by -d cpu is sufficient
-"insn & (1 << 21)" and "insn & (1 << 24)", abstract these
+to diagnose problems, but sometimes you want to see the state of
-bits out into wbit and pbit local flags. (We will want to
+the floating point registers as well. We don't want to enable that
-do more tests against them to determine whether we need to
+by default as it adds a lot of extra data to the log; instead,
-provide syndrome information.)
+allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 9 ++++++---
+ include/qemu/log.h   | 1 +
-file changed, 6 insertions(+), 3 deletions(-)
+ accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/include/qemu/log.h
-+++ b/target/arm/translate.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
-             } else {
+ #define CPU_LOG_PAGE       (1 << 14)
-                 int address_offset;
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-                 bool load = insn & (1 << 20);
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
-+                bool wbit = insn & (1 << 21);
++#define CPU_LOG_TB_FPU     (1 << 17)
-+                bool pbit = insn & (1 << 24);
-                 bool doubleword = false;
+ /* Lock output for a series of related logs.  Since this is not needed
-                 /* Misc load/store */
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-                 rn = (insn >> 16) & 0xf;
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+index XXXXXXX..XXXXXXX 100644
-                 }
+--- a/accel/tcg/cpu-exec.c
++++ b/accel/tcg/cpu-exec.c
-                 addr = load_reg(s, rn);
+@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
--                if (insn & (1 << 24))
+     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-+                if (pbit) {
+         && qemu_log_in_addr_range(itb->pc)) {
-                     gen_add_datah_offset(s, insn, 0, addr);
+         qemu_log_lock();
-+                }
++        int flags = 0;
-                 address_offset = 0;
++        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
++            flags |= CPU_DUMP_FPU;
-                 if (doubleword) {
++        }
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+ #if defined(TARGET_I386)
-                    ensure correct behavior with overlapping index registers.
+-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-                    ldrd with base writeback is undefined if the
+-#else
-                    destination and index registers overlap.  */
+-        log_cpu_state(cpu, 0);
--                if (!(insn & (1 << 24))) {
++        flags |= CPU_DUMP_CCOP;
-+                if (!pbit) {
+ #endif
-                     gen_add_datah_offset(s, insn, address_offset, addr);
++        log_cpu_state(cpu, flags);
-                     store_reg(s, rn, addr);
+         qemu_log_unlock();
--                } else if (insn & (1 << 21)) {
+     }
-+                } else if (wbit) {
+ #endif /* DEBUG_DISAS */
-                     if (address_offset)
+diff --git a/util/log.c b/util/log.c
-                         tcg_gen_addi_i32(addr, addr, address_offset);
+index XXXXXXX..XXXXXXX 100644
-                     store_reg(s, rn, addr);
+--- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.7.4
+.17.0

A random mix of items here, nothing very major.

thanks
-- PMM

The following changes since commit d0dff238a87fa81393ed72754d4dc8b09e50b08b:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170206' into staging (2017-02-07 15:29:26 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170207

for you to fetch changes up to 7727b832886fafbdec7299eb7773dc9071bf4cdd:

stellaris: Use the 'unimplemented' device for parts we don't implement (2017-02-07 18:30:00 +0000)

----------------------------------------------------------------
target-arm:
 * new "unimplemented" device for stubbing out devices in a
   system model so accesses can be logged
 * stellaris: document the SoC memory map
 * arm: create instruction syndromes for AArch32 data aborts
 * arm: Correctly handle watchpoints for BE32 CPUs
 * Fix Thumb-1 BE32 execution and disassembly
 * arm: Add cfgend parameter for ARM CPU selection
 * sd: sdhci: check data length during dma_memory_read
 * aspeed: add a watchdog controller
 * integratorcp: adding vmstate for save/restore

----------------------------------------------------------------
Cédric Le Goater (2):
      wdt: Add Aspeed watchdog device model
      aspeed: add a watchdog controller

Julian Brown (4):
      hw/arm/integratorcp: Support specifying features via -cpu
      target/arm: Add cfgend parameter for ARM CPU selection.
      Fix Thumb-1 BE32 execution and disassembly.
      arm: Correctly handle watchpoints for BE32 CPUs

Pavel Dovgalyuk (1):
      integratorcp: adding vmstate for save/restore

Peter Maydell (5):
      target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode
      target/arm: A32, T32: Create Instruction Syndromes for Data Aborts
      stellaris: Document memory map and which SoC devices are unimplemented
      hw/misc: New "unimplemented" sysbus device
      stellaris: Use the 'unimplemented' device for parts we don't implement

Prasad J Pandit (1):
      sd: sdhci: check data length during dma_memory_read

From: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>

VMState added by this patch preserves correct
loading of the integratorcp device state.

Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
Message-id: 20170131114310.6768.79416.stgit@PASHA-ISP
[PMM: removed unnecessary minimum_version_id_old lines]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/integratorcp.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@ static uint8_t integrator_spd[128] = {
    0xe, 4, 0x1c, 1, 2, 0x20, 0xc0, 0, 0, 0, 0, 0x30, 0x28, 0x30, 0x28, 0x40
 };
 
+static const VMStateDescription vmstate_integratorcm = {
+    .name = "integratorcm",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields      = (VMStateField[]) {
+        VMSTATE_UINT32(cm_osc, IntegratorCMState),
+        VMSTATE_UINT32(cm_ctrl, IntegratorCMState),
+        VMSTATE_UINT32(cm_lock, IntegratorCMState),
+        VMSTATE_UINT32(cm_auxosc, IntegratorCMState),
+        VMSTATE_UINT32(cm_sdram, IntegratorCMState),
+        VMSTATE_UINT32(cm_init, IntegratorCMState),
+        VMSTATE_UINT32(cm_flags, IntegratorCMState),
+        VMSTATE_UINT32(cm_nvflags, IntegratorCMState),
+        VMSTATE_UINT32(int_level, IntegratorCMState),
+        VMSTATE_UINT32(irq_enabled, IntegratorCMState),
+        VMSTATE_UINT32(fiq_enabled, IntegratorCMState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static uint64_t integratorcm_read(void *opaque, hwaddr offset,
                                   unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ typedef struct icp_pic_state {
     qemu_irq parent_fiq;
 } icp_pic_state;
 
+static const VMStateDescription vmstate_icp_pic = {
+    .name = "icp_pic",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields      = (VMStateField[]) {
+        VMSTATE_UINT32(level, icp_pic_state),
+        VMSTATE_UINT32(irq_enabled, icp_pic_state),
+        VMSTATE_UINT32(fiq_enabled, icp_pic_state),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static void icp_pic_update(icp_pic_state *s)
 {
     uint32_t flags;
@@ -XXX,XX +XXX,XX @@ typedef struct ICPCtrlRegsState {
 #define ICP_INTREG_WPROT        (1 << 0)
 #define ICP_INTREG_CARDIN       (1 << 3)
 
+static const VMStateDescription vmstate_icp_control = {
+    .name = "icp_control",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields      = (VMStateField[]) {
+        VMSTATE_UINT32(intreg_state, ICPCtrlRegsState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static uint64_t icp_control_read(void *opaque, hwaddr offset,
                                  unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void core_class_init(ObjectClass *klass, void *data)
 
     dc->props = core_properties;
     dc->realize = integratorcm_realize;
+    dc->vmsd = &vmstate_integratorcm;
+}
+
+static void icp_pic_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_icp_pic;
+}
+
+static void icp_control_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_icp_control;
 }
 
 static const TypeInfo core_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo icp_pic_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pic_state),
     .instance_init = icp_pic_init,
+    .class_init    = icp_pic_class_init,
 };
 
 static const TypeInfo icp_ctrl_regs_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo icp_ctrl_regs_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ICPCtrlRegsState),
     .instance_init = icp_control_init,
+    .class_init    = icp_control_class_init,
 };
 
 static void integratorcp_register_types(void)
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

The Aspeed SoC includes a set of watchdog timers using 32-bit
decrement counters, which can be based either on the APB clock or
a 1 MHz clock.

The watchdog timer is designed to prevent system deadlock and, in
general, it should be restarted before timeout. When a timeout occurs,
different types of signals can be generated, ARM reset, SOC reset,
System reset, CPU Interrupt, external signal or boot from alternate
block. The current model only performs the system reset function as
this is used by U-Boot and Linux.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-id: 1485452251-1593-2-git-send-email-clg@kaod.org
[clg: - fixed compile breakage
      - fixed io region size
      - added watchdog_perform_action() on timer expiry
      - wrote a commit log
      - merged fixes from Andrew Jeffery to scale the reload value ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/watchdog/Makefile.objs        |   1 +
 include/hw/watchdog/wdt_aspeed.h |  32 ++++++
 hw/watchdog/wdt_aspeed.c         | 225 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 258 insertions(+)
 create mode 100644 include/hw/watchdog/wdt_aspeed.h
 create mode 100644 hw/watchdog/wdt_aspeed.c

diff --git a/hw/watchdog/Makefile.objs b/hw/watchdog/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/Makefile.objs
+++ b/hw/watchdog/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-y += watchdog.o
 common-obj-$(CONFIG_WDT_IB6300ESB) += wdt_i6300esb.o
 common-obj-$(CONFIG_WDT_IB700) += wdt_ib700.o
 common-obj-$(CONFIG_WDT_DIAG288) += wdt_diag288.o
+common-obj-$(CONFIG_ASPEED_SOC) += wdt_aspeed.o
diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/watchdog/wdt_aspeed.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ASPEED Watchdog Controller
+ *
+ * Copyright (C) 2016-2017 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#ifndef ASPEED_WDT_H
+#define ASPEED_WDT_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_ASPEED_WDT "aspeed.wdt"
+#define ASPEED_WDT(obj) \
+    OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
+
+#define ASPEED_WDT_REGS_MAX        (0x20 / 4)
+
+typedef struct AspeedWDTState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    QEMUTimer *timer;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    uint32_t regs[ASPEED_WDT_REGS_MAX];
+
+    uint32_t pclk_freq;
+} AspeedWDTState;
+
+#endif  /* ASPEED_WDT_H */
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ASPEED Watchdog Controller
+ *
+ * Copyright (C) 2016-2017 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "sysemu/watchdog.h"
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+#include "hw/watchdog/wdt_aspeed.h"
+
+#define WDT_STATUS              (0x00 / 4)
+#define WDT_RELOAD_VALUE        (0x04 / 4)
+#define WDT_RESTART             (0x08 / 4)
+#define WDT_CTRL                (0x0C / 4)
+#define   WDT_CTRL_RESET_MODE_SOC       (0x00 << 5)
+#define   WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5)
+#define   WDT_CTRL_1MHZ_CLK             BIT(4)
+#define   WDT_CTRL_WDT_EXT              BIT(3)
+#define   WDT_CTRL_WDT_INTR             BIT(2)
+#define   WDT_CTRL_RESET_SYSTEM         BIT(1)
+#define   WDT_CTRL_ENABLE               BIT(0)
+
+#define WDT_TIMEOUT_STATUS      (0x10 / 4)
+#define WDT_TIMEOUT_CLEAR       (0x14 / 4)
+#define WDT_RESET_WDITH         (0x18 / 4)
+
+#define WDT_RESTART_MAGIC       0x4755
+
+static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)
+{
+    return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;
+}
+
+static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
+{
+    AspeedWDTState *s = ASPEED_WDT(opaque);
+
+    offset >>= 2;
+
+    switch (offset) {
+    case WDT_STATUS:
+        return s->regs[WDT_STATUS];
+    case WDT_RELOAD_VALUE:
+        return s->regs[WDT_RELOAD_VALUE];
+    case WDT_RESTART:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: read from write-only reg at offset 0x%"
+                      HWADDR_PRIx "\n", __func__, offset);
+        return 0;
+    case WDT_CTRL:
+        return s->regs[WDT_CTRL];
+    case WDT_TIMEOUT_STATUS:
+    case WDT_TIMEOUT_CLEAR:
+    case WDT_RESET_WDITH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: uninmplemented read at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return 0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return 0;
+    }
+
+}
+
+static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)
+{
+    uint32_t reload;
+
+    if (pclk) {
+        reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
+                          s->pclk_freq);
+    } else {
+        reload = s->regs[WDT_RELOAD_VALUE] * 1000;
+    }
+
+    if (aspeed_wdt_is_enabled(s)) {
+        timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + reload);
+    }
+}
+
+static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
+                             unsigned size)
+{
+    AspeedWDTState *s = ASPEED_WDT(opaque);
+    bool enable = data & WDT_CTRL_ENABLE;
+
+    offset >>= 2;
+
+    switch (offset) {
+    case WDT_STATUS:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: write to read-only reg at offset 0x%"
+                      HWADDR_PRIx "\n", __func__, offset);
+        break;
+    case WDT_RELOAD_VALUE:
+        s->regs[WDT_RELOAD_VALUE] = data;
+        break;
+    case WDT_RESTART:
+        if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {
+            s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];
+            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
+        }
+        break;
+    case WDT_CTRL:
+        if (enable && !aspeed_wdt_is_enabled(s)) {
+            s->regs[WDT_CTRL] = data;
+            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
+        } else if (!enable && aspeed_wdt_is_enabled(s)) {
+            s->regs[WDT_CTRL] = data;
+            timer_del(s->timer);
+        }
+        break;
+    case WDT_TIMEOUT_STATUS:
+    case WDT_TIMEOUT_CLEAR:
+    case WDT_RESET_WDITH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: uninmplemented write at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+    return;
+}
+
+static WatchdogTimerModel model = {
+    .wdt_name = TYPE_ASPEED_WDT,
+    .wdt_description = "Aspeed watchdog device",
+};
+
+static const VMStateDescription vmstate_aspeed_wdt = {
+    .name = "vmstate_aspeed_wdt",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_TIMER_PTR(timer, AspeedWDTState),
+        VMSTATE_UINT32_ARRAY(regs, AspeedWDTState, ASPEED_WDT_REGS_MAX),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const MemoryRegionOps aspeed_wdt_ops = {
+    .read = aspeed_wdt_read,
+    .write = aspeed_wdt_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .valid.unaligned = false,
+};
+
+static void aspeed_wdt_reset(DeviceState *dev)
+{
+    AspeedWDTState *s = ASPEED_WDT(dev);
+
+    s->regs[WDT_STATUS] = 0x3EF1480;
+    s->regs[WDT_RELOAD_VALUE] = 0x03EF1480;
+    s->regs[WDT_RESTART] = 0;
+    s->regs[WDT_CTRL] = 0;
+
+    timer_del(s->timer);
+}
+
+static void aspeed_wdt_timer_expired(void *dev)
+{
+    AspeedWDTState *s = ASPEED_WDT(dev);
+
+    qemu_log_mask(CPU_LOG_RESET, "Watchdog timer expired.\n");
+    watchdog_perform_action();
+    timer_del(s->timer);
+}
+
+#define PCLK_HZ 24000000
+
+static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedWDTState *s = ASPEED_WDT(dev);
+
+    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);
+
+    /* FIXME: This setting should be derived from the SCU hw strapping
+     * register SCU70
+     */
+    s->pclk_freq = PCLK_HZ;
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_wdt_ops, s,
+                          TYPE_ASPEED_WDT, ASPEED_WDT_REGS_MAX * 4);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = aspeed_wdt_realize;
+    dc->reset = aspeed_wdt_reset;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+    dc->vmsd = &vmstate_aspeed_wdt;
+}
+
+static const TypeInfo aspeed_wdt_info = {
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .name  = TYPE_ASPEED_WDT,
+    .instance_size  = sizeof(AspeedWDTState),
+    .class_init = aspeed_wdt_class_init,
+};
+
+static void wdt_aspeed_register_types(void)
+{
+    watchdog_add_model(&model);
+    type_register_static(&aspeed_wdt_info);
+}
+
+type_init(wdt_aspeed_register_types)
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

This enables reboot of a guest from U-Boot and Linux.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 1485452251-1593-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  2 ++
 hw/arm/aspeed_soc.c         | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/aspeed_timer.h"
 #include "hw/i2c/aspeed_i2c.h"
 #include "hw/ssi/aspeed_smc.h"
+#include "hw/watchdog/wdt_aspeed.h"
 
 #define ASPEED_SPIS_NUM  2
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSMCState fmc;
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     AspeedSDMCState sdmc;
+    AspeedWDTState wdt;
 } AspeedSoCState;
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_SCU_BASE         0x1E6E2000
 #define ASPEED_SOC_SRAM_BASE        0x1E720000
 #define ASPEED_SOC_TIMER_BASE       0x1E782000
+#define ASPEED_SOC_WDT_BASE         0x1E785000
 #define ASPEED_SOC_I2C_BASE         0x1E78A000
 
 static const int uart_irqs[] = { 9, 32, 33, 34, 10 };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                          sc->info->silicon_rev);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size", &error_abort);
+
+    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
+    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
+    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
+
+    /* Watch dog */
+    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
 }
 
 static void aspeed_soc_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

While doing multi block SDMA transfer in routine
'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
index 'begin' and data length 's->data_count' could end up to be same.
This could lead to an OOB access issue. Correct transfer data length
to avoid it.

Cc: qemu-stable@nongnu.org
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20170130064736.9236-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                 boundary_count -= block_size - begin;
             }
             dma_memory_read(&address_space_memory, s->sdmasysad,
-                            &s->fifo_buffer[begin], s->data_count);
+                            &s->fifo_buffer[begin], s->data_count - begin);
             s->sdmasysad += s->data_count - begin;
             if (s->data_count == block_size) {
                 for (n = 0; n < block_size; n++) {
-- 
2.7.4

From: Julian Brown <julian@codesourcery.com>

Since the integratorcp board creates the CPU object directly
rather than via cpu_arm_init(), we have to call the CPU
class parse_features() method ourselves if we want to
support the user passing features via the -cpu command
line argument as well as just the cpu name. Do so.

Signed-off-by: Julian Brown <julian@codesourcery.com>
[PMM: split out into its own patch]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/integratorcp.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
     const char *kernel_filename = machine->kernel_filename;
     const char *kernel_cmdline = machine->kernel_cmdline;
     const char *initrd_filename = machine->initrd_filename;
+    char **cpustr;
     ObjectClass *cpu_oc;
+    CPUClass *cc;
     Object *cpuobj;
     ARMCPU *cpu;
+    const char *typename;
     MemoryRegion *address_space_mem = get_system_memory();
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *ram_alias = g_new(MemoryRegion, 1);
     qemu_irq pic[32];
     DeviceState *dev, *sic, *icp;
     int i;
+    Error *err = NULL;
 
     if (!cpu_model) {
         cpu_model = "arm926";
     }
 
-    cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);
+    cpustr = g_strsplit(cpu_model, ",", 2);
+
+    cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]);
     if (!cpu_oc) {
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
+    typename = object_class_get_name(cpu_oc);
+
+    cc = CPU_CLASS(cpu_oc);
+    cc->parse_features(typename, cpustr[1], &err);
+    g_strfreev(cpustr);
+    if (err) {
+        error_report_err(err);
+        exit(1);
+    }
 
-    cpuobj = object_new(object_class_get_name(cpu_oc));
+    cpuobj = object_new(typename);
 
     /* By default ARM1176 CPUs have EL3 enabled.  This board does not
      * currently support EL3 so the CPU EL3 property is disabled before
-- 
2.7.4

From: Julian Brown <julian@codesourcery.com>

Add a new "cfgend" property which selects whether the CPU resets into
big-endian mode or not.  This setting affects whether we reset with
SCTLR_B (ARMv6 and earlier) or SCTLR_EE (ARMv7 and later) set.

Signed-off-by: Julian Brown <julian@codesourcery.com>
Message-id: 11420d1c49636c1790e60578ee996e51f0f0b835.1484929304.git.julian@codesourcery.com
[PMM: use error_report_err() rather than error_report();
 move the integratorcp changes to their own patch;
 drop an unnecessary extra #include;
 rephrase commit message accordingly;
 move setting of reset_sctlr above registration of cpregs
 so it actually has an effect]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h |  7 +++++++
 target/arm/cpu.c | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     int gic_vpribits; /* number of virtual priority bits */
     int gic_vprebits; /* number of virtual preemption bits */
 
+    /* Whether the cfgend input is high (i.e. this CPU should reset into
+     * big-endian mode).  This setting isn't used directly: instead it modifies
+     * the reset_sctlr value to have SCTLR_B or SCTLR_EE set, depending on the
+     * architecture version.
+     */
+    bool cfgend;
+
     ARMELChangeHook *el_change_hook;
     void *el_change_hook_opaque;
 };
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_el2_property =
 static Property arm_cpu_has_el3_property =
             DEFINE_PROP_BOOL("has_el3", ARMCPU, has_el3, true);
 
+static Property arm_cpu_cfgend_property =
+            DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
+
 /* use property name "pmu" to match other archs and virt tools */
 static Property arm_cpu_has_pmu_property =
             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
         }
     }
 
+    qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
+                             &error_abort);
 }
 
 static void arm_cpu_finalizefn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
             cpu->reset_sctlr |= (1 << 13);
     }
 
+    if (cpu->cfgend) {
+        if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
+            cpu->reset_sctlr |= SCTLR_EE;
+        } else {
+            cpu->reset_sctlr |= SCTLR_B;
+        }
+    }
+
     if (!cpu->has_el3) {
         /* If the has_el3 CPU property is disabled then we need to disable the
          * feature.
-- 
2.7.4

From: Julian Brown <julian@codesourcery.com>

Thumb-1 code has some issues in BE32 mode (as currently implemented). In
short, since bytes are swapped within words at load time for BE32
executables, this also swaps pairs of adjacent Thumb-1 instructions.

This patch un-swaps those pairs of instructions again, both for execution,
and for disassembly. (The previous version of the patch always read four
bytes in arm_read_memory_func and then extracted the proper two bytes,
in a probably misguided attempt to match the behaviour of actual hardware
as described by e.g. the ARM9TDMI TRM, section 3.3 "Endian effects for
instruction fetches". It's less complicated to just read the correct
two bytes though.)

Signed-off-by: Julian Brown <julian@codesourcery.com>
Message-id: ca20462a044848000370318a8bd41dd0a4ed273f.1484929304.git.julian@codesourcery.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/disas/bfd.h   |  7 +++++++
 target/arm/arm_ldst.h | 10 +++++++++-
 disas.c               |  1 +
 target/arm/cpu.c      | 23 +++++++++++++++++++++++
 4 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/include/disas/bfd.h b/include/disas/bfd.h
index XXXXXXX..XXXXXXX 100644
--- a/include/disas/bfd.h
+++ b/include/disas/bfd.h
@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {
      The bottom 16 bits are for the internal use of the disassembler.  */
   unsigned long flags;
 #define INSN_HAS_RELOC	0x80000000
+#define INSN_ARM_BE32	0x00010000
   PTR private_data;
 
   /* Function used to get bytes to disassemble.  MEMADDR is the
@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {
     (bfd_vma memaddr, bfd_byte *myaddr, int length,
 	     struct disassemble_info *info);
 
+  /* A place to stash the real read_memory_func if read_memory_func wants to
+     do some funky address arithmetic or similar (e.g. for ARM BE32 mode).  */
+  int (*read_memory_inner_func)
+    (bfd_vma memaddr, bfd_byte *myaddr, int length,
+             struct disassemble_info *info);
+
   /* Function which should be called if we get an error that we can't
      recover from.  STATUS is the errno value from read_memory_func and
      MEMADDR is the address that we were trying to read.  INFO is a
diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm_ldst.h
+++ b/target/arm/arm_ldst.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
 static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
                                      bool sctlr_b)
 {
-    uint16_t insn = cpu_lduw_code(env, addr);
+    uint16_t insn;
+#ifndef CONFIG_USER_ONLY
+    /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
+       within each word.  Undo that now.  */
+    if (sctlr_b) {
+        addr ^= 2;
+    }
+#endif
+    insn = cpu_lduw_code(env, addr);
     if (bswap_code(sctlr_b)) {
         return bswap16(insn);
     }
diff --git a/disas.c b/disas.c
index XXXXXXX..XXXXXXX 100644
--- a/disas.c
+++ b/disas.c
@@ -XXX,XX +XXX,XX @@ void target_disas(FILE *out, CPUState *cpu, target_ulong code,
 
     s.cpu = cpu;
     s.info.read_memory_func = target_read_memory;
+    s.info.read_memory_inner_func = NULL;
     s.info.buffer_vma = code;
     s.info.buffer_length = size;
     s.info.print_address_func = generic_print_address;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ print_insn_thumb1(bfd_vma pc, disassemble_info *info)
   return print_insn_arm(pc | 1, info);
 }
 
+static int arm_read_memory_func(bfd_vma memaddr, bfd_byte *b,
+                                int length, struct disassemble_info *info)
+{
+    assert(info->read_memory_inner_func);
+    assert((info->flags & INSN_ARM_BE32) == 0 || length == 2 || length == 4);
+
+    if ((info->flags & INSN_ARM_BE32) != 0 && length == 2) {
+        assert(info->endian == BFD_ENDIAN_LITTLE);
+        return info->read_memory_inner_func(memaddr ^ 2, (bfd_byte *)b, 2,
+                                            info);
+    } else {
+        return info->read_memory_inner_func(memaddr, b, length, info);
+    }
+}
+
 static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
 {
     ARMCPU *ac = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
         info->endian = BFD_ENDIAN_BIG;
 #endif
     }
+    if (info->read_memory_inner_func == NULL) {
+        info->read_memory_inner_func = info->read_memory_func;
+        info->read_memory_func = arm_read_memory_func;
+    }
+    info->flags &= ~INSN_ARM_BE32;
+    if (arm_sctlr_b(env)) {
+        info->flags |= INSN_ARM_BE32;
+    }
 }
 
 static void arm_cpu_initfn(Object *obj)
-- 
2.7.4

From: Julian Brown <julian@codesourcery.com>

In BE32 mode, sub-word size watchpoints can fail to trigger because the
address of the access is adjusted in the opcode helpers before being
compared with the watchpoint registers.  This patch reverses the address
adjustment before performing the comparison with the help of a new CPUClass
hook.

This version of the patch augments and tidies up comments a little.

Signed-off-by: Julian Brown <julian@codesourcery.com>
Message-id: caaf64ffc72f6ae183015337b7afdbd4b8989cb6.1484929304.git.julian@codesourcery.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qom/cpu.h      |  3 +++
 target/arm/internals.h |  5 +++++
 exec.c                 |  1 +
 qom/cpu.c              |  6 ++++++
 target/arm/cpu.c       |  3 +++
 target/arm/op_helper.c | 22 ++++++++++++++++++++++
 6 files changed, 40 insertions(+)

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
  * @cpu_exec_exit: Callback for cpu_exec cleanup.
  * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
  * @disas_set_info: Setup architecture specific components of disassembly info
+ * @adjust_watchpoint_address: Perform a target-specific adjustment to an
+ * address before attempting to match it against watchpoints.
  *
  * Represents a CPU family or model.
  */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 } CPUClass;
 
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update_all(ARMCPU *cpu);
 /* Callback function for checking if a watchpoint should trigger. */
 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
+/* Adjust addresses (in BE32 mode) before testing against watchpoint
+ * addresses.
+ */
+vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
+
 /* Callback function for when a watchpoint or breakpoint triggers. */
 void arm_debug_excp_handler(CPUState *cs);
 
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
         return;
     }
     vaddr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
+    vaddr = cc->adjust_watchpoint_address(cpu, vaddr, len);
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (cpu_watchpoint_address_matches(wp, vaddr, len)
             && (wp->flags & flags)) {
diff --git a/qom/cpu.c b/qom/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
+static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
+{
+    return addr;
+}
+
 static void cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->cpu_exec_enter = cpu_common_noop;
     k->cpu_exec_exit = cpu_common_noop;
     k->cpu_exec_interrupt = cpu_common_exec_interrupt;
+    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
+#if !defined(CONFIG_USER_ONLY)
+    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+#endif
 
     cc->disas_set_info = arm_disas_set_info;
 }
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return check_watchpoints(cpu);
 }
 
+vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    /* In BE32 system mode, target memory is stored byteswapped (on a
+     * little-endian host system), and by the time we reach here (via an
+     * opcode helper) the addresses of subword accesses have been adjusted
+     * to account for that, which means that watchpoints will not match.
+     * Undo the adjustment here.
+     */
+    if (arm_sctlr_b(env)) {
+        if (len == 1) {
+            addr ^= 3;
+        } else if (len == 2) {
+            addr ^= 2;
+        }
+    }
+
+    return addr;
+}
+
 void arm_debug_excp_handler(CPUState *cs)
 {
     /* Called by core code when a watchpoint or breakpoint fires;
-- 
2.7.4

In the ARM ldr/str decode path, rather than directly testing
"insn & (1 << 21)" and "insn & (1 << 24)", abstract these
bits out into wbit and pbit local flags. (We will want to
do more tests against them to determine whether we need to
provide syndrome information.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target/arm/translate.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             } else {
                 int address_offset;
                 bool load = insn & (1 << 20);
+                bool wbit = insn & (1 << 21);
+                bool pbit = insn & (1 << 24);
                 bool doubleword = false;
                 /* Misc load/store */
                 rn = (insn >> 16) & 0xf;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 }
 
                 addr = load_reg(s, rn);
-                if (insn & (1 << 24))
+                if (pbit) {
                     gen_add_datah_offset(s, insn, 0, addr);
+                }
                 address_offset = 0;
 
                 if (doubleword) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                    ensure correct behavior with overlapping index registers.
                    ldrd with base writeback is undefined if the
                    destination and index registers overlap.  */
-                if (!(insn & (1 << 24))) {
+                if (!pbit) {
                     gen_add_datah_offset(s, insn, address_offset, addr);
                     store_reg(s, rn, addr);
-                } else if (insn & (1 << 21)) {
+                } else if (wbit) {
                     if (address_offset)
                         tcg_gen_addi_i32(addr, addr, address_offset);
                     store_reg(s, rn, addr);
-- 
2.7.4

Add support for generating the ISS (Instruction Specific Syndrome)
for Data Abort exceptions taken from AArch32. These syndromes are
used by hypervisors for example to trap and emulate memory accesses.

This is the equivalent for AArch32 guests of the work done for AArch64
guests in commit aaa1f954d4cab243.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target/arm/translate.h     |  14 ++++
 target/arm/translate-a64.c |  14 ----
 target/arm/translate.c     | 184 +++++++++++++++++++++++++++++++++------------
 3 files changed, 149 insertions(+), 63 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
             ? 3 : MAX(1, s->current_el);
 }
 
+static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+{
+    /* We don't need to save all of the syndrome so we mask and shift
+     * out unneeded bits to help the sleb128 encoder do a better job.
+     */
+    syn &= ARM_INSN_START_WORD2_MASK;
+    syn >>= ARM_INSN_START_WORD2_SHIFT;
+
+    /* We check and clear insn_start_idx to catch multiple updates.  */
+    assert(s->insn_start_idx != 0);
+    tcg_set_insn_param(s->insn_start_idx, 2, syn);
+    s->insn_start_idx = 0;
+}
+
 /* target-specific extra values for is_jmp */
 /* These instructions trap after executing, so the A32/T32 decoder must
  * defer them until after the conditional execution state has been updated.
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
     }
 }
 
-static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
-{
-    /* We don't need to save all of the syndrome so we mask and shift
-     * out uneeded bits to help the sleb128 encoder do a better job.
-     */
-    syn &= ARM_INSN_START_WORD2_MASK;
-    syn >>= ARM_INSN_START_WORD2_SHIFT;
-
-    /* We check and clear insn_start_idx to catch multiple updates.  */
-    assert(s->insn_start_idx != 0);
-    tcg_set_insn_param(s->insn_start_idx, 2, syn);
-    s->insn_start_idx = 0;
-}
-
 static void unallocated_encoding(DisasContext *s)
 {
     /* Unallocated and reserved encodings are uncategorized */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
     a64_translate_init();
 }
 
+/* Flags for the disas_set_da_iss info argument:
+ * lower bits hold the Rt register number, higher bits are flags.
+ */
+typedef enum ISSInfo {
+    ISSNone = 0,
+    ISSRegMask = 0x1f,
+    ISSInvalid = (1 << 5),
+    ISSIsAcqRel = (1 << 6),
+    ISSIsWrite = (1 << 7),
+    ISSIs16Bit = (1 << 8),
+} ISSInfo;
+
+/* Save the syndrome information for a Data Abort */
+static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
+{
+    uint32_t syn;
+    int sas = memop & MO_SIZE;
+    bool sse = memop & MO_SIGN;
+    bool is_acqrel = issinfo & ISSIsAcqRel;
+    bool is_write = issinfo & ISSIsWrite;
+    bool is_16bit = issinfo & ISSIs16Bit;
+    int srt = issinfo & ISSRegMask;
+
+    if (issinfo & ISSInvalid) {
+        /* Some callsites want to conditionally provide ISS info,
+         * eg "only if this was not a writeback"
+         */
+        return;
+    }
+
+    if (srt == 15) {
+        /* For AArch32, insns where the src/dest is R15 never generate
+         * ISS information. Catching that here saves checking at all
+         * the call sites.
+         */
+        return;
+    }
+
+    syn = syn_data_abort_with_iss(0, sas, sse, srt, 0, is_acqrel,
+                                  0, 0, 0, is_write, 0, is_16bit);
+    disas_set_insn_syndrome(s, syn);
+}
+
 static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
 {
     /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val,      \
                                      TCGv_i32 a32, int index)            \
 {                                                                        \
     gen_aa32_ld_i32(s, val, a32, index, OPC | s->be_data);               \
+}                                                                        \
+static inline void gen_aa32_ld##SUFF##_iss(DisasContext *s,              \
+                                           TCGv_i32 val,                 \
+                                           TCGv_i32 a32, int index,      \
+                                           ISSInfo issinfo)              \
+{                                                                        \
+    gen_aa32_ld_i32(s, val, a32, index, OPC | s->be_data);               \
+    disas_set_da_iss(s, OPC, issinfo);                                   \
 }
 
 #define DO_GEN_ST(SUFF, OPC)                                             \
@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_st##SUFF(DisasContext *s, TCGv_i32 val,      \
                                      TCGv_i32 a32, int index)            \
 {                                                                        \
     gen_aa32_st_i32(s, val, a32, index, OPC | s->be_data);               \
+}                                                                        \
+static inline void gen_aa32_st##SUFF##_iss(DisasContext *s,              \
+                                           TCGv_i32 val,                 \
+                                           TCGv_i32 a32, int index,      \
+                                           ISSInfo issinfo)              \
+{                                                                        \
+    gen_aa32_st_i32(s, val, a32, index, OPC | s->be_data);               \
+    disas_set_da_iss(s, OPC, issinfo | ISSIsWrite);                      \
 }
 
 static inline void gen_aa32_frob64(DisasContext *s, TCGv_i64 val)
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                                 tmp = tcg_temp_new_i32();
                                 switch (op1) {
                                 case 0: /* lda */
-                                    gen_aa32_ld32u(s, tmp, addr,
-                                                   get_mem_index(s));
+                                    gen_aa32_ld32u_iss(s, tmp, addr,
+                                                       get_mem_index(s),
+                                                       rd | ISSIsAcqRel);
                                     break;
                                 case 2: /* ldab */
-                                    gen_aa32_ld8u(s, tmp, addr,
-                                                  get_mem_index(s));
+                                    gen_aa32_ld8u_iss(s, tmp, addr,
+                                                      get_mem_index(s),
+                                                      rd | ISSIsAcqRel);
                                     break;
                                 case 3: /* ldah */
-                                    gen_aa32_ld16u(s, tmp, addr,
-                                                   get_mem_index(s));
+                                    gen_aa32_ld16u_iss(s, tmp, addr,
+                                                       get_mem_index(s),
+                                                       rd | ISSIsAcqRel);
                                     break;
                                 default:
                                     abort();
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                                 tmp = load_reg(s, rm);
                                 switch (op1) {
                                 case 0: /* stl */
-                                    gen_aa32_st32(s, tmp, addr,
-                                                  get_mem_index(s));
+                                    gen_aa32_st32_iss(s, tmp, addr,
+                                                      get_mem_index(s),
+                                                      rm | ISSIsAcqRel);
                                     break;
                                 case 2: /* stlb */
-                                    gen_aa32_st8(s, tmp, addr,
-                                                 get_mem_index(s));
+                                    gen_aa32_st8_iss(s, tmp, addr,
+                                                     get_mem_index(s),
+                                                     rm | ISSIsAcqRel);
                                     break;
                                 case 3: /* stlh */
-                                    gen_aa32_st16(s, tmp, addr,
-                                                  get_mem_index(s));
+                                    gen_aa32_st16_iss(s, tmp, addr,
+                                                      get_mem_index(s),
+                                                      rm | ISSIsAcqRel);
                                     break;
                                 default:
                                     abort();
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 bool wbit = insn & (1 << 21);
                 bool pbit = insn & (1 << 24);
                 bool doubleword = false;
+                ISSInfo issinfo;
+
                 /* Misc load/store */
                 rn = (insn >> 16) & 0xf;
                 rd = (insn >> 12) & 0xf;
 
+                /* ISS not valid if writeback */
+                issinfo = (pbit & !wbit) ? rd : ISSInvalid;
+
                 if (!load && (sh & 2)) {
                     /* doubleword */
                     ARCH(5TE);
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                     tmp = tcg_temp_new_i32();
                     switch (sh) {
                     case 1:
-                        gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
+                        gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s),
+                                           issinfo);
                         break;
                     case 2:
-                        gen_aa32_ld8s(s, tmp, addr, get_mem_index(s));
+                        gen_aa32_ld8s_iss(s, tmp, addr, get_mem_index(s),
+                                          issinfo);
                         break;
                     default:
                     case 3:
-                        gen_aa32_ld16s(s, tmp, addr, get_mem_index(s));
+                        gen_aa32_ld16s_iss(s, tmp, addr, get_mem_index(s),
+                                           issinfo);
                         break;
                     }
                 } else {
                     /* store */
                     tmp = load_reg(s, rd);
-                    gen_aa32_st16(s, tmp, addr, get_mem_index(s));
+                    gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), issinfo);
                     tcg_temp_free_i32(tmp);
                 }
                 /* Perform base writeback before the loaded value to
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 /* load */
                 tmp = tcg_temp_new_i32();
                 if (insn & (1 << 22)) {
-                    gen_aa32_ld8u(s, tmp, tmp2, i);
+                    gen_aa32_ld8u_iss(s, tmp, tmp2, i, rd);
                 } else {
-                    gen_aa32_ld32u(s, tmp, tmp2, i);
+                    gen_aa32_ld32u_iss(s, tmp, tmp2, i, rd);
                 }
             } else {
                 /* store */
                 tmp = load_reg(s, rd);
                 if (insn & (1 << 22)) {
-                    gen_aa32_st8(s, tmp, tmp2, i);
+                    gen_aa32_st8_iss(s, tmp, tmp2, i, rd);
                 } else {
-                    gen_aa32_st32(s, tmp, tmp2, i);
+                    gen_aa32_st32_iss(s, tmp, tmp2, i, rd);
                 }
                 tcg_temp_free_i32(tmp);
             }
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                         tmp = tcg_temp_new_i32();
                         switch (op) {
                         case 0: /* ldab */
-                            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s),
+                                              rs | ISSIsAcqRel);
                             break;
                         case 1: /* ldah */
-                            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s),
+                                               rs | ISSIsAcqRel);
                             break;
                         case 2: /* lda */
-                            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
+                                               rs | ISSIsAcqRel);
                             break;
                         default:
                             abort();
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                         tmp = load_reg(s, rs);
                         switch (op) {
                         case 0: /* stlb */
-                            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s),
+                                             rs | ISSIsAcqRel);
                             break;
                         case 1: /* stlh */
-                            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s),
+                                              rs | ISSIsAcqRel);
                             break;
                         case 2: /* stl */
-                            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+                            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s),
+                                              rs | ISSIsAcqRel);
                             break;
                         default:
                             abort();
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
         int postinc = 0;
         int writeback = 0;
         int memidx;
+        ISSInfo issinfo;
+
         if ((insn & 0x01100000) == 0x01000000) {
             if (disas_neon_ls_insn(s, insn)) {
                 goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                 }
             }
         }
+
+        issinfo = writeback ? ISSInvalid : rs;
+
         if (insn & (1 << 20)) {
             /* Load.  */
             tmp = tcg_temp_new_i32();
             switch (op) {
             case 0:
-                gen_aa32_ld8u(s, tmp, addr, memidx);
+                gen_aa32_ld8u_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 4:
-                gen_aa32_ld8s(s, tmp, addr, memidx);
+                gen_aa32_ld8s_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 1:
-                gen_aa32_ld16u(s, tmp, addr, memidx);
+                gen_aa32_ld16u_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 5:
-                gen_aa32_ld16s(s, tmp, addr, memidx);
+                gen_aa32_ld16s_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 2:
-                gen_aa32_ld32u(s, tmp, addr, memidx);
+                gen_aa32_ld32u_iss(s, tmp, addr, memidx, issinfo);
                 break;
             default:
                 tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
             tmp = load_reg(s, rs);
             switch (op) {
             case 0:
-                gen_aa32_st8(s, tmp, addr, memidx);
+                gen_aa32_st8_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 1:
-                gen_aa32_st16(s, tmp, addr, memidx);
+                gen_aa32_st16_iss(s, tmp, addr, memidx, issinfo);
                 break;
             case 2:
-                gen_aa32_st32(s, tmp, addr, memidx);
+                gen_aa32_st32_iss(s, tmp, addr, memidx, issinfo);
                 break;
             default:
                 tcg_temp_free_i32(tmp);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
             addr = tcg_temp_new_i32();
             tcg_gen_movi_i32(addr, val);
             tmp = tcg_temp_new_i32();
-            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
+                               rd | ISSIs16Bit);
             tcg_temp_free_i32(addr);
             store_reg(s, rd, tmp);
             break;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
 
         switch (op) {
         case 0: /* str */
-            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 1: /* strh */
-            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 2: /* strb */
-            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 3: /* ldrsb */
-            gen_aa32_ld8s(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld8s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 4: /* ldr */
-            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 5: /* ldrh */
-            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 6: /* ldrb */
-            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         case 7: /* ldrsh */
-            gen_aa32_ld16s(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld16s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             break;
         }
         if (op >= 3) { /* load */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
         if (insn & (1 << 11)) {
             /* load */
             tmp = tcg_temp_new_i32();
-            gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             store_reg(s, rd, tmp);
         } else {
             /* store */
             tmp = load_reg(s, rd);
-            gen_aa32_st8(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             tcg_temp_free_i32(tmp);
         }
         tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
         if (insn & (1 << 11)) {
             /* load */
             tmp = tcg_temp_new_i32();
-            gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             store_reg(s, rd, tmp);
         } else {
             /* store */
             tmp = load_reg(s, rd);
-            gen_aa32_st16(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             tcg_temp_free_i32(tmp);
         }
         tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
         if (insn & (1 << 11)) {
             /* load */
             tmp = tcg_temp_new_i32();
-            gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+            gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             store_reg(s, rd, tmp);
         } else {
             /* store */
             tmp = load_reg(s, rd);
-            gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+            gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit);
             tcg_temp_free_i32(tmp);
         }
         tcg_temp_free_i32(addr);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
         store_cpu_field(tmp, condexec_bits);
       }
     do {
+        dc->insn_start_idx = tcg_op_buf_count();
         tcg_gen_insn_start(dc->pc,
                            (dc->condexec_cond << 4) | (dc->condexec_mask >> 1),
                            0);
-- 
2.7.4

Add a comment documenting the memory map of the SoC devices and which
are not implemented.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1484247815-15279-2-git-send-email-peter.maydell@linaro.org
---
 hw/arm/stellaris.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
         0x40024000, 0x40025000, 0x40026000};
     static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
 
+    /* Memory map of SoC devices, from
+     * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
+     * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
+     *
+     * 40000000 wdtimer (unimplemented)
+     * 40002000 i2c (unimplemented)
+     * 40004000 GPIO
+     * 40005000 GPIO
+     * 40006000 GPIO
+     * 40007000 GPIO
+     * 40008000 SSI
+     * 4000c000 UART
+     * 4000d000 UART
+     * 4000e000 UART
+     * 40020000 i2c
+     * 40021000 i2c (unimplemented)
+     * 40024000 GPIO
+     * 40025000 GPIO
+     * 40026000 GPIO
+     * 40028000 PWM (unimplemented)
+     * 4002c000 QEI (unimplemented)
+     * 4002d000 QEI (unimplemented)
+     * 40030000 gptimer
+     * 40031000 gptimer
+     * 40032000 gptimer
+     * 40033000 gptimer
+     * 40038000 ADC
+     * 4003c000 analogue comparator (unimplemented)
+     * 40048000 ethernet
+     * 400fc000 hibernation module (unimplemented)
+     * 400fd000 flash memory control (unimplemented)
+     * 400fe000 system control
+     */
+
     DeviceState *gpio_dev[7], *nvic;
     qemu_irq gpio_in[7][8];
     qemu_irq gpio_out[7][8];
-- 
2.7.4

Create a new "unimplemented" sysbus device, which simply accepts
all read and write accesses, and implements them as read-as-zero,
write-ignored, with logging of the access as LOG_UNIMP.

This is useful for stubbing out bits of an SoC or board model
which haven't been written yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1484247815-15279-3-git-send-email-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs   |   2 +
 include/hw/misc/unimp.h |  39 ++++++++++++++++++
 hw/misc/unimp.c         | 107 ++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)
 create mode 100644 include/hw/misc/unimp.h
 create mode 100644 hw/misc/unimp.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
 common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
 
+common-obj-y += unimp.o
+
 obj-$(CONFIG_VMPORT) += vmport.o
 
 # ARM devices
diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/unimp.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * "Unimplemented" device
+ *
+ * Copyright Linaro Limited, 2017
+ * Written by Peter Maydell
+ */
+
+#ifndef HW_MISC_UNIMP_H
+#define HW_MISC_UNIMP_H
+
+#define TYPE_UNIMPLEMENTED_DEVICE "unimplemented-device"
+
+/**
+ * create_unimplemented_device: create and map a dummy device
+ * @name: name of the device for debug logging
+ * @base: base address of the device's MMIO region
+ * @size: size of the device's MMIO region
+ *
+ * This utility function creates and maps an instance of unimplemented-device,
+ * which is a dummy device which simply logs all guest accesses to
+ * it via the qemu_log LOG_UNIMP debug log.
+ * The device is mapped at priority -1000, which means that you can
+ * use it to cover a large region and then map other devices on top of it
+ * if necessary.
+ */
+static inline void create_unimplemented_device(const char *name,
+                                               hwaddr base,
+                                               hwaddr size)
+{
+    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
+
+    qdev_prop_set_string(dev, "name", name);
+    qdev_prop_set_uint64(dev, "size", size);
+    qdev_init_nofail(dev);
+
+    sysbus_mmio_map_overlap(SYS_BUS_DEVICE(dev), 0, base, -1000);
+}
+
+#endif
diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/unimp.c
@@ -XXX,XX +XXX,XX @@
+/* "Unimplemented" device
+ *
+ * This is a dummy device which accepts and logs all accesses.
+ * It's useful for stubbing out regions of an SoC or board
+ * map which correspond to devices that have not yet been
+ * implemented. This is often sufficient to placate initial
+ * guest device driver probing such that the system will
+ * come up.
+ *
+ * Copyright Linaro Limited, 2017
+ * Written by Peter Maydell
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/misc/unimp.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+
+#define UNIMPLEMENTED_DEVICE(obj) \
+    OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
+
+typedef struct {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    char *name;
+    uint64_t size;
+} UnimplementedDeviceState;
+
+static uint64_t unimp_read(void *opaque, hwaddr offset, unsigned size)
+{
+    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
+
+    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
+                  "(size %d, offset 0x%" HWADDR_PRIx ")\n",
+                  s->name, size, offset);
+    return 0;
+}
+
+static void unimp_write(void *opaque, hwaddr offset,
+                        uint64_t value, unsigned size)
+{
+    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(opaque);
+
+    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+                  "(size %d, value 0x%" PRIx64
+                  ", offset 0x%" HWADDR_PRIx ")\n",
+                  s->name, size, value, offset);
+}
+
+static const MemoryRegionOps unimp_ops = {
+    .read = unimp_read,
+    .write = unimp_write,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 8,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 8,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void unimp_realize(DeviceState *dev, Error **errp)
+{
+    UnimplementedDeviceState *s = UNIMPLEMENTED_DEVICE(dev);
+
+    if (s->size == 0) {
+        error_setg(errp, "property 'size' not specified or zero");
+        return;
+    }
+
+    if (s->name == NULL) {
+        error_setg(errp, "property 'name' not specified");
+        return;
+    }
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &unimp_ops, s,
+                          s->name, s->size);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static Property unimp_properties[] = {
+    DEFINE_PROP_UINT64("size", UnimplementedDeviceState, size, 0),
+    DEFINE_PROP_STRING("name", UnimplementedDeviceState, name),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void unimp_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = unimp_realize;
+    dc->props = unimp_properties;
+}
+
+static const TypeInfo unimp_info = {
+    .name = TYPE_UNIMPLEMENTED_DEVICE,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(UnimplementedDeviceState),
+    .class_init = unimp_class_init,
+};
+
+static void unimp_register_types(void)
+{
+    type_register_static(&unimp_info);
+}
+
+type_init(unimp_register_types)
-- 
2.7.4

Use the 'unimplemented' dummy device to cover regions of the
SoC device memory map which we don't have proper device
implementations for yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1484247815-15279-4-git-send-email-peter.maydell@linaro.org
---
 hw/arm/stellaris.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
 #include "hw/char/pl011.h"
+#include "hw/misc/unimp.h"
 
 #define GPIO_A 0
 #define GPIO_B 1
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
             }
         }
     }
+
+    /* Add dummy regions for the devices we don't implement yet,
+     * so guest accesses don't cause unlogged crashes.
+     */
+    create_unimplemented_device("wdtimer", 0x40000000, 0x1000);
+    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
+    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
+    create_unimplemented_device("PWM", 0x40028000, 0x1000);
+    create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
+    create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
+    create_unimplemented_device("analogue-comparator", 0x4003c000, 0x1000);
+    create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
+    create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 }
 
 /* FIXME: Figure out how to generate these from stellaris_boards.  */
-- 
2.7.4

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0