Series comparison

-[Qemu-devel] [PULL 00/17] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-Target-arm queue...
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
-thanks
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
 -- PMM
-The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-are available in the git repository at:
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
 for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:
   hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * vITS: Support save/restore
+ * Fix coverity nit in int_to_float code
- * timer/aspeed: Fix timer enablement when reload is not set
+ * Don't set Invalid for float-to-int(MAXINT)
- * aspped: add temperature sensor device
+ * Fix fp_status_f16 tininess before rounding
- * timer.h: Provide better monotonic time on ARM hosts
+ * Add various missing insns from the v8.2-FP16 extension
- * exynos4210: various cleanups
+ * Fix sqrt_f16 exception raising
- * exynos4210: support system poweroff
+ * sdcard: Correct CRC16 offset in sd_function_switch()
  * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Cédric Le Goater (3):
+Alex Bennée (5):
-      hw/misc: add a TMP42{1, 2, 3} device model
+      fpu/softfloat: int_to_float ensure r fully initialised
-      aspeed: add a temp sensor device on I2C bus 3
+      target/arm: Implement FCMP for fp16
-      timer/aspeed: fix timer enablement when a reload is not set
+      target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Eric Auger (4):
+Peter Maydell (3):
-      kvm-all: Pass an error object to kvm_device_access
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-      hw/intc/arm_gicv3_its: Implement state save/restore
+      target/arm: Fix fp_status_f16 tininess before rounding
-      hw/intc/arm_gicv3_kvm: Implement pending table save
+      tcg: Optionally log FPU state in TCG -d cpu logging
       hw/intc/arm_gicv3_its: Allow save/restore
-Krzysztof Kozlowski (9):
+Philippe Mathieu-Daudé (1):
-      hw/intc/exynos4210_gic: Use more meaningful name for local variable
+      sdcard: Correct CRC16 offset in sd_function_switch()
       hw/timer/exynos4210_mct: Fix checkpatch style errors
       hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
       hw/timer/exynos4210_mct: Remove unused defines
       hw/arm/exynos: Move DRAM initialization next boards
       hw/arm/exynos: Declare local variables in some order
       hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
       hw/intc/exynos4210_gic: Constify array of combiner interrupts
       hw/misc/exynos4210_pmu: Add support for system poweroff
-Pranith Kumar (1):
+Richard Henderson (7):
-      timer.h: Provide better monotonic time
+      target/arm: Implement FMOV (general) for fp16
       target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
       target/arm: Implement FCVT (scalar, integer) for fp16
       target/arm: Implement FCVT (scalar, fixed-point) for fp16
       target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
- hw/misc/Makefile.objs                  |   1 +
+ include/qemu/log.h         |   1 +
- include/hw/arm/exynos4210.h            |   5 +-
+ target/arm/helper-a64.h    |   2 +
- include/hw/intc/arm_gicv3_its_common.h |   8 +
+ target/arm/helper.h        |   6 +
- include/migration/vmstate.h            |   2 +
+ accel/tcg/cpu-exec.c       |   9 +-
- include/qemu/timer.h                   |   5 +-
+ fpu/softfloat.c            |   6 +-
- include/sysemu/kvm.h                   |  11 +-
+ hw/sd/sd.c                 |   2 +-
- hw/arm/aspeed.c                        |   9 +
+ target/arm/cpu.c           |   2 +
- hw/arm/exynos4210.c                    |  27 +--
+ target/arm/helper-a64.c    |  10 ++
- hw/arm/exynos4_boards.c                |  50 +++-
+ target/arm/helper.c        |  38 +++-
- hw/intc/arm_gic_kvm.c                  |   9 +-
+ target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
- hw/intc/arm_gicv3_common.c             |   1 +
+ util/log.c                 |   2 +
- hw/intc/arm_gicv3_its_common.c         |  12 +-
+files changed, 428 insertions(+), 71 deletions(-)
  hw/intc/arm_gicv3_its_kvm.c            | 131 +++++++++--
  hw/intc/arm_gicv3_kvm.c                |  48 +++-
  hw/intc/exynos4210_gic.c               |  14 +-
  hw/misc/exynos4210_pmu.c               |  20 +-
  hw/misc/tmp421.c                       | 402 +++++++++++++++++++++++++++++++++
  hw/timer/aspeed_timer.c                |  37 ++-
  hw/timer/exynos4210_mct.c              |  50 ++--
  kvm-all.c                              |  14 +-
  default-configs/arm-softmmu.mak        |   1 +
 files changed, 741 insertions(+), 116 deletions(-)
  create mode 100644 hw/misc/tmp421.c

-[Qemu-devel] [PULL 01/17] hw/intc/exynos4210_gic: Use more meaningful name for local variable
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-There are to SysBusDevice variables in exynos4210_gic_realize()
-function: one for the device itself and second for arm_gic device.  Add
-a prefix "gic" to the second one so it will be easier to understand the
-code.
-While at it, put local uninitialized 'i' variable at the end, next to
-other uninitialized ones.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/exynos4210_gic.c | 12 ++++++------
-file changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-     DeviceState *dev = DEVICE(obj);
-     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
--    uint32_t i;
-     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
-     const char dist_prefix[] = "exynos4210-gic-alias_dist";
-     char cpu_alias_name[sizeof(cpu_prefix) + 3];
-     char dist_alias_name[sizeof(cpu_prefix) + 3];
--    SysBusDevice *busdev;
-+    SysBusDevice *gicbusdev;
-+    uint32_t i;
-     s->gic = qdev_create(NULL, "arm_gic");
-     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
-     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
-     qdev_init_nofail(s->gic);
--    busdev = SYS_BUS_DEVICE(s->gic);
-+    gicbusdev = SYS_BUS_DEVICE(s->gic);
-     /* Pass through outbound IRQ lines from the GIC */
--    sysbus_pass_irq(sbd, busdev);
-+    sysbus_pass_irq(sbd, gicbusdev);
-     /* Pass through inbound GPIO lines to the GIC */
-     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
-         memory_region_init_alias(&s->cpu_alias[i], obj,
-                                  cpu_alias_name,
--                                 sysbus_mmio_get_region(busdev, 1),
-+                                 sysbus_mmio_get_region(gicbusdev, 1),
-,
-                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
-         memory_region_add_subregion(&s->cpu_container,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
-         memory_region_init_alias(&s->dist_alias[i], obj,
-                                  dist_alias_name,
--                                 sysbus_mmio_get_region(busdev, 0),
-+                                 sysbus_mmio_get_region(gicbusdev, 0),
-,
-                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
-         memory_region_add_subregion(&s->dist_container,
---
-.7.4

-[Qemu-devel] [PULL 10/17] timer.h: Provide better monotonic time
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
-From: Pranith Kumar <bobby.prani@gmail.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Tested and confirmed that the stretch i386 debian qcow2 image on a
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
-raspberry pi 2 works.
+later on so we might as well mirror that.
-Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qemu/timer.h | 5 ++---
+ fpu/softfloat.c | 2 +-
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/qemu/timer.h b/include/qemu/timer.h
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/timer.h
+--- a/fpu/softfloat.c
-+++ b/include/qemu/timer.h
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
- /* The host CPU doesn't have an easily accessible cycle counter.
-    Just return a monotonically increasing value.  This will be
+ static FloatParts int_to_float(int64_t a, float_status *status)
     totally wrong, but hopefully better than nothing.  */
 -static inline int64_t cpu_get_host_ticks (void)
 +static inline int64_t cpu_get_host_ticks(void)
  {
--    static int64_t ticks = 0;
+-    FloatParts r;
--    return ticks++;
++    FloatParts r = {};
-+    return get_clock();
+     if (a == 0) {
- }
+         r.cls = float_class_zero;
- #endif
+         r.sign = false;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 06/17] hw/arm/exynos: Declare local variables in some order
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-From: Krzysztof Kozlowski <krzk@kernel.org>
+In float-to-integer conversion, if the floating point input
 converts exactly to the largest or smallest integer that
 fits in to the result type, this is not an overflow.
 In this situation we were producing the correct result value,
 but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Bring some more readability by declaring local function variables: first
+Fix the boundary case to take the right half of the if()
-initialized ones and then the rest (with reversed-christmas-tree order).
+statements.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+This fixes a regression from 2.11 introduced by the softfloat
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+refactoring.
 Cc: qemu-stable@nongnu.org
 Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
 ---
- hw/arm/exynos4210.c | 4 ++--
+ fpu/softfloat.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/fpu/softfloat.c
-+++ b/hw/arm/exynos4210.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+             r = UINT64_MAX;
- Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+         }
- {
+         if (p.sign) {
--    int i, n;
+-            if (r < -(uint64_t) min) {
-     Exynos4210State *s = g_new(Exynos4210State, 1);
++            if (r <= -(uint64_t) min) {
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
+                 return -r;
--    DeviceState *dev;
+             } else {
-     SysBusDevice *busdev;
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
-     ObjectClass *cpu_oc;
+                 return min;
-+    DeviceState *dev;
+             }
-+    int i, n;
+         } else {
+-            if (r < max) {
-     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
++            if (r <= max) {
-     assert(cpu_oc);
+                 return r;
              } else {
                  s->float_exception_flags = orig_flags | float_flag_invalid;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 12/17] aspeed: add a temp sensor device on I2C bus 3
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
-From: Cédric Le Goater <clg@kaod.org>
+In commit d81ce0ef2c4f105 we added an extra float_status field
 fp_status_fp16 for Arm, but forgot to initialize it correctly
 by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-Temperatures can be changed from the monitor with :
+Add the missing initialization.
-    (qemu) qom-set /machine/unattached/device[2] temperature0 12000
+Fixes: d81ce0ef2c4f105
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
  target/arm/cpu.c | 2 ++
 file changed, 2 insertions(+)
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/aspeed.c | 9 +++++++++
 file changed, 9 insertions(+)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/arm/cpu.c
-+++ b/hw/arm/aspeed.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
- static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
+                               &env->vfp.fp_status);
- {
+     set_float_detect_tininess(float_tininess_before_rounding,
-     AspeedSoCState *soc = &bmc->soc;
+                               &env->vfp.standard_fp_status);
-+    DeviceState *dev;
++    set_float_detect_tininess(float_tininess_before_rounding,
++                              &env->vfp.fp_status_f16);
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
+ #ifndef CONFIG_USER_ONLY
-      * enough to provide basic RTC features. Alarms will be missing */
+     if (kvm_enabled()) {
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+         kvm_arm_reset_vcpu(cpu);
 +
 +    /* add a TMP423 temperature sensor */
 +    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
 +                           "tmp423", 0x4c);
 +    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
 +    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
 +    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
 +    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
  }
  static void palmetto_bmc_init(MachineState *machine)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 04/17] hw/timer/exynos4210_mct: Remove unused defines
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Remove defines not used anywhere.
+Adding the fp16 moves to/from general registers.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/exynos4210_mct.c | 3 ---
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 3 deletions(-)
+file changed, 21 insertions(+)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ enum LocalTimerRegCntIndexes {
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-     L_REG_CNT_AMOUNT
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
- };
+             clear_vec_high(s, true, rd);
+             break;
--#define MCT_NIRQ                6
++        case 3:
- #define MCT_SFR_SIZE            0x444
++            /* 16 bit */
++            tmp = tcg_temp_new_i64();
- #define MCT_GT_CMP_NUM          4
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
++            write_fp_dreg(s, rd, tmp);
--#define MCT_GT_MAX_VAL          UINT64_MAX
++            tcg_temp_free_i64(tmp);
--
++            break;
- #define MCT_GT_COUNTER_STEP     0x100000000ULL
++        default:
- #define MCT_LT_COUNTER_STEP     0x100000000ULL
++            g_assert_not_reached();
- #define MCT_LT_CNT_LOW_LIMIT    0x100
+         }
      } else {
          TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          case 0xa: /* 64 bit */
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 08/17] hw/intc/exynos4210_gic: Constify array of combiner interrupts
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The static array of interrupt combiner mappings is not modified so it
+No sense in emitting code after the exception.
 can be made const for code safeness.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/exynos4210_gic.c | 2 +-
+ target/arm/translate-a64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/exynos4210_gic.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ enum ExtInt {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
-  * which is INTG16 in Internal Interrupt Combiner.
+         default:
-  */
+             /* all other sf/type/rmode combinations are invalid */
+             unallocated_encoding(s);
--static uint32_t
+-            break;
-+static const uint32_t
++            return;
- combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+         }
-     /* int combiner groups 16-19 */
-     { }, { }, { }, { },
+         if (!fp_access_check(s)) {
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 09/17] hw/misc/exynos4210_pmu: Add support for system poweroff
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-On all Exynos-based boards, the system powers down itself by driving
+Cc: qemu-stable@nongnu.org
-PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Handle writing to respective PMU register to fix power off failure:
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-    reboot: Power down
+Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
     Unable to poweroff system
     shutdown: 31 output lines suppressed due to ratelimiting
     Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000
     CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
     Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
     [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
     [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
     [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
     [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
     [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
     [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)
 Additionally the initial value of PS_HOLD has to be changed because
 recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
 When the register is kept at reset value, the kernel will not issue a
 write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
 so mimic its existence here.
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
+ target/arm/helper.h        |  6 +++
-file changed, 19 insertions(+), 1 deletion(-)
+ target/arm/helper.c        | 38 ++++++++++++++-
+ target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
-diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
+files changed, 122 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/exynos4210_pmu.c
+--- a/target/arm/helper.h
-+++ b/hw/misc/exynos4210_pmu.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+ DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
- #include "qemu/osdep.h"
+ DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
- #include "hw/sysbus.h"
+ DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
-+#include "sysemu/sysemu.h"
++DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
++DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
- #ifndef DEBUG_PMU
++DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
- #define DEBUG_PMU           0
++DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
-@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
+ DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
-     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
+ DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
-     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
+ DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
-     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
--    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
+ DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
-+    /*
+ DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
-+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
+ DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
-+     * DATA bit high, set usually by bootloader, keeps system on.
++DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
-+     */
++DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
-+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
-     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
+ DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
-     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
+ DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
-     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
+index XXXXXXX..XXXXXXX 100644
-     uint32_t reg[PMU_NUM_OF_REGISTERS];
+--- a/target/arm/helper.c
- } Exynos4210PmuState;
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
-+static void exynos4210_pmu_poweroff(void)
+ #undef VFP_CONV_FIX_A64
-+{
-+    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
+ /* Conversion to/from f16 can overflow to infinity before/after scaling.
-+    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+- * Therefore we convert to f64 (which does not round), scale,
-+}
+- * and then convert f64 to f16 (which may round).
-+
++ * Therefore we convert to f64, scale, and then convert f64 to f16; or
- static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
++ * vice versa for conversion to integer.
-                                     unsigned size)
++ *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
+     if (unlikely(float16_is_any_nan(f))) {
-             PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
-                     (uint32_t)offset, (uint32_t)val);
+     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
-             s->reg[i] = val;
+ }
-+            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
-+                /*
++uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
-+                 * We are interested only in setting data bit
++{
-+                 * of PS_HOLD_CONTROL register to indicate power off request.
++    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
-+                 */
++}
-+                exynos4210_pmu_poweroff();
++
-+            }
++uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
-         reg_p++;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 17/17] hw/intc/arm_gicv3_its: Allow save/restore
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We change the restoration priority of both the GICv3 and ITS. The
+Cc: qemu-stable@nongnu.org
-GICv3 must be restored before the ITS and the ITS needs to be restored
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-before PCIe devices since it translates their MSI transactions.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/migration/vmstate.h    |  2 ++
+ target/arm/translate-a64.c | 17 +++++++++++++++--
- hw/intc/arm_gicv3_common.c     |  1 +
+file changed, 15 insertions(+), 2 deletions(-)
  hw/intc/arm_gicv3_its_common.c |  2 +-
  hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 files changed, 16 insertions(+), 13 deletions(-)
-diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/target/arm/translate-a64.c
-+++ b/include/migration/vmstate.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
- typedef enum {
+     bool sf = extract32(insn, 31, 1);
-     MIG_PRI_DEFAULT = 0,
+     bool itof;
-     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
-+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
+-    if (sbit || (type > 1)
-+    MIG_PRI_GICV3,              /* Must happen before the ITS */
+-        || (!sf && scale < 32)) {
-     MIG_PRI_MAX,
++    if (sbit || (!sf && scale < 32)) {
- } MigrationPriority;
++        unallocated_encoding(s);
++        return;
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
      .minimum_version_id = 1,
      .pre_save = gicv3_pre_save,
      .post_load = gicv3_post_load,
 +    .priority = MIG_PRI_GICV3,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(gicd_ctlr, GICv3State),
          VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
      .name = "arm_gicv3_its",
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
 -    .unmigratable = true,
 +    .priority = MIG_PRI_GICV3_ITS,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(ctlr, GICv3ITSState),
          VMSTATE_UINT32(iidr, GICv3ITSState),
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
      Error *local_err = NULL;
 -    /*
 -     * Block migration of a KVM GICv3 ITS device: the API for saving and
 -     * restoring the state in the kernel is not yet available
 -     */
 -    error_setg(&s->migration_blocker, "vITS migration is not implemented");
 -    migrate_add_blocker(s->migration_blocker, &local_err);
 -    if (local_err) {
 -        error_propagate(errp, local_err);
 -        error_free(s->migration_blocker);
 -        return;
 -    }
 -
      s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
      if (s->dev_fd < 0) {
          error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      gicv3_its_init_mmio(s, NULL);
 +    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +        GITS_CTLR)) {
 +        error_setg(&s->migration_blocker, "This operating system kernel "
 +                   "does not support vITS migration");
 +        migrate_add_blocker(s->migration_blocker, &local_err);
 +        if (local_err) {
 +            error_propagate(errp, local_err);
 +            error_free(s->migration_blocker);
 +            return;
 +        }
 +    }
 +
-     kvm_msi_use_devid = true;
++    switch (type) {
-     kvm_gsi_direct_mapping = false;
++    case 0: /* float32 */
-     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
++    case 1: /* float64 */
 +        break;
 +    case 3: /* float16 */
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 13/17] timer/aspeed: fix timer enablement when a reload is not set
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-When a timer is enabled before a reload value is set, the controller
+Cc: qemu-stable@nongnu.org
-waits for a reload value to be set before starting decrementing. This
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-fix tries to cover that case by changing the timer expiry only when
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-a reload value is valid.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
 Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
+ target/arm/translate-a64.c | 30 ++++++++++++++----------------
-file changed, 29 insertions(+), 8 deletions(-)
+file changed, 14 insertions(+), 16 deletions(-)
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/timer/aspeed_timer.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
-             next = seq[1];
+     return v;
          } else if (now < seq[2]) {
              next = seq[2];
 -        } else {
 +        } else if (t->reload) {
              reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
              t->start = now - ((now - t->start) % reload_ns);
 +        } else {
 +            /* no reload value, return 0 */
 +            break;
          }
      }
      return next;
  }
-+static void aspeed_timer_mod(AspeedTimer *t)
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
 +{
-+    uint64_t next = calculate_next(t);
++    TCGv_i32 v = tcg_temp_new_i32();
-+    if (next) {
++
-+        timer_mod(&t->timer, next);
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
-+    }
++    return v;
 +}
 +
- static void aspeed_timer_expire(void *opaque)
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
-     AspeedTimer *t = opaque;
+     TCGv_ptr fpst = NULL;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
-         qemu_set_irq(t->irq, t->level);
++    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
      TCGv_i32 tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
      switch (opcode) {
      case 0x0: /* FMOV */
          tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
          tcg_temp_free_i64(tcg_op2);
          tcg_temp_free_i64(tcg_res);
      } else {
 -        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
 -        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
 +        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
          TCGv_i64 tcg_res = tcg_temp_new_i64();
 -        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
--    timer_mod(&t->timer, calculate_next(t));
+     if (is_scalar) {
-+    aspeed_timer_mod(t);
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
- }
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
- static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
+-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-                                    uint32_t value)
+-
- {
+         switch (fpop) {
-     AspeedTimer *t;
+         case 0x1a: /* FCVTNS */
-+    uint32_t old_reload;
+         case 0x1b: /* FCVTMS */
      trace_aspeed_timer_set_value(timer, reg, value);
      t = &s->timers[timer];
      switch (reg) {
 +    case TIMER_REG_RELOAD:
 +        old_reload = t->reload;
 +        t->reload = value;
 +
 +        /* If the reload value was not previously set, or zero, and
 +         * the current value is valid, try to start the timer if it is
 +         * enabled.
 +         */
 +        if (old_reload || !t->reload) {
 +            break;
 +        }
 +
      case TIMER_REG_STATUS:
          if (timer_enabled(t)) {
              uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
              uint32_t rate = calculate_rate(t);
              t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
 -            timer_mod(&t->timer, calculate_next(t));
 +            aspeed_timer_mod(t);
          }
          break;
 -    case TIMER_REG_RELOAD:
 -        t->reload = value;
 -        break;
      case TIMER_REG_MATCH_FIRST:
      case TIMER_REG_MATCH_SECOND:
          t->match[reg - 2] = value;
          if (timer_enabled(t)) {
 -            timer_mod(&t->timer, calculate_next(t));
 +            aspeed_timer_mod(t);
          }
          break;
      default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
      trace_aspeed_timer_ctrl_enable(t->id, enable);
      if (enable) {
          t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        timer_mod(&t->timer, calculate_next(t));
 +        aspeed_timer_mod(t);
      } else {
          timer_del(&t->timer);
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 05/17] hw/arm/exynos: Move DRAM initialization next boards
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
+We missed all of the scalar fp16 binary operations.
 from exynos4210.c to exynos4_boards.c because DRAM is board specific,
 not SoC.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/exynos4210.h |  5 +----
+ target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
- hw/arm/exynos4210.c         | 20 +-----------------
+file changed, 65 insertions(+)
  hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
 files changed, 45 insertions(+), 30 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
-     MemoryRegion iram_mem;
+     tcg_temp_free_i64(tcg_res);
      MemoryRegion irom_mem;
      MemoryRegion irom_alias_mem;
 -    MemoryRegion dram0_mem;
 -    MemoryRegion dram1_mem;
      MemoryRegion boot_secondary;
      MemoryRegion bootreg_mem;
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
 -        unsigned long ram_size);
 +Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return mp_affinity;
  }
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
++/* Floating-point data-processing (2 source) - half precision */
--        unsigned long ram_size)
++static void handle_fp_2src_half(DisasContext *s, int opcode,
-+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
++                                int rd, int rn, int rm)
- {
++{
-     int i, n;
++    TCGv_i32 tcg_op1;
-     Exynos4210State *s = g_new(Exynos4210State, 1);
++    TCGv_i32 tcg_op2;
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
++    TCGv_i32 tcg_res;
--    unsigned long mem_size;
++    TCGv_ptr fpst;
      DeviceState *dev;
      SysBusDevice *busdev;
      ObjectClass *cpu_oc;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
      memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
                                  &s->iram_mem);
 -    /* DRAM */
 -    mem_size = ram_size;
 -    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
 -        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
 -                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
 -        vmstate_register_ram_global(&s->dram1_mem);
 -        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
 -                &s->dram1_mem);
 -        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
 -    }
 -    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
 -                           &error_fatal);
 -    vmstate_register_ram_global(&s->dram0_mem);
 -    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
 -            &s->dram0_mem);
 -
     /* PMU.
      * The only reason of existence at the moment is that secondary CPU boot
      * loader uses PMU INFORM5 register as a holding pen.
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "qemu-common.h"
  #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
      EXYNOS4_NUM_OF_BOARDS
  } Exynos4BoardType;
 +typedef struct Exynos4BoardState {
 +    Exynos4210State *soc;
 +    MemoryRegion dram0_mem;
 +    MemoryRegion dram1_mem;
 +} Exynos4BoardState;
 +
- static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
++    tcg_res = tcg_temp_new_i32();
-     [EXYNOS4_BOARD_NURI]     = 0xD33,
++    fpst = get_fpstatus_ptr(true);
-     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
++    tcg_op1 = read_fp_hreg(s, rn);
-@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
++    tcg_op2 = read_fp_hreg(s, rm);
      }
  }
 -static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
 -                                                   Exynos4BoardType board_type)
 +static void exynos4_boards_init_ram(Exynos4BoardState *s,
 +                                    MemoryRegion *system_mem,
 +                                    unsigned long ram_size)
 +{
 +    unsigned long mem_size = ram_size;
 +
-+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
++    switch (opcode) {
-+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
++    case 0x0: /* FMUL */
-+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
++        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
-+                               &error_fatal);
++        break;
-+        vmstate_register_ram_global(&s->dram1_mem);
++    case 0x1: /* FDIV */
-+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
++        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
-+                                    &s->dram1_mem);
++        break;
-+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
++    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
-+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
++    write_fp_sreg(s, rd, tcg_res);
-+                           &error_fatal);
++
-+    vmstate_register_ram_global(&s->dram0_mem);
++    tcg_temp_free_ptr(fpst);
-+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
++    tcg_temp_free_i32(tcg_op1);
-+                                &s->dram0_mem);
++    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
-+static Exynos4BoardState *
+ /* Floating point data-processing (2 source)
-+exynos4_boards_init_common(MachineState *machine,
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
-+                           Exynos4BoardType board_type)
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
- {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
-+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
+         }
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
+         break;
-     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
++    case 3:
-@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-             machine->kernel_cmdline,
++            unallocated_encoding(s);
-             machine->initrd_filename);
++            return;
++        }
--    return exynos4210_init(get_system_memory(),
++        if (!fp_access_check(s)) {
--            exynos4_board_ram_size[board_type]);
++            return;
-+    exynos4_boards_init_ram(s, get_system_memory(),
++        }
-+                            exynos4_board_ram_size[board_type]);
++        handle_fp_2src_half(s, opcode, rd, rn, rm);
-+
++        break;
-+    s->soc = exynos4210_init(get_system_memory());
+     default:
-+
+         unallocated_encoding(s);
-+    return s;
+     }
  }
  static void nuri_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
  static void smdkc210_init(MachineState *machine)
  {
 -    Exynos4210State *s = exynos4_boards_init_common(machine,
 -                                                    EXYNOS4_BOARD_SMDKC210);
 +    Exynos4BoardState *s = exynos4_boards_init_common(machine,
 +                                                      EXYNOS4_BOARD_SMDKC210);
      lan9215_init(SMDK_LAN9118_BASE_ADDR,
 -            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
 +            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
      arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
  }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 11/17] hw/misc: add a TMP42{1, 2, 3} device model
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Largely inspired by the TMP105 temperature sensor, here is a model for
+We missed all of the scalar fp16 fma operations.
 the TMP42{1,2,3} temperature sensors.
-Specs can be found here :
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 file changed, 48 insertions(+)
-    http://www.ti.com/lit/gpn/tmp421
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/misc/Makefile.objs           |   1 +
  hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   1 +
 files changed, 404 insertions(+)
  create mode 100644 hw/misc/tmp421.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
- common-obj-$(CONFIG_APPLESMC) += applesmc.o
+     tcg_temp_free_i64(tcg_res);
- common-obj-$(CONFIG_MAX111X) += max111x.o
+ }
- common-obj-$(CONFIG_TMP105) += tmp105.o
-+common-obj-$(CONFIG_TMP421) += tmp421.o
++/* Floating-point data-processing (3 source) - half precision */
- common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
- common-obj-$(CONFIG_SGA) += sga.o
++                                int rd, int rn, int rm, int ra)
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
++{
-diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
++    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
-new file mode 100644
++    TCGv_i32 tcg_res = tcg_temp_new_i32();
-index XXXXXXX..XXXXXXX
++    TCGv_ptr fpst = get_fpstatus_ptr(true);
 --- /dev/null
 +++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Texas Instruments TMP421 temperature sensor.
 + *
 + * Copyright (c) 2016 IBM Corporation.
 + *
 + * Largely inspired by :
 + *
 + * Texas Instruments TMP105 temperature sensor.
 + *
 + * Copyright (C) 2008 Nokia Corporation
 + * Written by Andrzej Zaborowski <andrew@openedhand.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#include "qemu/osdep.h"
++    tcg_op1 = read_fp_hreg(s, rn);
-+#include "hw/hw.h"
++    tcg_op2 = read_fp_hreg(s, rm);
-+#include "hw/i2c/i2c.h"
++    tcg_op3 = read_fp_hreg(s, ra);
 +#include "qapi/error.h"
 +#include "qapi/visitor.h"
 +
-+/* Manufacturer / Device ID's */
++    /* These are fused multiply-add, and must be done as one
-+#define TMP421_MANUFACTURER_ID          0x55
++     * floating point operation with no rounding between the
-+#define TMP421_DEVICE_ID                0x21
++     * multiplication and addition steps.
-+#define TMP422_DEVICE_ID                0x22
++     * NB that doing the negations here as separate steps is
-+#define TMP423_DEVICE_ID                0x23
++     * correct : an input NaN should come out with its sign bit
-+
++     * flipped if it is a negated-input.
-+typedef struct DeviceInfo {
++     */
-+    int model;
++    if (o1 == true) {
-+    const char *name;
++        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +} DeviceInfo;
 +
 +static const DeviceInfo devices[] = {
 +    { TMP421_DEVICE_ID, "tmp421" },
 +    { TMP422_DEVICE_ID, "tmp422" },
 +    { TMP423_DEVICE_ID, "tmp423" },
 +};
 +
 +typedef struct TMP421State {
 +    /*< private >*/
 +    I2CSlave i2c;
 +    /*< public >*/
 +
 +    int16_t temperature[4];
 +
 +    uint8_t status;
 +    uint8_t config[2];
 +    uint8_t rate;
 +
 +    uint8_t len;
 +    uint8_t buf[2];
 +    uint8_t pointer;
 +
 +} TMP421State;
 +
 +typedef struct TMP421Class {
 +    I2CSlaveClass parent_class;
 +    DeviceInfo *dev;
 +} TMP421Class;
 +
 +#define TYPE_TMP421 "tmp421-generic"
 +#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
 +
 +#define TMP421_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
 +#define TMP421_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
 +
 +/* the TMP421 registers */
 +#define TMP421_STATUS_REG               0x08
 +#define    TMP421_STATUS_BUSY             (1 << 7)
 +#define TMP421_CONFIG_REG_1             0x09
 +#define    TMP421_CONFIG_RANGE            (1 << 2)
 +#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
 +#define TMP421_CONFIG_REG_2             0x0A
 +#define    TMP421_CONFIG_RC               (1 << 2)
 +#define    TMP421_CONFIG_LEN              (1 << 3)
 +#define    TMP421_CONFIG_REN              (1 << 4)
 +#define    TMP421_CONFIG_REN2             (1 << 5)
 +#define    TMP421_CONFIG_REN3             (1 << 6)
 +
 +#define TMP421_CONVERSION_RATE_REG      0x0B
 +#define TMP421_ONE_SHOT                 0x0F
 +
 +#define TMP421_RESET                    0xFC
 +#define TMP421_MANUFACTURER_ID_REG      0xFE
 +#define TMP421_DEVICE_ID_REG            0xFF
 +
 +#define TMP421_TEMP_MSB0                0x00
 +#define TMP421_TEMP_MSB1                0x01
 +#define TMP421_TEMP_MSB2                0x02
 +#define TMP421_TEMP_MSB3                0x03
 +#define TMP421_TEMP_LSB0                0x10
 +#define TMP421_TEMP_LSB1                0x11
 +#define TMP421_TEMP_LSB2                0x12
 +#define TMP421_TEMP_LSB3                0x13
 +
 +static const int32_t mins[2] = { -40000, -55000 };
 +static const int32_t maxs[2] = { 127000, 150000 };
 +
 +static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
 +{
 +    TMP421State *s = TMP421(obj);
 +    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
 +    int offset = ext_range * 64 * 256;
 +    int64_t value;
 +    int tempid;
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
-+    if (tempid >= 4 || tempid < 0) {
++    if (o0 != o1) {
-+        error_setg(errp, "error reading %s", name);
++        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +        return;
 +    }
 +
-+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
++    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
-+    visit_type_int(v, name, &value, errp);
++    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
-+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ /* Floating point data-processing (3 source)
-+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
-+ */
+  * +---+---+---+-----------+------+----+------+----+------+------+------+
-+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
-+                                   void *opaque, Error **errp)
+         }
-+{
+         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
-+    TMP421State *s = TMP421(obj);
+         break;
-+    Error *local_err = NULL;
++    case 3:
-+    int64_t temp;
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
++            unallocated_encoding(s);
-+    int offset = ext_range * 64 * 256;
++            return;
-+    int tempid;
++        }
-+
++        if (!fp_access_check(s)) {
-+    visit_type_int(v, name, &temp, &local_err);
++            return;
-+    if (local_err) {
++        }
-+        error_propagate(errp, local_err);
++        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        return;
 +    }
 +
 +    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
 +        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
 +                   temp / 1000, temp % 1000);
 +        return;
 +    }
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
 +    if (tempid >= 4 || tempid < 0) {
 +        error_setg(errp, "error reading %s", name);
 +        return;
 +    }
 +
 +    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
 +}
 +
 +static void tmp421_read(TMP421State *s)
 +{
 +    TMP421Class *sc = TMP421_GET_CLASS(s);
 +
 +    s->len = 0;
 +
 +    switch (s->pointer) {
 +    case TMP421_MANUFACTURER_ID_REG:
 +        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
 +        break;
-+    case TMP421_DEVICE_ID_REG:
+     default:
-+        s->buf[s->len++] = sc->dev->model;
+         unallocated_encoding(s);
-+        break;
+     }
 +    case TMP421_CONFIG_REG_1:
 +        s->buf[s->len++] = s->config[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->buf[s->len++] = s->config[1];
 +        break;
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->buf[s->len++] = s->rate;
 +        break;
 +    case TMP421_STATUS_REG:
 +        s->buf[s->len++] = s->status;
 +        break;
 +
 +        /* FIXME: check for channel enablement in config registers */
 +    case TMP421_TEMP_MSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    }
 +}
 +
 +static void tmp421_reset(I2CSlave *i2c);
 +
 +static void tmp421_write(TMP421State *s)
 +{
 +    switch (s->pointer) {
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->rate = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_1:
 +        s->config[0] = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->config[1] = s->buf[0];
 +        break;
 +    case TMP421_RESET:
 +        tmp421_reset(I2C_SLAVE(s));
 +        break;
 +    }
 +}
 +
 +static int tmp421_rx(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len < 2) {
 +        return s->buf[s->len++];
 +    } else {
 +        return 0xff;
 +    }
 +}
 +
 +static int tmp421_tx(I2CSlave *i2c, uint8_t data)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len == 0) {
 +        /* first byte is the register pointer for a read or write
 +         * operation */
 +        s->pointer = data;
 +        s->len++;
 +    } else if (s->len == 1) {
 +        /* second byte is the data to write. The device only supports
 +         * one byte writes */
 +        s->buf[0] = data;
 +        tmp421_write(s);
 +    }
 +
 +    return 0;
 +}
 +
 +static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (event == I2C_START_RECV) {
 +        tmp421_read(s);
 +    }
 +
 +    s->len = 0;
 +    return 0;
 +}
 +
 +static const VMStateDescription vmstate_tmp421 = {
 +    .name = "TMP421",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT8(len, TMP421State),
 +        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
 +        VMSTATE_UINT8(pointer, TMP421State),
 +        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
 +        VMSTATE_UINT8(status, TMP421State),
 +        VMSTATE_UINT8(rate, TMP421State),
 +        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
 +        VMSTATE_I2C_SLAVE(i2c, TMP421State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void tmp421_reset(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +    TMP421Class *sc = TMP421_GET_CLASS(s);
 +
 +    memset(s->temperature, 0, sizeof(s->temperature));
 +    s->pointer = 0;
 +
 +    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
 +
 +     /* resistance correction and channel enablement */
 +    switch (sc->dev->model) {
 +    case TMP421_DEVICE_ID:
 +        s->config[1] = 0x1c;
 +        break;
 +    case TMP422_DEVICE_ID:
 +        s->config[1] = 0x3c;
 +        break;
 +    case TMP423_DEVICE_ID:
 +        s->config[1] = 0x7c;
 +        break;
 +    }
 +
 +    s->rate = 0x7;       /* 8Hz */
 +    s->status = 0;
 +}
 +
 +static int tmp421_init(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    tmp421_reset(&s->i2c);
 +
 +    return 0;
 +}
 +
 +static void tmp421_initfn(Object *obj)
 +{
 +    object_property_add(obj, "temperature0", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature1", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature2", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature3", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +}
 +
 +static void tmp421_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
 +    TMP421Class *sc = TMP421_CLASS(klass);
 +
 +    k->init = tmp421_init;
 +    k->event = tmp421_event;
 +    k->recv = tmp421_rx;
 +    k->send = tmp421_tx;
 +    dc->vmsd = &vmstate_tmp421;
 +    sc->dev = (DeviceInfo *) data;
 +}
 +
 +static const TypeInfo tmp421_info = {
 +    .name          = TYPE_TMP421,
 +    .parent        = TYPE_I2C_SLAVE,
 +    .instance_size = sizeof(TMP421State),
 +    .class_size    = sizeof(TMP421Class),
 +    .instance_init = tmp421_initfn,
 +    .abstract      = true,
 +};
 +
 +static void tmp421_register_types(void)
 +{
 +    int i;
 +
 +    type_register_static(&tmp421_info);
 +    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
 +        TypeInfo ti = {
 +            .name       = devices[i].name,
 +            .parent     = TYPE_TMP421,
 +            .class_init = tmp421_class_init,
 +            .class_data = (void *) &devices[i],
 +        };
 +        type_register(&ti);
 +    }
 +}
 +
 +type_init(tmp421_register_types)
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
  CONFIG_TSC2005=y
  CONFIG_LM832X=y
  CONFIG_TMP105=y
 +CONFIG_TMP421=y
  CONFIG_STELLARIS=y
  CONFIG_STELLARIS_INPUT=y
  CONFIG_STELLARIS_ENET=y
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 15/17] hw/intc/arm_gicv3_its: Implement state save/restore
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
-From: Eric Auger <eric.auger@redhat.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-We need to handle both registers and ITS tables. While
+These where missed out from the rest of the half-precision work.
-register handling is standard, ITS table handling is more
-challenging since the kernel API is devised so that the
+Cc: qemu-stable@nongnu.org
 tables are flushed into guest RAM and not in vmstate buffers.
 Flushing the ITS tables on device pre_save() is too late
 since the guest RAM is already saved at this point.
 Table flushing needs to happen when we are sure the vcpus
 are stopped and before the last dirty page saving. The
 right point is RUN_STATE_FINISH_MIGRATE but sometimes the
 VM gets stopped before migration launch so let's simply
 flush the tables each time the VM gets stopped.
 For regular ITS registers we just can use vmstate pre_save()
 and post_load() callbacks.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
+[rth: Diagnose lack of FP16 before fp_access_check]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/arm_gicv3_its_common.h |   8 +++
+ target/arm/helper-a64.h    |  2 +
- hw/intc/arm_gicv3_its_common.c         |  10 ++++
+ target/arm/helper-a64.c    | 10 +++++
- hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
-files changed, 123 insertions(+)
+files changed, 83 insertions(+), 17 deletions(-)
-diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
+diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_its_common.h
+--- a/target/arm/helper-a64.h
-+++ b/include/hw/intc/arm_gicv3_its_common.h
++++ b/target/arm/helper-a64.h
 @@ -XXX,XX +XXX,XX @@
- #define ITS_TRANS_SIZE   0x10000
+ DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
- #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
+ DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
-+#define GITS_CTLR        0x0
++DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
-+#define GITS_IIDR        0x4
++DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
-+#define GITS_CBASER      0x80
+ DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
-+#define GITS_CWRITER     0x88
+ DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
-+#define GITS_CREADR      0x90
+ DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
-+#define GITS_BASER       0x100
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      /* Registers */
      uint32_t ctlr;
 +    uint32_t iidr;
      uint64_t cbaser;
      uint64_t cwriter;
      uint64_t creadr;
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_common.c
+--- a/target/arm/helper-a64.c
-+++ b/hw/intc/arm_gicv3_its_common.c
++++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
-     .pre_save = gicv3_its_pre_save,
+     return flags;
-     .post_load = gicv3_its_post_load,
+ }
-     .unmigratable = true,
-+    .fields = (VMStateField[]) {
++uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
-+        VMSTATE_UINT32(ctlr, GICv3ITSState),
++{
-+        VMSTATE_UINT32(iidr, GICv3ITSState),
++    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
-+        VMSTATE_UINT64(cbaser, GICv3ITSState),
++}
-+        VMSTATE_UINT64(cwriter, GICv3ITSState),
++
-+        VMSTATE_UINT64(creadr, GICv3ITSState),
++uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
-+        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
++{
-+        VMSTATE_END_OF_LIST()
++    return float_rel_to_flags(float16_compare(x, y, fp_status));
-+    },
++}
- };
++
+ uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
- static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
+ {
-@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
+     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
-     s->cbaser = 0;
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
      s->cwriter = 0;
      s->creadr = 0;
 +    s->iidr = 0;
      memset(&s->baser, 0, sizeof(s->baser));
      gicv3_its_post_load(s, 0);
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
+@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
-     return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+     }
  }
-+/**
+-static void handle_fp_compare(DisasContext *s, bool is_double,
-+ * vm_change_state_handler - VM change state callback aiming at flushing
++static void handle_fp_compare(DisasContext *s, int size,
-+ * ITS tables into guest RAM
+                               unsigned int rn, unsigned int rm,
-+ *
+                               bool cmp_with_zero, bool signal_all_nans)
-+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ {
-+ */
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-+static void vm_change_state_handler(void *opaque, int running,
+-    TCGv_ptr fpst = get_fpstatus_ptr(false);
-+                                    RunState state)
++    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
-+{
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+-    if (is_double) {
-+    Error *err = NULL;
++    if (size == MO_64) {
-+    int ret;
+         TCGv_i64 tcg_vn, tcg_vm;
-+
-+    if (running) {
+         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
++    switch (type) {
-+                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
++    case 0:
-+    if (err) {
++        size = MO_32;
-+        error_report_err(err);
++        break;
-+    }
++    case 1:
-+    if (ret < 0 && ret != -EFAULT) {
++        size = MO_64;
-+        abort();
++        break;
-+    }
++    case 3:
-+}
++        size = MO_16;
-+
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
++            break;
- {
++        }
-     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
++        /* fallthru */
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
++    default:
-     kvm_msi_use_devid = true;
+         unallocated_encoding(s);
-     kvm_gsi_direct_mapping = false;
+         return;
-     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+     }
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
-+    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+         return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
- static void kvm_arm_its_init(Object *obj)
+ /* Floating point conditional compare
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-                              &error_abort);
+     unsigned int mos, type, rm, cond, rn, op, nzcv;
- }
+     TCGv_i64 tcg_flags;
+     TCGLabel *label_continue = NULL;
-+/**
++    int size;
-+ * kvm_arm_its_pre_save - handles the saving of ITS registers.
-+ * ITS tables are flushed into guest RAM separately and earlier,
+     mos = extract32(insn, 29, 3);
-+ * through the VM change state handler, since at the moment pre_save()
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+ * is called, the guest RAM has already been saved.
++    type = extract32(insn, 22, 2);
-+ */
+     rm = extract32(insn, 16, 5);
-+static void kvm_arm_its_pre_save(GICv3ITSState *s)
+     cond = extract32(insn, 12, 4);
-+{
+     rn = extract32(insn, 5, 5);
-+    int i;
+     op = extract32(insn, 4, 1);
-+
+     nzcv = extract32(insn, 0, 4);
-+    for (i = 0; i < 8; i++) {
-+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+-    if (mos || type > 1) {
-+                          GITS_BASER + i * 8, &s->baser[i], false,
++    if (mos) {
-+                          &error_abort);
++        unallocated_encoding(s);
 +    }
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CTLR, &s->ctlr, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CBASER, &s->cbaser, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CREADR, &s->creadr, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CWRITER, &s->cwriter, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_IIDR, &s->iidr, false, &error_abort);
 +}
 +
 +/**
 + * kvm_arm_its_post_load - Restore both the ITS registers and tables
 + */
 +static void kvm_arm_its_post_load(GICv3ITSState *s)
 +{
 +    int i;
 +
 +    if (!s->iidr) {
 +        return;
 +    }
 +
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
++    switch (type) {
-+                      GITS_IIDR, &s->iidr, true, &error_abort);
++    case 0:
-+
++        size = MO_32;
-+    /*
++        break;
-+     * must be written before GITS_CREADR since GITS_CBASER write
++    case 1:
-+     * access resets GITS_CREADR.
++        size = MO_64;
-+     */
++        break;
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
++    case 3:
-+                      GITS_CBASER, &s->cbaser, true, &error_abort);
++        size = MO_16;
-+
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
++            break;
-+                      GITS_CREADR, &s->creadr, true, &error_abort);
++        }
-+
++        /* fallthru */
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
++    default:
-+                      GITS_CWRITER, &s->cwriter, true, &error_abort);
+         unallocated_encoding(s);
-+
+         return;
-+
+     }
-+    for (i = 0; i < 8; i++) {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+         gen_set_label(label_match);
-+                          GITS_BASER + i * 8, &s->baser[i], true,
+     }
-+                          &error_abort);
-+    }
+-    handle_fp_compare(s, type, rn, rm, false, op);
-+
++    handle_fp_compare(s, size, rn, rm, false, op);
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
+     if (cond < 0x0e) {
-+                      &error_abort);
+         gen_set_label(label_continue);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CTLR, &s->ctlr, true, &error_abort);
 +}
 +
  static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
      dc->realize = kvm_arm_its_realize;
      icc->send_msi = kvm_its_send_msi;
 +    icc->pre_save = kvm_arm_its_pre_save;
 +    icc->post_load = kvm_arm_its_post_load;
  }
  static const TypeInfo kvm_arm_its_info = {
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 16/17] hw/intc/arm_gicv3_kvm: Implement pending table save
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-From: Eric Auger <eric.auger@redhat.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-This patch adds the flush of the LPI pending bits into the
+These were missed out from the rest of the half-precision work.
 redistributor pending tables. This happens on VM stop.
-There is no explicit restore as the tables are implicitly sync'ed
+Cc: qemu-stable@nongnu.org
 on ITS table restore and on LPI enable at redistributor level.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
+[rth: Fix erroneous check vs type]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
-file changed, 34 insertions(+)
+file changed, 25 insertions(+), 6 deletions(-)
-diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/arm_gicv3_kvm.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
- #include "hw/sysbus.h"
+     unsigned int mos, type, rm, cond, rn, rd;
- #include "qemu/error-report.h"
+     TCGv_i64 t_true, t_false, t_zero;
- #include "sysemu/kvm.h"
+     DisasCompare64 c;
-+#include "sysemu/sysemu.h"
++    TCGMemOp sz;
- #include "kvm_arm.h"
- #include "gicv3_internal.h"
+     mos = extract32(insn, 29, 3);
- #include "vgic_common.h"
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
++    type = extract32(insn, 22, 2);
-     REGINFO_SENTINEL
+     rm = extract32(insn, 16, 5);
- };
+     cond = extract32(insn, 12, 4);
+     rn = extract32(insn, 5, 5);
-+/**
+     rd = extract32(insn, 0, 5);
-+ * vm_change_state_handler - VM change state callback aiming at flushing
-+ * RDIST pending tables into guest RAM
+-    if (mos || type > 1) {
-+ *
++    if (mos) {
-+ * The tables get flushed to guest RAM whenever the VM gets stopped.
++        unallocated_encoding(s);
 + */
 +static void vm_change_state_handler(void *opaque, int running,
 +                                    RunState state)
 +{
 +    GICv3State *s = (GICv3State *)opaque;
 +    Error *err = NULL;
 +    int ret;
 +
 +    if (running) {
 +        return;
 +    }
 +
-+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
++    switch (type) {
-+                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
++    case 0:
-+                           NULL, true, &err);
++        sz = MO_32;
-+    if (err) {
++        break;
-+        error_report_err(err);
++    case 1:
-+    }
++        sz = MO_64;
-+    if (ret < 0 && ret != -EFAULT) {
++        break;
-+        abort();
++    case 3:
-+    }
++        sz = MO_16;
-+}
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+
++            break;
-+
++        }
- static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
++        /* fallthru */
- {
++    default:
-     GICv3State *s = KVM_ARM_GICV3(dev);
+         unallocated_encoding(s);
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
+         return;
              return;
          }
      }
-+    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
+         return;
-+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+     }
-+    }
- }
+-    /* Zero extend sreg inputs to 64 bits now.  */
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
- static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
+     t_true = tcg_temp_new_i64();
      t_false = tcg_temp_new_i64();
 -    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
 -    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
 +    read_vec_element(s, t_true, rn, 0, sz);
 +    read_vec_element(s, t_false, rm, 0, sz);
      a64_test_cc(&c, cond);
      t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 03/17] hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-Statements under 'case' were in some places wrongly indented bringing
+All the hard work is already done by vfp_expand_imm, we just need to
-confusion and making the code less readable.  Remove also few unneeded
+make sure we pick up the correct size.
 blank lines.  No functional changes.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
-file changed, 20 insertions(+), 25 deletions(-)
+file changed, 17 insertions(+), 3 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+ {
-     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
+     int rd = extract32(insn, 0, 5);
-     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
+     int imm8 = extract32(insn, 13, 8);
--    index = GET_G_COMP_IDX(offset);
+-    int is_double = extract32(insn, 22, 2);
--    shift = 8 * (offset & 0x4);
++    int type = extract32(insn, 22, 2);
--    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
+     uint64_t imm;
-+        index = GET_G_COMP_IDX(offset);
+     TCGv_i64 tcg_res;
-+        shift = 8 * (offset & 0x4);
++    TCGMemOp sz;
-+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
-     break;
+-    if (is_double > 1) {
++    switch (type) {
-     case G_TCON:
++    case 0:
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
++        sz = MO_32;
-         lt_i = GET_L_TIMER_IDX(offset);
++        break;
++    case 1:
-         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
++        sz = MO_64;
--
++        break;
-         break;
++    case 3:
++        sz = MO_16;
-     case L0_TCON: case L1_TCON:
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
++            break;
      case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
      case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
 -    index = GET_G_COMP_IDX(offset);
 -    shift = 8 * (offset & 0x4);
 -    s->g_timer.reg.comp[index] =
 -            (s->g_timer.reg.comp[index] &
 -            (((uint64_t)UINT32_MAX << 32) >> shift)) +
 -            (value << shift);
 +        index = GET_G_COMP_IDX(offset);
 +        shift = 8 * (offset & 0x4);
 +        s->g_timer.reg.comp[index] =
 +                (s->g_timer.reg.comp[index] &
 +                (((uint64_t)UINT32_MAX << 32) >> shift)) +
 +                (value << shift);
 -    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 +        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 -    if (offset & 0x4) {
 -        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
 -    } else {
 -        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
 -    }
 +        if (offset & 0x4) {
 +            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
 +        } else {
 +            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
 +        }
++        /* fallthru */
--    exynos4210_gfrc_restart(s);
++    default:
--    break;
+         unallocated_encoding(s);
-+        exynos4210_gfrc_restart(s);
+         return;
-+        break;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-     case G_TCON:
+         return;
-         old_val = s->g_timer.reg.tcon;
+     }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
+-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
++    imm = vfp_expand_imm(sz, imm8);
-     case G_INT_ENB:
--
+     tcg_res = tcg_const_i64(imm);
-         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
+     write_fp_dreg(s, rd, tcg_res);
          for (i = 0; i < MCT_GT_CMP_NUM; i++) {
              if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
          break;
      case L0_TCNTB: case L1_TCNTB:
 -
          lt_i = GET_L_TIMER_IDX(offset);
          index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
          break;
      case L0_ICNTB: case L1_ICNTB:
 -
          lt_i = GET_L_TIMER_IDX(offset);
          index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
          if (icntb_max[lt_i] < value) {
              icntb_max[lt_i] = value;
          }
 -DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
 -        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
 +        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
 +                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
  #endif
 -break;
 +        break;
      case L0_FRCNTB: case L1_FRCNTB:
 -
          lt_i = GET_L_TIMER_IDX(offset);
          index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 07/17] hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-Use a define for a9mpcore_priv device type name instead of hard-coded
+We are meant to explicitly pass fpst, not cpu_env.
 string.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4210.c | 3 ++-
+ target/arm/translate-a64.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
- #include "qemu-common.h"
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
- #include "qemu/log.h"
+         break;
- #include "cpu.h"
+     case 0x3: /* FSQRT */
-+#include "hw/cpu/a9mpcore.h"
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
- #include "hw/boards.h"
++        fpst = get_fpstatus_ptr(true);
- #include "sysemu/sysemu.h"
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
- #include "hw/sysbus.h"
+         break;
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+     case 0x8: /* FRINTN */
-     }
+     case 0x9: /* FRINTP */
      /* Private memory region and Internal GIC */
 -    dev = qdev_create(NULL, "a9mpcore_priv");
 +    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
      qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
      qdev_init_nofail(dev);
      busdev = SYS_BUS_DEVICE(dev);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 14/17] kvm-all: Pass an error object to kvm_device_access
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
-From: Eric Auger <eric.auger@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-In some circumstances, we don't want to abort if the
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
 kvm_device_access fails. This will be the case during ITS
 migration, in case the ITS table save/restore fails because
 the guest did not program the vITS correctly. So let's pass an
 error object to the function and return the ioctl value. New
 callers will be able to make a decision upon this returned
 value.
-Existing callers pass &error_abort which will cause the
+  The block length is predefined to 512 bits
 function to abort on failure.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+and "4.10.2 SD Status":
-Reviewed-by: Juan Quintela <quintela@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
+  The SD Status contains status bits that are related to the SD Memory Card
-Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
+  proprietary features and may be used for future application-specific usage.
-[PMM: wrapped long line]
+  The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/sysemu/kvm.h        | 11 +++++++----
+ hw/sd/sd.c | 2 +-
- hw/intc/arm_gic_kvm.c       |  9 +++++----
+file changed, 1 insertion(+), 1 deletion(-)
  hw/intc/arm_gicv3_its_kvm.c |  2 +-
  hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
  kvm-all.c                   | 14 ++++++++------
 files changed, 28 insertions(+), 22 deletions(-)
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
+--- a/hw/sd/sd.c
-+++ b/include/sysemu/kvm.h
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
-  * @attr: the attribute of that group to set or get
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
-  * @val: pointer to a storage area for the value
+     }
-  * @write: true for set and false for get operation
+     memset(&sd->data[17], 0, 47);
-+ * @errp: error object handle
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-  *
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 - * This function is not allowed to fail. Use kvm_device_check_attr()
 - * in order to check for the availability of optional attributes.
 + * Returns: 0 on success
 + *          < 0 on error
 + * Use kvm_device_check_attr() in order to check for the availability
 + * of optional attributes.
   */
 -void kvm_device_access(int fd, int group, uint64_t attr,
 -                       void *val, bool write);
 +int kvm_device_access(int fd, int group, uint64_t attr,
 +                      void *val, bool write, Error **errp);
  /**
   * kvm_create_device - create a KVM device for the device control API
 diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic_kvm.c
 +++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
                              uint32_t *val, bool write)
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
 -                      KVM_VGIC_ATTR(offset, cpu), val, write);
 +                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
  }
- static void kvm_gicc_access(GICState *s, int offset, int cpu,
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
                              uint32_t *val, bool write)
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
 -                      KVM_VGIC_ATTR(offset, cpu), val, write);
 +                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
  }
  #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
          if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
              uint32_t numirqs = s->num_irq;
              kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
 -                              &numirqs, true);
 +                              &numirqs, true, &error_abort);
          }
          /* Tell the kernel to complete VGIC initialization now */
          if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
                                    KVM_DEV_ARM_VGIC_CTRL_INIT)) {
              kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 -                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
 +                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
 +                              &error_abort);
          }
      } else if (ret != -ENODEV && ret != -ENOTSUP) {
          error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      /* explicit init of the ITS */
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 -                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
 +                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
      /* register the base address */
      kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
 diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_kvm.c
 +++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
                        KVM_VGIC_ATTR(offset, 0),
 -                      val, write);
 +                      val, write, &error_abort);
  }
  static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
                        KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
 -                      val, write);
 +                      val, write, &error_abort);
  }
  static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                        KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
 -                      val, write);
 +                      val, write, &error_abort);
  }
  static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
                        KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
                        (VGIC_LEVEL_INFO_LINE_LEVEL <<
                         KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
 -                      val, write);
 +                      val, write, &error_abort);
  }
  /* Loop through each distributor IRQ related register; since bits
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
      /* Initialize to actual HW supported configuration */
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                        KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
 -                      &c->icc_ctlr_el1[GICV3_NS], false);
 +                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
      c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
  }
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
      }
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
 -                      0, &s->num_irq, true);
 +                      0, &s->num_irq, true, &error_abort);
      /* Tell the kernel to complete VGIC initialization now */
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 -                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
 +                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
      kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                              KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
 diff --git a/kvm-all.c b/kvm-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/kvm-all.c
 +++ b/kvm-all.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option.h"
  #include "qemu/config-file.h"
  #include "qemu/error-report.h"
 +#include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/pci/msi.h"
  #include "hw/pci/msix.h"
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
      return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
  }
 -void kvm_device_access(int fd, int group, uint64_t attr,
 -                       void *val, bool write)
 +int kvm_device_access(int fd, int group, uint64_t attr,
 +                      void *val, bool write, Error **errp)
  {
      struct kvm_device_attr kvmattr;
      int err;
@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
                             write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
                             &kvmattr);
      if (err < 0) {
 -        error_report("KVM_%s_DEVICE_ATTR failed: %s",
 -                     write ? "SET" : "GET", strerror(-err));
 -        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
 -        abort();
 +        error_setg_errno(errp, -err,
 +                         "KVM_%s_DEVICE_ATTR failed: Group %d "
 +                         "attr 0x%016" PRIx64,
 +                         write ? "SET" : "GET", group, attr);
      }
 +    return err;
  }
  /* Return 1 on success, 0 on failure */
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 02/17] hw/timer/exynos4210_mct: Fix checkpatch style errors
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-From: Krzysztof Kozlowski <krzk@kernel.org>
+Usually the logging of the CPU state produced by -d cpu is sufficient
 to diagnose problems, but sometimes you want to see the state of
 the floating point registers as well. We don't want to enable that
 by default as it adds a lot of extra data to the log; instead,
 allow it to be optionally enabled via -d fpu.
-Fix checkpatch errors:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-. ERROR: spaces required around that '+' (ctx:VxV)
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-. ERROR: spaces required around that '&' (ctx:VxV)
+Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 ---
  include/qemu/log.h   | 1 +
  accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-No functional changes.
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/timer/exynos4210_mct.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/include/qemu/log.h
-+++ b/hw/timer/exynos4210_mct.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
- {
+ #define CPU_LOG_PAGE       (1 << 14)
-     uint32_t freq = s->freq;
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-     s->freq = 24000000 /
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
--            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
++#define CPU_LOG_TB_FPU     (1 << 17)
-+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
-                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
+ /* Lock output for a series of related logs.  Since this is not needed
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-     if (freq != s->freq) {
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cpu-exec.c
-     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
++++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
--    if (offset&0x4) {
+     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-+    if (offset & 0x4) {
+         && qemu_log_in_addr_range(itb->pc)) {
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
+         qemu_log_lock();
-     } else {
++        int flags = 0;
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
++        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.7.4
+.17.0

Target-arm queue...

thanks
-- PMM

The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613

for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:

hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * vITS: Support save/restore
 * timer/aspeed: Fix timer enablement when reload is not set
 * aspped: add temperature sensor device
 * timer.h: Provide better monotonic time on ARM hosts
 * exynos4210: various cleanups
 * exynos4210: support system poweroff

----------------------------------------------------------------
Cédric Le Goater (3):
      hw/misc: add a TMP42{1, 2, 3} device model
      aspeed: add a temp sensor device on I2C bus 3
      timer/aspeed: fix timer enablement when a reload is not set

Eric Auger (4):
      kvm-all: Pass an error object to kvm_device_access
      hw/intc/arm_gicv3_its: Implement state save/restore
      hw/intc/arm_gicv3_kvm: Implement pending table save
      hw/intc/arm_gicv3_its: Allow save/restore

Krzysztof Kozlowski (9):
      hw/intc/exynos4210_gic: Use more meaningful name for local variable
      hw/timer/exynos4210_mct: Fix checkpatch style errors
      hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
      hw/timer/exynos4210_mct: Remove unused defines
      hw/arm/exynos: Move DRAM initialization next boards
      hw/arm/exynos: Declare local variables in some order
      hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
      hw/intc/exynos4210_gic: Constify array of combiner interrupts
      hw/misc/exynos4210_pmu: Add support for system poweroff

Pranith Kumar (1):
      timer.h: Provide better monotonic time

From: Krzysztof Kozlowski <krzk@kernel.org>

There are to SysBusDevice variables in exynos4210_gic_realize()
function: one for the device itself and second for arm_gic device.  Add
a prefix "gic" to the second one so it will be easier to understand the
code.

While at it, put local uninitialized 'i' variable at the end, next to
other uninitialized ones.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/exynos4210_gic.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
     DeviceState *dev = DEVICE(obj);
     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
     char cpu_alias_name[sizeof(cpu_prefix) + 3];
     char dist_alias_name[sizeof(cpu_prefix) + 3];
-    SysBusDevice *busdev;
+    SysBusDevice *gicbusdev;
+    uint32_t i;
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
     qdev_init_nofail(s->gic);
-    busdev = SYS_BUS_DEVICE(s->gic);
+    gicbusdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(sbd, busdev);
+    sysbus_pass_irq(sbd, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
         memory_region_init_alias(&s->cpu_alias[i], obj,
                                  cpu_alias_name,
-                                 sysbus_mmio_get_region(busdev, 1),
+                                 sysbus_mmio_get_region(gicbusdev, 1),
                                  0,
                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
         memory_region_add_subregion(&s->cpu_container,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
         memory_region_init_alias(&s->dist_alias[i], obj,
                                  dist_alias_name,
-                                 sysbus_mmio_get_region(busdev, 0),
+                                 sysbus_mmio_get_region(gicbusdev, 0),
                                  0,
                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
         memory_region_add_subregion(&s->dist_container,
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Fix checkpatch errors:
1. ERROR: spaces required around that '+' (ctx:VxV)
2. ERROR: spaces required around that '&' (ctx:VxV)

No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 {
     uint32_t freq = s->freq;
     s->freq = 24000000 /
-            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset&0x4) {
+    if (offset & 0x4) {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
     } else {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Statements under 'case' were in some places wrongly indented bringing
confusion and making the code less readable.  Remove also few unneeded
blank lines.  No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
     break;
 
     case G_TCON:
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
         lt_i = GET_L_TIMER_IDX(offset);
 
         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
-
         break;
 
     case L0_TCON: case L1_TCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    s->g_timer.reg.comp[index] =
-            (s->g_timer.reg.comp[index] &
-            (((uint64_t)UINT32_MAX << 32) >> shift)) +
-            (value << shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        s->g_timer.reg.comp[index] =
+                (s->g_timer.reg.comp[index] &
+                (((uint64_t)UINT32_MAX << 32) >> shift)) +
+                (value << shift);
 
-    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
+        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset & 0x4) {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-    } else {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-    }
+        if (offset & 0x4) {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
+        } else {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
+        }
 
-    exynos4210_gfrc_restart(s);
-    break;
+        exynos4210_gfrc_restart(s);
+        break;
 
     case G_TCON:
         old_val = s->g_timer.reg.tcon;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case G_INT_ENB:
-
         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
         for (i = 0; i < MCT_GT_CMP_NUM; i++) {
             if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_TCNTB: case L1_TCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_ICNTB: case L1_ICNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         if (icntb_max[lt_i] < value) {
             icntb_max[lt_i] = value;
         }
-DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
-        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
+        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
+                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
 #endif
-break;
+        break;
 
     case L0_FRCNTB: case L1_FRCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
from exynos4210.c to exynos4_boards.c because DRAM is board specific,
not SoC.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  5 +----
 hw/arm/exynos4210.c         | 20 +-----------------
 hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
 3 files changed, 45 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     MemoryRegion iram_mem;
     MemoryRegion irom_mem;
     MemoryRegion irom_alias_mem;
-    MemoryRegion dram0_mem;
-    MemoryRegion dram1_mem;
     MemoryRegion boot_secondary;
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size);
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return mp_affinity;
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size)
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    unsigned long mem_size;
     DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
                                 &s->iram_mem);
 
-    /* DRAM */
-    mem_size = ram_size;
-    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
-                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
-        vmstate_register_ram_global(&s->dram1_mem);
-        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
-                &s->dram1_mem);
-        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
-    }
-    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
-                           &error_fatal);
-    vmstate_register_ram_global(&s->dram0_mem);
-    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
-            &s->dram0_mem);
-
    /* PMU.
     * The only reason of existence at the moment is that secondary CPU boot
     * loader uses PMU INFORM5 register as a holding pen.
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
     EXYNOS4_NUM_OF_BOARDS
 } Exynos4BoardType;
 
+typedef struct Exynos4BoardState {
+    Exynos4210State *soc;
+    MemoryRegion dram0_mem;
+    MemoryRegion dram1_mem;
+} Exynos4BoardState;
+
 static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
     [EXYNOS4_BOARD_NURI]     = 0xD33,
     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
     }
 }
 
-static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
-                                                   Exynos4BoardType board_type)
+static void exynos4_boards_init_ram(Exynos4BoardState *s,
+                                    MemoryRegion *system_mem,
+                                    unsigned long ram_size)
+{
+    unsigned long mem_size = ram_size;
+
+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
+                               &error_fatal);
+        vmstate_register_ram_global(&s->dram1_mem);
+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
+                                    &s->dram1_mem);
+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
+    }
+
+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
+                           &error_fatal);
+    vmstate_register_ram_global(&s->dram0_mem);
+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
+                                &s->dram0_mem);
+}
+
+static Exynos4BoardState *
+exynos4_boards_init_common(MachineState *machine,
+                           Exynos4BoardType board_type)
 {
+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
     MachineClass *mc = MACHINE_GET_CLASS(machine);
 
     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
             machine->kernel_cmdline,
             machine->initrd_filename);
 
-    return exynos4210_init(get_system_memory(),
-            exynos4_board_ram_size[board_type]);
+    exynos4_boards_init_ram(s, get_system_memory(),
+                            exynos4_board_ram_size[board_type]);
+
+    s->soc = exynos4210_init(get_system_memory());
+
+    return s;
 }
 
 static void nuri_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
 
 static void smdkc210_init(MachineState *machine)
 {
-    Exynos4210State *s = exynos4_boards_init_common(machine,
-                                                    EXYNOS4_BOARD_SMDKC210);
+    Exynos4BoardState *s = exynos4_boards_init_common(machine,
+                                                      EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Bring some more readability by declaring local function variables: first
initialized ones and then the rest (with reversed-christmas-tree order).

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
 
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
-    int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
+    DeviceState *dev;
+    int i, n;
 
     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
     assert(cpu_oc);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Use a define for a9mpcore_priv device type name instead of hard-coded
string.

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "hw/cpu/a9mpcore.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     }
 
     /* Private memory region and Internal GIC */
-    dev = qdev_create(NULL, "a9mpcore_priv");
+    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
     qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
     qdev_init_nofail(dev);
     busdev = SYS_BUS_DEVICE(dev);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

On all Exynos-based boards, the system powers down itself by driving
PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
Handle writing to respective PMU register to fix power off failure:

reboot: Power down
    Unable to poweroff system
    shutdown: 31 output lines suppressed due to ratelimiting
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000

CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
    Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
    [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
    [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
    [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
    [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
    [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
    [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)

Additionally the initial value of PS_HOLD has to be changed because
recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
When the register is kept at reset value, the kernel will not issue a
write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
so mimic its existence here.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
+#include "sysemu/sysemu.h"
 
 #ifndef DEBUG_PMU
 #define DEBUG_PMU           0
@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
-    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
+    /*
+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
+     * DATA bit high, set usually by bootloader, keeps system on.
+     */
+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
 
+static void exynos4210_pmu_poweroff(void)
+{
+    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
+    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+}
+
 static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
                                     unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
             PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
                     (uint32_t)offset, (uint32_t)val);
             s->reg[i] = val;
+            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
+                /*
+                 * We are interested only in setting data bit
+                 * of PS_HOLD_CONTROL register to indicate power off request.
+                 */
+                exynos4210_pmu_poweroff();
+            }
             return;
         }
         reg_p++;
-- 
2.7.4

From: Pranith Kumar <bobby.prani@gmail.com>

Tested and confirmed that the stretch i386 debian qcow2 image on a
raspberry pi 2 works.

Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/timer.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
 /* The host CPU doesn't have an easily accessible cycle counter.
    Just return a monotonically increasing value.  This will be
    totally wrong, but hopefully better than nothing.  */
-static inline int64_t cpu_get_host_ticks (void)
+static inline int64_t cpu_get_host_ticks(void)
 {
-    static int64_t ticks = 0;
-    return ticks++;
+    return get_clock();
 }
 #endif
 
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for
the TMP42{1,2,3} temperature sensors.

Specs can be found here :

http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 404 insertions(+)
 create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
 common-obj-$(CONFIG_MAX111X) += max111x.o
 common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_TMP421) += tmp421.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Texas Instruments TMP421 temperature sensor.
+ *
+ * Copyright (c) 2016 IBM Corporation.
+ *
+ * Largely inspired by :
+ *
+ * Texas Instruments TMP105 temperature sensor.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/i2c/i2c.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+
+/* Manufacturer / Device ID's */
+#define TMP421_MANUFACTURER_ID          0x55
+#define TMP421_DEVICE_ID                0x21
+#define TMP422_DEVICE_ID                0x22
+#define TMP423_DEVICE_ID                0x23
+
+typedef struct DeviceInfo {
+    int model;
+    const char *name;
+} DeviceInfo;
+
+static const DeviceInfo devices[] = {
+    { TMP421_DEVICE_ID, "tmp421" },
+    { TMP422_DEVICE_ID, "tmp422" },
+    { TMP423_DEVICE_ID, "tmp423" },
+};
+
+typedef struct TMP421State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    int16_t temperature[4];
+
+    uint8_t status;
+    uint8_t config[2];
+    uint8_t rate;
+
+    uint8_t len;
+    uint8_t buf[2];
+    uint8_t pointer;
+
+} TMP421State;
+
+typedef struct TMP421Class {
+    I2CSlaveClass parent_class;
+    DeviceInfo *dev;
+} TMP421Class;
+
+#define TYPE_TMP421 "tmp421-generic"
+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
+
+#define TMP421_CLASS(klass) \
+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
+#define TMP421_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
+
+/* the TMP421 registers */
+#define TMP421_STATUS_REG               0x08
+#define    TMP421_STATUS_BUSY             (1 << 7)
+#define TMP421_CONFIG_REG_1             0x09
+#define    TMP421_CONFIG_RANGE            (1 << 2)
+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
+#define TMP421_CONFIG_REG_2             0x0A
+#define    TMP421_CONFIG_RC               (1 << 2)
+#define    TMP421_CONFIG_LEN              (1 << 3)
+#define    TMP421_CONFIG_REN              (1 << 4)
+#define    TMP421_CONFIG_REN2             (1 << 5)
+#define    TMP421_CONFIG_REN3             (1 << 6)
+
+#define TMP421_CONVERSION_RATE_REG      0x0B
+#define TMP421_ONE_SHOT                 0x0F
+
+#define TMP421_RESET                    0xFC
+#define TMP421_MANUFACTURER_ID_REG      0xFE
+#define TMP421_DEVICE_ID_REG            0xFF
+
+#define TMP421_TEMP_MSB0                0x00
+#define TMP421_TEMP_MSB1                0x01
+#define TMP421_TEMP_MSB2                0x02
+#define TMP421_TEMP_MSB3                0x03
+#define TMP421_TEMP_LSB0                0x10
+#define TMP421_TEMP_LSB1                0x11
+#define TMP421_TEMP_LSB2                0x12
+#define TMP421_TEMP_LSB3                0x13
+
+static const int32_t mins[2] = { -40000, -55000 };
+static const int32_t maxs[2] = { 127000, 150000 };
+
+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int64_t value;
+    int tempid;
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
+
+    visit_type_int(v, name, &value, errp);
+}
+
+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+ */
+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    Error *local_err = NULL;
+    int64_t temp;
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int tempid;
+
+    visit_type_int(v, name, &temp, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
+                   temp / 1000, temp % 1000);
+        return;
+    }
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
+}
+
+static void tmp421_read(TMP421State *s)
+{
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    s->len = 0;
+
+    switch (s->pointer) {
+    case TMP421_MANUFACTURER_ID_REG:
+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
+        break;
+    case TMP421_DEVICE_ID_REG:
+        s->buf[s->len++] = sc->dev->model;
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->buf[s->len++] = s->config[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->buf[s->len++] = s->config[1];
+        break;
+    case TMP421_CONVERSION_RATE_REG:
+        s->buf[s->len++] = s->rate;
+        break;
+    case TMP421_STATUS_REG:
+        s->buf[s->len++] = s->status;
+        break;
+
+        /* FIXME: check for channel enablement in config registers */
+    case TMP421_TEMP_MSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    }
+}
+
+static void tmp421_reset(I2CSlave *i2c);
+
+static void tmp421_write(TMP421State *s)
+{
+    switch (s->pointer) {
+    case TMP421_CONVERSION_RATE_REG:
+        s->rate = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->config[0] = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->config[1] = s->buf[0];
+        break;
+    case TMP421_RESET:
+        tmp421_reset(I2C_SLAVE(s));
+        break;
+    }
+}
+
+static int tmp421_rx(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len < 2) {
+        return s->buf[s->len++];
+    } else {
+        return 0xff;
+    }
+}
+
+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len == 0) {
+        /* first byte is the register pointer for a read or write
+         * operation */
+        s->pointer = data;
+        s->len++;
+    } else if (s->len == 1) {
+        /* second byte is the data to write. The device only supports
+         * one byte writes */
+        s->buf[0] = data;
+        tmp421_write(s);
+    }
+
+    return 0;
+}
+
+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (event == I2C_START_RECV) {
+        tmp421_read(s);
+    }
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription vmstate_tmp421 = {
+    .name = "TMP421",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, TMP421State),
+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
+        VMSTATE_UINT8(pointer, TMP421State),
+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
+        VMSTATE_UINT8(status, TMP421State),
+        VMSTATE_UINT8(rate, TMP421State),
+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tmp421_reset(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    memset(s->temperature, 0, sizeof(s->temperature));
+    s->pointer = 0;
+
+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
+
+     /* resistance correction and channel enablement */
+    switch (sc->dev->model) {
+    case TMP421_DEVICE_ID:
+        s->config[1] = 0x1c;
+        break;
+    case TMP422_DEVICE_ID:
+        s->config[1] = 0x3c;
+        break;
+    case TMP423_DEVICE_ID:
+        s->config[1] = 0x7c;
+        break;
+    }
+
+    s->rate = 0x7;       /* 8Hz */
+    s->status = 0;
+}
+
+static int tmp421_init(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    tmp421_reset(&s->i2c);
+
+    return 0;
+}
+
+static void tmp421_initfn(Object *obj)
+{
+    object_property_add(obj, "temperature0", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature1", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature2", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature3", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+}
+
+static void tmp421_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    TMP421Class *sc = TMP421_CLASS(klass);
+
+    k->init = tmp421_init;
+    k->event = tmp421_event;
+    k->recv = tmp421_rx;
+    k->send = tmp421_tx;
+    dc->vmsd = &vmstate_tmp421;
+    sc->dev = (DeviceInfo *) data;
+}
+
+static const TypeInfo tmp421_info = {
+    .name          = TYPE_TMP421,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(TMP421State),
+    .class_size    = sizeof(TMP421Class),
+    .instance_init = tmp421_initfn,
+    .abstract      = true,
+};
+
+static void tmp421_register_types(void)
+{
+    int i;
+
+    type_register_static(&tmp421_info);
+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
+        TypeInfo ti = {
+            .name       = devices[i].name,
+            .parent     = TYPE_TMP421,
+            .class_init = tmp421_class_init,
+            .class_data = (void *) &devices[i],
+        };
+        type_register(&ti);
+    }
+}
+
+type_init(tmp421_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
 CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
+CONFIG_TMP421=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Temperatures can be changed from the monitor with :

(qemu) qom-set /machine/unattached/device[2] temperature0 12000

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    DeviceState *dev;
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+
+    /* add a TMP423 temperature sensor */
+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
+                           "tmp423", 0x4c);
+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
 static void palmetto_bmc_init(MachineState *machine)
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

When a timer is enabled before a reload value is set, the controller
waits for a reload value to be set before starting decrementing. This
fix tries to cover that case by changing the timer expiry only when
a reload value is valid.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
             next = seq[1];
         } else if (now < seq[2]) {
             next = seq[2];
-        } else {
+        } else if (t->reload) {
             reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
             t->start = now - ((now - t->start) % reload_ns);
+        } else {
+            /* no reload value, return 0 */
+            break;
         }
     }
 
     return next;
 }
 
+static void aspeed_timer_mod(AspeedTimer *t)
+{
+    uint64_t next = calculate_next(t);
+    if (next) {
+        timer_mod(&t->timer, next);
+    }
+}
+
 static void aspeed_timer_expire(void *opaque)
 {
     AspeedTimer *t = opaque;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
         qemu_set_irq(t->irq, t->level);
     }
 
-    timer_mod(&t->timer, calculate_next(t));
+    aspeed_timer_mod(t);
 }
 
 static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
                                    uint32_t value)
 {
     AspeedTimer *t;
+    uint32_t old_reload;
 
     trace_aspeed_timer_set_value(timer, reg, value);
     t = &s->timers[timer];
     switch (reg) {
+    case TIMER_REG_RELOAD:
+        old_reload = t->reload;
+        t->reload = value;
+
+        /* If the reload value was not previously set, or zero, and
+         * the current value is valid, try to start the timer if it is
+         * enabled.
+         */
+        if (old_reload || !t->reload) {
+            break;
+        }
+
     case TIMER_REG_STATUS:
         if (timer_enabled(t)) {
             uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
             uint32_t rate = calculate_rate(t);
 
             t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
-    case TIMER_REG_RELOAD:
-        t->reload = value;
-        break;
     case TIMER_REG_MATCH_FIRST:
     case TIMER_REG_MATCH_SECOND:
         t->match[reg - 2] = value;
         if (timer_enabled(t)) {
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
     trace_aspeed_timer_ctrl_enable(t->id, enable);
     if (enable) {
         t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        timer_mod(&t->timer, calculate_next(t));
+        aspeed_timer_mod(t);
     } else {
         timer_del(&t->timer);
     }
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

In some circumstances, we don't want to abort if the
kvm_device_access fails. This will be the case during ITS
migration, in case the ITS table save/restore fails because
the guest did not program the vITS correctly. So let's pass an
error object to the function and return the ioctl value. New
callers will be able to make a decision upon this returned
value.

Existing callers pass &error_abort which will cause the
function to abort on failure.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
[PMM: wrapped long line]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h        | 11 +++++++----
 hw/intc/arm_gic_kvm.c       |  9 +++++----
 hw/intc/arm_gicv3_its_kvm.c |  2 +-
 hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
 kvm-all.c                   | 14 ++++++++------
 5 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
  * @attr: the attribute of that group to set or get
  * @val: pointer to a storage area for the value
  * @write: true for set and false for get operation
+ * @errp: error object handle
  *
- * This function is not allowed to fail. Use kvm_device_check_attr()
- * in order to check for the availability of optional attributes.
+ * Returns: 0 on success
+ *          < 0 on error
+ * Use kvm_device_check_attr() in order to check for the availability
+ * of optional attributes.
  */
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write);
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp);
 
 /**
  * kvm_create_device - create a KVM device for the device control API
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 static void kvm_gicc_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
             uint32_t numirqs = s->num_irq;
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
-                              &numirqs, true);
+                              &numirqs, true, &error_abort);
         }
         /* Tell the kernel to complete VGIC initialization now */
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
                                   KVM_DEV_ARM_VGIC_CTRL_INIT)) {
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
+                              &error_abort);
         }
     } else if (ret != -ENODEV && ret != -ENOTSUP) {
         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     /* explicit init of the ITS */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     /* register the base address */
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
                       KVM_VGIC_ATTR(offset, 0),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
                       KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
                       KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
                       (VGIC_LEVEL_INFO_LINE_LEVEL <<
                        KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 /* Loop through each distributor IRQ related register; since bits
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     /* Initialize to actual HW supported configuration */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
-                      &c->icc_ctlr_el1[GICV3_NS], false);
+                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
 
     c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     }
 
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
-                      0, &s->num_irq, true);
+                      0, &s->num_irq, true, &error_abort);
 
     /* Tell the kernel to complete VGIC initialization now */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
diff --git a/kvm-all.c b/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
 }
 
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write)
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp)
 {
     struct kvm_device_attr kvmattr;
     int err;
@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
                            &kvmattr);
     if (err < 0) {
-        error_report("KVM_%s_DEVICE_ATTR failed: %s",
-                     write ? "SET" : "GET", strerror(-err));
-        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
-        abort();
+        error_setg_errno(errp, -err,
+                         "KVM_%s_DEVICE_ATTR failed: Group %d "
+                         "attr 0x%016" PRIx64,
+                         write ? "SET" : "GET", group, attr);
     }
+    return err;
 }
 
 /* Return 1 on success, 0 on failure */
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We need to handle both registers and ITS tables. While
register handling is standard, ITS table handling is more
challenging since the kernel API is devised so that the
tables are flushed into guest RAM and not in vmstate buffers.

Flushing the ITS tables on device pre_save() is too late
since the guest RAM is already saved at this point.

Table flushing needs to happen when we are sure the vcpus
are stopped and before the last dirty page saving. The
right point is RUN_STATE_FINISH_MIGRATE but sometimes the
VM gets stopped before migration launch so let's simply
flush the tables each time the VM gets stopped.

For regular ITS registers we just can use vmstate pre_save()
and post_load() callbacks.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gicv3_its_common.h |   8 +++
 hw/intc/arm_gicv3_its_common.c         |  10 ++++
 hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
 3 files changed, 123 insertions(+)

diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
+#define GITS_CTLR        0x0
+#define GITS_IIDR        0x4
+#define GITS_CBASER      0x80
+#define GITS_CWRITER     0x88
+#define GITS_CREADR      0x90
+#define GITS_BASER       0x100
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
     /* Registers */
     uint32_t ctlr;
+    uint32_t iidr;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .unmigratable = true,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ctlr, GICv3ITSState),
+        VMSTATE_UINT32(iidr, GICv3ITSState),
+        VMSTATE_UINT64(cbaser, GICv3ITSState),
+        VMSTATE_UINT64(cwriter, GICv3ITSState),
+        VMSTATE_UINT64(creadr, GICv3ITSState),
+        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
+        VMSTATE_END_OF_LIST()
+    },
 };
 
 static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
     s->cbaser = 0;
     s->cwriter = 0;
     s->creadr = 0;
+    s->iidr = 0;
     memset(&s->baser, 0, sizeof(s->baser));
 
     gicv3_its_post_load(s, 0);
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
     return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 }
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * ITS tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 {
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+
+    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 static void kvm_arm_its_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
                              &error_abort);
 }
 
+/**
+ * kvm_arm_its_pre_save - handles the saving of ITS registers.
+ * ITS tables are flushed into guest RAM separately and earlier,
+ * through the VM change state handler, since at the moment pre_save()
+ * is called, the guest RAM has already been saved.
+ */
+static void kvm_arm_its_pre_save(GICv3ITSState *s)
+{
+    int i;
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], false,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, false, &error_abort);
+}
+
+/**
+ * kvm_arm_its_post_load - Restore both the ITS registers and tables
+ */
+static void kvm_arm_its_post_load(GICv3ITSState *s)
+{
+    int i;
+
+    if (!s->iidr) {
+        return;
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, true, &error_abort);
+
+    /*
+     * must be written before GITS_CREADR since GITS_CBASER write
+     * access resets GITS_CREADR.
+     */
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, true, &error_abort);
+
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], true,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
+                      &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, true, &error_abort);
+}
+
 static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 
     dc->realize = kvm_arm_its_realize;
     icc->send_msi = kvm_its_send_msi;
+    icc->pre_save = kvm_arm_its_pre_save;
+    icc->post_load = kvm_arm_its_post_load;
 }
 
 static const TypeInfo kvm_arm_its_info = {
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

This patch adds the flush of the LPI pending bits into the
redistributor pending tables. This happens on VM stop.

There is no explicit restore as the tables are implicitly sync'ed
on ITS table restore and on LPI enable at redistributor level.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
+#include "sysemu/sysemu.h"
 #include "kvm_arm.h"
 #include "gicv3_internal.h"
 #include "vgic_common.h"
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * RDIST pending tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3State *s = (GICv3State *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
+                           NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
+
 static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
 {
     GICv3State *s = KVM_ARM_GICV3(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+    }
 }
 
 static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We change the restoration priority of both the GICv3 and ITS. The
GICv3 must be restored before the ITS and the ITS needs to be restored
before PCIe devices since it translates their MSI transactions.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/migration/vmstate.h    |  2 ++
 hw/intc/arm_gicv3_common.c     |  1 +
 hw/intc/arm_gicv3_its_common.c |  2 +-
 hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 4 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
 typedef enum {
     MIG_PRI_DEFAULT = 0,
     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
+    MIG_PRI_GICV3,              /* Must happen before the ITS */
     MIG_PRI_MAX,
 } MigrationPriority;
 
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
     .minimum_version_id = 1,
     .pre_save = gicv3_pre_save,
     .post_load = gicv3_post_load,
+    .priority = MIG_PRI_GICV3,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(gicd_ctlr, GICv3State),
         VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
-    .unmigratable = true,
+    .priority = MIG_PRI_GICV3_ITS,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(ctlr, GICv3ITSState),
         VMSTATE_UINT32(iidr, GICv3ITSState),
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
     Error *local_err = NULL;
 
-    /*
-     * Block migration of a KVM GICv3 ITS device: the API for saving and
-     * restoring the state in the kernel is not yet available
-     */
-    error_setg(&s->migration_blocker, "vITS migration is not implemented");
-    migrate_add_blocker(s->migration_blocker, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        error_free(s->migration_blocker);
-        return;
-    }
-
     s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
     if (s->dev_fd < 0) {
         error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, NULL);
 
+    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+        GITS_CTLR)) {
+        error_setg(&s->migration_blocker, "This operating system kernel "
+                   "does not support vITS migration");
+        migrate_add_blocker(s->migration_blocker, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            error_free(s->migration_blocker);
+            return;
+        }
+    }
+
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-- 
2.7.4

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0